Despite significant supervisory action in 2007 to simplify and provide guidance on Section 404 of the Sarbanes-Oxley Act (SOX), publicly owned financial institutions and other companies required to comply with the law’s internal control over financial reporting requirements expect to incur ever higher costs in the months and years ahead.

This finding from a survey conducted by the U.S. Chamber of Commerce could come as a disappointment to the Securities and Exchange Commission (SEC), which this year issued its management guidance on Section 404, and to the Public Company Accounting Oversight Board (PCAOB), which issued new Auditing Standard No. 5 (An Audit of Internal Control Over Financial Reporting That Is Integrated with an Audit of Financial Statements).

The SEC and PCAOB took these steps specifically to help bring down the costs of compliance, especially for small businesses. Nevertheless, most public companies subject to Section 404 that responded to the survey do not anticipate any savings and expect the costs to rise.

Whose Opinions Are These?

The findings are based on an on-line survey of approximately 5,000 contacts provided by the U.S. Chamber’s Center for Capital Markets Competitiveness and other organizations, including the American Bankers Association, American Stock Exchange, and Institute of Management Accountants. Of those, 177 people freely responded.

The majority of the respondents were public companies (89.8 percent), and the financial services industry made up the largest industry sector responding to the survey (24.7 percent of the respondents). Banks and other financial institutions have unique concerns about Section 404 because insured depository institutions are already subject to the annual audit and reporting requirements under Section 36 of the Federal Deposit Insurance Act and its implementing regulations (Part 363 of Federal Deposit Insurance Corporation Regulations).

Insured institutions that are also public companies are subject to both Section 36 of the FDI Act and Section 404 of SOX, and there is some overlap between the two requirements in both purpose and provisions. As a result, the financial services industry has been uniquely affected by the Section 404 rulemaking and interpretive process, and it is no wonder that the highest percentage of respondents to the survey were bankers.

Half of the survey respondents were from smaller public companies (described as having a public float of $75 million or less). These “non-accelerated filers” have had additional time to come into compliance with the management report (Section 404(a)) and auditor attestation (Section 404(b)) requirements of SOX.

Specifically, non-accelerated calendar-year filers will be required to begin providing management reports on internal controls over financial reporting in 2008 for periods ending on December 31, 2007. Audit attestations for non-accelerated calendar-year filers must begin to be provided in 2009 for periods ending on December 31, 2008.

Key Findings

These looming compliance dates appear to fuel the pessimism about the costs of Section 404 compliance. Nearly two-thirds (64 percent) of the respondents expect an increase in costs in 2008 and 2009 because they will begin having to file management reports under Section 404(a) and provide auditor attestations under Section 404(b).

Just how much do they expect the additional costs to be? According to the survey, 47 percent of the respondents who expect a cost increase believe it will exceed $100,000. Respondents with a public float of less than $75 million (52 percent) anticipate that the internal and external costs of implementing Section 404(a) will exceed $200,000. A somewhat lower percentage (44 percent) of the same group anticipate that the costs of implementing Section 404(b) will also exceed $200,000.

Part of the cost of compliance is incurred from the engagement of external auditors. Eighty-four percent of the respondents have engaged an auditor in preparation for compliance with Section 404(a), and 66 percent have engaged an auditor to comply with Section 404(b).

A clear majority of non-accelerated filers (79 percent) believe that a further delay in the compliance deadline for Section 404(a) and 404(b) would be helpful.

It is also evident from the survey that the respondents remain unconvinced that Section 404 is beneficial in terms of detecting and preventing material fraud and improving the reliability of financial reports. Approximately nine out of ten respondents believe that their costs will “greatly exceed” or “moderately exceed” the benefits of compliance. Fifty-nine percent reported that Section 404 will help them and their auditors “very little at all” in rooting out material fraud.

Behind the Responses

The U.S Chamber’s survey report includes narrative comments from the respondents who participated. Most of the comments are negative, although a few indicated hope that the time-consuming and expensive costs of compliance were behind them.

One very small bank ($45 million in asset size) reported that it will incur a direct expense in 2007 of about $75,000 to document and comply with Section 404(a). For a bank this size, these costs have extremely negative consequences for earnings, the respondent said.

