Having zipped through the United States Congress at lightning speed in the wake of high profile corporate scandals that torpedoed Enron Corp. and WorldCom Inc., the Sarbanes-Oxley Act of 2002 remains one of the most potent legacies of such failures. In fact, it's one of the most far reaching regulatory changes affecting the financial community, including the accounting profession, in more than 70 years, experts say.
"There has been a widespread impact," says Mark Zastre, a chartered accountant and assurance partner with accounting and consulting firm Grant Thornton LLP in Vancouver. "Increasingly complex rules have created a lot of stress in the profession, with regulatory changes having necessitated hiring people with pretty specialized experience and expertise."
For the accounting profession, one of the most monumental parts of the Sarbanes-Oxley (SOX) legislation is Section 404, Management Assessment of Internal Controls. It requires senior management -- specifically the chief executive officer and chief financial officer -- as well as an independent external auditor to certify not only that a company has established internal controls over financial reporting but that they are working.
Section 404 poses a major hurdle for senior management and the corporate audit committee, says Gar Emerson, corporate director and national chairman of law firm Fasken Martineau DuMoulin LLP in Toronto.
Publicly listed companies based in the U.S. on exchanges such as the New York Stock Exchange (NYSE) or NASDAQ that have market capitalization of at least $75-million have been subject to SOX 404 since Nov. 15, 2004. But it is not just U.S. based companies that must pay heed. Canadian and other international firms listed on U.S. exchanges will also need to follow its provisions by July 15, 2006, at the earliest.
All other public companies listed on U.S. exchanges, regardless of market capitalization or geographic location, will also be subject to SOX 404 by July 15, 2007, at the earliest.
Toronto-based Corus Entertainment Inc., which is listed on the NYSE, will be required to comply with SOX 404 by its fiscal year end date of Aug. 31, 2006.
The impact on the company has been significant. It has installed new software, ensured information technology controls are in place and undertaken a comprehensive review of business practices including controls and procedures across all of its radio stations and television networks.
Preparing for SOX 404 has been "incredibly expensive, and has cost us over $1-million," says Tom Peddie, Corus' vice-president and chief financial officer. "But it has generated some benefits as well. I feel better about some of the controls and procedures that will come out of it."
The demand for qualified accountants who understand SOX 404 has sparked a boom in the profession, particularly in such cities as Calgary, where many multinational energy companies are listed on U.S. exchanges.
Professional accountants have been called to work on SOX projects, causing a chain reaction that has left a vacuum in the industry and driven salaries up, says Murray Bandura, a Calgary-based recruiting manager for the finance and accounting division of Robert Half International Ltd.
"I've been in the work force since 1972 and am a native Calgarian, and I've never seen such a strong economy from an accountants' point of view," Mr. Bandura says.
The Canadian regulatory equivalent to SOX 404 was first proposed by the Canadian Securities Administrators in February, 2005, in their multilateral instrument (MI) 52-111 -- Reporting on Internal Control Over Financial Reporting. It would have created essentially the same two-step approach, requiring senior management and audit certification to vouch for the existence and veracity of corporate internal controls.
However, this proposal was left open to debate, and as a result, the CSA came back in March, 2006, with a surprise decision.
First, it would not enact 52-111 as such. Instead, it would incorporate part of those requirements into an expanded multilateral instrument, 52-109.
And, perhaps most controversially, it would drop the requirement for external audits.
That decision was made largely in response to complaints from small and medium sized public companies listed exclusively on Canadian exchanges who said hiring an external accountant would not be cost effective. Thus, the burden of internal-control certification will be on the shoulders of the CEO and CFO when the regulation takes effect on Dec. 31, 2007.
However, Mr. Emerson says, "it will not be an assessment of internal controls to the same extent as SOX 404.
"All (the CEO and CFO) will have to do is certify that they have evaluated the effectiveness of internal controls over financial reporting and caused the management discussion and analysis to disclose their process for evaluating effectiveness, and the conclusions they came to."
He predicts directors of companies listed exclusively on Canadian exchanges will incur "increased personal responsibility and liability in satisfying their obligations."
In fact, without audit assurance to back them up, both CEOs and CFOs will face potentially greater exposure to personal liability under current rules, he adds.
Although Canadian regulations are not as stringent as those in the U.S., accountants in this country are also preparing for a dramatically increased workload as a result of the expanded version of MI 52-109.
Mr. Zastre of Grant Thornton LLP says, "We've been providing our people with a lot of training over the past couple of years to help them understand, evaluate and assess internal controls."
"It's not just accountants in public practice who are undergoing that kind of training," he says. "Those in private industry also have to think about internal controls now more than they have had to in the recent past, so it's a real challenge."
