CA on Governance, Risk and Compliance (GRC)
- Insights and observations on happenings in the GRC market
Against a whole wave of financial scandals driven by fraudulent accounting practices that involved major US corporations such as Worldcom, Enron and Tyco, the US Senate and House of Representatives passed the Sarbanes-Oxley Act in 2002 to restore investor confidence and underwrite the integrity of financial information.
As a result, if you speak in the US about Corporate Governance, the answer will be immediately Sarbanes-Oxley Act (SOX). Consequently, the tendency has been to categorize any piece of internal control legislation as SOX. As an example, Japan’s Financial Instruments and Exchange Law has come to be widely known as J-SOX. Similarly, we’re hearing all kinds of talk about something called “EuroSOX.” In my opinion this is a misnomer and I will try to explain why.
We Europeans started our quest for corporate transparency and accountability in 1998 in order to create a single financial market across the EU (European Union), four years ahead of SOX.
In order put an end to the ‘Tower of Babel’ in financial reporting, improve competition and transparency and make the free movement of capital much easier, the EU decided in 2003 that all EU companies will have to prepare their consolidated accounts in accordance with International Accounting and Financial Reporting Standards (IAS and IFRS).
First, some terminology. “Subsidiarity” is a fundamental principle of EU law. According to this principle, the EU may only act and make laws where member states agree that the action of individual countries is insufficient. “Proportionality” is another fundamental principle of European law which states that the EU may only act to the extent that is needed to achieve its objectives, and not further.
Consequently, it is impossible for the EU to generate an overly prescriptive legislation such as SOX. The EU requires member states to achieve a particular result without dictating the means of achieving that result. This leaves member states with a certain amount of leeway as to the exact rules to be adopted.
SOX places the responsibility and accountability for the tracking of information that impacts financial performance very clearly upon the shoulders of the management teams of those businesses, with teeth that do bite – the CEO and CFO can be fined, go to prison for up to 20 years, or both.
France, although also adopting a legislative, rules-based approach, does not require an explicit statement from management or the board of its responsibility for the internal controls system.
Other jurisdictions focus on dividing responsibilities for establishing and maintaining the internal controls system between the board and the management of the company.
Many EU countries have opted for a comply-or-explain approach with varying degrees of strength. The comply-or-explain requirement generally obligates companies to comply with the provisions of a corporate governance code or else explain non-compliance.
As a consequence there are no pan-European requirements for specific internal controls and as a result, the “Euro” prefix should not be used.
Furthermore, the “SOX” suffix is not acceptable as there are at least as many differences as similarities between Sarbanes-Oxley and the various European legislations on related topics.
“EuroSox” is a commonly used term. But, it is misnamed and misused.
True — but also with translation into the language and laws of the 25 member states, it likely is not as draconian as SOX. Now that we are in the implementation phase, it will be interesting to see the country-specific educational efforts, given our current economic climate.
@A. Fairchild - Thanks for your comment. EU Member States have different legal systems and different legacy regulatory structures. As you said, there are also problems of language, both legal and common, which can result in critical words having very different meanings in different places. Even if the temptation to create a “best in class” mandate is resisted, and each country starts the process of implementation by attempting the literal transposition of a directive into national law, the results can still be very different.
For an example of how this plays out, take a look at the City of London’s three research papers, available on its website at the link below, about comparative implementations of EU Directives (Insurance Mediation Directive (IMD), Second Money Laundering Directive and Insider Dealing and Market Abuse directives).
Please Leave a Comment: