Public companies have had to dig even deeper than previously estimated to pay the costs of complying with Section 404 of the Sarbanes-Oxley Act, according to a new survey by Financial Executives International (FEI).
Companies’ total costs for year one Section 404 compliance averaged $4.36 million, up 39% from the $3.14 million they expected to pay, based on FEI’s earlier July 2004 cost survey. The increase stems largely from a 66% leap in external costs for consulting, software and other vendors and a 58% increase in the fees charged by external auditors.
With March 16 as the general deadline for public companies to complete an assessment of their internal controls over financial reporting, FEI recently surveyed 217 public companies with average revenues of $5 billion to gauge Section 404 compliance costs.
Their total cost of compliance averaged $1.34 million for internal costs, $1.72 million for external costs and $1.30 million for auditor fees. The auditor fees are in addition to companies’ financial statement audit fees, on average 57% higher. (See table below for a comparison of actual costs to previously estimated costs and www.fei.org for more details).
Companies Say Costs Exceed Benefits
Just over half, 55%, of companies surveyed believe Section 404 gives investors and other external audiences more confidence in a company’s financial reports, and 83% of large companies (over $25 billion) agree. Significantly, however, 94% of all respondents said the costs of compliance exceed the benefits.
In general, companies applaud the added focus on internal controls, but many respondents believe that the level of detail required is impractical and bureaucratic. “The spirit was right on,” wrote a respondent. “However, the execution to the level of detail that was required was much more than necessary.”
“Now that we’ve gone through the first run of this mammoth compliance effort, it’s time to review what we have learned and identify ways to improve the annual assessment process going forward,” said Colleen Cunningham, President and CEO of FEI. “Essentially, Section 404 is well intentioned, but the implementation effort is guilty of over-kill.”
“FEI was one of the first business groups to support Sarbanes-Oxley, but we recommend a more efficient implementation of the existing rules,” continued Ms. Cunningham. “Going forward, we recommend that regulators allow auditors to rely on the cumulative knowledge gained from earlier 404 work, and not simply start from scratch when it is time to re-assess companies. Further, we suggest a true risk-based audit approach that defines key controls, allowing for auditors to obtain a reasonable assurance of the integrity of a company’s systems.”
Back to the Future
When asked about year-two costs, 85% of respondents said they expect non-auditor expenditures to decrease (by an average of 39%), and 68% said they believe the costs of their primary auditor will also decrease (by an average of 25%).
In order to improve the effectiveness and efficiency of the Section 404 process, companies identified the following top recommendations (more than one answer permitted):
?? Allow for a more risk-based audit approach (71%)
?? Reduce degree of documentation (66%)
?? Provide flexibility for remediating control problems in Q4 (60%)
?? Increase judgment allowed in aggregating deficiencies (55%)
?? Permit roll-forward procedures (54%)
About Sarbanes-Oxley Section 404
Section 404 requires each company’s annual report to contain (1) a statement of management’s responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and (2) management’s assessment, as of the end of the company’s most recent fiscal year, of the effectiveness of the company’s internal control structure and procedures for financial reporting. Section 404 also requires the company’s auditor to attest to and report on management’s assessment of the effectiveness of the company’s internal controls and procedures for financial reporting.
Year One Costs of Sarbanes-Oxley Section 404 Compliance
|
March 2005 |
Estimated in July 2004
|
Estimated in January 2004
|
|
Internal Costs* |
$1,337,935 |
$1,283,385 |
$ 613,250 |
|
External Costs |
$1,716,987 |
$1,037,100 |
$ 732,100 |
|
Auditor Attestation Fees
|
$1,301,050 |
$ 823,200 |
$ 590,100 |
|
Total |
$4,355,972 |
$3,143,685 |
$1,935,450 |
* Internal costs assumes full-time professionals (at 2,000 hours per year) at a compensation rate
(salary plus benefits) of $100,000 per year.
