Everyone thought the Sarbanes-Oxley financial disclosure Act would require CIOs to perform heroic feats of integration, spend fortunes on software and invest enormous amounts of sweat equity. Now, with the law reinterpreted, only the last appears to be true.

Reader ROI

• How and why the Sarbanes-Oxley Act evolved
• Why CIOs can now breathe more easily
• What nontechnological steps CIOs are taking to ensure compliance

In the US, Congress responds to public outrage by passing legislation.Hence, the Sarbanes-Oxley Act, forged in the flames of the WorldCom, Tyco and Enron scandals. The Act was intended to protect investors from executive fraud by requiring stricter standards for - and more oversight of - corporate accounting. As written, it's far-reaching - covering everything from who can sit on a board of directors to penalties for mistreating corporate whistle-blowers. And complying with it is potentially very expensive and time-consuming. When President George Bush signed the Act into law in July 2002, corporate executives held their breath, waiting to see how the Securities and Exchange Commission would interpret it. (The law itself isn't as important as how the SEC chooses to apply and enforce it.) When the SEC proposed a strict interpretation three months later, they gulped. But when the SEC issued its final rule on the most important section of the law last June, they exhaled.

What You Thought (and What Was Widely Reported) No Longer Applies.

A year ago, everyone was afraid of Sarbanes-Oxley. It looked as if companies were going to have to spend millions automating everything from ledger balancing to revenue accounting. Compliance promised to become a new cottage industry for software vendors. Now, it appears none of that need happen. Somewhere between the time the law left the President's desk in July 2002 and the SEC's issuance of its final rule in June 2003, Sarbanes-Oxley, or Sarbox, or Sox, as it is variously and colloquially known, lost some of its teeth.

Of course, it can still bite. Companies will be forced to document their processes and change some of them. And compliance will still carry a price tag. But thanks to the final rule, CIOs will not have to confront the challenges and expenses of automation.

"You have to have adequate controls - not automated controls," says Joseph Hearington Jr, corporate director for internal auditing at Universal, a $US2.6 billion tobacco company. "We have a combination of automated and manual, and that works for us. Our challenge isn't to reinvent the wheel, but to make sure we can prove that what we have works."

This is very different from what everyone thought - and from what the vendors and the technology press have been (and in some cases still are) saying and reporting. As recently as this past spring, articles continued to tell CIOs that technology is necessary to achieve Sarbanes-Oxley compliance and that their IT departments were directly in the line of fire.

The section of the Sarbanes-Oxley Act responsible for this furore is 404, which requires that both CEOs and CFOs test and attest to the effectiveness of their companies' internal controls. While the October 2002 SEC proposed rule did not elaborate on how effective "effective" needed to be, it made it perfectly clear how seriously it took Section 404 by interpreting internal controls in the broadest way possible. The proposal targeted "the company's entire system of internal controls, rather than just its internal accounting controls".

Most experts applied the same thoroughness to the rest of the section, including that tricky word effective. The only way to guarantee that a control is 100 per cent effective, said the prevailing wisdom, was to remove the possibility of human error. A conservative reading of the SEC's proposal, says Irwin Kishner, chairman of the corporate law department at Herrick, Feinstein, a firm whose clients include Bridgestone/Firestone and Hollinger International, would have outlawed the manual processes that bridged the gaps between automated systems - for example, reconciling financial data from multiple systems in a spreadsheet. Automating each of these processes would have cost companies millions and kept CIOs busy for years.

The reaction from affected companies (which was just about every company) was understandably negative, and what followed was a serious outbreak of politics.