"A lot of companies are girding themselves for the challenge," says James Haddad, vice president of corporate finance at $1.4 billion Cadence Design Systems in San Jose, Calif. and chairman of the Association of Financial Professionals' financial reporting committee. "And it's not an insignificant one, given the uncertainty that still exists" about many of the new regulations.

Here are some of the trickier hurdles, identified by executives and their advisers, to surmount:

THE SIGN-OFF BY CEOs AND CFOs

Probably the biggest amount of work facing companies relates to the section of Sarbanes-Oxley that requires CEOs and CFOs to sign off on their company's quarterly financial statements. Executives who knowingly sign off on financials that contain a false statement are subject to fines or jail time. With that in mind, many companies are constructing a more precise paper trail for their procedures for compiling financial information in order to give the CEO and CFO more confidence that they can rely on that data.

Companies "have to set up procedures, so that senior officials are comfortable that effective processes have been used and [the calculations] can all be documented, both externally and for the audit committee," says David Becker, a former SEC General Counsel who's now a partner at law firm Cleary Gottlieb Steen & Hamilton in Washington, D.C. "What's happening is the whole disclosure process is becoming more formalized."

This kills two birds in a sense since Sarbanes-Oxley also requires that CEOs and CFOs sign off on the company's internal controls once a year, and the SEC has now stipulated that they do so every quarter. This extra regulation gratis the SEC particularly rankles companies and is criticized as burdensome and unnecessary.

Klafter of Santa Clara, Calif.-based Intel says that his company has always had controls in place to ensure the accuracy of its financial reporting. But now that the CEO and CFO have the sign-off, the company has set up "a series of controls evaluations meetings" to give the two executives a chance to hear reports from the staff members who put the data together and ask questions about the data before signing off every quarter. The process "necessitates going down the chain to ensure that everyone who is reporting up in turn has his or her documentation in order," he says.

Some companies have even extended the sign-off process, so that staff members preparing financial data sign off on what they're submitting.

Klafter characterized the effort of preparing for the executive sign-offs as the most time-consuming task related to Sarbanes-Oxley and added that those meetings will continue to require time every quarter.

THE AUDITOR'S SIGN-OFF

But if you think it is hard to get your CEO and CFO feeling comfortable about the numbers and how they were calculated, just wait until it's the auditor's turn. Still licking their wounds in the wake of Enron, WorldCom and you name the scandal over the past year, auditors are feeling particularly vulnerable and skittish. The demise of Arthur Andersen LLP was more than just a wake-up call about the need for diligence, and most executives expect auditors to put finance departments through a few sets of rings of fire before agreeing to approve their internal controls. Outside auditors "are going to have their own testing requirements, they are going to have their own demands for levels of documentation," Intel's Klafter says. "There is going to be a whole other layer of auditing and review that is going to come from the independent auditors."

Rick Fumo, a senior vice president of practices at Parson Consulting in Chicago, predicts that the process of documenting internal controls will be a "massive effort, especially for multinationals." Companies will have to identify their risks and the controls on those risks to be sure that they've got the right numbers and that those numbers end up in their financial reports, he says.

And let's not forget that making the process as complex as possible is in most audit firms' interest, to some degree, given that inevitably this extra effort will be reflected in the audit bill for services rendered.

Wayne Kolins, national director of assurance at BDO Seidman, a Chicago-based accounting company, notes that "audits in the past did not require that internal controls be certified.This requirement could add 10%, 15%, 25%, 50%, 100% to the audit fee on some jobs," Kolins says, adding that the impact on the fee "depends on the size and the sophistication of the company…a large company with great controls and great documentation is looking at a smaller percentage increase." In general, he expects a "20% to 25% increases in fees" as a result of the internal controls measure.

EXECUTIVE LOANS

A big source of concern for companies has been Sarbanes-Oxley's ban on company loans to executives. The law's language is broad enough not only to prohibit those huge loans that WorldCom was reportedly making to Bernie Ebbers, but to call into question such common corporate arrangements as relocation loans to executives, the cashless exercise of options, borrowing from a 401(k) plan or putting a personal charge on a corporate credit card while on a business trip and reimbursing the company later. "It's ridiculous. An executive takes a business trip. He takes a spouse with him or her [and] uses the company credit card. That's a prohibited loan," says Gary Apfel, a Los Angeles-based partner at law firm LaBoeuf Lamb Greene & MacRae.

