Growing costs of internal controls

Compliance with SarbanesOxley Section 404 on reporting on internal controls over financial reporting is far more difficult than originally envisioned, according to a survey of 120 Sarbanes-Oxley project leaders at a January conference hosted by PricewaterhouseCoopers. Identifying and evaluating internal

control deficiencies is among the most difficult steps to compliance in preparing for management assertion. Three-quarters of respondents reported a significant increase in effort compared with their original estimates of work required to comply. The following areas are causing the most difficulty, according to the conference survey: level of testing needed, level of documentation needed, and evaluating and identifying deficiencies. The major problem areas are manual controls over significant transactions, computer controls, not including security, and security controls. Nearly 90 percent of companies were investing in new technology for compliance. More than half reported that their management and board perception is that SarbanesOxley compliance is a necessary cost of doing business, and 95 percent of respondents expect their companies to meet the Section 404 compliance deadline. The first companies required to comply are those with fiscal years ending after June 15, 2004.