There is some evidence that good corporate governance produces direct economic benefit to the organization. One study, conducted at Georgia State University and published in December 2004, found that public companies with independent boards of directors have higher returns on equity, higher profit margins, larger dividend yields, and larger stock repurchases.(1) This study was consistent with another study of 250 companies by the MIT Sloan School of Management which concluded that, on average, businesses with superior information technology (IT) governance practices generate 25 percent greater profits than firms with poor governance, given the same strategic objectives.(2)

Although the Sarbanes-Oxley Act of 2002 applies almost exclusively to publicly held companies, the corporate scandals that gave rise to that legislation have increased pressure on all organizations (including family-owned businesses and not-for-profit organizations) to have better corporate governance. Private and not-for-profit organizations may feel pressure from lenders, insurance underwriters, regulators, venture capitalists, vendors, customers, and contributors to be Sarbanes-Oxley compliant. In addition, some courts and state legislatures may by analogy apply the enhanced corporate governance practices developed under Sarbanes-Oxley to private and not-for-profit organizations. Finally, a few provisions of Sarbanes-Oxley do affect private and not-for-profit organizations, such as the provisions relating to criminal liability for document destruction and for retaliation against whistleblowers.

Nonprofit organizations are not immune from scandal. Even before there was an Enron, there was the scandalous bankruptcy of AHERF (the Allegheny Health, Education and Research Foundation), a nonprofit organization. The scandals involving The Nature Conservancy, the United Way of the National Capital Area, and PipeVine, Inc., attest to the need for not-for-profit organizations to have at least the perception of good corporate governance. On August 16, 2005, it was reported in The Wall Street Journal that Cornell University Medical School agreed to pay $4.4 million in connection with fraudulent U.S. Government claims that allegedly occurred as a result of Cornell's failure to pay attention to a whistleblower who was a member of the Cornell faculty.

Private companies that intend to seek capital from financial institutions and institutional investors should also be sensitive to their corporate governance image, since this image is an important factor in the ultimate decision to provide capital to the organization. Family-owned private companies benefit from good corporate governance by avoiding the devastating effects of sibling rivalry and expensive litigation between family members who have different views concerning the business.

Is Perception Important?

The perception of good corporate governance is an important ingredient of the image of an organization, whether public, private, or nonprofit.

For example, when The Nature Conservancy, a not-for-profit organization, was perceived to have poor corporate governance, the public contributions to this organization were substantially reduced.(3) Private, including family-owned, companies that have a poor reputation for corporate governance are less likely to be welcomed at financial institutions and will appear less attractive to venture capitalists and private equity funds. Some investment and private equity funds will not purchase the securities of public companies that have low corporate governance ratings.

A perception of unethical conduct by an organization can be very costly in legal cases. For example, a Texas jury rendered a $253 million verdict against Merck & Co. in August 2005 in the first Vioxx case. A factor in the jury verdict was an in-house training game for Vioxx sales representatives called "Dodge Ball." The plaintiff's attorney was able to create the impression that this was a game that encouraged Merck sales representatives to dodge questions from doctors about the safety of Vioxx, despite the denials by Merck's witness.(4)

Practical corporate governance

Practical corporate governance is the process of developing cost-efficient corporate governance structures for an organization and instituting "best practices" by weighing costs against benefits. This is accomplished by analyzing specific risks of the organization, making cost-benefit judgments, and utilizing the lessons of past corporate scandals. It rejects the mindless "check-the box" mentality of corporate governance rating groups and some major accounting firms. Rather, the focus is on specific risk analysis, a cost-benefit analysis, and learning from the past.

The implementation of Section 404 of the Sarbanes-Oxley Act of 2002 is a classic example of "impractical" corporate governance. Section 404 requires (among other things) that independent auditors attest to the internal controls of public companies. This requirement imposed a huge cost burden on public companies because it spawned an expensive "check-the-box" mentality among major auditing firms. A Securities and Exchange Commission (SEC) commissioner reported that one auditing firm found 60,000 "key" internal controls at a single company!(5)

As initially interpreted, Section 404 was not tailored to specific organizational risks and did not require a cost-benefit analysis. Public companies were forced to incur inordinate expense in complying with Section 404 and had to divert their internal audit efforts into compliance with mind-numbing documentation requirements that were intended to prevent low-level management frauds, even though the major frauds that forced the adoption of this requirement were the result of top management manipulations. Moreover, Section 404 created a monopoly for major auditing firms since only independent auditors could attest to the internal controls. This tie-in of auditing and attestation services permitted monopoly pricing by major auditing firms; a public company was in effect forced to change independent auditors in order to obtain competition in the pricing of the Section 404 attestation services, and many companies were reluctant to do so.

In May 2005 (and again in November 2005), the SEC and the Public Company Accounting Oversight Board (PCAOB), to their credit, recognized some of the problems engendered by their own rules and permitted a top-down, riskbased approach to internal controls, rejecting the "check-the-box" analysis.(6) As a result of this regrettable episode, corporate governance unfortunately received an undeserved bad reputation as being synonymous with huge costs and little corporate benefit.

