By now, most of the world's financial management community is familiar with the controversy over s404 of the Sarbanes-Oxley Act, and more specifically with the heated debates surrounding its substantial cost and what many consider to be its negligible benefits.

On 10 May, the Public Company Accounting Oversight Board (PCAOB) and the US Securities and Exchange Commission (SEC) hosted a day-long roundtable to discuss these issues and to learn about the hands-on experiences of those who have gone through the compliance process.

The list of panellists reads like a who's who from the US regulatory, industrial, labour, institutional investor, academic and audit communities.

Opening remarks from SEC chairman Christopher Cox and PCAOB acting chairman Bill Gradison, set a tone that suggested the day would be much more like a congressional testimony than a mere information gathering exercise - and it was.

The first thing we heard was that although accelerated filers have climbed the initial learning curve, many of the problems experienced in year one are still being felt in year two.

First, while costs may have come down for some companies, they are still substantially higher than the $90,000 (£48,000) initially forecast by the SEC. As an extreme example, Phil Ameen, vice president and comptroller of GE, noted that in 2004 his company's s404 costs were $33m, and pretty much held constant for 2005. A recent survey from Financial Executives International (FEI), a US association of CFOs and FDs, suggests that the vast majority of senior finance officers still feel that the costs of s404 outweigh the benefits.

According to Colleen Cunningham, CEO of FEI, 85% of its respondents thought the costs of s404 outweighed the benefits. This figure declined from 94% in 2005. She also comments that despite the reported 13% year-over-year decline in s404 audit costs, overall audit fees have remained relatively flat. (The fact that the s404 audit is becoming integrated with the financial audit may make it difficult to accurately differentiate between s404 audit costs and financial audit costs.)

In addition to the hard costs of management time and audit, some point to the impact on the accounting environment as a whole, as a soft cost associated with s404. As H Rodgin Cohen, chairman of Sullivan & Cromwell LLP, explained: 'I think when you try and measure the benefits and the burdens, in addition to the costs, which presumably can be quantifiable, there is a more qualitative cost, and that remains the continuing very conservative environment in the accounting profession with respect to the internal controls procedure.

'We are seeing and continue to see almost a direct correlation between a failure to apply a complex accounting standard (FAS 133, Accounting for Derivative Instruments and Hedging Activities, is probably the best example), to a restatement - to a material weakness. That line seems to be almost inevitable. Likewise, error seems to correlate directly to a significant deficiency.'

Robert W Davis, CFO of CA Inc, a representative of the US Chamber of Commerce, also spoke about the soft costs associated with boards and upper management being too focused on protection and control. He said: 'We are spending a disproportionate amount of time having management so focused on value protection that they're not creating value.'

Other concerns that were noted throughout the day related to the burden s404 imposed on small companies, the impact on the innovative capabilities of US companies and the impact on the relative attractiveness of US capital markets.

Probably we are the nearest to convincing the regulators to close this Pandora's box since the SEC inked the s404 rules. After all, if acting SEC chief accountant Scott Taub can pose the question: 'How would management's process be different if audit wasn't there?' is there not hope for a viable answer?

Realistically, the total elimination of the requirement for an audit opinion on a company's internal control over financial reporting is wishful thinking. However, if the regulators were paying attention to the insightful and compelling arguments from their panellists, there is ample reason to believe that they will take action to improve the implementation of s404 on a number of fronts.

Most notable would be the provision of additional guidance to the managements of companies of all sizes on how to go about the assessment process, and thereby help to reduce costs. (This echoes the results of a soon to be released study commissioned by the Institute of Management Accountants that indicates that the absence of a practical 'top down/risk-based' approach is a root cause of Sarbox implementation problems.)

According to Sullivan & Cromwell's Cohen: 'One great virtue of having standards or guidance for management would be to be able to draw that distinction between the roles of management in the process and that of the outside accountants. I think the bottom line of that, once everybody recognises the respective roles, would be a reduction in costs.'

Edward E Nusbaum, CEO and executive partner, Grant Thornton LLP, called for more practical guidance for both management and the audit community based upon real case study evidence. 'That kind of real, practical guidance based on examples and case studies would allow us to use judgment, and allow companies to use judgment,' he said.

He also called for better guidance on the definition of material weaknesses and significant deficiencies, which, he said, 'would make us more efficient going forward, and particularly benefit smaller companies'.

