UNDERSTANDING THE SARBANES-OXLEY ACT AND ITS IMPACT

Transcription

1 S w 909B13 UNDERSTANDING THE SARBANES-OXLEY ACT AND ITS IMPACT Devin Scarrow wrote this note under the supervision of Professor Mary Heisz solely to provide material for class discussion. The authors do not intend to provide legal, tax, accounting or other professional advice. Such advice should be obtained from a qualified professional. Ivey Management Services prohibits any form of reproduction, storage or transmittal without its written permission. Reproduction of this material is not covered under authorization by any reproduction rights organization. To order copies or request permission to reproduce materials, contact Ivey Publishing, Ivey Management Services, c/o Richard Ivey School of Business, The University of Western Ontario, London, Ontario, Canada, N6A 3K7; phone (519) ; fax (519) ; cases@ivey.uwo.ca. Copyright 2009, Ivey Management Services Version: (A) THE SARBANES OXLEY ACT In 2002, U.S. lawmakers quickly passed the Sarbanes-Oxley Act (SOX) in the wake of several high-profile bankruptcies and the revelation of accounting irregularities and corporate fraud at several American corporations such as WorldCom, Adelphia Communications and Enron. Enron was the shining example of a corporate accounting scandal. In late 2001, the company was forced to declare bankruptcy after the revelation the company had several billion dollars of off-balance-sheet-debt in Special Purpose Entities, or SPEs. In the next few months of turmoil, as news of the accounting irregularities made headlines worldwide, Enron s stock price fell from a high of more than US$90 per share to less than 50 cents per share, wiping out billions of dollars of stock market value. 1 This unprecedented bankruptcy, together with other accounting scandals, significantly affected shareholder confidence throughout the United States. Following the public outrage over Enron, Paul Sarbanes, a Democrat senator from Maryland, and Michael Oxley, a Republican member of the House of Representatives, each wrote separate bills in an attempt to restore investor confidence in the American securities markets. These two bills were later consolidated to become the Sarbanes-Oxley Act, commonly known as SOX. SOX enjoyed widespread support from both Democrats and Republicans in both houses of Congress. Congress and the Senate passed the act very quickly by a cumulative vote of with a minimal debate and very few amendments. 2 President George W. Bush signed the bill into law on July 30, By 2008, SOX was to apply to all publicly listed companies in the United States and all companies registered with the Securities Exchange Commission (SEC). Private companies, however, would be exempt. Notably, SOX would apply to a large number of foreign-domiciled companies that are cross-listed in the United States. 1 CBC News Online, From Collapse to Convictions: A Timeline, October 23, 2006, accessed September 2, ComplianceHome, Sarbanes-Oxley (SOX), accessed April 7, 2009.

2 Page 2 The broad goal of the act was to increase investor confidence and reduce unethical behavior in corporate America. SOX aimed to increase and enforce accountability among corporate management and boards of directors by mandating new standards of corporate governance and management control. Section 302: Corporate Responsibility for Financial Reports Enacted in 2002, this section stipulates that a corporation s chief executive officer (CEO) and chief financial officer (CFO) must sign off on the accuracy and completeness of the financial statements at each reporting date. Further, these signing officers are held personally responsible for designing, establishing, maintaining and evaluating internal controls at the corporation. Lastly, this section stipulates that these signing officers are responsible for the disclosure of any fraudulent activity discovered, whether material in nature or not, to the corporation s board of directors and its external auditors. 3 Section 404: Management Assessment of Internal Controls Although lawmakers did not debate SOX at length, some sections have caused long-lasting controversy. In particular, section 404 was the most controversial because it was responsible for the majority of the costs businesses have incurred to implement SOX. This section requires management to produce an annual internal control report that contains an assessment of the design and effectiveness of the corporation s internal controls. Further, section 404 requires a company s external auditors to provide an opinion on management s internal control report. 4 Section 404 came into effect for large public corporations on November 15, Smaller corporations and foreign filers were initially given more time to comply with section 404. Unlike previous standards, section 404 requires corporations to demonstrate an extra level of transparency. Not only must the financial statements be stated accurately and completely at each reporting date but the company must prove all of the processes it uses to develop its financial statements work correctly with effective and complete internal controls. In 2002, most corporations had not devoted considerable internal resources to documenting and testing these processes and controls; thus, compliance with section 404 represented a large amount of work. In 2005, the first full year in which SOX audits were required, roughly 16 per cent of filing companies received an adverse opinion on internal controls from their external auditors. 5 The list of companies receiving adverse audit opinions included several giants of corporate America such as General Electric, American International Group (AIG) and Eastman Kodak. It should be noted, however, that most companies that received an adverse SOX audit opinion received an unqualified audit opinion of their financial statements. 6 In 2006, the number of companies receiving an adverse internal control report opinion declined to 11 per cent. 7 3 United States Congress, Sarbanes Oxley Act of Ibid. 5 Jian Zhang and Kurt Pany, Current Research Questions on Internal Control over Financial Reporting under Sarbanes- Oxley, The CPA Journal, February 2008, pp Stephen K. Asare et al., The Sarbanes-Oxley Act: Legal Implications and Research Opportunities, Research in Accounting Regulation, January 2007, pp Jian Zhang and Kurt Pany, Current Research Questions on Internal Control over Financial Reporting under Sarbanes- Oxley, The CPA Journal, February 2008, pp