Is corporate governance costly?

Good corporate governance can be performed in a cost-efficient manner by focusing efforts on the significant risks facing the organization rather than attempting to cover any possible theoretical risk, and by installing the best cost-efficient practices within the organization. Resources must be concentrated in areas that have the greatest potential benefit, such as improving the corporate culture and establishing an effective internal audit function. Creating an ethical, law-abiding culture provides the greatest benefit for the organization compared to the relatively minimal cost of establishing such a culture. The benefits of good corporate governance, by avoiding governmental investigations, lawsuits, and damage to the reputation to the organization, should significantly outweigh the cost of good corporate governance.

The benefits of good corporate governance are longer term, whereas the costs of good corporate governance are incurred in the short term. Executives who are focused on short-term results may see only the costs and not the benefits. Consequently, management tends to be skeptical of incurring these costs and tends to do no more than is legally required.

Boards of directors must be sensitive to management's skepticism of good corporate governance. Incentives must be provided to management for accomplishing specific corporate governance goals. These goals should include, at a minimum, the creation of an ethical, law- abiding corporate culture and the establishment of an effective internal audit function that monitors management on financial issues as well as operational issues. If the board's compensation incentives to top management are focused solely on "hitting the numbers," the board must share the blame with management for any subsequent scandals involving cooking the books.

Directors should also weigh the costs of good corporate governance against their own personal liability. In January 2005, 10 former directors of WorldCom agreed to contribute $18 million of their personal funds, which amounted to 20 percent of their combined net worth, as part of a $54 million settlement with the bankrupt corporation's shareholders.(7) Similarly, 10 former Enron directors agreed to pay $13 million of their own funds, roughly 10 percent of their profits from selling Enron stock, toward the total $168 million settlement of shareholder claims.(8) In 2004, a former chairman of Global Crossing personally contributed $30 million to a securities/ERISA (Employee Retirement Income Security Act) class action settlement.(9)

Can you rely on the outside auditor?

Many audit committees rely almost exclusively on the outside auditor in performing their task of monitoring management and providing good corporate governance. Unfortunately, there is a serious disconnect between what directors believe the outside auditor is responsible for and what the outside auditor believes. Given the large number of corporate scandals that have occurred at organizations audited by a "Big Four" auditor, it is difficult to understand how any board of directors can place exclusive reliance on its auditor.

Excerpts from the statement of Mel Dick, the engagement partner responsible for Arthur Andersen's audit of WorldCom, to the Committee on Financial Services of the U.S. House of Representatives, follow. These excerpts should cause all boards of directors and their audit committees to reexamine their exclusive reliance on the outside auditor.

Chairman Oxley, Congressman LaFalce, Members of the Committee:

"I am Mel Dick. I am a graduate of the University of South Dakota. Upon graduation in 1975, I joined Arthur Andersen as a staff auditor. I was a partner at Andersen until I left Andersen on June 1 of this year. I have spent the majority of my career working with diverse telecommunications companies.

The Chairman's letter of invitation, faxed to my attorney on the night of July 3, states:—This hearing will focus on the recent announcement that WorldCom overstated profits and understated liabilities in the amount of $3.9 billion.

The Chairman's letter refers to the disclosure by WorldCom on June 25 that approximately $3.1 billion in expenses were improperly booked as capital expenditures in 2001 and an additional $797 million of expenses were improperly booked as capital expenditures in first quarter of 2002. The newspaper reports that I have read allege that senior financial management at WorldCom improperly transferred line costs expenses to capital accounts in the company's accounting records.

Let me state clearly and without any qualification that, prior to June 21, 2002, when Andersen was first contacted about this matter, neither I, nor to my knowledge, any member of the Andersen team had any inkling that these transfers had been made.

In fact, in connection with our quarterly reviews for March 31, June 30 and September 30, 2001, our year end audit at December 31, 2001 and our quarterly review for March 30, 2002, the Andersen audit team specifically asked WorldCom senior financial management whether there were any significant top side entries. On each occasion, management represented to Andersen that there were no such entries.

The fundamental premise of financial reporting is that the financial statements of a company—in this case WorldCom—are the responsibility of the company's management, not its outside auditors. WorldCom management is responsible for managing its business, supervising its operational and accounting personnel, and preparing accurate financial statements. It is the responsibility of management to keep track of capital projects and expenditures under its supervision. The role of an outside auditor is to review the financial statements to determine if they are prepared in accordance with Generally Accepted Accounting Principles and to conduct its audit in accordance with Generally Accepted Auditing Standards, which require that auditors plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. [Emphasis added.]

Our audit and our reviews of WorldCom were performed by experienced audit professionals. Our audit plan was the product of a deliberative and diligent evaluation of a global telecommunications company with over $100 billion in assets.

