Complying with Section 404 of The Sarbanes-Oxley Act will cost public companies an average 62 percent more than previously anticipated, according to a recent survey by Financial Executives International (FEI), the leading professional organization serving Chief Financial Officers and other senior financial executives. The increase in Section 404 compliance costs stems from a 109 percent rise in internal costs, a 42 percent jump in external costs and a 40 percent increase in the fees charged by external auditors.
In July 2004, FEI surveyed 224 public companies with average revenues of $2.5 billion to gauge Section 404 compliance cost estimates. Results showed the total cost of compliance is now estimated at $3.14 million*, or 62% more than the $1.93 million estimate identified in FEI's January 2004 survey. The companies surveyed expect to pay their auditors $823,200 in fees for attestation of their internal controls, in addition to the annual audit fees. This compares to the $590,100 companies expected auditors would charge for attestation in January 2004. The survey was conducted the week of July 19, and distributed to 3,088 companies, and drew a response rate of 13.8 percent.
"When we conducted our January survey, audit firms hadn't yet provided their clients with complete estimates for Section 404 work because the auditing standards had not been finalized," said Colleen Sayther, President and CEO of FEI. "Now that the standards are finalized and implementation efforts are further along, compliance costs can be more accurately determined."
As part of management's attestation process, the survey showed that companies are documenting internal controls for 92% of total revenue. The estimates on the cost of complying with Section 404, in terms of hours and dollars, have steadily risen over the last six months. Looking to the employee hours needed to be Section 404 compliant, public companies expect to spend an average of 25,667 internal hours (vs. 12,265 estimated in January) and 5,037 external hours (vs. 3,059). Companies also expect to spend an additional $1,037,100 on software and IT consulting.
"Audit firms have been entrusted to deliver value from Section 404," adds FEI's Sayther. "They have latitude in terms of the scope and depth of their work and should exercise care and judgment, and be cognizant of the cost-to-benefit ratio. However, compliance alone cannot be expected to produce higher levels of accountability or deter those from acting without integrity. That responsibility remains in the hands of senior management entrusted to set a proper tone at the top and act in the best interests of shareholders."
Section 404 of Sarbanes-Oxley requires each company's annual report to contain (1) a statement of management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and (2) management's assessment, as of the end of the company's most recent fiscal year, of the effectiveness of the company's internal control structure and procedures for financial reporting. Section 404 also requires the company's auditor to attest to and report on management's assessment of the effectiveness of the company's internal controls and procedures for financial reporting, in accordance with standards established by the PCAOB (Public Company Accounting Oversight Board).