3 Page 3 Although the details and implications of a SOX audit under Section 404 are outside of the scope of this note, Exhibits 1, 2, 3 and 4 provide examples of both management reports and auditors reports on internal controls. See Exhibit 1 for General Electric s 2004 management report on internal controls, which details material weaknesses in the company s internal controls. See Exhibit 2 for General Electric s 2004 auditor s report expressing a negative opinion about the company s internal controls. See Exhibit 3 for General Electric s 2008 management report on internal controls expressing an opinion that management maintained an effective control structure. See Exhibit 4 for General Electric s 2008 combined auditor s report of financial statements and internal controls expressing a clean audit opinion for both the company s financial statements and control structure. Other Notable Sections 8,9 Section 101 established the Public Company Accounting Oversight Board (PCAOB), an independent non-governmental organization, and authorized it with oversight responsibility for the auditing of public companies. Previously, this function had been performed by the American Institute of Certified Public Accountants (AICPA). Section 201 provides guidelines for non-auditing activities for a corporation s external auditors. Notably, this section prohibits a company s auditors from also providing non-auditing services, such as bookkeeping, consulting or financial systems design and implementation services. Section 203 requires the periodic rotation of the auditing firm s engagement partner. Section 206 stipulates that a corporation s senior officers cannot have been employed by the auditing firm for, at minimum, the 12 months preceding the audit. Section 301 requires a corporation s audit committee to comprise independent members of the board of directors. To be considered independent, a person cannot accept any fees from the corporation other than fees related to service on either the board of directors or the audit committee, and cannot be considered to be affiliated with the corporation or any of its subsidiaries. Section 301 further stipulates that the audit committee must set up an effective whistleblower program that provides protection for individuals coming forward to company officials with information related to accounting, internal controls and auditing matters. Section 407 requires that a corporation disclose whether an audit committee has at least one financial expert, and if not, the reason for the lack of such an expert. A financial expert is defined as a person having an understanding of generally accepted accounting principles and financial statements, experience in the preparation or auditing of financial statements, experience with internal accounting controls and an understanding of audit committee functions. Section 806 provides job security for whistleblowers. Section 906 outlines personal criminal liability and penalties for a corporation s signing officers who fail to comply with SOX. 8 Guy Lander, What Is Sarbanes Oxley? McGraw-Hill, New York, United States Congress, Sarbanes Oxley Act of 2002.

