Despite dire predictions last fall that 20% or more of

companies might flunk the first audits of internal controls under Section 404 of the Sarbanes-Oxley Act, it now appears that only 8% didn't clear the bar. And for the most part, even those that had to admit to material weaknesses in their systems did not find themselves severely punished by equity markets. Yet, the process was hardly painless and companies have been howling for months about the resources needed for the first year of compliance. In 2004, the costs for just the nation's largest companies have been estimated at $1.4 billion.

The hand-wringing may not have been in vain. Although no one at the Securities and Exchange Commission (SEC) or the Public Company Accounting Oversight Board (PCAOB) would characterize it as such, there is evidence that the two agencies primarily responsible for Section 404 compliance are backing off a bit from their take-no-prisoners stance of last year. In mid-May, for example, the two came out with guidance for external auditors that emphasized exercising good judgment and relying on the work of others when auditing internal controls. Auditors should integrate the audits of financial reporting and internal controls, the regulators say. They should work from the top down, rather than wasting time checking low-level controls that aren't that important, and they should rely on controls assessments performed by the company when that's appropriate. Regulators say the guidelines should help cut 404-related costs in the second year of compliance, and observers agree.