I've spent six weeks arguing that rules change what organizations are required to do — but rarely change what they are. Today I'm arguing against myself, because every argument deserves a fair fight against its best counterexample.
The strongest one I know is Sarbanes-Oxley (SOX) Section 404. And the case is real. It didn't ask firms to describe their internal controls — it required the controls to exist and survive an independent audit. Two decades later, the infrastructure it forced into existence — control documentation, testing regimes, audit committee muscle — is simply how public-company financial reporting works now. Coates and Srinivasan's review of more than 120 studies (Accounting Horizons, 2014) found the institutions SOX built survived intact and reporting quality appears to have improved. If my thesis were "regulation never changes organizations," SOX would break it.
But the same review cuts back the other way on three fronts.
Causal attribution is weak. Reporting quality rose after SOX, but the research can't cleanly separate the rule's effect from everything else that changed after Enron and WorldCom — including the scared-straight effect of watching two giants implode.
The costs fell disproportionately on smaller firms — so heavily that Congress permanently exempted thousands of smaller companies from the audit requirement. The mandate that worked was also the mandate a large share of firms were eventually excused from. Capacity determined who could even afford to be changed by it.
And the part of SOX that worked was precisely the part that couldn't be satisfied with paperwork. The certification and disclosure provisions — the say-something parts — produced exactly the boilerplate this series has been documenting for six weeks.
So the honest scorecard: regulation can change what organizations are — when it mandates capability, verifies it independently, and the regulated firms can bear the cost. That's a narrow gate, and most rules never attempt it, because that kind of rule is expensive, slow, and fought at every step.
My argument survives — but it comes out more precise than it went in. That's what counterexamples are for.
No. 010 in the Threshold Effects series. First published on LinkedIn, August 19, 2026.