4 Page 4 THE CANADIAN RESPONSE TO SOX By late 2002, it had become increasingly clear that SOX would improve financial reporting and corporate governance in the United States. As a result, Canadian securities regulators were pressured to adopt SOXlike regulations to maintain investor confidence in Canada s securities markets and to ensure Canadian corporations continued to enjoy preferential access to U.S. securities markets. 10 However, Canadian regulators did not feel a strong sense of urgency to introduce SOX-like legislation because no Canadian cases of accounting irregularities or corporate fraud had been experienced on the scale of either WorldCom or Enron. This lack of urgency allowed Canadian securities regulators to take a slower and more collaborative approach to introducing SOX-like legislation, which resulted in less uncertainty and confusion than SOX had caused in the United States. In contrast to the American approach, in which SOX was written and passed very quickly with little input from affected parties, the Canadian legislation was initially released as a set of draft instruments. Regulators sought the input and comments of affected parties to ensure that any legislation would both meet the regulator s requirements and reflect the unique aspects of the Canadian business environment and Canadian financial markets. 11 The Canadian Public Accountability Board In 2002, the Canadian Public Accountability Board (CPAB) was created by the Canadian Securities Administrators (CSA), the Superintendent of Financial Institutions and Canada s chartered accountants. The CPAB was given the mandate to oversee public auditors, ensuring the quality and independence of the auditing profession in Canada. 12 Specifically, the CPAB was given the authority to regularly inspect the auditors of public companies and to set and enforce rules and guidelines regarding auditor independence and the quality control of the auditing process. 13 The creation of the CPAB was welcomed by the auditing profession. For example, Bill MacKinnon, CEO of KPMG Canada LLP argued that self-regulation of auditing standards and quality in the auditing profession was no longer acceptable in a post-enron world. 14 The six largest Canadian auditing firms immediately agreed to implement the CPAB s requirements as soon they were established. 15 Proposed Legislation In December 2002, the Ontario government passed Bill 198, An Act to Implement Budget Measures and Other Initiatives of the Government. 16 This act amended Ontario s Securities Act, and reformed several securities laws in Ontario. This proposed legislation allowed the Canadian Securities Administrators 10 Tara Gray, Canadian Response to the U.S. Sarbanes-Oxley Act of 2002: New Directions for Corporate Governance, Parliamentary Information and Research Service, Ottawa, October 4, Ibid. 12 Jim Middlemiss, From There to Here, CA Magazine, June 2008, pp Canadian Securities Administrators, New Independent Public Oversight for Auditors of Public Companies Announced by Federal and Provincial Regulators and Canada s Chartered Accountants, press release, July 17, 2002, accessed September 2, Margaret Craig-Bourdin, Greater Public Oversight of Audit Firms on Agenda, CA Magazine Web article, October 3, 2002, accessed August 27, Ibid. 16 H. Garfield Emerson and Geoff A. Clarke, Bill 198 and Ontario s Securities Act: Giving Investors and the OSC Added Muscle, Fasken Martineau DuMoulin LLP, presented at the 3rd Annual Directors Governance Summit, Toronto, November 17 19, 2003.

5 Page 5 (CSA), an umbrella organization representing Canada s 13 provincial and territorial regulators, to develop several new regulations in 2003: Multilateral Instrument (MI) , Certification of Disclosure in Companies Annual and Interim Filings, requires CEOs and CFOs to personally certify the correctness and completeness of their company s financial statements. This requirement is very similar to SOX s section 302. This requirement was initially to be effective for financial years ending on or after January 1, MI , Audit Committees, enacts several rules similar to those found in SOX regarding the role and composition of the audit committee. This set of requirements came into force on January 1, MI , Reporting on Internal Control over Financial Reporting, was originally published for comment by securities regulators in every Canadian jurisdiction excluding British Columbia in February of The regulations enshrined in this proposal were very similar to those of SOX s section 404. Specifically, under this proposal, Canadian publicly listed companies would be required to create and maintain an evaluation of the effectiveness of internal controls over financial reporting, report on material weaknesses of their internal controls and provide for an audit of internal controls over financial reporting. MI was originally to become effective on or after June 30, If all of the proposed legislation had been adopted, the Canadian regulatory framework would have been sufficiently similar to that of the American regulatory framework enshrined in SOX; however, as will be explained below, the enacted legislation differed from that originally proposed. Enacted Legislation The regulations enshrined in the original MI and MI both came into effect in However, in March 2006, after substantial review and consultation proposal, MI was abandoned in part due to the delays, uncertainty and controversy surrounding SOX s section 404 in the United States. 20 The CSA received a landslide of comments and feedback related to MI from Canadian businesses arguing that this piece of the legislation was unneeded, would prove exceedingly expensive and was far too American. 21 These respondents argued that the benefits of MI would not justify the costs to Canadian businesses and these new standards swung the pendulum too far toward rigid controls. As a result, MI was expanded to include provisions requiring a company s CEO and CFO to certify and report on the effectiveness of the company s internal controls over financial reporting and was to be phased in, starting in financial years ending on or after December 31, The CSA explained that it believed the amendment to MI and the rejection of MI appropriately balanced the costs and benefits of internal control reporting, while strengthening investor protection, and reflecting the unique aspects of Canadian businesses and securities markets. 22 In the end, the major differences between the provisions of the expanded MI and the abandoned MI are that a Canadian company will not be required to engage in an audit or to obtain an audit opinion 17 Ontario Securities Commission, Category 5: Ongoing for Issuers and Insiders, accessed February 16, Ibid. 19 Canadian Securities Administrators, CSA Notice , Status of Proposed Multilateral Instrument and Proposed Amended and Restated Multilateral Instrument , March 3, British Columbia did seek comments in a similar fashion on its views on internal control reporting requirements. 20 Ibid. 21 Peter Morton, Compliance Costs, CA Magazine, December 2005, pp , Deloitte & Touche LLP, Reporting on Internal Control: The Implications of the CSA s Proposed Approach, Deloitte & Touche LLP, April 2006.

