Corporations that embraced Sarbanes-Oxley goals from the start by automating financial reporting and encouraging business-wide cultures of compliance have eliminated material weaknesses and slashed costs more quickly than other companies. "Some cut compliance costs by nearly a third this past year, at the same time they improved the effectiveness of their internal controls over financial reporting," says Larry Raff, national partner in charge of KPMG's 404 Institute, which conducted the survey.

Of the 930 executives with compliance responsibilities who responded to the survey (representing all sizes and all types of businesses), those that were most successful in reducing deficiencies while lowering costs shared some common traits: They automated much of the financial reporting process, integrated compliance into day-to-day operations to give employees a feeling of ownership, gave internal audit personnel strategic roles to play, centralized controls that are preventive, rather than detective, and adopted a risk-based approach before many of their peers. "Companies that were ahead of the curve take a broad view of risk, embedding compliance efforts within the business," Raff says. "That means having compliance teams such as internal audit more involved in early program development, rather than being brought in after controls are implemented."

That's the upside for the most successful firms. The downside is that the early implementers will see savings slow from now on. Lessons learned from experiences over the past three years have already netted big savings, according to the KPMG survey. And early adoption of the risk-based approach has sliced the number of controls to be monitored. From now on, says Raff, spending will decline at a slower rate due to the law of diminishing returns.