After a seemingly endless series of postponements in deadlines designed to help smaller public companies prepare for Sarbanes-Oxley Section 404(a) compliance, a new study of 3,321 smaller companies finds little evidence that they are any better prepared now than when the delays first began. More than a third of the companies reviewed by SOX research and compliance firm Lord & Benoit, gave little or no consideration to the delays and completed assessments at the last minute–or not at all.

More disturbing is smaller companies' attitude. “About 700 companies were completely noncompliant or they issued statements with poor segregation of duties,” says Robert Benoit, Lord & Benoit president, noting that segregation of duties is not a control problem but, rather, a way to forestall financial reporting abuses. Even with just two people in a company, accounting and check signing duties can be divided. “These companies just decided they weren't going to do it,” Benoit says.

Good compliance at smaller companies is the exception, rather than the rule, agrees Peter Nelson, a partner at LBB & Associates Ltd., based in Houston, an audit firm specializing in smaller developing companies. One out of 40 client companies is prepared for 404, and a few are addressing it. As for the others? “I'm not sure what they're doing, but they're not worrying about it, that's for sure,” says Nelson. LBB advises the companies to start worrying about 404(a compliance), but, he adds: “It's not our job to act as the management of the company.”

The bottom line is that no one knows which companies still have ineffective disclosure and financial reporting controls, notes Mark Cheffers, CEO of Audit Analytics, a research firm based in Sutton, Mass. “Imagine all the small produce companies telling the FDA that they should be excluded from e. coli testing because they're small and testing is a burden,” he says. “If you want to see a market destroyed, just let e. coli be picked up.”

Lord & Benoit, which examined filers with fiscal years ending Dec. 15, 2007 and Jan. 31, 2008, found that 34% of companies that filed shrugged off any sense of urgency to assess internal controls, leaving things to the last minute. Some 12% were noncompliant, filing faulty reports or not indicating how they planned to become compliant, while another 7% did not bother filing. And there's no indication their boards are about to push them: 19% of audit committees are noncompliant.

Costs should not be a deterrent : The average costs of 404(a) and 404(b) compliance are $53,724 and $24,750, respectively, according to an earlier Lord & Benoit study on SOX investment–less than the salary of a full-time accountant. Company sales averaged about $59 million annually. “The CEOs of many of these small companies are often the original founders, and they're used to getting their way,” Benoit says.