Most companies still have a lot more work before they are in compliance with Section 404 of the Sarbanes-Oxley Act, according to two new surveys.
They’re cutting it mighty close, considering that for many companies, Section 404 — which will guide how auditors report on companies’ assessments of their internal controls — becomes effective with their first fiscal year ending after November 15.
Software provider ACL Services Ltd. and the Center for Continuous Auditing found that nearly half of the companies they surveyed have not completed 60 percent of their preparations for addressing Section 404. In fact, of 248 senior audit professionals at U.S. corporations with more than $1 billion in revenues, 19 of the survey respondents said that their preparations are not even 20 percent complete.
And although 73 percent of all respondents are highly confident in their company’s ability to maintain Section 404 compliance after their first filing deadline, one-quarter are only mildly confident or not confident at all.
“The results of this survey reflect the concerns we have been hearing from the audit community,” said Harald Will, president and CEO of ACL Services, in a statement. “Many companies still maintain a short-term mindset when addressing the ongoing requirements set forth in Sarbanes-Oxley, despite recognition of the benefits of ongoing and continuous monitoring of internal controls.”
And in a study of 152 CFOs and managing directors of U.S. businesses, PricewaterhouseCoopers found that 79 percent of surveyed executives say their company must make improvements to comply with Section 404.
Respondents to PwC’s study said that the areas most in need of remediation are financial processes (55 percent), computer controls (48 percent), internal audit effectiveness (37 percent), security controls (35 percent), audit committee oversight (26 percent), and fraud programs (24 percent).
In addition, while 64 percent said that their senior management and board of directors see Sarbanes-Oxley as one of many steps in a larger corporate governance initiative, 30 percent said it is simply a goal to be achieved.
Another notable finding from the two studies: Despite all the complaints about the high costs of meeting these new regulatory requirements, many companies don’t keep tabs on them very well. In the PwC study, 56 percent of respondents said their company does not track the costs of Sarbanes-Oxley and other compliance programs and report on them internally. And the ACL-CCA survey found that 67 percent of companies have no annual budget for Section 404 compliance after the initial filing requirement.
“Given the early outcry about Sarbanes-Oxley’s added costs, it’s surprising that most companies do not document and track this expense,” said PwC partner Dan DiFilippo, in a statement. “However, many companies have only recently begun to understand the types of costs and value associated with compliance efforts. We expect more aggressive monitoring as companies examine the effectiveness of their compliance approach.”