The survey revealed that many U.S. corporations were unprepared to meet the original deadline of Section 404 of the Sarbanes-Oxley Act for introducing strong internal controls and processes for implementing the Act's provisions regarding the fairness, accuracy, and thoroughness of their financial reporting.

In particular, the survey of 65 top human resources executives of Fortune 1000 companies highlighted disagreement and confusion over human resources' role in helping companies achieve compliance. Of course, this was before the Securities and Exchange Commission extended the compliance deadline by one year to years ending on or after June 15, 2004.

According to the survey, many companies have not moved beyond the first steps, which include determining internal responsibility for performing a baseline assessment and subsequent annual evaluations of their controls and procedures for financial reporting. While 51 percent of respondents say the HR function is responsible for this activity, 29 percent say it "possibly" is, and 12 percent don't know. Another 8 percent say HR is not responsible.

"Compliance with the internal control requirements of Sarbanes-Oxley offers a huge opportunity for HR to enhance its service delivery and improve overall organizational effectiveness," said David Glueck, a director in Deloitte & Touche's Human Capital practice. "By helping companies establish, communicate, and annually assess the control environment, HR can have a significant impact on setting the tone and standards of acceptable behavior for ethical business practices within its organization."

Specifically, HR executives can help companies comply with Sarbanes-Oxley by making sure there is sufficient staffing, and that the staffing has the appropriate skills sets and background to execute the necessary control activities.

HR executives who want to take the best advantage of the one-year reprieve for Section 404 compliance should begin by mapping out a plan of attack. The model to follow, offered Glueck, is based on the internal control framework developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), which arose from the savings-and-loans scandals of the 1980s. The COSO framework breaks effective internal control into five interrelated components: control environment, risk assessment, control activities, information and communication, and monitoring.

To help their companies construct this framework, HR executives should begin by analyzing their organization's current state regarding the five components, recommended Glueck. Large companies may need to dedicate full-time staff to an internal controls program management team. Once it pinpoints the company's strengths and weaknesses, the team should move forward to correct the shortcomings. This framework also can be used by organizations' external auditors, which legally are required to issue a separate report attesting to management's assertion on the effectiveness of its internal controls and procedures for financial reporting.

In some cases, HR executives already are preparing to undertake activities that address internal controls but are not directly tied to their traditional role. For example, 56 percent of survey respondents plan to assess the roles and responsibilities of individuals with control activities to ensure they have the level of responsibility/authority/time/resources needed to complete these tasks. Moreover, 54 percent plan to work with the board of directors to increase the understanding of the board's roles and responsibilities.

"Complying with Sarbanes-Oxley will require significant changes in procedures and practices, as well as the day-to-day activities of many senior executives and the people reporting to them," noted Glueck. "HR can take a leadership role in making that transition a success while helping reinforce important corporate values and behavior."