Last fall Ernst & Young published the results of a survey on trends in the implementation of internal controls,
focusing in particular on the progress that companies were making in meeting
Section 404 deadlines for Sarbanes-Oxley.  Since the publication date was
last October, this isn’t breaking news … but the existence of the survey was
news to me and I found it useful and interesting.  (You can get to the
Acrobat file by clicking here.)

The general message is (surprise!) that companies were finding that it was
taking much more effort than they expected and that they were not, in general,
sticking to the schedules they had put into place earlier.

But there are also findings that are a more surprising.  Here is an
example:  59% of the companies surveyed said that they were tracking their
testing and remediation work in an Access database or an Excel spreadsheet ( !!)
.  The implication is that these companies are not at all able to provide
real-time information about remediation across the organization.  Bummer.

Here is another one:  nearly 30% of the companies surveyed had not yet
selected a technology platform for 404 compliance implementation.  Since
these companies will have, in general, met their initial deadlines without
making a platform commitment, that suggests that there are a good number of
companies that have worked through the first round of 404 issues without making
a big technology buy.  These companies are in a good position to bring
clear expectations and requirements to their planning and purchasing.

2005 is the year that Section 404 internal controls become required for all
SEC filers, not just the accelerated filers. It is a pretty good bet that there
will be more companies coming to terms with the issues highlighted in the
E&Y survey.  It is worth a look if you haven’t seen it.