Here's a fascinating panel discussion in on the theme: Sarbanes-Oxley: The Good, The Bad, The Ugly".

In the discussion, Morrison & Foerster partner Jordan Eth describes it as the "new CYA (cover your ass) world".

"Used to be everyone was together in the boat, trying to move it forward. Now, they've got employees who are whistleblowers, you've got management getting subcertifications, people saying, "I'm relying on you, at the shipping dock. You'd better be really careful, or else you're going to be sued, where I'm covered by insurance. Indemnification. You've got all those fun questions. You've got the board and the management now. Board has its lawyers and the audit committee has its lawyers and management has its lawyers."

And fraud is still occurring. "The idea behind Sarbanes-Oxley is that now we would have this new era when everyone complies, and all this money is going to be great, we're going to spend it all on internal controls. It'll be terrific. You know how many securities class actions get filed against companies every year? Roughly 200. You know how many before Sarbanes-Oxley? Roughly 200. You know how many before the reform act? Roughly 200...Are you getting deterrence from the SEC? Well, you have more SEC actions than ever. That means there's more fraud than ever? Probably means you have more cops than ever, is what it really means. And you have new litigation risks."

The discussion also has former SEC commissioner Joseph Grundfest saying that the rules around Section 404, where management must certify it has reasonable internal controls to ensure there's no misstatement, are not cost-effective. Not only that, they are vague, ambiguous and result in armies of auditors being sent out to look for things have low probabilities of causing material events.

While on the subject of 404, a Public Company Accounting Oversight Board report has identified a host of problems implementing the section.

"The board found that both firms and issuers faced enormous challenges in the first year of implementation, arising from the limited timeframe that issuers and auditors had to implement [Sarbanes-Oxley Act] Section 404; a shortage of staff with prior training and experience in designing, evaluation and testing control; and related strains on available resources."

The report also called on auditors to use more judgment when assessing companies for risk and devising appropriate audits.

Don't hold your breath. With a section as vague and ambiguous as that, audit judgement sounds easier in theory than it is in practice.