The Sarbanes Oxley act turns three years old tomorrow, and while many businesses would rather see SOX's accounting and accountability measures scaled back, former SEC Chairman Arthur Levitt believes that now that the terrible twos have passed.

At a recent DC conference (sponsored by a SOX solution vendor) Levitt commented that the benefits of the reforms for investors have been "well worth the cost." Levitt continued:

"If you have any doubts about this, ask those thoughtful shareholders in any of those 586 companies that disclosed material weaknesses in internal controls during the first four months of the year. I'm sure they will tell you that expenditures made in complying with Rule 404 is money well spent," said Levitt, addressing reporters this week...

According to David Richards, president of the Institute of Internal Auditors, (which has the treacley - but very appropriate for a three year old - motto, Progress Through Sharing) the burden on companies will steadily decrease - allowing SOX to provide the accountability functions it was designed for while not hitting companies quite so hard in the pocketbook, which thus far the act has done mightily - to the tune of billions of not trillions of dollars.

...AMR Research Inc. estimates spending on compliance regulations will exceed $15.5 billion in 2005 and $80 billion over the next five years. Companies will spend $5.8 billion in 2005 on SOX requirements alone. A much-cited study by University of Rochester professor Ivy Xiying Zhang estimates the indirect total market value costs of SOX at an astounding $1.4 trillion.

Richards cited an internal IIA study to support his contentions of progressively decreasing SOX-related costs:

"Looking below the surface, we found that 10% to 15% was learning time; 20% was spent on doing the documentation, and 15% to 20% was spent on remediation. "Is this likely to recur every year? I don't think so"...

In addition to providing good employment for some of his organization's 107,000 worldwide members, Richards joked, SOX gave focus to a problem that "should have been on the agenda many years ago."

Onerous as they are, the requirements of Section 404 provide consistency, methods of compliance and a written record that can be referred back to measure progress, he said. Most importantly, the financial controls will become embedded in the company, with a "broader understanding by operations people and management of their responsibility for the controls."

Interesting comments all around, especially on the eve of the appointment of new SEC chief , Christopher Cox (more on that fellow later today).

The full article from which these comments were drawn can be found here, at Search Security.com.

-- MDT