The study, Management's Assessment of Internal Control Over Financial Reporting, conducted by Professor Parveen P. Gupta of Lehigh University, assessed the views of nearly 400 CFOs, controllers, internal auditors, and SOX compliance specialists at publicly traded companies.

"In our view, these results unequivocally point to the need for clearer guidance for management in answering the critical question of 'how much control is enough?,' driven by a risk-based approach, as opposed to an auditor's binary checklist. This is hurting corporate America's ability to do business," said Paul A. Sharman, IMA president and CEO.

During the past two years, IMA has devoted significant time and resources to studying, researching, and analyzing SOX and the massive economic costs and problems associated with the current regulatory framework. As the latest initiative in this area, the study was commissioned to identify the root causes of SOX Sections 302 and 404 implementation issues. The study is scheduled to be published by IMA in June 2006. Some of the specific findings include:

• The majority of respondents -- 68 percent -- indicated that lack of practical guidance on what constitutes an effective or ineffective system of internal control over financial reporting was a significant cost driver; 
• Only 11 percent of respondents utilized the guidance provided in COSO's 1992 framework to manage their risk and controls prior to SOX legislation, and less than eight percent indicated that their external auditors used this framework prior to SOX to evaluate the effectiveness of the internal control over financial reporting for their company; 
• Only 13 percent of respondents believe that COSO's 1992 framework, the current dominant control model, alone is sufficient to help them lead to a pass/fail conclusion about their system of internal control over financial reporting; and 
• Only 23 percent of respondents indicated that their external auditors were conducting integrated audits.

"In summary, the absence of a practical 'top down/risk-based' approach, as indicated by the study's findings, is the real root cause of SOX implementation problems," said Dr. Gupta. "Research also confirmed that corporations have turned to PCAOB AS2 as the de facto standard for management guidance."

According to Sharman, the trickle-down effect of SOX implementation costs, exceeding an aggregate cost of $35 billion, contributes to delays in product innovation, a reduction of global competitiveness of U.S. companies, and an overall reduction in shareholder value.

"IMA is in favor of SOX legislation because it formally recognizes that CEOs and CFOs are accountable for business performance, ethical reporting and restoring shareholder confidence," added Sharman. "However, the lack of practical guidance and a skills deficit among management in risk and controls assurance have resulted in the checking and re-checking of thousands of pieces of data, to the point where corporate America has been distracted from the important business of doing business."

Based on the study findings, IMA has plans to further develop and expose for comment a management-centric risk and control assessment framework called "CARD-ME" (Collaborative Assurance and Risk Design - Management Edition) that will focus on providing management with practical and cost-effective guidance and approaches to meet what Congress called for in the SOX legislation. During a formal exposure process, input will be sought from all IMA members and other interested professional associations around the world.