Poll: SOX Compliant Companies Get Lower Cost Risk-Management Value

A news release announcing a survey of 220 companies about SOX compliance issues labeled the difference in enjoying value between companies that have already complied and those not as a “compliance chasm.” The poll by RevenueRecognition.com and International Data Corp. asked companies to rate the cost of six major Sarbanes-Oxley compliance tasks as well the effectiveness of those tasks for improving risk management.

The news release reported a split among respondents between those who had already complied with SOX and rated effectiveness equal to or greater than costs and those who haven’t yet and rated effectiveness lower than costs. The first group required only 83% of the effort and achieved more satisfactory results than the second group, indicating that they may have had a smaller gap between existing practices and those required by SOX. In addition, the announcement said, companies that have complied are more likely to continue changing their processes and to deploy technology for compliance activities in 2005.

According to the announcement, the costs and effectiveness ratings were approximately even for activities such as documenting accounting policies, certification and signoff on internal controls, certification of financial statements and responding to external audit attestation processes.

However, the news release said, pollsters found two exceptions:

• the cost of documenting internal controls was rated substantially higher than its effectiveness for improving risk management
• the cost of remediation of weaknesses found was rated substantially lower than its effectiveness for improving risk management.

Compliance Costs

The poll found that for public enterprises with more than $1 billion in revenue, the average amount of labor spent on compliance activities was more than twelve person-years. Companies in the $200 million to $1 billion revenue range averaged more than six and a half person-years of effort.

Furthermore, the cost of external auditing services increased 52% for public companies. Mid-sized companies with $200 million to $1 billion in revenue reported an 81% average increase.

When asked which financial processes present the most risk of restating financial results, approximately 40% of respondents selected revenue accounting; no other process received more than 15%. It is no surprise therefore to find that 83% of respondents from public companies indicated that in 2005 they plan to deploy or evaluate solutions for revenue accounting, billing, and/or financial consolidation–three areas that have a direct bearing on revenue reporting.

The survey was conducted during December 2004. Some 220 finance officials, including CFOs, controllers and vice presidents of finance, were surveyed. More survey results are available online at http://www.revenuerecognition.com/article.cfm/3662112 . RevenueRecognition.com is an educational resource for financial executives. IDC is a market intelligence and advisory firm in the information technology and telecommunications industries.