Sarbanes-Oxley: what do financial executives really think? With the 10th anniversary of the major transformative piece of compliance legislation on the horizon, financial executives assess the effect of its key component, section 404.

• Author: Christensen, Brian
• Position: Compliance

July 30 will mark 10 years since George W. Bush signed into law the Sarbanes-Oxley Act, which introduced the most sweeping changes to financial reporting processes since passage of the U.S. securities laws nearly 70 years earlier.

Section 404, one of the most significant provisions of Sarbanes-Oxley, requires management to report on the effectiveness of internal control over financial reporting (ICFR) and, for many companies, the auditor to attest to management's assertion.

Few executives would want to relive the early days of Section 404 compliance. Until the U.S. Securities and Exchange Commission published its 2007 interpretive guidance, many companies felt beholden to their external auditors for direction as to "what to do" because there wasn't a guidebook for companies to follow.

Those early days were filled with false starts, trial and error, unwanted surprises, tense dialogue and inefficiencies--everything one would expect during a learning process. And that is exactly what the Section 404 compliance experience has proven to be: a learning process.

Naturally, as with all such processes, there have been lessons for companies that have been passed along to others (see sidebar on page 61 for "Ten Important Lessons"). The plethora of conferences, webinars, briefings, white papers and roundtables has played a significant role in facilitating this passage of rite, as those who learned the hard way sought to make it easier for those who followed.

Even the regulators got into the act. The Public Company Accounting Oversight Board (PCAOB) scrapped its rigorous requirements in Auditing Standard No. 2 (AS2) and replaced it with AS5. The SEC, after receiving feedback from two years of roundtables, issued its interpretive guidance for management regarding the evaluation and assessment of ICFR. As lessons have been applied, companies have improved their controls and streamlined compliance.

Section 404 of Sarbanes-Oxley has been a source of debate about its costs and benefits. As the learning curve costs declined and the compliance process became more integrated with the business, the intensity of the debate declined, with one exception--the impact of the auditor attestation provisions of Section 404(b), which require company auditors to issue an opinion on the effectiveness of the audit client's ICFR, on smaller companies..

To this point, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) issued further guidance on the use of its Internal Control--Integrated Framework, focusing in particular on smaller companies. In addition, in 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act mandated a study by the SEC to ascertain whether the attestation requirement was necessary and cost effective in providing investor protections for issuers with public float between $75 and $250 million.

Although the final study issued last year recommended retaining the current $75 million threshold--meaning no further exemptions of Section 404(b)--the focus on job creation shifted the debate to reducing the burden on startup companies.

The...