A lack of practical implementation guidance and the incomplete nature of the Committee of Sponsoring Organizations’ 1992 framework -- in assessing effectiveness of internal controls over financial reporting -- are two of the key cost drivers for public companies complying with Sarbanes-Oxley Section 404 (SOX) requirements, according to a new study.
A study from the Institute of Management Accountants, “COSO 1992 Control Framework and Management Reporting on Internal Control: Survey and Analysis of Implementation Practices,” attempted to assess the views of nearly 400 chief financial officers, controllers, internal auditors and Sarbanes-Oxley compliance specialists at publicly traded companies.
Conducted by Professor Parveen P. Gupta of Lehigh University, the study found a number of factors that hurt cost-effective SOX compliance -- including high-cost compliance activities, the definition and use of risk-based models, application of risk assessments, integrated audits, IT controls assessments and skills gap issues, among other problems.
Among the suggestions the study offers to public policymakers are that the COSO board reevaluate the suitability of the 1992 framework in light of the demands placed on it to meet the Section 404 requirements; and secondly, that the board carefully and objectively assess whether the reliance on the current guidance by management to assess and report on controls is as efficient and effective as possible.
The study also calls for a joint project from the COSO organizations that would focus on identifying the most significant skill gaps that exist currently in the management, external audit, and internal audit communities.
More information on the study, which costs $30 for members, is available at