6 Page 6 related to its internal controls. This lack of a requirement for an audit opinion on the design and effectiveness of the company s internal controls from its external auditors is the single major and notable difference between Canadian and American reporting requirements. 23 Aside from this difference, the substance of SOX s sections 302 and 404, together with many of SOX s other sections, is fully enshrined in the Canadian legislation. THE COSTS OF SOX IMPLEMENTATION: TANGIBLE AND INTANGIBLE Early on, it was clear both that the monetary costs of implementing SOX were significantly higher than first anticipated and that other serious non-monetary costs were resulting from SOX. In 2004, the actual benefits of implementing SOX were still unclear. Donald Nicholson, chief accountant at the SEC, said in 2004, I suspect that the costs are not easy to estimate, but I know that it is even tougher to quantify the benefits. 24 In a 2005 statement to the SEC, a representative of PriceWaterhouseCoopers said, The costs are tangible, quantifiable and immediate, while many of the benefits are intangible, harder to quantify and longer term. 25 Tangible Costs 404 Compliance Initial Costs After the U.S. government quickly passed the SOX legislation, the SEC released implementation rules for SOX s Section 404. Initially senior officials at the SEC had believed that many, if not most, companies would have already implemented and documented internal controls to a large extent, such that only a minimal amount of work would be required to comply with SOX s Section 404. On the basis of this assumption, the regulator estimated that initial compliance with this section would cost, on average, $94,000 for a publicly listed company or $1.24 billion in aggregate for all corporations. 26 It quickly became apparent, however, that this assumption was grossly inaccurate. Initial compliance with section 404 alone was estimated to cost businesses more than $30 billion in aggregate, and the largest portion related to the design, installation and documentation of internal controls. 27 A study by Financial Executives International (FEI) of 217 large public corporations found that in 2004, large companies with revenues in excess of $5 billion spent, on average, $4.36 million to initially comply with section 404, a cost that was 39 per cent higher than the companies own initial estimates. 28 Costs of initial compliance for smaller corporations have been estimated to average between $250,000 and $500, Also increasingly clear early on was the reality that the costs of complying with section 404 would fall disproportionately on smaller companies. A large multinational corporation with $10 billion in revenue could afford $5 million in compliance costs much more easily than a small corporation with $10 million in 23 PricewaterhouseCoopers LLP, Navigating the New World: Multilateral Instrument and Notice , PricewaterhouseCoopers LLP, A Price Worth Paying? Auditing Sarbanes-Oxley, The Economist, May 21, 2005, p Ibid. 26 Dennis C. Stovall, SOX Compliance: Cost and Value, The Business Review, Cambridge, December 2008, pp Amey Stone, SOX: Not So Bad After All? Business Week Online, August 1, Tara Gray, Canadian Response to the U.S. Sarbanes-Oxley Act of 2002: New Directions for Corporate Governance, Parliamentary Information and Research Service, Ottawa, October 4, Michael F. Holt, The Sarbanes Oxley Act: Costs, Benefits and Business Impacts, CIMA Publishing, Boston, 2008.

