SARBANES-OXLEY SHOULD NOT BE EXTENDED TO NONPROFITS

Our very own Jack Siegel will be participating on a panel this week at ARNOVA’s annual conference, this year being held in Chicago.  The panel will consider whether the Sarbanes-Oxley Act of 2006 should be extended to nonprofit organizations.  Here are Jack’s thoughts and comments:

People like easy solutions to difficult problems.  That may explain why so many people are looking to Sarbanes-Oxley as model legislation to improve nonprofit governance.  These people are well-intentioned,...

The Desktop Guide is Quickly Becoming the Must Have Guide for Nonprofit Executives Jack Siegel's new book, A Desktop Guide for Nonprofit Directors, Officers, and Advisors: Avoiding Trouble While Doing Good, has quickly become the go to guide for nonprofit executives and advisors. So what are people saying about the Guide? When our Jack Siegel introduced himself to one of the leading authorities on the law of federal tax exemption after she had made a presentation at a recent conference, the speaker said, "You're the 'Jack' in the Guide!  We are fighting over your Guide in our office."  A second speaker held the book up to two people who were asking questions after her presentation, exclaiming "I love this book.  I tell everyone at conferences to buy it."  One state charity regulator has indicated that the Guide is great and has recommended it to her fellow regulators.  Some of our readers have followed the link to the Amazon.com Web site, but apparently have not bought the Guide.  If they were turned off by the price, they should reconsider.  One prominent attorney in the exempt organization field grabbed a review copy of the Guide and couldn't put it down.  She has instructed a number of her clients to buy it, pointing out to them that for less than 1/2 hour of her billable time, they receive a lesson (and resource) that tells it like she would like it told.  If you are starting a new charity, the Guide could save you thousands of dollars in legal fees by teaching you how to better utilize your legal counsel and framing the issues so you don't spin your wheels at $400 an hour. Buy your copy today at Amazon.com,  Barnes & Noble, or John Wiley (the publisher).

but misguided. 

Sarbanes-Oxley applies to companies that are required to file reports with the Securities and Exchange Commission under the Securities Exchange Act of 1934.  I have not been able to obtain exact statistics regarding the number of companies subject to Sarbanes-Oxley's core provisions, but the numbers I have seen suggest that the number is somewhere between 10,000 and 13,000.  See Final Report of the Advisory Committee on Smaller Public Companies to the U.S. Securities and Exchange Commission, April 23, 2006.

GuideStar reports that its tax return database includes returns for over 1.5 million tax-exempt entities.  The IRS reports that for 2003, the latest year for which data is available, it received tax returns for 211,858 Section 501(c)(3) organizations.  The bulk of those entities held less than $1 million in assets, as the following table illustrates:

    Number of Entities             Asset Range                        Percentage of Total Entities
    58,001                        Under $100,000 in assets                          27.37%
    60,107             Between $100,000 and $500,000 in assets             28.37%
    25,451             Between $500,000 and $1 million in assets            12.01%
    52,393             Between $1 million and $10 million in assets          24.73%
    10,934                   $10 million to $50 million in assets                   5.16%
    4,973                          Over $50 million in assets                           2.35%

The vast majority (somewhere between 67% and 80%) of Section 501(c)(3) organizations would be considered microcaps by the SEC. 

One of the recurring complaints about Sarbanes-Oxley has been the staggering cost of compliance.  The SEC originally estimated that the cost of complying with Rule 404 would be somewhere around $91,000 per respondent.  See SEC, Final Rule: Mangement's Reports on Internal Controls Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports, 2003.   Section 404 requires covered companies to report on their system of internal controls.

One study indicates that the cost of Section 404 compliance has far exceeded the $91,000 number, coming in at an average of $4.5 million per issuer in the first year (and dropping to an average of $3.8 million per issuer in the second year).  See Financial Executives International, Survey on Sarbanes-Oxley Section 404 Implementation (March 2006).  Another survey focuses on the compliance costs incurred by just small issuers.  Although significantly below the $4.5 million number, those costs can still exceed $1 million in the first year.  See CRA International, Sarbanes-Oxley 404 Costs and Implementation Issues: Spring 2006 Update, April 17, 2006.  The GAO conducted its own study to assess how internal control reporting provisions in Section 404 impacted smaller issuers, defined by the GAO as those issues with less than $700 million in market capitalization.  See GAO, Consideration of Key Principles Needed in Addressing Implementation for Smaller Companies, GAO-06-361, April 2006.  The GAO concluded:

While regulators, public companies, auditors, and investors generally agree that the Sarbanes-Oxley Act has had a positive impact on investor protection, available data indicate that smaller public companies face disproportionately higher costs (as a percentage of revenues) in complying with the act, consistent with the findings of the Small Business Administration on the impact of regulations generally on small businesses.

