In total, the results suggest that more than 80 percent of companies expect no better than a 20 percent reduction in key controls going forward.
"Companies appear to be saying that they've already made most of their improvements related to SOX and financial reporting," says Matt Kelly, editor-in-chief of Compliance Week. "Any additional improvements will be marginal, and certainly not as dramatic as regulators and standard setters claimed when releasing AS5."
In AS5, the PCAOB says companies should take a "top-down" approach to compliance and use a risk-based analysis to determine which internal controls are most important and then focus on those. Regulators hoped that the new guidelines would allow companies to reduce the number of their controls, which would reduce the complexity of the corresponding reports and, in turn, reduce the cost of compliance with Sarbanes-Oxley section 404.
For its "key controls" study, Compliance Week surveyed approximately 300 public companies during a one-week period in January via an online reader survey. The study revealed that though most respondents had reduced their key controls "significantly" during the first year of Sarbox compliance, less than half expect to reduce their controls by more than 10 percent in coming years.
Not surprisingly, the study also found that large companies had more controls than SMBs, and that companies in highly regulated industries like pharma and financial services had more complex controls in place.