Home > Compliance Management News > Ex-SEC chief Pitt decries state of Sarbanes-Oxley and risk management
Compliance Management News:
EMAIL THIS

Ex-SEC chief Pitt decries state of Sarbanes-Oxley and risk management

By Alexander B. Howard, Associate Editor
05 Jun 2009 | SearchCompliance.com

Enterprise IT news roundup
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google

Former Securities and Exchange Commission Chairman Harvey Pitt, who once led the implementation of the Sarbanes-Oxley Act (SOX), now does not have much good to say about it.

More compliance resources
FAQ: What is the impact of Sarbanes-Oxley on IT operations?

What is a compliance audit?
Pitt spoke on Thursday at the Compliance Week 2009 conference in Washington, noting that a decade has passed since Enron and WorldCom created the impetus for Sarbanes-Oxley. Pitt observed, however, that such laws are nearly always designed to address the last corporate crisis, ignoring that corporate failures are "like bugs that adapt to DDT" -- or regulatory oversight.

"SOX was hastily and badly drafted," he said. "[What it described] was all already illegal … but it was important in showing the country wouldn't stand for this kind of behavior. If SOX was really effective, would we have seen the subprime crisis in corporate America?"

He added that he does not see Sarbanes-Oxley genuinely assisting organizations with their governance efforts in the present, either. "I believe it's generally ineffective. Lawyers and companies approach SOX with a 'check the box' mentality. Success requires that you get behind the requirements, understand why they're there and implement the concept, not the literal words."

Pitt was equally blunt about the current state of the regulatory system and risk management.

"Eventually, we're going to have to reform our regulatory system," he said. "It's badly broken and doesn't address major problems. It would be much better to have a comprehensive game plan. Government has to be able to function deftly, swiftly and agilely when unexpected problems arise."

In his view, reflecting the strong undercurrent of expectation flowing through the conference this week, it's now "inevitable that more regulation will come, forcing companies to be more ethical, more compliant and overall better corporate citizens."

Every corporate employee bears responsibility for recognizing problems, and responsibility for addressing them internally.
Harvey Pitt
former chairman, Securities and Exchange Commission
With the new century "not even a decade old," the nation has already seen an "astounding cavalcade" of corporate malfeasance, Pitt said. In the past, he described corporate watchdogs who "merely watched." Risk management was "pushed to the side." There were "failures at all levels." Now, "every corporate employee bears responsibility for recognizing problems, and responsibility for addressing them internally."

Pitt framed the issue in the context of "The Sarah Pitt Syndrome." His mother, described as a "self-medicating health nut," endured stomach pain for two years before she made it to the doctor. In his assessment, businesses can't afford to similarly ignore issues until a crisis arises. As he sees it, business has been following a pattern of "reverse laissez faire." That's meant that they've sat back and "waited for government to tell them what must be fixed and then are shocked when they don't like it."

He kicked off his speech by focusing on the importance of history. In his view, "The single greatest mistake of business is avoiding the necessity of looking at all operations to identify issues before they evolve into a crisis."

So, given that, what is American business -- and the CEOs, CIOs, chief technology officers and CCO who are anticipating such regulation -- supposed to do? Pitt distilled his advice to what he termed a "simple" insight: "Businesses need to acknowledge that their success depends on their ability to adapt and thrive under corporate Darwinism."

Let us know what you think about the story; email: Alexander B. Howard, Associate Editor



Tags: SOX and other public company compliance requirementsRisk management and complianceManaging governance and complianceVIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google



RELATED CONTENT
SOX and other public company compliance requirements
Discovery process puts onus on electronic records management tools
Electronic discovery critical to health of company, IT organization
Business model risk is a key part of your risk management strategy
Financial crimes resulting in increased compliance enforcement
Chapter excerpt: The Three Core Disciplines of IT Risk Management
Leveraging your business intelligence resources for compliance
Kill-switch bill would add certification, licensing burdens
Enforcement date for FACT's Red Flags Rule approaches
Economic downturn won't kill regulatory compliance projects
FAQ: What is the impact of Sarbanes-Oxley on IT operations?

Risk management and compliance
FTC compliance mandates new rules for social media marketing
How to design an FTC compliance program for social media marketing
GPS devices, geolocation data create privacy, security risks
Threat management for information systems relies on categorization
Mass. data protection regulation passes big test in public hearing
Does using ISO 27000 to comply with PCI DSS make for better security?
FTC pursuing HIPAA violations as a matter of consumer protection
Are mandatory business continuity management standards good business?
PCI DSS compliance requires better management of vendor risk
PCI DSS compliance requires new vendor management strategy

Managing governance and compliance
Priorities for your sound regulatory compliance management policy
Threat management for information systems relies on categorization
HITECH FAQ: What is the impact of the HITECH Act on IT operations?
Survey shows privacy policy success lies in collaboration with IT
Record locator service a step to health information exchange
U.S. CIO Vivek Kundra on Data.gov, OpenID and government transparency
Nonprofits are working to maintain donor trust with PCI compliance
Mass. data protection law requirements amended, deadline extended
Security and privacy top IT agenda for Massachusetts CIO
The Web of social media and compliance: Online privacy regulations

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
IT controls  (SearchCompliance.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary

HomeNewsTopicsITKnowledge ExchangeTipsBlogsMultimediaWhite PapersProducts
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts