Section 404 compliance: telling it like it is; It's 'showtime' for reporting on internal controls, and Financial Executives Research Foundation (FERF) asked some in corporate America, 'How's it going?' Here are a few tales from the trenches.

• Author: Sinnett, William M.
• Position: Regulation

Investors will soon hear and read a lot about internal control. Beginning with this year's annual reports, companies will, for the first time, be reporting on the effectiveness of their internal control over financial reporting--as required by Section 404 of the Sarbanes-Oxley Act of 2002. Not all of the news will be good, because some companies will have to disclose control deficiencies that have not yet been remediated as of fiscal year end.

[ILLUSTRATION OMITTED]

Companies have long been plagued by control deficiencies and weaknesses in their systems of internal control. The Public Company Accounting Oversight Board (PCAOB) has now defined three different magnitudes of control deficiencies, and has even provided examples. To the extent that control deficiencies are identified, both management and the external auditors are required to determine if they are significant deficiencies or material weaknesses (see sidebar). Only material weaknesses are required to be publicly reported. For over a year now, companies have been documenting their business and financial reporting processes and how those processes are controlled, and then testing those controls.

The Dow Chemical Co. got started early. "We started back in March of 2003," says Ron Edmonds, global accounting director for Dow. "We put together a Sarbanes-Oxley Section 404 Implementation Team, drawn from finance, information systems, manufacturing, human resources, legal and the business units, to first decide what had to be done and then implement the needed actions."

Dow decided to install Deloitte's Risk Control Tracking System to store and keep track of all the process documentation, process flow charts and control self-assessments. By mid-2003, Dow had documented most of its processes and was able to start testing the related controls.

Early Start Helpful

"We found some gaps in existing documentation and some control deficiencies, but, because we got started early, we were able to remediate the deficiencies and retest the controls," Edmonds recounts. He estimates that, all told, Dow employees spent over 100,000 hours documenting, testing, remeditating and retesting. And, while Edmonds did not attach an internal cost to the hours, if the average professional is paid $100,000 per year in salary and benefits, this total cost could approach $5 million--not including the additional costs of soft-ware and outside consultants.

Dow's Implementation Team kept its audit committee well informed of its activities and progress. "We put together...