Apfel argues that Congress never intended the loan prohibition to ban transactions like the cashless exercise of options or occasionally putting personal expenses on a company credit card. But because the law was enacted in haste, "there wasn't enough time to vet the language," he says. "It's a law of unintended consequences."

In the absence of any advice from the SEC, companies have been looking at all their practices that could fall under the loan prohibition and consulting their lawyers. In October, a group of 26 big law firms put together a memo on best practices for loans in the wake of the legislation. But Richard Susko, a partner at Cleary Gottlieb Steen & Hamilton, one of the law firms that participated in the memo, warns that it provides only guidelines. Companies still have to carefully examine each situation and the facts involved, he says. "The cashless exercise of options, the split-dollar life insurance, even reasonable personal use of credit cards and reasonable personal advances–you need to fly spec each transaction."

Susko says, for example, that he thinks outright loans to relocate are "a problem." He suggests that companies could instead give an executive a bonus equal to the interest on the loan that executives will now be forced to get on the outside. The incidental personal use of corporate credit cards is probably all right, he says. But Apfel says he knows of some companies that have put in place prohibitions against charging any personal items on company credit cards.

The loan prohibition could be an impediment to companies going public, Susko notes, if the company has outstanding loans to its executives. Sarbanes-Oxley has a grandfather provision, but that wouldn't apply to privately held companies, and Susko notes that Sarbanes-Oxley's prohibition "comes into play on the date the registration [to go public] is filed with the SEC."

THE BOARD

There's also concern about Sarbanes-Oxley's requirements for boards of directors, which are expected to create a wave of desertions from corporate boards. In addition to mandating that all audit committee members be independent, it gives that committee more power and responsibility and dictates that one audit committee member should be a "financial expert." The SEC's original definition of a financial expert suggested employment as a CPA was necessary to qualify, which set off quite a clamor as companies worried that there wouldn't be enough former CPAs to go around. But in mid-January, the SEC broadened its definition of financial expert to include work as a CFO, chief accounting officer, controller or "other relevant experience."

Executive search firms say the new rules have already resulted in more turnover on boards, and they expect that to continue. This is on top of board defections prompted by significant increases in shareholder and employee class action litigation aimed specifically at directors and officers. "One level of turnover has been stimulated by the requirements," says Paul Ray, vice chairman and board practice leader at A.T. Kearney Executive Search. "And some people who have been on boards have opted to get off them as a result of the regulations and increased pressure."

Ray adds that while there are still plenty of people interested in serving on boards, more and more people "look at being on a board much more carefully and with greater scrutiny than they did before, simply because of the liability associated with it. An increasing number of people are reluctant to [serve], particularly on the audit committee."

David Schneider, the CEO of Lexecon Inc., an economics consulting firm, says Sarbanes-Oxley "is raising the stakes at the individual director level. [Board members] are raising the question, 'Should I be on this board? Do I have enough time, do I have something to contribute, and if not, should I be here?'"

Companies have also expressed concern about publicly identifying the audit committee's financial expert for fear that person would become a prime candidate for these lawsuits. There's a sense that the audit committee's added responsibilities, which include the direct oversight of outside auditors, will make all of its members more likely targets for litigation, although it's not clear that legally they are any more liable.

To ensure some stability and help recruit the best, Julie Daum, the head of the U.S. board-member practice at search firm Spencer Stuart, says it's possible that companies could begin paying audit committee members more than other directors. She says the companies she works with are divided into two camps. One side contends that "The audit committee is working harder right now than other board committees, and they should be compensated for that," Daum says. The other claims that "a two-tiered board with two different pay scales" would undermine the board's unity.

Still, even with these kinds of debates raging, Daum says, companies know they must reconsider board compensation and may need to offer a sweetener of some sort to get qualified people to consider taking on the new workload.

The New World Order

So how are companies likely to respond to Sarbanes-Oxley's substantial challenge? For large publicly traded companies, there is little question: They have to work hard to get into compliance–at least for the first year or two. Since there will inevitably be a debate over what is full compliance, most experts don't expect companies to look for shortcuts or loopholes just yet.

For small and midsize companies, the new law raises a bigger question: Should companies even remain public? In fact, the challenges presented by Sarbanes-Oxley have already persuaded some companies to pack it in and go private.

