CFRI examines 'year two' issues for section 404.

Now that U.S. companies have put the bruising work of "year one" on the Sarbanes-Oxley Act's Section 404 behind them and are underway on their year-two efforts, are things going to get any easier?

Probably, but as was brought out at FEI's Current Financial Reporting Issues (CFRI) conference in New York in November, there are plenty of potential headaches ahead. The much-ballyhooed section of the 2002 law requires public companies to develop an assessment, at the end of the most current fiscal year, of the effectiveness of a company's internal control structure and the procedures the issuer has in place for financial reporting.

This one section has been the most controversial, and most loudly protested, of the Sarbanes-Oxley (SOX) provisions, and research in the past couple of years has consistently shown that the hours spent on compliance and the ensuing costs have been far higher than regulators estimated. At some companies, compliance managers have been focused on little else in the past two years.

"Preparers [of financial statements] are struggling to find a balance between spending tremendous time and effort on SOX and running their businesses the best way they know how," FEI President and CEO Colleen Cunningham noted in her opening remarks of the two-day conference.

"Many say [the cost of compliance] has been excessive, and there has been healthy debate about how those costs could be lowered and how the process could become more streamlined," she added. "If there is good news on the cost side, it is in the finding from our own members that 85 percent expect their costs in year two for Section 404 to be lower, by an average of almost 40 percent, than in year one."

In a second-day panel discussion, "Section 404: Achieving Sustainability for the Future," a corporate accounting executive, a regulator, an accounting firm executive and the head of the Institute of Internal Auditors (IIA) examined some of the key issues around putting permanent compliance solutions in place.

Arnold Hanish, chief accounting officer for Eli Lilly & Co., noted that at Lilly, a new level of accountability has been created by having line managers report on changes they have made to the audit committee. He added that a "quality review" effort is underway to push sustainability, and that training would be provided where it was deemed necessary.

Hanish noted that Lilly executives had determined that they could probably do more to cascade training programs down through the company to enhance compliance.

Robert J. Kueppers, national managing partner for risk in the Professional and Regulatory Matters practice at Deloitte & Touche LLP, argued that the cost of 404 compliance is "becoming too much of a focus." Costs will drop in year two, he said, but a great deal of that will have nothing to do with assessments of internal controls by outside audit firms like his own. "This is a tremendous opportunity to improve business operations," he said.

David Richards, president of the IIA, argued that companies have struggled with an inability to decide which internal controls are truly important--the so-called "key controls"--and end up spending an inordinate amount of time testing all of those rather than look closely at their basic processes and pare the "key" list to a more manageable number.

Speaking to a widespread sense that outside auditors have become more cautious and less collegial with their clients--given that the Public Accounting Oversight Board (PCAOB) is now staring over their shoulders--Hanish said that many corporate executives believe auditor fees have been driven up by decisions by audit engagement leaders to send issues to their regional or national issues for review. Many of those issues, he said, would probably have been settled locally two or more years ago.

Laura Phillips, associate chief auditor for the PCAOB, conceded that the challenges facing companies were very real, especially in terms of resources--and that the compressed time frame for compliance "created something of a crisis environment." But she maintained that "a lot of deferred maintenance" has been accomplished, referring to improved internal processes that resulted from the work of 404 compliance teams.

Phillips agreed that costs should fall, and noted that "a lot of important control groups have been rectified or are in the process of being remediated." She added: "Overall, I think we're generally on the right track."