Section 404: delayed and examined

Internal Auditor, April, 2004 by C. Brune

ON FEB. 24, THE U.S. Securities and Exchange Commission (SEC) pushed the U.S. Sarbanes-Oxley Act of 2002 Section 404 compliance dates back from June 15 to Nov. 15, 2004. The new schedule applies to accelerated filers--generally U.S. companies with a market capitalization exceeding $75 million--who must comply with the requirements for their first fiscal year ending on or after the deadline. Non-accelerated filers have even longer to comply: They must meet the requirements for their first fiscal year ending on or after July 15, 2005, a three-month extension from the original April 15 deadline. The SEC also delayed these requirements for registered investment companies. The extended compliance deadlines give registered companies extra time to prepare and become acquainted with developing guidance on Section 404.

The costs and preparatory work associated with Section 404 compliance have been a top concern for many U.S. internal audit organizations. A recent survey of more than 320 U.S. public companies revealed that large public organizations--those with more than $5 billion in annual revenues--are planning to spend more than $4.6 million in their first year to comply with Section 404. Estimated costs are driven by factors such as internal labor, external consulting and software expenses, and additional audit fees.

Conducted by Financial Executives International (FEI), an association serving senior financial executives, the survey found that participating organizations expect to:

* Need an average of 12,265 additional internal work hours and more than 3,050 external service hours, excluding auditor attestation work.

* Spend from $170,000 to $1.4 million for external consulting, software, and other vendor charges, not including annual auditor attestation fees.

* Spend up to $1.5 million in auditor attestation fees.

* Document up to 80 percent of their company's internal control processes.

* Document processes that cover up to 92 percent of total company revenues. (One in five companies indicated they expected to document 100 percent of their operational processes.)

* Document internal control processes at an average of 79 percent of their physical locations.

* Have their external auditors test an average of 57 percent of the company's processes. (Smaller companies expect the auditors to test 42 percent of their processes on average.)

At the time of the survey, only 25 percent of responding companies had implemented a permanent solution for Section 404 compliance; 52 percent planned to deploy a solution during 2004; and nearly 14 percent of the companies had no specific plans to implement a permanent compliance solution.

Another recent study of 100 major companies examined the ways in which businesses are preparing to comply with Section 404. Conducted by Ernst & Young, Emerging Trends in Internal Controls looked at a variety of issues, including companies' level of effort for initial implementation and compliance, the establishment of a core project management office, the appropriate size and makeup of a project team, and the technology enablers being used. Respondents were also asked to describe the stage at which their companies were in the implementation process and whether they were on schedule.

Key findings include:

* 70 percent of surveyed companies plan to incur more than 10,000 work hours, with 36 percent budgeting for more than 25,000 hours.

* The average Section 404 project team comprised between 11 and 50 people.

* Many companies have not yet selected a specific vendor to provide technology support and are using basic word processing, spreadsheet, and flowcharting software until they make a companywide decision.

* Most companies surveyed were at the stage of completing their internal control documentation.

For additional information about the Sarbanes-Oxley Section 404 compliance dates, visit the SEC Web site at www.sec.gov and select press release number "2004-21." Visit www.fei.org to view the complete FEI survey questions and results. To obtain a copy of the Ernst & Young survey, visit www.ey.com.