There is some debate over the specific requirements of
the Sarbanes Oxley act, as written.

The business community has generally acknowledged that, as John A. Thain, CEO of the New York Stock Exchange states, "There is no question that, broadly speaking, Sarbanes Oxley was necessary". However, the cost of implementing the new requirements has led some to question how effective or necessary the specific provisions of the Sarbanes Oxley Act truly are.

One key area of cost is the updating of information systems to comply with the control and reporting requirements. Systems which provide document management, access to financial data, or long-term storage of information must now provide auditing capabilities. In most cases this requires significant changes, or even complete replacement, of existing systems which were designed without the needed level of auditing details.

Sarbanes Oxley | SarbOx | SOX 404

Costs associated with Sarbane Oxley 404 compliance have proven to be higher than first anticipated.

According to the Financial Executives International (FEI), in a survey of 217 companies with average revenue above $5 billion, the cost of compliance with the Sarbanes Oxley Act was an average of $4.36 million. The survey also indicated actual costs of to be approximately 39% higher than companies expected to spend. The high cost of compliance throughout the first year can be attributed to the sharp increase in hours charged per audit engagement. However, non-compliance comes with an even higher cost in terms of stiffer penalties and jail sentences.

Source - Wikipedia