Cherry-Picking Sarbanes-Oxley: Provisions That Deserve a Second Look

EXECUTIVE SUMMARY * Private companies and charities aren't required to comply with the Sarbanes-Oxley Act. But they can adopt some of its requirements as best practices. Cherry-picking the provisions that will help them the most means they can get maximum benefit at minimum cost. * Among the private entities that might want to voluntarily adopt the provisions of Sarbanes-Oxley are companies planning an IPO and those that might merge with or be acquired by a public company within the next two or three years. Such companies might earn a premium for already being Sarbanes-Oxley compliant. * A number of Sarbanes-Oxley provisions also might make sense for other private companies or NPOs. For example, many private organizations are creating audit committees composed of outside directors or naming an audit committee financial expert. * A code of ethics is a good idea for any organization, as it establishes the tone at the top and helps employees understand what is expected of them. Similarly, putting whistle-blower provisions in place can help private companies and NPOs fight fraud. * While large public companies are required to establish and maintain internal controls over financial reporting, it isn't yet clear whether the benefits of doing so are worth the high cost for private organizations. ********** While public companies are required to comply with the Sarbanes-Oxley Act, privately held businesses and charitable organizations generally are immune from the acts far-reaching provisions. Still, many such entities are finding that certain aspects of the act can benefit their overall operations and are cherry-picking those parts that will do them the most good. Here are some requirements of Sarbanes-Oxley that deserve a second look even from organizations that don't have to implement any of the act's provisions. THE WHO AND WHY What types of private entities might want to voluntarily adopt the Sarbanes-Oxley provisions that so many public companies have been struggling to implement? For companies that might soon go public, the voluntary aspect of adoption becomes almost mandatory. Companies planning an IPO within the next two to three years would be better off adopting Sarbanes-Oxley guidelines now rather than waiting until they go public, when they might face unknown costs and delays. Companies contemplating a merger or being acquired by a public company within the next few years also are prime candidates. If a private company owner's exit strategy is to prepare the company for eventual sale, one of the suitors might be a public company willing to pay a premium for an acquisition target that already is Sarbanes-Oxley compliant. Many not-for-profit organizations also are adopting some Sarbanes-Oxley provisions. In California, for example, the Nonprofit Integrity Act of 2004 requires charitable organizations with over $2 million in gross revenues to have an audit committee, which also approves nonaudit services, and audited financial statements. The directors of these entities may themselves be officers of public companies who understand the benefits of stronger internal controls and some of the other requirements of Sarbanes-Oxley, and would like to see the NPOs they help preside over comply voluntarily Companies with absentee owners also might consider adopting certain parts of the act voluntarily to ensure the professional management is doing a good job. And finally, banks that extend loans or lines of credit to private companies are asking borrowers for more internal controls--like those found in Sarbanes-Oxley--before making loans. BEYOND CONTROLS Sarbanes-Oxley is more than just a requirement for stricter internal control audits. It includes other elements that affect overall corporate governance and audit relationships. In some instances even public companies are making changes that the act doesn't require but that stem from the new climate of corporate behavior. …