In the Regulatory Environment, Everything Old Is New Again

Sarbanes-Oxley has turned CFOs' clock back by reestablishing a focus on controls. But in today's complex corporate structures, the challenges -- and the penalties for not meeting them
-- are more severe.

Despite the uncertainty surrounding the SEC's imminent enforcement of the Sarbanes-Oxley Act, most corporate finance departments have executed their compliance efforts with quiet efficiency. Thousands of hours have been logged, higher-than-anticipated internal compliance costs have been absorbed and much-larger-than-usual audit fees have been negotiated with minimal impact to most bottom lines or the CFO's strategic status as the CEO's go-to executive.

Senior finance executives say it's too early to tell how the new regulatory era will reshape corporate finance. Although much can and will be done to improve the efficiency of ongoing Sarbanes-Oxley compliance efforts, the fact that businesses have responded so quickly to the most sweeping SEC rule changes in 70 years demonstrates that corporate finance functions have strengthened their overall governance capabilities in the past decade.

That's part of the reason Stephen Giusto, CFO of Costa Mesa, Calif.-based professional services firm Resources Connection Inc., exuded confidence as he strolled into a meeting with his company's audit partner in late January to review some elements of Sarbanes-Oxley's internal controls requirements. Giusto's optimism was well-founded. His company advises clients on compliance. And Resources Connection is months ahead of schedule for meeting its own May 2005 deadline for compliance with Section 404. So he was somewhat disconcerted to discover that the audit partner was "still trying to figure out what he needed to tell us," he says.

Giusto explains that some of the SEC's guidance on Section 404 and, consequently, some of the accounting industry's understanding of its role in attesting to internal controls are "pretty much as clear as mud." Despite those question marks, his confidence has not dissipated. "I'm not worried about whether or not we have appropriate controls. I think we do," he explains. "I'm more concerned about how we comply from a process standpoint."

Compliance first-movers -- companies with Section 404 deadlines looming in November and December -- may be less sanguine. But not by much: In a PricewaterhouseCoopers survey of executives who attended one of that firm's compliance conferences in late January, 95 percent said they expect their company to meet its Section 404 deadlines.

Much of that confidence stems from the fact that the sprawling new law boils down to principles that are familiar to most finance executives. Giusto recalls that as he reviewed compliance requirements with his auditor, a particular phrase kept coming to mind: "Everything old is new again."