With respect to the audit guidelines, as found under Auditing Standard No 2 (AS 2), An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements, Barbara Hackman Franklin, president and CEO of Barbara Franklin Enterprises, and former US secretary of commerce, commented: 'I think it's now time to amend the standard and literally take the guidance that you put forth last year and put it into the wording of the standard. That will empower auditors in a way that they don't feel empowered to make a judgment right now.

'The second thing would be to give guidance to management about their role here, and particularly to small companies.'

Samuel A DiPiazza, global CEO of Price-waterhouseCoopers International, pointed to several areas in AS 2 that create audit difficulty: 'There's guidance that we need in the profession as well. Restatements are a problem. First, evaluating a deficiency and the extent of a deficiency is hard enough. But then when you have a situation where deficiencies are a strong indicator, restatement is a strong indicator of a material weakness and vice versa, then you've got very serious issues about when a restatement leads to a material weakness and an adverse opinion.

'And if there is anything that's creating enormous stress in the system, it's sitting right there. You know, from the profession's viewpoint, every restatement doesn't mean you have a material weakness.'

One week after the roundtable, both the SEC and the PCAOB announced their first steps in 'getting it right'. On 17 May, the SEC released the beginnings of its process to revise s404, while the PCAOB announced that it plans to propose revisions to AS 2 and integrate the May guidance, which emphasised the auditor's need to incorporate the work of internal auditors and other parties in their controls attestations.

The PCAOB will take a second look at what role the auditor should play in evaluating the company's process of assessing internal control effectiveness.

The actions the SEC intends to take are varied, but include more guidance on how to complete the assessment of internal control over financial reporting. (SMEs will have to comply with s404, but compliance will be postponed until after the new and 'scalable' guidance has been issued.)

In drafting this guidance, the SEC says it will seek external input on the appropriate role of outside auditors in connection with the management assessment and on the manner in which outside auditors provide the attestation required by s404(b) - the section that deals with the auditors' role in the attestation - 'to assist in our consideration of possible alternatives to the current approach'.

The SEC will also inspect the PCAOB's inspection process, ie, 'the staff (of the SEC) will examine whether the PCAOB inspections of audit firms have been effective in encouraging implementation of the principles outlined in the PCAOB's 1 May 2006 statement'. The 1 May statement announced that it would focus its efforts on whether auditors have achieved cost-savings efficiencies in the audits they have performed under AS 2.

For some, these 'giant steps' may be met with a collective sigh of relief, others however caution against creating yet more rules. The FEI's Colleen Cunningham said: 'I guess when I hear guidance, I get worried that we're going to get another standard that will box management in to some degree. And I think it's very, very important to understand that every company is run differently.

'Every company gets comfortable with their internal controls perhaps in a different way. I think we need to make sure that it (the guidance) is principles-based; that the guidance focuses on the clarification of key terms and definitions; and a clarification that management is not expected to follow the same rules that the auditors are required to do.'

While many would agree that the SEC and PCAOB are attempting to undo much of the negative effects of s404 implementation thus far, this new round of guidance inspires numerous other questions, such as: will companies be compelled to undo their current evaluation process to meet SEC requirements or will the new guidance be robust enough to allow companies to proceed along their current path?

Can the new guidance possibly meet both the needs of the large company accelerated filers, and smaller companies that have yet to begin the assessment process? And how long will the process of issuing new guidance take? Will the auditor's role be changed in a way that will substantially reduce the costs of s404, perhaps to the point where independent assessments of the effectiveness of a company's internal controls are no longer required?

Clearly, whether these 'giant steps' help to close one Pandora's box - or merely opening another - remains to be seen.

Section 404 of Sarbanes-Oxley requires compliance by the following categories of business operating in the UK: subsidiaries and branches of US public companies; any UK company with a US equity or debt listing; and UK subsidiaries and branches of other foreign companies with a US equity or debt listing.

These have until the middle of this month to comply with the onerous 'internal controls' audit requirements. This means for most companies a first Sarbox reporting date of year-end 2006.

In its 17 May statement, the SEC said it 'expected' to issue a short postponement. However, it added: 'It is anticipated that any such postponement would nonetheless require all filers to comply with the management assessment required by s404(a) of Sarbanes-Oxley for fiscal years beginning on or after 16 December 2006.'

Ramona Dzinkowski is an economist and business journalist working in Toronto.