Internal Controls after Sarbanes-Oxley: Revisiting Corporate Law's "Duty of Care as Responsibility for Systems"

I. INTRODUCTION Immediately after the passage of the Sarbanes-Oxley Act (SOX), much of the commentary was about Congress' scatter-gun approach, firing at so many different targets at once to prompt better corporate financial reporting and disclosure. Executives, outside directors, lawyers, accountants, analysts, and others gained new obligations. ' For the most part, these groups now seem to have adjusted to their new regimes without all that much difficulty or lingering complaint, perhaps because the changes were never really as draconian as portrayed. Today, the vocal criticism is largely reserved for just one piece of the legislation: the internal controls requirement found in section 404, which in some circles has become almost synonymous with SOX itself. Doubts about the balance of costs and benefits and whether the result will be increased de-listings and going private transactions to avoid 404's burdens have made this the portion of the Act that has encountered the most political resistance.2 The tone of these complaints is that 404's requirements are new, radical, and ill-considered. Until recently, at least, the internal controls requirements have received less attention from legal academics than many other salient aspects of the legislation.3 Revisiting section 3.4.2 of Clark's Corporate Law4 ("Duty of Care as Responsibility for Systems") reminds us, however, that the internal controls story actually goes back many decades, and that many of the strategic issues that are at the heart of section 404 have long been contentious. My Article will briefly update Clark's account through the late 1980s and 1990s before returning to Sarbanes-Oxley and rulemaking thereunder by the SEC and the newly created Public Company Accounting Oversight Board ("PCAOB"). My main point builds on one of Clark's but digs deeper. Internal controls requirements, whether federal or state, are incoherent unless and until one articulates clearly for whose benefit they exist, and to what end. There are, in fact, a number of competing articulations. The failure to identify a single and coherent rationale creates significant uncertainty, which has been exploited by players in the legal, accounting, consulting, and information technology fields. Companies are probably spending more time and resources on 404 compliance than a reasonable reading of the legislation and the rules necessarily requires, heavily influenced by those who gain from issuer over-compliance. This rent-seeking compromises the political viability and substantive quality of what is at the heart a beneficial statutory reform. II. CLARK'S COMMENTARY Section 3.4.2 addresses the board of directors' monitoring duties with respect to potential corporate misconduct. It begins with an extended discussion of Graham v. AlHsChalmers Mfg. Co.,5 where the Delaware Supreme Court famously refused to impose liability on the directors for inattention with regard to illegal price-fixing behavior at the mid-manager level absent some affirmative showing that the directors were on specific notice of a problem. After critiquing the court's reasoning, Clark offers one possible justification for the result: in so far as the shareholders of the company are concerned, the extent of compliance with law is really a matter of business judgment, because ex ante a positive expected value to noncompliance sometimes exists. A monitoring model designed solely to promote compliance as such does not really fit within corporate law (i.e., shareholder protection) as commonly understood, but should instead, if at all, be connected to the legislation that imposes the underlying legal obligations.6 But Clark then says that this critique does not apply with respect to one particular kind of compliance regime: internal accounting controls. "Not having such a system might very well be thought to result in a risk of injury to shareholders that no reasonable director would normally incur,"7 and thus accounting controls present a distinguishable issue from legal compliance programs generally. …