Sarbanes Oxley Section 404 Costs of Compliance: a case study

In 2002 US Congress approved the Sarbanes Oxley Act (SOX). Section 404 requires companies to assess their internal controls and acquire an attestation of this assessment from their external auditor. In this paper, we investigate the costs of compliance of this assessment and attestation. The European division of a US listed company is used as a case study. The divisional project approach is described, and costs of compliance for this division are presented in two categories: assessment costs, mainly hours spent by internal staff; and attestation costs, mainly audit fees. The case study shows that the internal hours spent on assessment are approximately 12 times higher than the initial estimate made by the SEC in 2002, and that the realised other expenses are approximately 1.4 times higher than this estimate. Furthermore, a year on year increase of 50 per cent of the company’s audit fee in the first year of Section 404 compliance is found. Companies can reduce the costs of compliance by implementing programmed controls, using auditors from countries with lower rates, remediating material weaknesses only, focusing on the internal control system rather than on individual controls, and by encouraging the auditor to rely on the company’s assessment.