Private companies, nonprofits can't ignore SOX

By Marv Balousek

Executives of private companies or nonprofit organizations still may be breathing sighs of relief that most of the Sarbanes-Oxley Act of 2002 doesn't apply to them.

But it's time to stop sighing.

While it's true that the federal legislation stemming from corporate scandals such as Enron and Arthur Andersen is aimed mostly at publicly traded companies, are spreading rapidly to both private companies and nonprofits.

"They're kind of becoming a standard on how you should govern a company," said Brian Anderson of the Axley Brynelson law firm in Madison, who advises private companies and nonprofits. "A lot of companies haven't had (internal controls) in place, and a lot of this is being driven by donors or banks."

New York and California are among the states considering legislation to extend the requirements of Sarbanes-Oxley, or SOX, to private companies and nonprofits.

Anderson said two aspects of the federal law that apply directly to private companies are records retention and whistleblower protection. Whether public or private, companies are required to keep all records that may someday be related to a federal investigation. They're also required to make it safe and easy for employees to report wrongdoing.

SOX requirements have tempted some public companies to go private, but that may not be such a good idea, said David Brophy, director of the Center for Venture Capital at the University of Michigan.

In a white paper produced by RMS McGladrey, a business services firm, Brophy said private companies must be SOX-compliant if they ever want to be a public company, sell out to another company, issue public debt or deal with a venture capital or private equity firm.

SOX has been a boon for large accounting firms, but smaller firms and software companies are cashing in too. One reason is that the standards require one accounting firm for conducting audits and one for establishing internal controls.

Dan Andersen, a partner with the public accounting firm Virchow Krause, agrees. "Our work has been assisting the management of some large corporations. All of these companies already had internal controls, but none of their internal controls were documented. It's meant a lot of business for certain CPA firms that are not the company's auditor."

Internal controls, for example, ensure that more than one person is involved in writing checks, purchasing, making deposits and bookkeeping.

"There is a natural extension to nonprofits," Andersen said. "The more they function with an independent board, the more you will see the influence of Sarbanes-Oxley filter into those companies."

Johnson Block & Co. is a smaller Madison accounting firm that doesn't work with many public companies, but company president Millard Johnson said SOX is having an effect on the firm.

"If someone's looking to become public down the road, of course, it has a direct impact," he said. "It just seems like there's greater awareness that private companies and governmental units have to be more careful how they do things."

Software companies also are benefiting from SOX. Brian Anderson of Axley Brynelson said whistleblower software allows people with one click to file a complaint with a third party out of reach of a company's managers.

Since 1995, Devesys, a Madison software company, has produced software to track ethics complaints and legal violations. Now, the company is marketing its software as a SOX solution.

Steve Birchall, Devesys marketing director, said compliance with SOX standards requires more than a superficial commitment.

"Enron had a very good code of ethics," he said. "On the surface, it was the best."

madison.com ©2009 Capital Newspapers. All rights reserved.