The cost of complying with the Sarbanes-Oxley Act in most cases appears to be matched by the effectiveness of improving risk management, according to a survey by RevenueRecognition.com and International Data Corp.
While the survey of 220 businesses found this to be the case for activities such as documenting accounting policies, certification and sign off on internal controls, certification of financial statements, and responding to external audit attestation processes, there were two exceptions. Respondents rated the cost of documenting internal controls "substantially higher" than its effectiveness for improving risk management, while they rated the cost of remediation of weaknesses "substantially lower" than its effectiveness for improving risk management.
The study found that rated effectiveness equal to or greater than costs, required only 83% of the effort and achieved more satisfactory results than the second group, which rated effectiveness less than the costs.
The survey also found that public companies with more than $1 billion in revenue spent an average of 12 person years on compliance, while those with between $200 million and $1 billion averaged six-and-one-half person years. According to the study, the cost of external auditing services increased 52% for public companies; mid-sized companies with $200 million to $1 billion in revenue reported an 81% average increase.