Many finance experts expect the SEC's endorsement to lead to lower costs for SOX 404 compliance. “With AS5, we now have clearer more substantial support for a risk-based approach,” says Brett Curran, vice president of governance, risk and compliance (GRC) and privacy practices at Axentis Corp. “It will be a catalyst to help auditors rely more on their judgment and that will cut costs.”

AS5 was approved over last-minute requests for reforms by NASDAQ, which echoed the concerns of others who felt AS5 didn't go far enough in providing a workable definition for “materiality,” an important component necessary to determine which risks have the greatest potential to impact the bottom line. NASDAQ also wants to see an ombudsman established at the PCAOB to advocate for issuers who feel their internal controls are being overaudited, and also permission for companies with no material weaknesses one year to skip the auditor portion of 404 the next. These reforms could work their way into future PCAOB comments and standards.

Finance, audit and information technology professionals were mostly enthusiastic, though that was tempered by some irritation that it took so long for the SEC and PCAOB to finally give their stamps of approval to what managers have said all along: It was a waste of time and money to test audit controls for uncritical processes such as, say, petty cash and the company coffee budget. “It came four years too late, but it's essentially an admission that the delay has contributed to the extensive costs associated with Sox Section 404 compliance,” says John McLaughlin, senior managing director of advisory business services at Smart Business Advisory Consulting LLC, based in Devon, Penn.

Some companies, perhaps 10% of all the large public companies covered by SOX, have been assertive in adopting a risk-based approach before AS5 was cast in stone. It wasn't easy, though, because external auditors, in many cases, refused to veer from the strict SOX doctrine despite PCAOB hints that risk-assessment was a reasonable approach because, perhaps, the pendulum had swung too far in the direction of overauditing.

Celebrate Sarbanes-Oxley's fifth anniversary with Treasury & Risk magazine. Read “Finally, the Party Can Start”, the Cover Story of T&R's summer double issue.