How low can Sarbanes-Oxley Section 404 costs go? In the third year of compliance with Section 404, total average costs have dropped an additional 23 percent from year two, say respondents to an FEI survey. Financial Executives Research Foundation asks why and what more can be expected.

Normally, an increase in a company's share price is good news. For Atlanta-based Industrial Distribution Group Inc., such an event--which added more than $1 million to the company's public float--resulted in costing the company additional audit fees, since it caused its filing status under the Sarbanes-Oxley Act of 2002 to change.

On June 30, 2005, Karl Shin, director of internal audit for IDG, learned that his company had calculated its public float (unaffiliated share market capitalization) to be approximately $76 million. One of its key competitors had recently released favorable earnings, resulting in increased stock prices for both companies. Thus, that $1 million over the $75 million threshold changed its status from a non-accelerated to an accelerated filer under Sarbanes-Oxley. As an accelerated filer, the company's auditors would have to attest to its internal controls under Section 404 for 2005.

Shin expected that this day would eventually come, and he had already hired an outside staffing firm back in February to begin the arduous task of documenting internal controls. Now that the company was officially an accelerated filer, he hired a second staffing firm to document just the information technology (IT) controls and assist in its internal testing.

"We were an IPO roll-up of some smaller companies," recalls Shin, "and we had multiple systems. But we were proactive, beginning our documentation before we had to." Shin was in charge of the project, and knew he had the full support of management. IDG is a nationwide distributor of products and services in the maintenance, repair, operating and production (MROP) industry.

IDG passed its first Section 404 audit that year, but at a price. Shin realized that the best way to reduce the audit fees in future years would be to capitalize on efficiencies gained through reducing the number of its computer systems, because multiple systems require multiple sets of documentation, multiple testing and multiple audits.

The following year, however, the company got its chance to reduce costs. When faced with the challenge of deciding when to convert to one system, IDG opted to convert different regions of the company to a common operating platform at separate times. By the end of the year, however, the company was on one system, which led to a 50 percent decrease in Section 404 attestation fees from the previous year. Shin estimates that it will be able to reduce 2007 fees by another 40 percent.

[GRAPHIC OMITTED]

This decrease in audit fees at IDG is consistent with respondents to a survey of Financial Executives International (FEI) members, in which they were asked to quantify their 2006 Section 404 compliance costs. Of the 172 companies categorized as "accelerated filers" that responded to the survey, the total average year-three costs for Section 404 was $2.9 million, about 23 percent less than the prior-year average of $3.8 million.

Reduce the Number of Key Controls

Like Shin, Gary Kabureck, vice president and chief accounting officer of Stamford, Conn.-based Xerox Corp., an accelerated filer, found that his company's audit fees have decreased. Though Xerox has one more year of experience with Section 404 compliance (having filed in 2004, 2005 and 2006), it continues to benefit from the usual learning curve.

"We track our internal hours spent on Section 404 compliance," says Kabureck, "and we find that the number of hours required came down substantially in years two and three, mainly because we had completed a lot of the controls documentation in 2003."

However, the reduction in internal hours spent at Xerox was not just the result of the learning curve and previously completed documentation. Xerox rationalized the number of its key controls in 2005. Back in 2004, a lot of companies decided to err on the side of safety, so they set up duplicate controls, Kabureck recalls. Every control needs to be tested and audited each year.

Now, he says, those companies have found that not every control needs a back-up, and they were able to reduce the number of key controls. "At Xerox, we have also shifted a portion of our emphasis from transaction-level controls to entity controls, which further allowed us to reduce the number of our key controls," he explains.

And using fewer key controls does not necessarily result in greater risk. Kabureck explains that, "Xerox has a lot of business locations, so we look for locations that potentially could be at greater risk, even if they are not material to the overall business." Conceptually, he says, these might be locations that have had greater management turnover, could be undergoing local change events or involve a foreign unit that could be subject to Foreign Corrupt Practices Act risk. He says they spend more time looking at locations that might be considered riskier than others. "We use good business judgment about these matters, and we always ask 'If this was your company, what would you do?'"

So, after three years of accelerated filing, what benefits has anyone seen from Sarbanes-Oxley compliance? IDG's Shin says that his company is working smarter, and he provides three examples. First, everyone has to be more accountable. "Management has taken the certifications required by Sections 302 and 906 seriously," he says. Second, policies (such as those related to inventory cycle counts), that report names and even employee titles at various locations are more consistent. Finally, he says, "everyone is now held to a higher standard."

Kabureck says that Xerox now has a better accounting close process. "Our close is easier, quicker and has fewer surprises."

Measuring Benefits and Costs

At best, responses to the FEI survey were mixed as to whether the benefits exceed the costs. When asked whether the benefits of compliance with Section 404 have exceeded their costs, 78.1 percent disagree and 21.9 percent agree. Kabureck believes Xerox is somewhere in between. He says, "By the end of 2006, we were near a point of equilibrium, where the benefits began to approach the costs of compliance."

