There is no doubt that Section 404, the section of Sarbanes-Oxley that requires documentation of compliance systems, has added significant costs, disproportionately hurting smaller companies. Since weak compliance systems lay behind several scandals - making it hard to bring cases against some big companies - getting something like Section 404 was inevitable. But because the legislation was rushed through without any cost-benefit analysis, American companies are paying the price big time.

While measures have been introduced to ease the burden, the most effective way of dealing with the problem is to use employees, says William Mitchell College of Law associate professor Thuy Vo. Instead of requiring management to assess the company's internal accounting activities, she says the company should be required to check its internal control environment by having employees evaluate Senior management's behavior and ethics.

In her paper, Lifting the curse of the SOX through employee assessments of the internal control environment, the author argues that it's better than just relying on auditors because management's reporting of a weakness in the company's accounting activities doesn't reveal the integrity of the organization. On the other hand, employees' reporting of a weakness in management's behavior and ethics, all done anonymously much like a hotline, can reveal a lot about the executives' standard of leadership and personal commitment to business integrity.

"Employees, by their insider access and exposure to executive action on a routine basis, can be the answer to our need to understand the way executives view their obligations to the company and its stakeholders, their faithfulness to the internal rules and structural mechanisms that they purportedly established and implemented, their philosophy about legal compliance, and their perspective about personal rewards and executive entitlement. The signals emanating from the executives' conduct in making routine decisions and resolving issues on an ongoing basis can be a strong indication, although admittedly not a guarantee, of how well their ethics and integrity will stand up when the challenging situations arise that test those values.

"Employee assessment of senior management's ethics and integrity should be conducted on a company-wide basis. The inclusion of the entire employee base assures a review of business leaders throughout the organization. Also, the survey needs to broadly cover the entire employee population in order to separate the idiosyncratic views from those that reflect the company as a whole. An independent party outside of the organization should be retained to review the survey responses and prepare a composite profile of senior management of the company without identifying specific employees. Using an outside third party to compile the employee responses provides a comprehensive view of the organization that is unbiased by internal agendas and politics. In these company-wide surveys, maintaining the anonymity of the employee making the assessment encourages frank reflection and disclosure. By ensuring confidentiality, the survey is more likely to be successful in soliciting details that can identify patterns of management wrongdoing and convey the ethical tone of the management group as a whole."

It certainly would be cheaper. But would it be effective?

The author acknowledges that employees might well have an incentive to under-report unethical activity because they would be reluctant to damage the company, and hence their jobs. The other problem is that most employees already have enough on their plate and that these sorts of surveys would just add to their workload, causing resentment and running into resistance.

Still, it's an interesting and unusual idea that might be worth looking at. Something needs to be done.