The costs of compliance.

Financial Executives International surveyed companies about their expectations of the time and money needed to design, implement, and evaluate effective internal control systems required by Section 404 of the Sarbanes-Oxley Act of 2002. Here are the survey results.

Total costs of first-year compliance with Section 404 of the Sarbanes-Oxley Act could exceed $4.6 million for each of the largest U.S. companies, according to a survey of 321 companies by Financial Executives International (FEI), a professional organization serving chief financial officers (CFOs) and other senior financial executives.

In general, the cost of compliance varied in direct proportion to the size of the company. Of the respondents, 20% were from companies with more than $5 billion in annual revenues. At the other end of the spectrum, 3.3% had annual revenues under $25 million. Overall, the average cost-of-compliance estimate for all companies in the survey was just under $2 million for roughly 12,000 hours of internal work and 3,000 hours of external work, plus additional auditor fees of $590,000, or an increase of 38%. These data contrast sharply with estimates from an FEI survey of 83 companies conducted in May 2003. The earlier survey suggested that the average company could expect the compliance effort to require a total of 6,000 hours for internal, external, and attestation time, and projected a rise in audit fees of 35%.

Software vendors and consultants will be encouraged by survey results: Except for the respondent segment with the highest annual revenues, companies of all other sizes expected to spend the most on external costs.

Section 404 requirements

Section 404 of Sarbanes-Oxley requires each company's annual report to contain:

* A statement of management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting

* Management's assessment, as of the end of the company's most recent fiscal year, of the effectiveness of the company's internal control structure and procedures for financial reporting

Section 404 also requires the company's auditor to attest to and report on management's assessment of the effectiveness of the company's internal controls and procedures for financial reporting, in accordance with standards established by the Public Company Accounting Oversight Board (PCAOB).

The higher costs incurred by larger, more complex companies are understandable. However, "even for small...