7 Page 7 revenue could afford $250,000 in compliance costs. 30 These increased costs of regulatory compliance together with the increased legal liability risks inherent in SOX were thought by many to have helped start a boom in the private equity industry because many smaller corporations were taken private to avoid the costs of SOX compliance Compliance Ongoing Costs Initial compliance with section 404 was only the first bite SOX took out of businesses bottom lines. The annual ongoing costs of compliance are estimated to be in the millions of dollars for larger companies and in the hundreds of thousands of dollars for smaller companies. 32 This increased cost to businesses will exert downward pressure on the bottom line of many corporations for years in the future, affecting the competitiveness of many complying corporations. Auditing Fees In addition to the increased costs of compliance, other cost effects were also realized. For example, when SOX came into effect, auditing firms immediately increased their regular audit fees by 20 to 40 per cent as a result of the increased audit work required. 33,34 Further, some criticism suggested that auditing firms were raising the prices of their auditing services, previously often priced as loss leaders, not only as a result of the increased work but also in reaction to restrictions around the amount of non-auditing services the firm could provide to audit clients under the new legislation. 35,36 Other Costs As a result of the threat of new legal liabilities imposed on the officers and directors of companies, insurance companies increased the premiums charged for directors and officers insurance, 37 a type of insurance that protects the assets of the corporation and the personal assets of both individual managers and board members. Legal fees for many corporations initially increased as a result of the enactment of SOX because corporate counsel needed to spend more time ensuring companies were complying with the new legislation. 38 Penalties of non-compliance were initially thought to be so severe that ensuring that all SOX s requirements were being met was imperative. Because most companies have now gained experience regarding compliance with SOX, these legal fees have decreased A Price Worth Paying? Auditing Sarbanes-Oxley, The Economist, May 21, 2005, p Michael F. Holt, The Sarbanes Oxley Act: Costs, Benefits and Business Impacts, CIMA Publishing, Boston, Ibid. 33 Colleen A. Sayther, Report Card on Sarbanes-Oxley: One Year Later, Financial Executive, October 2003, p Michael F. Holt, The Sarbanes Oxley Act: Costs, Benefits and Business Impacts, CIMA Publishing, Boston, Alan Kohler, The Jig is Up for Loss-Leader Auditors, Sidney Morning Herald, April 28, Shannon L. Charles et al., The Association between Financial Reporting Risk and Audit Fees Before and After the Historic Events Surrounding SOX, Social Science Research Network, September Colleen A. Sayther, Report Card on Sarbanes-Oxley: One Year Later, Financial Executive, October 2003, p Dennis C. Stovall, SOX Compliance: Cost and Value, The Business Review, Cambridge, December 2008, pp Ibid.

8 Page 8 SOX s increased tangible costs lower the profits of each complying company, affect the company s share price and reduce the amount of money the company can reinvest to produce future growth and returns for shareholders. 40,41 As a result of these significant and sometimes unexpected costs, the business community has loudly criticized SOX. Intangible Costs Board of Directors SOX changed the landscape for a company s board of directors. Because of increasing requirements for their work and increased legal liability, many business professionals began to question the value of being a member of any corporation s board of directors. 42 This situation initially affected the quality of corporate governance at many American corporations because the talent pool of new directors had shrunk, and those individuals who were willing to serve on a corporate board increasingly focused their attention on legal liabilities, and less so on taking risks and pursuing entrepreneurial activities. 43 Decreased U.S. Listings When SOX first became a reality, the senior executives of many American companies who had previously been considering an initial public offering (IPO) had second thoughts about doing so in the United States because of the costs of complying with SOX. 44 Many non-american companies that had planned to list on a U.S. exchange initially threatened to instead list on a foreign stock exchange. 45,46 One study found that companies were increasingly delisting from American stock exchanges, and that 20 per cent of companies listed in the United States were considering delisting. 47,48 SOX s onerous and expensive compliance requirements on their own decreased the short-term competitiveness of American stock exchanges. 49 Decreased Management Attention Because of the new requirements, management time and attention was being diverted from running companies to ensuring compliance with regulations. 50 Further, the penalties for non-compliance were thought to significantly affect a management team s willingness to take risks. 51 The turnover rate of corporate CEOs also increased shortly after SOX s implementation William J. Dodwell, Six Years of the Sarbanes-Oxley Act: Are We Better Off? The CPA Journal, August 2008, pp Michael F. Holt, The Sarbanes Oxley Act: Costs, Benefits and Business Impacts, CIMA Publishing, Boston, Ibid. 43 Tara Gray, Canadian Response to the U.S. Sarbanes-Oxley Act of 2002: New Directions for Corporate Governance, Parliamentary Information and Research Service, Ottawa, October 4, Ibid. 45 Ibid. 46 A Price Worth Paying? Auditing Sarbanes-Oxley, The Economist, May 21, 2005, p Peter Hostak et al., An Examination of the Impact of the Sarbanes-Oxley Act on the Attractiveness of US Capital Markets for Foreign Firms, Social Science Research Network, April 30, A Price Worth Paying? Auditing Sarbanes-Oxley, The Economist, May 21, 2005, p William J. Dodwell, Six Years of the Sarbanes-Oxley Act: Are We Better Off? The CPA Journal, August 2008, pp Dennis C. Stovall, SOX Compliance: Cost and Value, The Business Review, Cambridge, December 2008, pp Colleen A. Sayther, Report Card on Sarbanes-Oxley: One Year Later, Financial Executive, October 2003, p Amey Stone, SOX: Not So Bad After All? Business Week Online, August 1, 2005.

