Anecdotal evidence of the immense cost of complying with Sarbanes-Oxley, particularly the internal controls provision in Section 404, is starting to surface as next year's deadlines grow nearer. According to this article in USA Today, the CEOs of Fortune 500 companies Affiliated Computer Services and Steelcase say it will take their companies 20,000 staff hours to comply, the equivalent of 10 people working full time for a year. Other companies such as Dell estimate that compliance will take closer to 5,000 hours.

As discussed here previously, the SEC's Final Rule regarding Section 404 estimated an average 383-hour workload per company, a figure that was raised from the SEC's original estimate of just 5 hours after strong comments such as this one from Intel's Cary Klafter advised the SEC that its had "underestimated the time and effort involved in complying with these rules by at least a factor of 100, if not a greater order of magnitude." The numbers in the USA Today article suggest that Klafter could have added another zero to the end of that prediction and still have been correct.