Red tape or a chance to drill deep and find opportunities? That's the choice thrown up by Section 404 of Sarbanes-Oxley which holds managers responsibile for internal controls and requires auditors to check those controls and form an opinion. This stuff can be absolutely critical for investors who want to know first whether there are shortcomings, and secondly whether these are material. It also forces the company to ask what's the best way for keeping the market informed. But of course, all this comes at a cost. According to estimates from the Controllers' Leadership Roundtable, the average company on a turnover of less than $5 billion required an extra 6,285 audit hours to meet the SOX rules. The internal auditors have to test all the internal controls. Then the external auditors come in to see everything is up to scratch. The result: plenty of SOX-bashing. But as the Wall Street Journal's Alan Murray points out, all the bitching and moaning is because CEOs are now working in a very different world. Regulators, shareholders, trial lawyers, ambitious attorneys general and boards are giving them more heat than ever before, and Sarbanes-Oxley is only part of a much broader picture. Murray's piece has been republished here. But as BusinessWeek points out, the smart companies are using compliance to cut costs and clean up unwieldy processes.While we're on that point, it's worth checking what the consultants at McKinsey say about linking regulation to strategy. The McKinsey piece does not deal directly with Sarbanes-Oxley but it shows how changing the response from confrontation or passive compliance to proactive dialogue can open new business opportunities. For instance, the wave of regulation banning junk food and improving labelling creates potential markets for smaller players focusing on healthy foods. Similar opportunities exist in the environmental and pharmaceutical areas. Handled properly, the regulatory environment can allow the company to drill down to the kind of detail that allows it to see opportunities and put in new systems.