While Shin acknowledges the benefits of Section 404, he believes the costs are greater than the benefits.

Nick Sucic, vice president and controller for The Davey Tree Expert Co., concurs that costs are greater than benefits. Davey Tree is not listed on a public exchange. However, since it is employee-owned and has more that 3,000 shareholders, it is categorized as an accelerated filer. So, while in comparison to Xerox's 2006 audit fees of $23.7 million, Davey Tree's total audit fees of $461,900 may appear to be small, they represent a significant expense for the smaller company.

"What is absent today is any possible negotiation on audit fees," says Sucic. He says he has found internal efficiencies, but, from an audit perspective, he doesn't see any efficiencies in the process, "perhaps because our auditors are at the behest of the PCAOB [Public Company Accounting Oversight Board]." He says he finds that discouraging.

In its 2006 proxy statement, Davey Tree separately disclosed its financial statement audit fee of $267,400 from its Section 404 attestation fee of $154,000. Although he says the Section 404 fee has gone down due to a more integrated audit, Sucic points out that it will never get to zero.

Internal Control Standards Revisited

The cost and effort involved over the past three years no doubt has resulted in a revision of the standards created to support Section 404. On May 23, the U.S. Securities and Exchange Commission (SEC) approved interpretive guidance for management's assessment of internal controls over financial reporting. In a press release, SEC Chairman Christopher Cox said, "Companies of all sizes will be able to scale and tailor their evaluation procedures according to the facts and circumstances. And investors will benefit from reduced compliance costs."

In the same press release, SEC Chief Accountant Conrad Hewitt said that "while the guidance is intended to help public companies of all sizes, smaller companies, which will begin complying with Section 404 this year, should benefit from its scalability and flexibility." He added that the SEC had worked closely with the PCAOB to better align its guidance with the PCAOB's new auditing standard, Auditing Standard No. 5 (AS5).

The proposed SEC guidance--posted to the Federal Register on June 12, with comments due in 30 days--covers two broad areas, evaluation and reporting. When identifying financial reporting risks and controls, the guidance details an approach that allows management to identify controls and maintain supporting evidential matter in a manner that is tailored to their company's financial reporting risks.

Though this varies among companies, the rule notes that management's effort in subsequent years should be less. This is because subsequent evaluations should be more focused on changes in risk and controls rather than identification of all financial reporting risks and the related controls. Additionally, SEC Deputy Chief Accountant Zoe-Vonna Palm-rose has identified changes from the proposed guidance in three major areas: entity-level controls, ongoing monitoring and self-assessment, and fraud risk considerations.

The guidance has redefined material weakness as "a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis." Meanwhile, a significant deficiency is defined as a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight.

The SEC also approved rule amendments that confirm a company's internal control evaluation satisfies the annual evaluation required by Exchange Act Rules 13a-15 and 15d-15. Additionally, the guidance more clearly conveys that the auditor is not evaluating management's evaluation process but is opining directly on internal control over financial reporting.

For accelerated filers, like Xerox, IDG and Davey Tree, changes from the new guidance will be more subtle. "In many ways," says Kabureck, "we've [already] adopted what they've done." Shin says that AS5 doesn't say anything that AS2 didn't; rather, it just provides more examples and more clarity. "The reliance on work of others for walk-throughs is good, though," he quickly adds. In year one, he explains that there was just too much substantive testing. "Hopefully, AS5 will test a bit smarter."

Kabureck also points out that there will still be differences between SEC guidance and AS5. "Most prudent companies will study the AS5 requirements. AS3 also still governs audit documentation, which must be kept current--that hasn't changed with AS5." That said, there is still an opportunity to reduce costs--though it would appear that this is nearing its end.

While the full impact on existing internal control evaluations is still to be determined, one thing is certain--come the end of fiscal 2007, non-accelerated filers have to comply with Section 404. Kabureck advises these companies to invest their efforts in defining key controls. If controls are over-defined at a level that is too granular, he says, it will lead to a lot of extra work. "Define the controls up front and spend all the time you need on that."

CHERYL GRAZIANO, CPA ([e-mail]), is Vice President-Research and Operations and WILLIAM M. SINNETT ([e-mail]) is Director of Research, both with Financial Executives Research Foundation (FERF).

RELATED ARTICLE: TAKEAWAYS

* FEI members at 172 accelerated-filer companies that responded to FEI's latest Sarbanes-Oxley Section 404 compliance costs survey reported costs averaging $2.9 million; about 23 percent less than the prior-year average.

* In May, the SEC approved interpretive guidance for management's assessment of internal controls over financial reporting. SEC Chairman Cox said that companies of all sizes will be able to scale and tailor their evaluation procedures according to their particular facts and circumstances.

* Xerox VP and CAO Gary Kabureck advises non-accelerated filers--which will need to file by the end of fiscal 2007--to invest efforts in defining key controls up front.