Sentencing Rules Pressure CIOs
Accused CEOs could fire IS execs to avoid Sarbox punishment

Proposed sentencing guidelines for Sarbanes-Oxley Act violations, scheduled to take effect Nov. 1, bring risks for CIOs. While it's unlikely any CIOs would go to jail under the proposal, which awaits congressional approval, legal experts say the guidelines could set up CIOs to be the fall guys if another C-level executive faces conviction.

The proposed guidelines, published by the U.S. Sentencing Commission in its May 1 report to Congress, attempt to spread accountability for unethical or illegal behavior throughout a corporation. If any C-level executive, not just the CEO or the CFO, is responsible for such behavior, he can now go to jail. This isn't a big deal for CIOs—unless they're engaged in Enron-style fraud or they're charged with their company's Sarbanes-Oxley compliance efforts. Most CIOs aren't in charge of compliance (see "The Sarbox Conspiracy").

The risk for CIOs, says William Bierce, an attorney at Bierce & Kenerson, comes from sections of the guidelines that deal with crime detection. Companies that fail to detect behavior like accounting fraud have to hold someone responsible. Since most accounting is done through financial information systems, companies will rely on CIOs to catch problematic transactions. That makes the CIO responsible for detecting fraudulent actions.

The proposal contains a clause that says organizations can avoid punishment if they take "appropriate disciplinary measures" for "failing to take responsible steps to prevent or detect criminal conduct." If a CIO doesn't modify the company's financial system so that illegal or unauthorized transactions are prevented and so that it notifies him when an unusual transaction takes place, then he has failed to take responsibility. Deborah Birnbach, a lawyer with Testa, Hurwitz & Thibeault, says that a company accused of a Sarbanes-Oxley violation should insist that it took appropriate precautions. But if a CEO can avoid jail time by firing a CIO, you can bet your career he'll do it. —Ben Worthen