SEC Commission Glassman Gets Real

In a speech given Nov. 17  in Denmark, SEC Commissioner Glassman admitted the obvious:  Section 404 of Sarbanes Oxley and the SEC's rules under the section are not working.  Section 404 requires publicly traded companies in the United State to put in a system of internal controls and requires that auditors include a verification of the internal controls in their audits.  Glassman noted:  "What was intended to be  top-down, risk-based management exercise has become a bottom-up, non-risk based process with an apparent focus on controls for controls sake."  She noted that the expenses of complying with the Section were "excessive." 

Congress and the SEC have, from the beginning, shown an amazing lack of common sense over these mandated internal controls.  Congress first threatens auditors with huge personal liability and with losing their firms and their jobs and then gives auditors an open-ended requirement to certify companies "reasonable" internal controls.  And auditors are risk averse by nature anyway.  The auditors did what any extremely risk averse profession would do; they had professional to standardize and develop complex check-lists of tasks.  They would hide in group behavior and in detail.  They could not be liable if the did what others auditors did and they did it in great detail.  Then the auditors forced all companies to submit to the check-lists.  Their behavior was to be expected.  The SEC's response was to jawbone -- yell at auditors for being too inflexible -- and lash out at critics, reminding them that the 33 act was criticized too as too expensive.  The SEC response was silly: It has not worked of course.  Either the SEC gets more specific in the rules (which it does not want to do) or it relaxes the tremendous liability pressure put on auditors who implement the rules.