The amount of money a corporation spends complying with the Sarbanes-Oxley Act of 2002 depends to such an extent on its existing processes, organization and technology that it's almost impossible to estimate the total cost, analysts complain.

According to a survey of its members, Financial Executives International says a typical company will spend $4.6 million this year on SarbOx, plus an additional 38% per year for future audits. AMR Research predicts compliance budgets will go up 10% per year after the act goes into full effect in December.

Those expecting big bills are the smart ones, says Robert Kugel, vice president and research director of Ventana Research. Taking an on-the-cheap approach and then having to re-do the documentation will be far more expensive, even if you don't include potential fines, he says.

Companies that use compliance projects to streamline their processes a la the business process re-engineering efforts of the 1980s could well come out ahead by making their financial procedures more efficient, says Brian Wood, research director at Gartner Inc. Shaking out the inefficiencies will save time and money, he adds, even if the real costs won't be clear until 2005.

When the bill is tallied, the CEO and CFO should insist on seeing a positive return, not just a cost, agrees Jim DeLoach, managing director of risk-analysis consultancy Protiviti Inc.: "This is an incredible opportunity to build efficiency into the [business] process while simultaneously reducing its reporting risk."