A great deal of frenzy currently surrounds the Sarbanes-Oxley requirement that public companies assess, and their outside auditors attest to, the effectiveness of the company's internal controls.

To paraphrase Epicetus, "[w]hat concerns me is not the way things are, but rather the way people think things are." Most companies seem to be adopting one of two diametrically opposed, but equally ill-advised, approaches: Some take the new requirements at face value, while others, like Henny Penny, act as if the sky is falling.

Both extremes are ill-advised.

Public companies should focus on the fundamental changes Section 404 will require ...