Sarbanes-Oxley

Section 404 Post-Implementation - What You Should Be Thinking About Now

addresses Section 404 post-implementation issues, including the level of effort required for implementation, how to embed control consciousness in business units, and how to avoid being locked into "implementation only" strategies. A framework for the future containing elements we are developing and piloting with a select group of companies also is included. (See the A&A Developments Database.)

Companies are in the midst of implementing Section 404 of the Sarbanes-Oxley Action of 2002 (Section 404), one of the most involved and costly processes they may have faced. Many companies are starting to think past implementing Section 404 to post-implementation "404+1" and beyond. We work with companies to help them address post-implementation issues: level of effort, how to embed control consciousness in business units, and how to avoid being locked into "implementation-only" strategies that may prove to be cost-ineffective in the long run.

While we recognize the significant time and effort your company is putting toward Section 404 implementation, we feel strongly that post-implementation is something you should be thinking about now. The requirements of Section 404 are no less onerous in year two and beyond, although the sheer amount of documentation may be less.

Based upon surveys we have conducted, as well as observations from Section 404 Roundtables and seminars, we have note some preliminary observations on 404+1:

• Ongoing compliance efforts will be significant as much as 50% to 75% of first-year implementation.
• Over 70% of companies are planning some form of control self-assessment as part of their future compliance strategy, yet many such programs have failed to deliver in the past.
• The role of internal audit in the ongoing process is still evolving, and views seem to be polarizing.
• Technology enablers and other techniques can reduce the cost of compliance and bring additional value.

Section 404 Post-Implementation -- What Should You Be Thinking About Now