Users Struggle to Pinpoint Sarbanes-Oxley IT Costs

Computerworld - Sarbanes-Oxley readiness costs can be hard for companies to pin down, partly because complying with the new financial reporting law isn't a one-time event like Y2k.
For instance, Eastman Chemical Co. hasn't even tried to evaluate the IT costs associated with its Sarbanes-Oxley Act compliance initiative, said Mark Montgomery, director of administrative operations support and technology systems at the Kingsport, Tenn.-based chemicals maker. He noted that the required work is viewed as "an ongoing effort," not a finite project.
Montgomery and several other corporate managers said Sarbanes-Oxley's mandate that companies annually document and attest to the effectiveness of their financial controls means that compliance work will have to be done on a continual basis.
"A lot of people have this mind-set that it's a one-time project," said Kyle Didier, vice president of finance at Regis Corp., a Minneapolis-based operator of 9,700 hair salons in the U.S. and Europe. But he added that he expects Regis to test its internal financial controls regularly using a software tool called Certainty that was developed by Movaris Inc. in Campbell, Calif.
Regis has been working on Sarbanes-Oxley readiness for the past nine months and expects to complete an initial round of documentation and testing by year's end. Didier said the company will likely incur slightly more than $100,000 in IT costs over the course of its compliance effort. That includes both software and manpower expenses, he added.
John Van Decker, an analyst at Meta Group Inc. in Stamford, Conn., said most companies are currently focusing on Section 404 of the law, which requires CEOs and chief financial officers to certify the effectiveness of the financial controls they have in place. Companies with market capitalizations of $75 million or more have to comply for fiscal years that end on or after June 15, 2004. Smaller businesses and foreign-owned companies have until April 15, 2005.
Financial Executives International, a Florham Park, N.J.-based association of corporate finance managers, surveyed its members last May on cost estimates for complying with Section 404. On average, the 83 respondents expect to spend about $480,000 on software, consulting services and employee training in advance of the compliance deadlines.
Mark Nagelvoort, vice president and internal control manager at Hudson United Bank in Mahwah, N.J., said the subsidiary of Hudson United Bancorp expects its IT costs tied to Sarbanes-Oxley to come in at less than $500,000, though he declined to be more specific. That includes the bank's use of a software tool called SOXA Accelerator from HandySoft Global Corp. in Vienna, Va., plus