Profiting from Sarbanes-Oxley

An article on SmartMoneydiscusses the price performance of Resources Global Professionals a financial consulting company that has profited greatly from Sarbanes-Oxley. The company has been doing extremely well over the last 12 months and gives a solid forecast for the future:

But one comment sheds particular light on the company's continued success: "Fiscal 2005 saw the expansion of many client relationships with companies who initially became familiar with Resources for Sarbanes-Oxley compliance efforts, but have extended their work with us into other core business areas."

Cross-selling, in other words. And Resources is still doing plenty of compliance and audit work for foreign companies, as well as companies that are trying to resolve problems that initial audits uncovered. That reflects pretty cleanly an observation from CIBC analyst Thatcher Thompson that we mentioned in our last story, that "upfront compliance is revealing shortcomings at many companies that will involve other projects to fix."

I assume that this is also good news for the other accounting firms and consulting companies (althought the shares of Accenture have been basically flat for the past 18 months).

The next round of Sarbanes-Oxley may result in less work, but be more specialized. Deloitte in a recent newsletter stated the following:

Many financial institutions are evaluating next steps in their 404 programs. Some are sitting back and waiting until next year to repeat the cycle of testing and evaluation of their internal controls. Others are taking the lessons learned and using them to implement new processes and modify system shortcomings. For several reasons, we believe the latter approach is far more prudent.
First, Section 404 is more than a “pass/fail” test of controls. The misleading implication of viewing Section 404 in this way is that a firm that passes has nothing to worry about. But this might not be the case. A pass does not necessarily mean that all is right with a firm’s risk management program. By its nature, compliance and reporting can never be entirely fail-safe. 404 programs will require constant fine-tuning and vigilance.