Two of the key cost drivers for public companies complying with Sarbanes Oxley Section 404 (SOX) requirements are:

• Lack of practical management implementation guidance
• Incomplete nature of the COSO (Committee of Sponsoring Organizations) 1992 framework in assessing effectiveness of internal controls over financial reporting (ICoFR)

• Redundant testing (between auditors and inside SOX compliance resources) due to a lack of collaboration to reduce the sample size. The data suggests that the original goal of achieving efficiencies via an integrated audit of internal control incremental to (not duplicative of) the traditional financial statement audit is still not a reality.
• Approximately two-thirds of the total respondents identified major cost drivers as: A lack of practical guidance from the SEC or other professional organizations on how to decide what constitutes an effective (or ineffective) internal control system
• More than half of respondents acknowledged that they did not use COSO 1992 to assess IT control effectiveness, in spite of indicating their control assessment was done in accordance with COSO 1992.
• Almost 52 percent of respondents used COBIT for this critical aspect of their ICoFR assessment.
• Forty-five percent of smaller public companies and 35 percent of larger public companies are using a "bottom-up" approach to internal controls, rather than a "risk-based" point-of-view. The higher percentage for smaller companies could suggest a skills gap issue in applying robust risk assessment methods.
• Only 38 percent of respondents indicated that the COSO 1992 controls framework, the predominant framework in use, was guiding their internal control assessments, while 62 percent primarily rely on Accounting Standard 2 (AS2). Due to the lack of practical guidance, AS2 has become the de facto assessment standard for company management.
• Fifty-seven percent of respondents did not believe that the COSO 1992 framework alone was sufficient guidance for determining the effectiveness of internal controls, strongly suggesting that practical assessment methodologies linked to the framework are necessary to assert to the SEC that an organization has an effective system of internal controls.