In this article, the author considers the recent shift towards a formal corporate governance regulatory framework, and reflects on the future direction of regulation. The author explores the potential for corporate norms to be the ultimate source of corporate governance regulation. It is argued that empirical data on the formal governance measures introduced recently through the Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley" or "SOX") supports the contention that norms are overall more effective than formal rules in regulating corporate governance. Energy should be directed at developing, nurturing and promoting positive norms inside the corporation, rather than automatically jumping on the formal regulation bandwagon.