SOX proves there are adults running the business. There are some bad parts of SOX, but most of it is good. Also, companies can define their own policies and standards under SOX, unlike say PCI where you must adhere to an industry standard. This means companies that are run well can make decisions about doing a user access review yearly instead of quarterly.
Yes - we punished 1,000’s of good honest companies for the deliberate misdeeds of a few bad apples. Terrible policy.
Those "few bad apples" caused the worst global recession since the Depression. Let's not minimize the circumstances that led to Sarbox.
Edit: This is wrong, see below.
I thought SOX came out of Enron and WorldCom which didn't have much to do with the 2008 recession?
Sarbox was enacted in 2002.
The 2007-2008 financial crisis led to Dodd-Frank, which is much more concerned with banking practices than public investment.