After a seemingly endless series of postponements in deadlinesdesigned to help smaller public companies prepare forSarbanes-Oxley Section 404(a) compliance, a new study of 3,321smaller companies finds little evidence that they are any betterprepared now than when the delays first began. More than a third ofthe companies reviewed by SOX research and compliance firm Lord& Benoit, gave little or no consideration to the delays andcompleted assessments at the last minute–or not at all.

More disturbing is smaller companies' attitude. “About 700companies were completely noncompliant or they issued statementswith poor segregation of duties,” says Robert Benoit, Lord &Benoit president, noting that segregation of duties is not acontrol problem but, rather, a way to forestall financial reportingabuses. Even with just two people in a company, accounting andcheck signing duties can be divided. “These companies just decidedthey weren't going to do it,” Benoit says.

Good compliance at smaller companies is the exception, ratherthan the rule, agrees Peter Nelson, a partner at LBB &Associates Ltd., based in Houston, an audit firm specializing insmaller developing companies. One out of 40 client companies isprepared for 404, and a few are addressing it. As for the others?“I'm not sure what they're doing, but they're not worrying aboutit, that's for sure,” says Nelson. LBB advises the companies tostart worrying about 404(a compliance), but, he adds: “It's not ourjob to act as the management of the company.”

The bottom line is that no one knows which companies still haveineffective disclosure and financial reporting controls, notes MarkCheffers, CEO of Audit Analytics, a research firm based in Sutton,Mass. “Imagine all the small produce companies telling the FDA thatthey should be excluded from e. coli testing because they're smalland testing is a burden,” he says. “If you want to see a marketdestroyed, just let e. coli be picked up.”

Lord & Benoit, which examined filers with fiscal yearsending Dec. 15, 2007 and Jan. 31, 2008, found that 34% of companiesthat filed shrugged off any sense of urgency to assess internalcontrols, leaving things to the last minute. Some 12% werenoncompliant, filing faulty reports or not indicating how theyplanned to become compliant, while another 7% did not botherfiling. And there's no indication their boards are about to pushthem: 19% of audit committees are noncompliant.

Costs should not be a deterrent : The average costs of 404(a)and 404(b) compliance are $53,724 and $24,750, respectively,according to an earlier Lord & Benoit study on SOXinvestment–less than the salary of a full-time accountant. Companysales averaged about $59 million annually. “The CEOs of many ofthese small companies are often the original founders, and they'reused to getting their way,” Benoit says.