NetLojix Communications, a Santa Barbara, Calif., company that manages networks and LANs, announced on Dec. 30 that CEO Anthony E. Papa and President James F. Pisani would buy the firm for about $260,000, or two cents per share. "Of course, you have to say that our president and CEO chose to make an offer to buy the company with the share price at a low," says Greg Wilson, controller at NetLojix. But Sarbanes-Oxley was also a factor, he says. "We just heard from our auditor, Faber & Hass, a Ventura, Calif.-based firm, that their auditing costs will be going up some 30% to 40% next year" because of the new law.

"Obviously, with all the changes in the laws, the cost of going private seems less significant," adds Wilson, whose firm took in about $15 million in revenues in 2002, down from $20 million in 2001.

And NetLojix is not alone in its decision. Amar Budarapu, chairman of the U.S. securities practice group of Baker & McKenzie, a Dallas law firm, says his firm is "actually working on a growing number of going private transactions. I personally have three [transactions] in the works," he says. "All of the partners are working on them." Budarapu adds that the companies involved are generally smaller ones that will be hardest hit by increased costs involved, such as for auditing fees. "For a small company, raising the budget by $100,000 is serious," he says. "It takes a number of months to go private, so I think you'll see this trend more clearly later this year," Budarapu adds.

That's at home. Overseas, this kind of shying away from U.S. public markets isn't restricted to such small companies. Sarbanes-Oxley has been discouraging major foreign companies from listing in the U.S. Japanese giants Daiwa Securities Group Inc. and Fuji Photo Film Co. Ltd., along with Germany's luxury car maker Dr. Ing. h.c. F. Porsche AG, have all either abandoned or delayed planned U.S. listings since the law was passed. "A lot of foreign companies are saying, 'We don't want to list,'" notes Budarapu.

To give this problem dimension in terms of market impact, consider that the New York Stock Exchange alone listed 470 non-U.S. companies at last count, with a combined global market cap of $3.8 trillion, or about 30% of the total exchange.

Indeed, there may also be a problem in reverse since some new U.S. requirements will now differ from or, more importantly, conflict with the laws of other nations. Independent audit committees are almost unheard of at many European and Asian companies. In Europe and Japan, outside auditors are chosen by shareholders, not the audit panel as required by Sarbanes-Oxley. In Germany, the source of some of the loudest complaints over the new U.S. laws, supervisory board audit committees must include employee representatives, who by definition aren't independent. It was this rule that finally made Porsche decide against a U.S. listing.

After the proposed regs were released, the European Commission threatened retaliation. In response, the SEC partially backed down in late January, with the final release of rules implementing sections 406 and 407. The commission granted temporary exemptions for foreign issuers and proposed alternate rules which would not require foreign companies to disclose whether auditors were independent.

In a statement read aloud by Mario Monti, the EU's commissioner for competition, at the recent World Economic Forum in Davos, the EC applauded the SEC's concessions as "important reliefs" and "a step in the right direction," even though the regs are not even in their final form yet. "We feel that many of our comments have been taken into account," the EC statement further noted.

But clearly, this is not a full-fledged solution, given the recent efforts towards creating a global corporate accounting system and more unified regulations. From a U.S. investor's point of view, it could also discourage investment in European companies. From a U.S. company's perspective, it gives its European rivals an unfair advantage since they have to meet fewer costly regulations and disclose less.

Damper on M&A

Apfel of LaBoeuf Lamb says Sarbanes-Oxley is also likely to discourage mergers and acquisitions near term because acquiring companies will be worried about whether target companies have adequate internal controls or other problems that the new law will bring to light. "It's having a stifling effect on deals," Apfel says. "How do companies get comfortable on the buy side that they're not inheriting all kinds of Sarbanes-Oxley problems? People are trying to get their arms around that, what kind of due diligence or additional representations and warranties are needed."

What may be even more frustrating is the fact that some wonder, for all the work involved, whether Sarbanes-Oxley's requirements will do the trick in terms of restoring investor confidence. "We're being asked to provide more transparency, which is a good thing, but the average investor is confused," says Haddad, the Cadence vice president and AFP committee chairman. Both companies and investors, he says, "will have to try to understand all the new information that is coming out of this tidal wave of regulation."