Any way you slice it, U.S. companies and their compliance teams are being pushed to the max. One quarter remains until the first batch of companies, and their auditors, must attest to their internal controls as required by the Sarbanes-Oxley Act. Controls are being rethought and remade as internal tests reveal weaknesses, and for many the last leg of the process–external auditors showing up at your door–is finally within sight.

Some public companies are happily on schedule and ready for the final round of auditor tests. For others, it will be a mad scramble up to the end. For all, there is the slight dread that unexpected failures could be found late in the process when there is little time to correct and retest them. Perhaps the only sure thing is that more paper is being produced and more money is being spent than anyone could have guessed when Sarbanes-Oxley was signed into law two years ago.

This unexpectedly heavy burden continues to concern regulators, who also have a lot riding on a successful first round of Section 404 attestations. In an August speech, Donald T. Nicolaisen, chief accountant at the Securities and Exchange Commission, reiterated that "it is absolutely critical that we get the internal control requirements right" and suggested that the SEC was even considering a delay in the implementation of other initiatives to provide more time for management and auditors to complete the 404 review.