I think that large parts of Sarbanes-Oxley make sense, and were not terribly costly to implement. The problem is SOX Section 404, which requires that managements certify to a system of internal controls, and that the company's public accountants audit those controls. Why is that a problem? At least two reasons.

First, it elevates the process of developing financial statements to the same level as the accuracy of the final statements. That is, you can have entirely accurate financial statements, and still violate the law by having arrived at them through a flawed process. If that isn't imposing Euro-think on the American body economic, I don't know what is!

Second, "internal controls" standards require an enormous amount of segregation of duties. You need multiple people to perform different tasks. So, for example, the people who take orders should not be able to open a new customer account, etc. This all makes a certain logical sense, but it is incredibly costly if you are not large enough to justify a lot of segregated positions. The SOX audit process virtually requires a level of staff for certain functions that a small company does not need and cannot justify. This creates a huge bias against small companies, which are the thing that really differentiates American capitalism from European social-capitalism.

We should not through the baby out with the bathwater, but SOX 404, as currently implemented, is bathwater that should be tossed.

Sarbanes-Oxley is such a piece of shit as an IT professional. It has required separation of duties within IT to the point that more time is spent and money spent on audit controls than on innovation and improving business processes. I work doing consulting and compliance is often the number 1 concern now for IT organizations.

At a previous customer we spent over three years straight with a team of over a dozen simply auditing user accounts and doing process revisions to ensure compliance. The system administrators could not create accounts because of separation of duties, so we needed a process of accountability for new account creation and a new team and this and that. Net is that it made businesses less efficient.

The whole point of publicly traded companies is that they are transparent. Private companies have a lot more opportunity for corruption and Enron type scandals, just fewer people own the company and it is not traded for every idiot to hold in their 401k. If regulations are pushing public companies private, that is the wrong direction to go if you want to prevent fraud and securities abuses.

Going private is no shield from the requirements of Sarb-Ox.

Tigerhawk is quite right that the key problem is Sarb-Ox 404 and the key problem with it is that few of our senators or congressmen have any real notion of how businesses actually work nowadays. Few if any large publicly-traded companies are monoliths these days.

I know at first hand that several Fortune 100 companies have recognized that there's no way for them to comply with the provision of 404 without making their vendors comply, too. Consequently, the inefficiencies of 404 are being imposed by their customer on companies for whom the act was never intended.

I work in a department that was SOx 404 compliant before SOx existed - a bank. We have "Separation of Duties" for everything. But adding SOx has still increased our overhead and caused a few additional hurdles that really don't add anything to the end-result.

From a different perspective - and more related to the "money trail" - what is happening is that smaller companies that can go international are going to England and Scotland (lower taxes too). They just incorporate there instead of the US. The result is the investment money that used to come into the US is now going elsewhere. When presented with this info, the FedGov offical being interviewed commented that "this type of legislation will eventually become adopted everywhere, so it's only a temporary shift".

Oh really? Tell that to Scotlands *booming* investment and commodities markets....