SOX 404, 302 Compliance Offers "Proportional Value"

A survey of 220 businesses revealed that while compliance costs associated with SOX Sections 404 and 302 are front-loaded, once companies are through the process, there is a great deal of proportional value. The poll, conducted jointly by International Data Corp. and RevenueRecognition.com, also noted that a compliance "chasm" exists and that companies that have crossed it have achieved more effective results at less cost. IDC asked respondents to rate the cost of six major Sarbanes-Oxley compliance tasks, and also to judge the effectiveness of those tasks for improving risk management. The cost and effectiveness ratings were roughly even for activities such as documenting accounting policies, certification and sign off on internal controls, certification of financial statements, and responding to external audit attestation processes. However, the cost of documenting internal controls was rated substantially higher than its effectiveness for improving risk management, and the cost of repairing any weaknesses was rated substantially lower than its effectiveness for improving risk management. The survey focused on costs for internal resources and outside consulting from both Big Four and non-Big Four audit firms. The resource requirements to support SOX increased in direct proportion to the size of organization based upon revenue. For public enterprises with more than $1 billion in revenue, the average amount of labor spent on compliance activities was more than 12 person-years. Companies in the $200 million to $1 billion revenue range averaged more than six-and-a-half person-years of effort. Furthermore, the cost of external auditing services increased 52 percent for public companies. Midsized companies with $200 million to $1 billion in revenue reported an 81 percent average increase.