The 404 Plunge

The Sarbanes-Oxley Act of 2002 has been a headache for senior leaders at public companies across the country, but by and large, markets have welcomed the law’s push for an increased level of disclosure and management responsibility for truth in financials.

Although nonprofit hospitals aren’t required to follow any of the law’s provisions—Sarbox only applies to public for-profit companies—pressure to implement at least some of the law’s reforms is growing from institutional investors who underwrite hospitals’ debt and board members who want greater accountability from the people they trust to mind the store. But implementing the onerous section 404 of the law—management’s certification of the effectiveness of an organization’s internal controls—has largely been ignored by even large nonprofit hospital systems. That’s because it’s so expensive an undertaking, says Dee J. Balle Jr., Americas provider care sector leader at Ernst & Young LLP in Irvine, Calif. A recent survey by the consultancy found that of the 70 publicly traded healthcare companies who have filed 404 reports, between 10,000 and 25,000 hours were spent internally in preparation time.

“That excludes any external audit hours that were involved,” Balle says. “The message is it’s going to take a lot more time than you think it’s going to take.” Further, of that 70, 52 spent between $1 million and $2 million on the exercise.

Another complaint about 404 implementation—an exercise that rigorously checks each internal control for efficacy and redundancy—has been that public companies had to finish the review within a year. But now that most public companies have completed the process, nonprofits not bound by the one-year restriction may benefit from lessons learned.

“I feel great about the progress we’ve made,” says Robert DeMichiei, chief financial officer of the University of Pittsburgh Medical Center, one of a handful of nonprofit systems that have tackled 404 compliance. “I have much more comfort in our processes and our financial statements.”

The exercise can also yield real efficiency gains, as well as actual ROI, as processes are streamlined and made more relevant to the way the business operates today, as opposed to years ago.

During its review, UPMC found many redundant and conflicting internal controls, and DeMichiei is confident the $5 billion organization will emerge more efficient after its certification from outside auditors in September. DeMichiei adds, however, that Sarbanes compliance may not be cost efficient for some smaller community hospitals. “From what we’re seeing in lessons learned, (section 404) isn’t for everyone.”

—Philip Betbeze