Sarbanes-Oxley costs too much, takes too much time and focuses too much on checking boxes rather than taking a risk-based approach. We can't begin to count how many times we've read the arguments.
And they're true, to a certain extent. If they weren't, would so many people be determined to make Sarbox less burdensome?
Something about Sarbanes-Oxley must be working, though, becausenon-profits in North Carolina are voluntarily implementing Sarbox-like internal controls. Philanthropy Journal reports that Foundation for the Carolinas requires audit committee members to rotate off the audit every five years and has a strict policy of non-retaliation against whistleblowers.
Similarly, United Way of Central Carolinas has an independent audit committee that is completely separate from the finance committee, reports directly to the board of directors and includes a finance expert. Moreover, the organization mandates that its CEO and CFO sign off on financial statements and has a compensation committee that sets market-based performance goals for its CEO.
A Foundation representative tells Philanthropy Journal that the organization has a duty to be as transparent as possible and to demonstrate that it is worthy of the public's trust in managing public contributions.
Oddly enough, these are not the first non-profits to tackle Sarbanes-Oxley compliance. A non-profit hospital in Pennsylvania declared it had attained voluntary compliance last year.
Maybe Sarbox isn't awful for public companies because it's awful, but because they have no choice.