Automated internal controls may be the buzzword for compliance with Section 404 of Sarbanes-Oxley, but most companies still rely on old-fashioned manual controls even today, nearly six years after 404 first started going into effect.

So says the latest study from KPMG’s 404 Institute. According to its 2009 benchmarking report on SOX compliance efforts—which surveyed more than 1,000 businesses that comply with Section 404—more than half say 80 percent of their key controls are still manual. Another 24 percent say about 60 percent of their key controls are still manual, and 10 percent say it’s split 50-50.

Only 10 percent say a ...