The staffs of the Securities and Exchange Commission and the Public Company Accounting Oversight Board are churning new guidance on how companies can better navigate the internal control provisions of The Sarbanes-Oxley Act of 2002. That’s the promise of those agencies’ respective chairmen, made at a packed SEC roundtable event last week. The PCAOB has promised guidance by mid-May, while the SEC offered no precise timeline.

During the roundtable, comments focused on the cost of first-year compliance, the scope of internal control testing and reporting, and lack of communication between auditors and their clients. In the end, panel discussions turned toward the creation of a risk-based approach, where auditors could exercise more judgment about which controls deserve greatest attention.