SOX, Accountability, and Responsibility

Dear Bob …

In response to your Keep the Joint Running titled “Confidence or accountability – pick one” there’s a new wrinkle — SOX.

With all of the new audits, policy and procedure drills, the mindset of Control just flourishes.  And blind, rote compliance to the Letter of the SOX Laws seems to add a generous scoop of “growth stimulant” to the mix.  Instead of enjoying the fruits of our labors we get tangled up in choking weeds.

Right now, there are standing committees to review every aspect of every task our group works on.  I have always demanded that we have good specifications, clear documentation, fall-back procedures etc. for everything we develop.  Now we have people who make certain that reams of checklists and status reports are filled out and stored in on-line folders.  Nobody ever reads them for content.  We could easily adapt that old NASA program from the 60’s that randomly built reports from stock phrases and use it to create these documents and no one would ever know.  However, if the audit control checklist does not have every box checked by someone that performs multiple inventories (with status reports) on the project folder, the project does not go to production.

In our current culture of SOX-CYA the emphasis is on compliance to an abstract form, not on how well a product performs or if it can be maintained.  It reminds me of a client I had back in the 70’s.  He thought that if the data collection/input form didn’t have any blank entries, it was good.  By only rejecting data forms that had blanks, he kept his quality count artificially inflated and his manager happy.  Unfortunately, that person had the attitude of believing everything in the computer.  For him, GIGO turned into Garbage In, Gospel Out.  You can imagine what that did to the credibility of the systems and the confidence the rest of the organization had in how we did our work.  It took years of forcing in proper audit routines and client education to turn that around.

When did we replace good judgment with paranoia and an unwillingness to take responsibility?

– Rhetorical questioner

Dear Questioner …

It’s an interesting point. SOX is a beautiful example of having to impose accountability because nobody would otherwise take responsibility. From what I know about Sarbanes-Oxley, it’s what you’d expect when you take a bunch of fundamentally sound principles and ask a collection of attorneys-turned-legislators to put them into practice.

Imagine how things would have turned out had everyone involved in the fiascos that led to SOX taken responsibility instead (and make no mistake: Taking responsibility is the polar opposite of holding people accountable, since one is internally driven and the other is externally imposed).

Instead of rationalizing the practice of using internal audit business to sell consulting, thereby creating a conflict of interest, the accounting profession would have created the “Chinese Walls” necessary to maintain their own integrity. And CEOs would have taken the steps necessary to get the accurate numbers they need to run their companies well, instead of taking the steps necessary to create illusions for Wall Street (and themselves).

It’s a self-inflicted wound. To answer your question, we replaced good judgment with avoidance of responsibility when we decided the sole responsibility of the corporation is to “increase shareholder value.” With no other responsibilities – like customer, employee, community and environmental interests, and professional standards – to counterbalance this one-dimensional business driver, it’s unsurprising the system is out of control.

– Bob