Ask FERF (financial executives research foundation) about ... Sarbanes-Oxley Implementation Guidance.

The Financial Executives Reserach Foundation (FERF) article on page 63 makes it clear that the jury is still out on whether or not increased regulation will bring about substantive changes in detecting fraud. In the meantime, with an onslaught of rulemaking from the Securities and Exchange Commission, Public Company Accounting Oversight Board, Financial Accounting Standards Board and International Accounting Standards Board, there are many questions about compliance and costs.

FEI Section 404 Implementation Survey: Cost Estimates Rising. In response to numerous inquiries about implementation costs for Sarbanes-Oxley Section 404 compliance, FEI conducted a survey of members from public companies during January, and received responses from 321 companies--with some striking findings.

The largest U.S. companies expect to spend an average of 35,000 hours to adopt Section 404, and incur an increase of 38 percent over current audit fees. Companies expect to document an average of 80 percent of their processes and expect external auditors will test an average of 57 percent of those processes.

Following an FEI survey in June 2003, which focused on a narrower population, the latest survey contains the broadest and most up-to-date information on estimated Section 404 implementation costs derived from senior financial executives from companies ranging from less than $25 million in sales to over $5 billion.

The results are striking--not only in terms of implementation costs, but also since the estimates have, in some cases, as much as doubled in less than a year--as implementation efforts have gotten further along.

Key findings on implementation efforts include average increases of:

* 12,265 internal people hours

* 3,059 external people hours (software consultants, other accounting firms); an estimated $732,100 for external services

* 38 percent incremental increase in current audit fees

* $592,100 incremental additional cost due to auditor attestation.

And, although the required implementation date of fiscal years ending on or after June 15, 2004 is soon approaching, the survey found that a significant number of companies are still in the early stages of deploying permanent tool solutions: Twenty-five percent have already deployed, 52 percent plan to deploy during 2004 and 10 percent plan to deploy after 2004. However, almost 14 percent have no specific plans to implement a solution tool at this time.

The complete survey is on FEI's Web site: www.fei.org/news/404_survey.cfm.

The Public Company Accounting Oversight Board (PCAOB) has received 189 comment letters on its proposed internal control standard. The standard and comment letters are available on PCAOB's Web site: www.pcaobus.org/pcaob_rulemaking.asp.

Users' key concerns are the costs of implementation and little emphasis on internal audit work. As proposed, the rule is effective for fiscal years ending on or after June 15, 2004. Many companies plan to go through a dry run attestation in the quarter preceding their fiscal yearends. However, as this article went to press, a standard had not been finalized, making it difficult for companies with fiscal year-ends between June and August.

A briefing paper that provides an interpretation of the proposed guidelines has been published by PricewaterhouseCoopers. "Management's Responsibility for Assessing the Effectiveness of Internal Control Over Financial Reporting Under Section 404 of the Sarbanes-Oxley Act" can be accessed from FEI's Web site: www.fei.org/down/oad/PWC_1_21_04.pdf.

The PwC briefing paper identifies two components of material misstatement risk: inherent risk, defined as the susceptibility of misstatement, and fraud risk, which is due to fraudulent financial reporting or misappropriation of assets.

The brief also discusses identification of company-level controls, relevant financial statement assertions and significant processes and determination of what business units should be evaluated and which controls should be tested.

Financial Executives Research Foundation (FERF) has developed useful resources that analyze compliance:

"Sarbanes-Oxley Act of 2002--A Financial Executive Checklist," provides a high-level summary of requirements with links to related SEC regulations.

"Best Practices for Sarbanes-Oxley Implementation and Sarbanes-Oxley Section 404 Implementation Discussion with FEI Companies," provides a benchmark on what leading FEI companies are doing.

"Technology Tools for Sarbanes-Oxley Compliance," reviews the technological requirements of many companies and how some vendors can fill those needs.

An executive report on Section 404 implementation is in development. Check the Web site for current titles. All FERF publications are available at the FERF bookstore: www.fei.org/rfbookstore/.

To comment on or participate in publications, contact Research Director Cheryl de Mesa Graziano ([e-mail]).

contributed by FERF