The Big Four accounting firms -- Deloitte & Touche LLP, Ernst & Young LLP, KMPG LLP, and PricewaterhouseCoopers LLP -- asked consulting firm CRA International (CRA) to review data for a sampling of the firms' large-cap¹ and small-cap² Fortune 1000 clients who had likely implemented SOX Section 404 in the first year.

What is Section 404? Section 404 of the Sarbanes-Oxley Act governs internal controls of financial reporting. It requires management of a public company and the company's independent auditor to issue (1) a management report on the effectiveness of the company's internal control over financial reporting and (2) an independent auditor's report that includes both an opinion on management's assessment and an opinion on the effectiveness of the company's internal control over financial reporting.

The just-released report is a follow up to the original report that only covered large-cap companies. According to the first study, the average per-company Section 404 total implementation costs were estimated at $7.8 million, or just 1/10th of one percent of revenues. Average per-company audit fees were estimated to be one-quarter of the total implementation costs. On average, each company identified 348 deficiencies and remediated 271 of them, and was expected to remediate an additional 77.

As a follow up, the Big Four asked CRA in October 2005 to examine second-year costs for those included in the first study, in addition to a separate group of smaller public companies. This follow up includes information about auditors' methodology and the key factors driving costs.

New findings

According to the new study conducted in October, implementation costs are expected to decline in the second year for both larger and smaller public companies. In addition, the survey found that audit fees account for a minority of the Section 404 implementation costs:

Implementation costs
	2nd year	1st year	% decline	% of revenue	% toward audit fees
Smaller	$900,000	$1.5m	39%	0.46%	35% ($520k)
Larger	$4.3m	$7.3m	42%	0.19%	26% ($1.9m)

Key controls tested by auditors and companies in year two is expected to decline for both groups:

Key controls
	2nd year	1st year	% decline
Smaller
auditors	206	262	22%
companies	298	359	17%
Larger
auditors	540	669	19%
companies	867	992	13%

For both groups, reduced documentation is the primary reason for the cost declines in year two, according to the companies' independent auditors, surveyed by CRA. Auditors also cited increased efficiency in internal controls and change in remediation efforts.

According to CRA International, this report will be made available on the CRA Web site; however, no publication date was specified.

Notes:
¹ market capitalization of $700m or more
² market capitalization between $75m and $700m