There are significant differences between the size of the companies subject to the core provisions in the Sarbanes-Oxley Act and the average size of those comprising the nonprofit community.  Given that difference and the disproportionate impact of regulation on small entities, those calling for extension of Sarbanes-Oxley to nonprofits should be very reticent in making that demand.  An entity with a market capitalization of $10 billion is simply an entirely different animal than an entity with  $2 million in restricted assets.

My recent personal experiences with nonprofits provides direct evidence that there is a significant difference between public-traded companies and nonprofits.  Last week, I spoke for three hours to a group of 35 nonprofit executives from a small, but prosperous community.  I was told that no one in the group made over $100,000 per year.  I also learned that of the 35 executives, only two knew about the intermediate sanctions in Section 4958 of the Internal Revenue Code.  Most of the nonprofits represented had very few administrators/accountants.  In one instance, the executive director was working on a part-time basis.  When we talked about audits, the group became quite vocal, complaining that it was difficult to find auditors who were qualified and willing to conduct audits of these organizations.  In short, unlike large publicly-traded companies subject to SEC jurisdiction, these organizations do not have in-house counsel, internal audit staffs, or significant resources that could be used to pay for compliance with detailed regulation.  The dollar volume of transactions simply does not permit these entities to incur the overhead that comes with multiple accountants on staff.  A week earlier I spoke to a group of state regulators about financial controls.  These regulators focus on social service agencies that receive federal grant money.  Although these administrators were one-step removed from the nonprofits themselves, they voiced similar concerns about the burdensome costs that can come with internal controls and regulation.

I have never been one to accept the claim that implementing and maintaining a system of solid internal controls is too burdensome or costly.  My response has always been:  “So dissolve the organization and just leave a bag of money on the street with a note saying that the needy should just help themselves.”  People in the audience always respond, “That’s absurd.” To which I respond, “Is it really any more absurd then having no financial controls?”  Point made.  Every organization has a duty to protect charitable assets.  That duty inevitably means implementing solid financial controls.  Yet, many of the nonprofits I speak to only have one accountant on staff.  Often that person is more bookkeeper than accountant.  I can only ask:  How is the organization dividing the recordkeeping, custodial, and authorization functions with respect to each asset category among independent individuals within the organization?  In other words, before Congress or a state legislative body mandates internal control studies and certifications for nonprofits, it should first make sure that these organizations have rudimentary financial controls.

Now, let’s consider the basic provisions in Sarbanes-Oxley and whether they make sense for nonprofit organizations.

A.  Financial Statement Certification.  Section 302(a) of Sarbanes-Oxley requires each principal executive officer and the principal financial officer to certify to the accuracy of the financial statements (to their knowledge).  As I point out in the Forward to my book, A Desktop Guide for Nonprofit Directors, Officers, and Advisors: Avoiding Trouble While Doing Good (Wiley 2006), certification has not always proven to be meaningful in the public company realm.  I write:

Sarbanes-Oxley has largely become a boondoggle for accountants and consultants and, more importantly, a checklist that some boards and executives can now hide behind in lieu of addressing difficult cultural and ethical issues that go to the core of how business is conducted in the United States. If you doubt this, simply take a look at American International Group, one of the “bluest” of the blue chip companies. On March 15, 2004, Maurice Greenberg, its Chairman and CEO, and Howard I. Smith, its Vice-Chairman and CFO, both signed Exhibit 31 to AIG’s annual Form 10-K filing, thereby making the financial certifications required by Section 302 of Sarbanes-Oxley. A little over a year later, the front page of the Wall Street Journal carried the following headline: AIG Admits ‘Improper’ Accounting: Broad Range of Problems Could Cut $1.77 Billion Of Insurer’s Net Worth, A Widening Criminal Probe. The article reports that the improper accounting that the company admitted to had occurred over the last decade, presumably including the period covered by the two certifications made. Mr. Greenberg was forced to resign amidst investigations by multiple governmental agencies. AIG’s stock price dropped 29% during the turmoil.

Ask yourself how meaningful certification from an anthropologist who heads up a natural history museum actually is?  If you were a lawyer representing a doctor who was asked to head up a quarterly research journal, would you advise him to serve as the executive editor if he had to certify to financial statements?

B.  Auditor Rotation.  Section 203 of Sarbanes-Oxley mandates rotation of lead audit partners every five years.  There is some logic to requiring a fresh pair of eyes.  However, does this requirement go far enough?  Won’t many of the personnel on the audit remain the same? Won’t the audit plan remain the same?  Most importantly, who will replace the lead audit partner?  Will it be a subordinate who has been elevated to partner?  If you believe rotation is a good idea, a much stronger case can be made for firm rotation rather than audit partner rotation.  That may work for large public companies, but what about the small nonprofit in northern Minnesota?  There may only be one audit firm that has nonprofit expertise.  In my view, we should rely on professional standards to assure that whoever is auditing an entity is properly performing his duties.