9 Page 9 THE BENEFITS OF SOX IMPLEMENTATION The ultimate goal of SOX was to increase investor confidence by improving the transparency, integrity and accountability of financial reporting. The document s authors also envisioned many other goals, including a decrease in the ability to perpetuate fraud, better oversight of accounting practices by the corporation s board of directors and a reduction in the amount and scale of potential errors in a corporation s financial reporting. Increased Regulation The creation of the PCAOB and the increased powers given to the SEC provide new and increased levels of regulatory oversight for both auditing firms and corporations. Further, the increased powers of these two organizations to monitor and discipline auditing firms and corporations both provide a strong disincentive for corporations to engage in questionable accounting practices or fraud and dissuade auditing firms from allowing questionable practices to persist. Better Financial Reporting Undoubtedly, SOX has helped to restore the public s faith in financial reporting and its accuracy. The incidence of financial reporting restatements increased significantly following the implementation of SOX as a result of the exposure of control weaknesses and other issues that had not previously been detected or corrected at many companies. 53 SOX s enhanced reporting requirements have improved the transparency of corporate financial reporting and the quality of the financial reporting process. 54 Lastly, the requirements for CEO and CFO attestation as to the completeness and accuracy of the company s financial reports and the penalties for non-compliance significantly affected the perception of financial reporting and its accuracy. This improved public perception of corporate America s financial reporting has helped to restore investor confidence in the U.S. securities markets and, thus, has promoted a more efficient capital allocation process. 55 Better Management of Companies and Corporate Governance Because of SOX s requirements, companies initially needed to spend a considerable amount of time and effort designing and testing internal controls. For many companies, SOX introduced a new way of thinking about and managing the company s control structure. 56 Many companies were forced to spend a significant amount of time and effort building a better control structure, which, though painful at the time, provided a significant benefit to the corporation in the long run. In several cases, these better controls have reduced the possibility for fraud and allowed companies to catch small errors before they became large ones. 57,58 As a result of SOX s requirements, members of a corporation s board of directors must pay significantly more attention to their duties, and are increasingly asking hard questions that had previously gone unasked 53 William J. Dodwell, Six Years of the Sarbanes-Oxley Act: Are We Better Off? The CPA Journal, August 2008, pp Ibid. 55 Ibid. 56 Colleen Cunningham, The Gain and Pain of Sarbanes-Oxley, Financial Executives International, December Colleen A. Sayther, Report Card on Sarbanes-Oxley: One Year Later, Financial Executive, October 2003, p William J. Dodwell, Six Years of the Sarbanes-Oxley Act: Are We Better Off? The CPA Journal, August 2008, pp

10 Page 10 and unanswered. In general, corporate board members are now much better informed about the true performance of their corporations than they were before SOX. This situation allows for better decision making and risk assessment in corporate board rooms. 59 SOX s regulations regarding the corporation s audit committee have also significantly affected the process of corporate governance. By providing the audit committee with increased power and mandating that its members be both independent and financially literate, SOX improves the reliability of the internal auditing function and minimizes the potential for management interference. 60 From an external audit perspective, by limiting the ability of external audit firms to perform non audit-related work, SOX reduces the scope for auditor complicity in accounting impropriety and errors. Lastly, although this point is controversial, SOX has helped to improve ethical behavior in corporate America by mandating severe penalties for corporate malfeasance and limiting the scope for a company s managers to use the I didn t know defence. 61 COSTS VERSUS BENEFITS? Some have argued that a sufficient regulatory and legal framework was in place prior to SOX to prevent most corporate accounting scandals and frauds. 62 An accounting scandal or fraud cannot be absolutely prevented. A possibility will always exist for a corporation or a well-placed individual to perpetuate fraud or to engage in questionable accounting practices. Many critics argue that integrity cannot be legislated and that SOX s significant costs did not justify its moderate gains in the regulatory framework for American business. 63 Did the main benefits of SOX gains in shareholder confidence that increased equity market participation and liquidity justify these costs? Do the benefits of SOX for corporate governance increased oversight from the board of directors, an increase in the reliability of internal controls and increased power given to audit committees help to justify the costs? Due to the intangible nature of the majority of the benefits of SOX, we may never know whether the benefits truly warranted the costs. 59 Amey Stone, SOX: Not So Bad After All? Business Week Online. August 1, Stephen Wagner and Lee Dittmar, The Unexpected Benefits of Sarbanes-Oxley, Harvard Business Review, April 2006, pp Mapping the Terrain: Issues That Connect Business and Ethics Survey, Business Roundtable Institute for Corporate Ethics, May Michael F. Holt, The Sarbanes Oxley Act: Costs, Benefits and Business Impacts, CIMA Publishing, Boston, Colleen A. Sayther, Report Card on Sarbanes-Oxley: One Year Later, Financial Executive, October 2003, p. 6.

