Compliance; Poll: most won't find 404 burdens easing.

The burden of Sarbanes-Oxley Section 404 compliance hit companies hard in year one, but a recent survey confirms what many in the market have been saying--year two will not provide the efficiencies organizations had hoped for. The survey by ACL Services Ltd. and the Center for Continuous Auditing (CCA) reports that only 40 percent of these organizations already have, or plan to, automate the testing of their controls this year; that leaves nearly 60 percent of the companies to continue the struggle to find the skilled resources necessary to test the myriad of internal controls present in any large organization.

More than 95 percent of companies polled in the survey report that a "reduction of staff time and associated costs to test internal controls" are central to maintaining effective Section 404 compliance. The poll of 247 senior audit professionals at corporations with more than $1 billion in annual revenues looked at the serious challenges organizations face in making their Sarbanes-Oxley compliance efforts sustainable.

An overwhelming 92 percent of respondents identified the importance of enabling timely and effective management insight into controls deficiencies, giving further credence to the fact that sustaining Section 404 compliance is a top-of-mind concern for audit and financial management. In addition, more than 80 percent of the audit executives cited the need for faster, more effective identification and correction of inappropriate transactions, and deemed increased investments in technology solutions designed to continuously monitor controls to be important.

"The results of this survey mirror much of what we heard last year," says Harald Will, president and CEO of ACL, a Vancouver, B.C.-based provider of business assurance analytics technology for audit and controls professionals. "Many companies still maintain a short-term mindset when addressing the ongoing requirements set forth in Sarbanes-Oxley, despite recognition of the benefits of ongoing and continuous monitoring of transactions for the purposes of assuring internal controls," he adds. "And while internal auditors are overwhelmingly in favor of adopting the technology and best practices of continuous monitoring and auditing, organizations frequently don't seem ready or willing to back them up."

"Continuous monitoring of controls is a management function and part of the organization's control structure in accordance with COSO (Committee of Sponsoring Organizations) best practices. Auditors, on the other hand, use continuous auditing processes to test transactions and identify anomalies and to test the continuous monitoring processes of management," says J. Donald Warren Jr., director of the CCA. "The combination of these continuous processes provides management with timely information to take corrective action when a control deficiency is identified, as well as providing assurance to management on the effectiveness of the company's internal control environment."