Michael Decker

London Bridge

SOX fan

Good analysis - SOX is not about stopping fraud, it's about accountability. It's about finding out who did what, when - and who knew about it.

Clever systems such as AXOS and Cryoserver can now pin down exactly where a piece of information was at any minute of any day going back decades, but the article's spot-on in spotting the 'compliance hole': an employee/manager/director could nip out to an internet cafe, go to a public phone, or even drop bulky brown envelopes in the mail.

No internal IT systems are going to pick up that activity - but that's not the point! SOX puts in place criminal penalties for all sorts of business activity which was previously promoted as 'good governance' by otherwise sensible US law and accountancy firms- e.g. 'automatically destroy all your emails just in case someone calls them as evidence'. Even one of the largest UK law firms had an internal policy until quite recently of electronically shredding their own email after six months, and they’re by no means unique - crazy when you think how many contracts are made/altered via email, and when you consider that contract disputes aren't time-expired for at least six years. If the other side has kept their emails, and you haven't, you'd better reach for your pen to write a very large settlement cheque. And if you wilfully destroyed potential evidence you'd better get used to talking to the wife and kiddies through plexiglass. That's if you still have a wife after the HUGE fine that will cost you your house....

Like the article says, it's about raising the bar. And putting people *behind* bars now and again has a VERY healthy effect on raising standards of corporate governance.