Compliance Week Survey On Key Controls

Section 404 is undoubtedly one of the most talked about provisions of the Sarbanes-Oxley Act. Many have complained about the burdens and the costs of complying with the section. The SEC has continually extended the compliance deadline for smaller companies.

A new survey by Compliance Week (a news letter focused on corporate governance) to be published today suggests that most public companies have made the necessary improvements to their internal controls, requiring few changes going forward. This result suggests that Auditing Standard No. 5 may not be of as much assistance as anticipated in streamlining SOX compliance procedures, according to a Compliance Week release.

SOX Section 404 requires that companies assess their controls and that auditors sign off on the effectiveness of those controls. As a company reduces the number of key controls – those used to ensure that the company financial reporting processes are timely and reliable – it simplifies its financial reporting processes, reducing the chance of error and costs. According to the Compliance Week survey of nearly 300 public companies, nearly three quarters of those companies reduced their number of key controls significantly in their first year of SOX compliance. As a result, most companies do not expect to make significant reductions in the number of key controls on a going forward basis.

Other key findings from the survey include:

• the median number of key controls at the entities surveyed is 297 although the range varied greatly from only a few to as many as 5,000 depending on the size of the company;

• companies in complex and highly regulated industries had more key controls; and

• the type of enterprise software system did not have any apparent relation to the number of key controls.