Another respondent said that the PCAOB’s Auditing Standard No. 5 is not likely to result in a material decrease in the company’s Section 404 compliance costs.

A respondent from a large bank (accelerated filer) said that Section 404 has been very costly with minimal benefit in detecting fraud, although it has provided “some focus on creation or improvement of internal procedures.”

A $2.5 billion institution that describes itself as a community banking organization indicated that it has been reporting under Section 404 for four years. As a result, the respondent said, its external audit costs have doubled, and its internal costs have been even higher. The Big 4 accounting firm it uses has not reduced its fees as a result of the SEC and PCAOB reforms made during 2007, according to the respondent.

Another respondent pointed out that financial institutions are already scrutinized by external auditors and state and federal examiners under the banking laws and regulations, and as a result, internal controls have always been important to banks. In this environment, Section 404 audits are redundant, the respondent opined.

One respondent said that his company engaged an outside firm to assist with Section 404 documentation and testing, which still requires the expenditure of management time and effort.

A suggestion from another respondent would give the internal audit function full responsibility for SOX compliance, believing that the value of an external auditor’s opinion regarding internal controls is minimal.

A community bank respondent wrote that Section 404 does not enhance its internal control system but does add significant costs.

Accounting Firms See Different Story

In contrast to the general pessimism among public companies and their internal auditors, the four big accounting firms (Deloitte & Touche, Ernst & Young, KPMG, and PricewaterhouseCoopers) have been tracking Section 404 implementation costs and have detected a downward trend.

They sampled first-year implementation costs through two surveys prepared by CRA International, one in the spring of 2005 and another at the end of that year. They again updated the survey in the spring of 2006.

The initial survey in 2005 reviewed first-year implementation cost data for a sample of the firms’ Fortune 1000 clients with market capitalization over $700 million (“larger companies”). The first survey also included data on the number of control deficiencies identified and remedied as a result of Section 404.

The updated 2005 survey projected second-year costs for both the Fortune 1000 clients included in the earlier study as well as a new group of “smaller” public companies with market capitalization between $75 million and $700 million, which are also “accelerated filers” and have been required to be in compliance with Section 404.

The findings of the updated study indicated that average total Section 404 implementation costs were expected to decline in the second year at both the larger and the smaller companies surveyed. Specifically, the costs for smaller companies were expected to decline an average of 39 percent in the second year of implementation from $1.5 million to $900,000. Total second-year implementation costs for larger companies were projected to decline 42 percent on average from $7.3 million to $4.3 million.

Also according to the 2005 updated survey, auditrelated fees did not constitute the largest share of implementation costs. CRA International found that audit fees accounted for about 35 percent of total Section 404 implementation costs for the smaller companies surveyed. For larger companies during the first year of implementation, only 26 percent of costs were attributable to audit fees.

The expected decline in costs, the survey claimed, was attributable to less documentation needed in the second year of implementation, “the benefits of experience,” and fewer remediation controls applied in year two.

Other findings in the updated 2005 study indicated that the number of key controls tested in year two were expected to decline, and it was anticipated that independent audit firms engaged for Section 404 audits would rely more heavily on the work of others (including internal auditors) during the second year of implementation.

The 2006 survey data continued the theme of a downward trend in Section 404 implementation costs and attempted to draw a bright line between audit fees and total costs (including internal and third-party costs). According to the survey, in year two of implementation for accelerated filers, including both “larger” and “smaller” companies, total costs declined substantially.

Specifically, the 2006 survey found that overall costs fell 30.7 percent for smaller companies and 43.9 percent for larger companies in the second year of implementation. In monetary terms, average costs fell strucfrom $8.5 million to $4.8 million between year one and year two.

Audit fees also declined an average of 20.6 for smaller companies and 22.3 percent for larger companies. As a percentage of total costs, audit fees accounted for 39 percent for smaller companies and 33 percent for larger companies in year two.

The 2006 survey also revealed that the number of key controls tested during a Section 404 audit declined by more than 21 percent for smaller companies and 19 percent for larger companies.

For purposes of the survey, independent auditors working on Section 404 engagements gave their opinions about the reasons that costs went down. The top three were increased efficiencies, less documentation, and less reliance on public companies or outside parties to help public companies get ready for implementation.