C. Auditor Independence.  Section 201 of Sarbanes-Oxley lists nine nonaudit services that are deemed to impair an auditor’s independence. Suspect services include appraisal services, financial information system design, and performance of management functions.  Here I cannot disagree with Sarbanes-Oxley.  The auditor should be independent.  I do note, however, that any nonprofit that receives $500,000 or more in federal government grants must obtain an audit that complies with the Single Audit Act of 1984.  The GAO has promulgated what are referred to as Generally Accepted Government Auditing Standards, sometimes referred to as the Yellow Book.  These standards impose auditor independence requirements, meaning that a separate legislation would be duplicative for many nonprofits receiving federal grants.  Many state and local agencies making grants to nonprofits have adopted GAGAS or an equivalent set of rules.

D.  Audit Committee.  Sarbanes-Oxley effectively mandates an audit committee for covered companies.  Each member must be both independent and a member of the company’s board of directors.  I certainly don't dispute the merits of this rule.  I see no reason why nonprofit boards should not have an audit committee.  However, too many nonprofits don’t have a board member who is qualified to serve on an audit committee.  That isn’t an excuse, but it is a fact.  Proponents of audit committees should recognize that many of the directors who are on boards of publicly-traded companies are paid significant sums for their services.  Typically, nonprofit directors are volunteers.  That means attracting those with specialized expertise and who are willing to put in the time is much more difficult.  In short, the law can force audit committees on nonprofit boards, but in many cases, those committees will be paper-tigers.

Conclusions. Top-down mandates are not the solution to poor governance.  If enacted, I suspect that there will be a lot of noncompliance.  IBM, General Motors, and the rest of the Fortune 500 were inundated with invitations to seminars, newsletters, and e-mails describing Sarbanes-Oxley and its compliance implications.  If Sarbanes-Oxley is imposed on the nonprofit sector, the large accounting, law, and consulting firms will inundate large universities and hospital systems with similar communications in an effort to generate demand for professional services.  Many small nonprofits will not get the message, either because no one believes it is worth contacting them or because the person receiving the communication will simply ignore it. 

To the extent there is compliance, I suspect a lot of it will be viewed as burdensome paperwork that must be satisfied.  There may be audit committees, but will it meet on a regular basis?  Will those who are members of the committee understand the importance of the management letter?  Will those on the committee even be able to read the financial statements?

Those questions are not meant to provide excuses.  However, I would argue that a bottom up approach is warranted.  The sector, as a whole, needs to understand the importance of good governance, financial controls, and the need for a variety of policies (conflict-of-interest, whistle blower, record-retention, and investment, to name just a few). In short, the nonprofit sector needs education more than it needs additional regulation. 

Additionally, a strong case can and should be made for merger and consolidation.  It is ridiculous when three or four social service agencies provide the same services in the same community, each with inadequate financial controls because meaningful controls require personnel and money to maintain and implement them.  Too often, these agencies exist because the executive directors resist the logic underlying consolidation in order to protect their own positions. State regulators may not be able to force mergers until there are problems, but both private and public grant makers are in a position to encourage consolidation.

To the extent that there are proposals that should be enacted into law, they should distinguish between large (hospitals, universities, and large cultural institutions) and small nonprofits.  Moreover, I would expect to see religious organizations seeking blanket exemptions, arguing that the regulation violates their First Amendment rights.  Before succumbing to that argument, legislators should test the assertion that the First Amendment imposes a limitation on regulation that is broadly applicable to nonprofits.  In the last several years, I have seen a lot of fraud in religious organizations--the latest being an alleged $8.6 million theft by two priests.  It is unclear to me why religious organizations should be exempted from good governance provisions given their abysmal track record.

Internal Revenue Service - Circular 230 Disclosure: As provided for in Treasury regulations, any advice (but none is intended) relating to federal taxes that is contained in this communication is not intended or written to be used, and cannot be used, for the purpose of (1) avoiding penalties under the Internal Revenue Code or (2) promoting, marketing or recommending to another party any plan or arrangement addressed herein.

THE FOREGOING IS NOT AND SHOULD NOT BE TAKEN AS LEGAL ADVICE. IF LEGAL ADVICE IS REQUIRED, THE NON-PROFIT OR OTHER PARTY IN QUESTION SHOULD SEEK THE ADVICE OF QUALIFIED LEGAL COUNSEL. If you liked this post, please visit http://www.charitygovernance.com for a description of our training and consulting services.  You will also want to acquire a copy of Jack Siegel's book, A Desktop Guide for Nonprofit Directors, Officers, and Advisors: Avoiding Trouble While Doing Good." Copyright 2006, Charity Governance Consulting LLC. All Rights Reserved. You may not copy any portion of this post to a computer "clipboard" for re-posting anywhere or e-mailing, or otherwise reproduce this post. If you want others to review this post, you may provide them with a link to this web blog. Any use of the material or ideas in this post by reporters or other publishers shall make reference to Jack Siegel, author of "A Guide for Non-Profit Directors, Officers and Advisors: Avoiding Trouble While Doing Good" and this web blog.  For additional information call 773-325-2124