11 Page 11 Exhibit 1 GENERAL ELECTRIC S 2004 MANAGEMENT REPORT ON INTERNAL CONTROLS Management s Annual Report on Internal Control Over Financial Reporting (as restated) The management of General Electric Company is responsible for establishing and maintaining adequate internal control over financial reporting for the company. With the participation of the Chief Executive Officer and the Chief Financial Officer, our management conducted an evaluation of the effectiveness of our internal control over financial reporting as of December 31, 2004, based on the framework and criteria established in Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission. In the company s Annual Report on Form 10-K for the year ended December 31, 2004, filed on March 1, 2005, management concluded that our internal control over financial reporting was effective as of December 31, Subsequently, management identified the following material weakness in internal control over financial reporting with respect to accounting for hedge transactions: a failure to ensure the correct application of SFAS 133 when certain derivative transactions were entered into at GECC prior to August 2003 and failure to correct that error subsequently. This material weakness has caused us to amend our Annual Report on Form 10-K for the year ended December 31, 2004, in order to restate the financial statements for the years ended December 31, 2004, 2003 and 2002 and to restate financial information for the year ended December 31, 2001 and each of the quarters in 2003 and Solely as a result of this material weakness, our management has revised its earlier assessment and has now concluded that our internal control over financial reporting was not effective as of December 31, General Electric Company s independent auditor, KPMG LLP, a registered public accounting firm, has issued an audit report on our management s revised assessment of our internal control over financial reporting as of December 31, This audit report follows. JEFFREY R. IMMELT Chairman of the Board and Chief Executive Officer KEITH S. SHERIN Senior Vice President, Finance and Chief Financial Officer May 5, 2005 Source: accessed September 2, 2009.

12 Page 12 Exhibit 2 GENERAL ELECTRIC S 2004 AUDITOR S REPORT OF INTERNAL CONTROLS Report of Independent Registered Public Accounting Firm To Shareowners and Board of Directors of General Electric Company: We have audited management s restated assessment, included in the accompanying Management s Annual Report on Internal Control over Financial Reporting (as restated) that General Electric Company and consolidated affiliates ( GE ) did not maintain effective internal control over financial reporting as of December 31, 2004, because of the effect of the material weakness identified in management s restated assessment, based on criteria established in Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission ( COSO ). GE management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting. Our responsibility is to express an opinion on management s assessment and an opinion on the effectiveness of GE s internal control over financial reporting based on our audit. We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, evaluating management s assessment, testing and evaluating the design and operating effectiveness of internal control, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion. A company s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company s assets that could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

13 Page 13 Exhibit 2 (continued) A material weakness is a control deficiency, or combination of control deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected. Management has identified and included in its restated assessment the following material weakness as of December 31, 2004: a failure to ensure the correct application of Statement of Financial Accounting Standards No. 133 when certain derivative transactions were entered into at General Electric Capital Corporation prior to August 2003 and failure to correct that error subsequently. This material weakness resulted in restatements of the Company's previously issued consolidated financial statements as of December 31, 2004 and 2003, and for each of the years in the three-year period ended December 31, 2004, and the financial information for each of the quarters in 2004 and As stated in the fourth paragraph of Management s Annual Report on Internal Control over Financial Reporting (as restated), management s assessment of the effectiveness of GE s internal control over financial reporting has been restated. We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the statement of financial position of General Electric Company and consolidated affiliates as of December 31, 2004 and 2003, and the related statements of earnings, changes in shareowners equity and cash flows for each of the years in the three-year period ended December 31, The aforementioned material weakness was considered in determining the nature, timing, and extent of audit tests applied in our audit of the 2004 consolidated financial statements (as restated), and this report does not affect our report dated February 11, 2005, except as to the restatement discussed in note 1 to the consolidated financial statements, which is as of May 5, 2005, which expressed an unqualified opinion on those consolidated financial statements. In our opinion, management s restated assessment that GE did not maintain effective internal control over financial reporting as of December 31, 2004, is fairly stated, in all material respects, based on criteria established in Internal Control Integrated Framework issued by COSO. Also, in our opinion, because of the effect of the material weakness described above on the achievement of the objectives of the control criteria, GE did not maintain effective internal control over financial reporting as of December 31, 2004, based on criteria established in Internal Control Integrated Framework issued by COSO. KPMG LLP Stamford, Connecticut February 11, 2005, except as to the fourth paragraph of Management s Annual Report on Internal Control over Financial Reporting (as restated), which is as of May 5, 2005 Source: accessed September 2, 2009.

