Internal Control Assessment Costs Are Declining

April 2006

Library Sections:

Sarbanes-Oxley (SOX) Section 404 requires identification and testing of important internal controls, a management assessment of the effectiveness of the controls, and the outside auditors' report on all of these. By far, Section 404 is SOX's most costly requirement, causing many to suggest amending this provision, especially for smaller registrants.

In Mid-April, CRA International released a report commissioned by the Big Four accounting firms. The report addresses survey results of the components and amounts of Section 404 costs in year two of its implementation. The report is useful in providing management and audit committees a means of benchmarking their own efforts.

SOX 404 costs fall into three major categories. Internal company assessments were performed with internal personnel. But the internal accountants could not take up the full load, and managements wisely realized that first year efforts would not entirely reoccur. Consequently, a whole industry grew almost overnight for outside consultants that would help document and test internal controls. Finally, the outside auditors test these company-provided conclusions and provide their agreement in a separate report.

With this background in mind, here are the major conclusions. In these conclusions, companies with a market capitalization of $700 million or more (still a fairly small number) are considered "large", and companies between $75 and $700 million are considered "small."

Comparing the first and second years of SOX 404 reporting, overall costs decreased 31% for small companies, and 44% for large companies. The decrease for small companies was around the same for even the smallest of firms (those with market capitalizations of under $125 million).
The cost decreases did not happen evenly across the board for each type of cost. Third party costs were cut the most - 52% for small companies and 56% for large companies.
Although the costs of the outside auditors attributed to Section 404 decreased 22%, this was more than offset with other charges from the outside auditors. Supposedly the additional charges did not relate to Section 404. Consequently, outside audit costs actually went up a small amount.
Despite the cost cuts, SOX 404 compliance costs remain high. In the second year of implementation, large companies reported an average of $4.8 million spent, while small companies spent an average of over $800 thousand.
For both large and small companies, the number of reported material weaknesses were either cut in half (for large companies), or cut by 75% (for small companies). Understandably, the companies with material weaknesses are addressing these issues.

What to Expect in the Next Few Years

Before implementation of Section 404 began, we said that this internal control assessment would be way more expensive than the regulators or most commentators had forecast. Once the costs started to be known, we were critical of the accounting profession for overreacting to the requirements by demanding more work than was necessary. Finally, we said that the Section 404 costs would decline significantly once management obtained greater experience with the requirements. So far, all of these predictions have been spot-on.

Here's what we believe lies ahead:

Although the reasons collected by CRA for cost decreases initially appear to be different, they are all really variations of learning costs, and elimination of unneeded steps. The learning curve identified in the first two years is steeper than we often see for labor and consulting functions, perhaps because the internal control assessments were quite different than what the staff accountants were routinely doing. Nevertheless, classic learning curves tell us that efficiencies will continue, albeit at a declining ongoing rate. Accordingly, look to see meaningful cost declines for at least another two years.
Outside accountants have not discovered the efficiencies that in-house accountants have already demonstrated. Understandably, management focused on its own costs, which they understood better and could more easily control. In contrast, the outside auditors managed to keep their billings high, causing no decrease in outside auditor costs. This result is not consistent with another study of proxy information that showed decreased outside audit costs. However, all information points to the conclusion that outside auditor costs need to be further controlled. There is no good reason why outside audit costs could not experience meaningful cost declines as personnel become more experienced in this area. Because outside auditors have always tested controls as part of generally accepted auditing standards, the overall cost declines from learning curves could understandably be less. Nevertheless, nothing reasonably explains the continued high outside audit costs beyond a lack of competition.
Currently, there is a shortage of accounting personnel. Due to supply and demand forces, accounting salaries have increased substantially more than other business labor costs. Much of this demand has been due to Section 404 assessments. As this entire area becomes more routine and efficient, expect accounting salaries to flatten.

Should SOX 404 Be Changed?

For all the complaints about the admittedly high costs, the cost of a failed financial statement and related restatement is even greater. Ask any investor in any of the major financial frauds whether they would have preferred their investment to have earned less money, or crashed due to a larger problem. The increased cost of better reporting is nothing compared to the losses caused by an accounting misstatement.

A substantial movement is underway to exempt smaller registrants from Section 404. While performing this work is certainly expensive, the smaller companies have less to test. In line with this expectation, the CRA study shows that the costs for smaller companies are not as disproportionate as some suggest. Further, an investment of any specific amount is just as important to a small-company investor as the same amount invested in a larger firm. After all, a dollar lost is a dollar lost, regardless of the size of the firm involved.

If anything, smaller companies have a greater challenge with controls, as well as other increased risks. For this reason, smaller companies have greater costs of capital than larger firms. Smaller companies should realize that further disparity in regulatory requirements between small and large firms will increase the risk disparity that already exists, causing the cost of capital differential to also increase. While the smaller companies will have a cost advantage if Section 404 did not apply to them, this cost advantage will decline over time, as the learning curve efficiencies described above take full effect. In the long-tem, we suspect the risk disadvantage caused by less assurance of good controls will more than offset the cost advantage.

Currently, an independent assessment of the registrant's SOX 404 compliance must be made by the registrant's outside auditor. The company's outside auditor is a natural to do this work, and is currently mandated as the provider of this service. Nevertheless, the lack of competitive alternatives among the Big Four, combined with the lack of cost decreases reported above, stimulates our following controversial proposal: Allow firms other than the auditor report on the internal controls. Additional competition would probably be good for the Big Four - or at least their clients.

Fulcrum Inquiry is a forensic accounting firm. We perform a broad range of financial investigations, and provide accounting assessments for related litigation.