As with any audit, we planned our audit of WorldCom in general reliance on the honesty and integrity of management of the company. One of the key elements of evidence all auditors rely upon are management's representations. As all auditors do, we also tested and, based on our tests, concluded that we could rely on the company's management processes and internal controls, including the internal audit function. We relied on the results of our testing and the effectiveness of these systems in planning and performing our audit. At the same time, we approached our work with a degree of professional skepticism, alert for potential misapplication of accounting principles. [Emphasis added.]

Additionally, we performed numerous analytical procedures of the various financial statement line items, including line costs, revenues, and plant and service in order to determine if there were any significant variations that required additional work. We
also utilized sophisticated auditing software to study WorldCom's financial statement line items, which did not trigger any indication that there was a need for additional work.

In performing our work, we relied on the integrity and professionalism of WorldCom's senior management, including Scott Sullivan, WorldCom CFO and David Myers, WorldCom Controller, and their staff. [Emphasis added.]

If the reports are true that Mr. Sullivan and others at WorldCom improperly transferred line cost expenses to capital accounts so as to misstate the company's actual performance, I am deeply troubled by this conduct. In addition, if reports are true that WorldCom's internal auditors discovered these entries, I would be very interested to know how and when they discovered these entries.

I do not know the specifics of what Mr. Sullivan did or directed others at WorldCom to do, and I have not had the opportunity to review the entries that are at issue here. I understand that Mr. Sullivan has acknowledged that he never told Andersen about the accounting he is said to have employed.

At this point, however, while I can explain our general approach to the WorldCom audit and explain generally the work that we did, I do not have enough information to comment on the entries that WorldCom senior financial management are said to have made, or how they were hidden from the Andersen auditors . . ."(10)

Although the Auditing Standards Board has, since WorldCom, enhanced the duties of the auditor to detect fraud in Statement of Accounting Standards (SAS) No.99 (effective for audits beginning after December 15, 2002), it is not clear that auditors no longer have the right to assume that management is honest. SAS No. 99 does state in Paragraph .13:

The auditor should conduct the engagement with a mindset that recognizes the possibility that a material misstatement due to fraud could be present, regardless of any past experience with the entity and regardless of the auditor's belief about management's honesty and integrity. Furthermore, professional skepticism requires an ongoing questioning of whether the information and evidence obtained suggests that a material misstatement due to fraud has occurred. In exercising professional skepticism in gathering and evaluating evidence, the auditor should not be satisfied with less-than-persuasive evidence because of a belief that management is honest.(11)

The quoted language from SAS No. 99 does not specifically state that the auditor has no right to assume that management is honest. While the quoted language does not completely repudiate the position stated by Mel Dick, it is helpful in enhancing the responsibilities of the auditors to detect fraud.

From Corporate Governance Best Practices: Strategies for Public, Private, and Not-for-Profit Organizations (Wiley, Sept. 2006). Excerpted with permission.

ENDNOTES

1. Lawrence D. Brown and Marcus L. Caylor, "Corporate Governance and Firm Performance," Georgia State University, December 7, 2004, http://papers.ssrn.com/sol3/papers.cfm?abstract_id=586423.
2. Weill, IT Governance: How Top Performers Manage IT Decision Rights for Superior Results. (Boston: Harvard Business School Press, 2004). 
3. Stephens et al., "Senators Question Conservancy's Practices," Washington Post, June 8, 2005.
4. Berenson, "Some Pointed Questioning at the Vioxx Trial in Texas," New York Times, July 19, 2005.
5. Speech by SEC Commissioner Paul Atkins before the Securities Regulation Institute in San Diego, California, January 19, 2006, www.sec.gov/news/speech/spch011906psa.htm.
6. Commission Statement on Implementation of Internal Control Reporting Requirements," May 16, 2005, www.sec.gov/news/press/2005-74.htm, "Policy Statement Regarding Implementation of Auditing Standard No. 2, an Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements," Public Company Accounting Oversight Board, May 16, 2005, PCAOB Re. No. 2005-009, May 16, 2005.
7. "WorldCom Execs to Pay $18 million," CBSNews.com, January 7, 2005, www.cbsnews.com/stories/2005/01/07/national/main665522.shtml?CMP=ILC-SearchStories.
8. White, "Former Directors Agree to Settle Class Actions," Washington Post, January 8, 2005.
9.  Morgenson, "Global Crossing Settles for $325 Million," New York Times.com, March 20, 2004, http://select.nytimes.com/gst/abstract.html?res=F20D14FA3A550C738EDDAA0894DC404482.
10. Remarks of Melvin Dick, United States House of Representatives, Committee on Financial Services, July 8, 2002, financial services.house.gov/media/pdf/070802md.pdf. 
11. American Institute of Certified Public Accountants, "Statement on Auditing Standards No. 99: Considerations of Fraud in a Financial Statement Audit," (AICPA, 2002).