Companies trying to comply with the Sarbanes-Oxley Act of 2002 are finding that one of the toughest—and yet most essential—areas for establishing controls over internal processes and procedures isn’t even required under the law: spreadsheets.

BNSF Railway recently went through the process. The company, a subsidiary of the $13 billion Burlington Northern Santa Fe Corp., is one of the largest railroad networks in North America, and its financial department—like many in Corporate America—is heavily reliant on spreadsheets. In the latter part of 2004, when the company was racing to comply with Sarbanes-Oxley for the first time, BNSF's accounting firm provided guidance ...