SOX 404 Compliance Costly
GRAND RAPIDS — For many public companies, compliance with Section 404 of the Sarbanes-Oxley Act has been a time-consuming and expensive endeavor.
Section 404 mandates that public companies evaluate and annually report on the effectiveness of their internal controls over financial reporting and that an independent auditor substantiate the effectiveness. It’s intended to strengthen corporate controls to prevent fraud and fraud’s negative financial impact on a company.
Large companies with fiscal years ending after Dec. 15, 2004, had to issue their first Section 404 report along with their Form 10K in March.
Small public companies with fiscal year-ends coming after July 15, 2005, must begin issuing a report on the effectiveness of internal controls in every annual report to come. So if a company’s fiscal year ends, say, in June, it has another year before it has to file Section 404 reports.
Mary Ellen Rodgers, Deloitte’s office managing partner in Grand Rapids, thinks Section 404 has clearly been the most difficult of SOX compliances to implement.
“Section 404 is what mandates companies to do reporting to their shareholders on their internal controls, so it has taken not only a significant amount of dollar resources but a huge amount of time on behalf of companies to be able to do the testing that is mandated in order to issue the 404,” she said.
Most companies, she said, have probably had to implement some kind of technology tool to allow them to monitor compliance, because documenting controls over every system and every location within a company would be an unwieldy process without implementation of some type of online tool.
The downside is that it has come at great expense to companies.
As Rogers explained, large companies that have already had to comply had a short timeframe within which to implement Section 404, and the requirements of implementation were huge.
“There wasn’t a lot of step-by-step guidance out there because it was new for everyone,” she recalled.Robert Herr, partner in charge of Crowe Chizek & Co.’s Grand Rapids office, recalls that “everybody was kind of feeling their way along” as the SOX rules, regulations and guidance were being formulated.
“It’s not as if somebody came out with a picture book that showed people how to do it. It has been very expensive for those that have had to do it — I think far more than perhaps all of us originally anticipated. Part of that is just because what they were supposed to do was unknown.”
At the end of the day, will the operational benefits outweigh the costs?
Financial Executives International recently surveyed 217 public companies with average revenues of $5 billion and asked about their Section 404 compliance costs.
The FEI survey, released in late March, revealed that the average cost of complying with the internal controls mandate has jumped to $4.36 million, an increase of 39 percent over 2004 estimates. The increase was attributed to increases in external costs for consulting, software and other vendors and to increased fees charged by external auditors.
According to survey results, some 55 percent of those polled indicated that Section 404 “gives investors and other external audiences more confidence in a company’s financial reports.” However, 94 percent of respondents said they believed the costs of Section 404 compliance exceed the benefits.
Comparatively, a survey of 220 business leaders conducted in December 2004 by RevenueRecognition.com and International Data Corp. suggested that while costs are significant on the front end, “there is proportional value once companies get through the full compliance process.”
The survey concentrated on costs for internal resources and outside consulting. It found that total resource requirements to support SOX 404 increased in direct proportion to the size of organization based on revenue.
“For public enterprises with more than $1 billion in revenue, the average amount of labor spent on compliance activities was more than 12-person years. Companies in the $200 million to $1 billion range averaged more than 6.5-person years worth of effort,” according to survey results.
Additionally, the survey indicated that the average cost of external auditing services increased 52 percent for public companies. Mid-sized companies with $200 million to $1 billion in revenue reported an 81 percent average increase.
Another national survey released in December 2004 indicated that most companies were seeing internal benefits from compliance. Oversight Systems Inc.’s 2004 Financial Executive Report On Sarbanes-Oxley Compliance queried 222 financial executives. While the majority of respondents had mixed feelings as to the cost vs. benefits question, 57 percent of them said SOX compliance was “a good investment for shareholders,” according to the survey.
Respondents reported the following benefits:
- 46 percent said SOX compliance ensures the accountability of people involved in financial operations and reporting.
- 33 percent said SOX compliance decreases the risk of financial fraud.
- 31 percent said they have fewer errors in financial operations.
- 27 percent reported SOX improvements in the accuracy of financial reports.
- 25 percent said SOX compliance empowers the board audit committee by providing it with more information.
- 20 percent claimed SOX strengthens investors’ views of the company.
“I think that most financial executives and CEOs would say that there is real benefit in documenting and testing internal controls,” Rogers remarked. She said most of the companies she has been involved with have really spent a lot of energy in tweaking their internal controls, strengthening in areas that need to be strengthened and, in some cases, eliminating duplicate controls.
As Herr sees it, 80 percent of companies were operating just fine and doing well before SOX came along.
“They had good controls, good systems, honest and ethical people … perhaps in a few cases, companies saw where they had little holes and could improve it and did improve it,” he said.
“They’re not going to make any more money because of that. Could it improve investor confidence, and therefore their marketability as a public company? Perhaps. I think the question of cost benefit to those 80 or 90 percent of the good companies in the country is still largely unknown. It is a huge unknown.”
Rodgers thinks there’s a benefit to the business when the whole topic of internal controls is discussed at the highest levels of the organizations.
“But I think it is yet to be seen if the cost of implementation will be fully recognized through operational improvements.”