It's August of 2003: Do you know where your company's Sarbanes-Oxley compliance system is?

Like many companies, your publicly traded $3 billion retail operation has been a rather late—and disgruntled—adopter of the tough corporate-compliance rules triggered by the Sarbanes-Oxley Act of 2002. You've struggled to meet the provisions of Section 302, already in effect, which covers detailed certification of quarterly financial statements. But Section 404, which holds executive management responsible for their company's internal control system, is now looming large.

So it's time to get moving: If a company's compliance system doesn't measure up, it'll be the CEO's (and the CFO's) head on a platter. The challenge is nothing less than a thorough analysis and overhaul of all internal controls. And this isn't a corporate-only job; all six subsidiaries and 2,000 stores, plus hundreds of employees, will need to be involved—and diverted—in the process.

Creating a system that meets the new requirements won't be cheap, either. AMR Research estimates that Fortune 1000 companies will spend $2.5 billion on Sarbanes-Oxley compliance this year. A few million of that will come from you, mostly in staff time. A consulting firm will help you scope out the project and implement a Web-based compliance application that will help manage the flow of work. But in the end, technology and consulting costs will be just a drop in the bucket compared with your ongoing internal costs.

The return on this investment? The exhaustive analysis of processes may generate some incremental returns, but few companies are expecting a windfall. For now, it's simply a cost of doing business—one you'll be sure to document and certify in your brand-new compliance system.

To see the details behind this planner and fill in your own estimates, click on the Tool icon above and download the interactive worksheet.