A s such, it demands compliance with a broad range of reforms relating to the accounting procedures of publicly held corporations, with the emphasis on those companies listed on the US Stock Exchange or with US subsidiaries to make greater disclosure of their internal controls, codes of ethics and auditing procedures.
At the time of its introduction, the impact of Sarbanes-Oxley was not to be under-estimated. PricewaterhouseCoopers, for example, stated that the Act was “the most important piece of legislation affecting corporate governance, financial disclosure and the practice of public accounting since the US securities laws of the 1930s.”
Yet many observers have considered it to be a somewhat knee-jerk response – described by one US observer as the Government ‘shooting from the hip’ with critical areas left open-ended and vague.
For example, Sarbanes-Oxley places stronger emphasis on the accuracy of key data which may impact on the financial performance, profitability or audit accountability of a company, yet what constitutes such data is not defined in the Act – nor how long it should be retained.
It requires that internal controls are put in place to ensure this is achieved, with CEOs and CFOs signing off that such data is both complete and accurate. Yet if what constitutes data in this context lacks clarity, the penalties certainly do not, for possible custodial sentences face those who fail to carry this out satisfactorily.
The Act has also increased transparency, by for example reducing reporting times for quarterly reports from 45 to 35 days and annual reports from 90 to 60 days. Further, any information likely to impact on quarterly earnings must be reported within two days of the event occurring, whereas previously a company had up to 15 days to do this.
So, nearly a year on, how have companies this side of the Atlantic dealt with the new imperatives of Sarbanes-Oxley? Though there have undoubtedly been differences in the scale and depth of implementation, depending more often than not on the size of the financial organisation, a number of common threads have emerged.
Though they are taking a more ‘belt and braces’ approach to the implementation and control of key processes, UK and European companies have been cautious about investing heavily in meeting US-centric legislation which may not align with local auditing requirements. More importantly, parallel European legislation is anticipated in the near future which is likely to be much clearer – both in terms of compliance and exemptions – with regard to specific vertical markets.
Indeed, the fact that Sarbanes-Oxley has attracted relatively little press attention in recent months would seem to support the view that such financial organisations are broadly meeting the main thrust of the Act, with the requirements of the equivalent EU legislation yet to be made public.
So how much work has been required to ensure compliance? For those institutions operating a central general ledger for example, meeting reduced reporting times may not present a major difficulty. Yet in an environment with disparate ledger and accounting systems, manual consolidation is likely to be more problematic.
More broadly, as with aerospace and defence, the banking industry in general and the FX arena in particular has long been strongly risk averse. The introduction of the CLS Bank for example has had significant impact in reducing settlement risk between members, by adopting a real-time payment versus payment system.
Again, in terms of operational risk, the industry-wide emphasis on risk reduction has been reflected in the generally high rates of straight-through processing (STP) now being achieved. From this perspective, STP not only delivers cost savings but may clearly be seen as the flipside of operational risk, in that the higher the level of automation and process control achieved – the ‘building blocks’ of STP – so the level of operational risk is reduced.
Here, the industry has been strongly supported by specialist providers in improving and monitoring workflow and process automation, so enabling greater transparency and control. A simple example: the availability of web-based products now makes it much easier for corporate treasuries to provide confirmations of their trades with the banks.
Financial organisations have generally operated stronger controls than many other sectors, being subject to regulatory as well as legislative constraints. At present there are a number of European regulations in development, such as the Prospectus Directive and Financial Conglomerates Directive, designed to reduce and assess the level of risk by increasing visibility.
This is especially important for private investors, who are generally considered to be the group most at risk – on the basis that the more you can see in advance the more likely you are to deal effectively with it. Yet in each case a balance has to be struck: the Investment Services Directive for example seeks to protect retail investors through greater transparency, without adversely affecting overall market liquidity.
Basel II, part of the Capital Adequacy Directive No 3 and due to come into effect in 2006, introduces the concept of regulatory compliance for operational risk. This is an area not previously subject to industry-wide control and financial organisations of all sizes must adopt one of three risk models in setting aside the regulatory capital required under the forthcoming regulation.
At its simplest, the model requires that a percentage of total trading turnover is set aside as regulatorycapital; large financial organisations however are more likely to adopt a more complex model, in which the amount of regulatory capital put aside will be based on the probability of certain events happening. This will be based on the previous three years’ loss data and so a consolidated database will be required to enable the necessary calculations and provide information for the regulator.
Though Sarbanes-Oxley has impacted on UK and European financial organisations in terms of tightening up their accounting procedures, many will have looked at compliance in the broader context of the forthcoming equivalent European directives. In each case, an impact assessment will be made: in particular, smaller banks with fewer resources will be mindful of the need to balance investment in achieving regulatory compliance with the more pressing day-to-day imperatives of keeping the business running and maintaining competitiveness.
In many ways, the general thrust of Sarbanes-Oxley – and any parallel European legislation – is little more than the formalising of what should be regarded as good business practice. The implementation of better operational and process controls, increased automation and workflow will mean that companies have a much greater feel for what is going on in their business.