14 Page 14 Exhibit 3 GENERAL ELECTRIC S 2008 MANAGEMENT REPORT ON INTERNAL CONTROLS Management s Annual Report on Internal Control Over Financial Reporting Management is responsible for establishing and maintaining adequate internal control over financial reporting for the Company. With our participation, an evaluation of the effectiveness of our internal control over financial reporting was conducted as of December 31, 2008, based on the framework and criteria established in Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this evaluation, our management has concluded that our internal control over financial reporting was effective as of December 31, Our independent registered public accounting firm has issued an audit report on our internal control over financial reporting. Their report appears on the following page. JEFFREY R. IMMELT Chairman of the Board and Chief Executive Officer KEITH S. SHERIN Vice Chairman and Chief Financial Officer February 6, 2009 Source: accessed September 2, 2009.

15 Page 15 Exhibit 4 GENERAL ELECTRIC S 2008 AUDITORS REPORT OF FINANCIAL STATEMENTS AND INTERNAL CONTROLS Report of Independent Registered Public Accounting Firm To Shareowners and Board of Directors of General Electric Company: We have audited the accompanying statement of financial position of General Electric Company and consolidated affiliates ( GE ) as of December 31, 2008 and 2007, and the related statements of earnings, changes in shareowners equity and cash flows for each of the years in the three-year period ended December 31, We also have audited GE s internal control over financial reporting as of December 31, 2008, based on criteria established in Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission ( COSO ). GE management is responsible for these consolidated financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting. Our responsibility is to express an opinion on these consolidated financial statements and an opinion on GE s internal control over financial reporting based on our audits. We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the financial statements are free of material misstatement and whether effective internal control over financial reporting was maintained in all material respects. Our audits of the consolidated financial statements included examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements, assessing the accounting principles used and significant estimates made by management, and evaluating the overall financial statement presentation. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions. A company s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company s assets that could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

16 Page 16 Exhibit 4 (continued) In our opinion, the consolidated financial statements appearing on pages 50, 52, 54, and the Summary of Operating Segments table on page 26 present fairly, in all material respects, the financial position of GE as of December 31, 2008 and 2007, and the results of its operations and its cash flows for each of the years in the three-year period ended December 31, 2008, in conformity with U.S. generally accepted accounting principles. Also, in our opinion, GE maintained, in all material respects, effective internal control over financial reporting as of December 31, 2008, based on criteria established in Internal Control Integrated Framework issued by COSO. As discussed in Note 1 to the consolidated financial statements, GE, in 2008, changed its method of accounting for fair value measurements and adopted the fair value option for certain financial assets and financial liabilities, in 2007, changed its methods of accounting for uncertainty in income taxes and for a change or projected change in the timing of cash flows relating to income taxes generated by leveraged lease transactions, and, in 2006, changed its methods of accounting for pension and other postretirement benefits and for share-based compensation. Our audits of GE s consolidated financial statements were made for the purpose of forming an opinion on the consolidated financial statements taken as a whole. The accompanying consolidating information appearing on pages 51, 53 and 55 is presented for purposes of additional analysis of the consolidated financial statements rather than to present the financial position, results of operations and cash flows of the individual entities. The consolidating information has been subjected to the auditing procedures applied in the audits of the consolidated financial statements and, in our opinion, is fairly stated in all material respects in relation to the consolidated financial statements taken as a whole. KPMG LLP Stamford, Connecticut February 6, 2009 Source: accessed September 2, 2009.