(FORTUNE Magazine) – This holiday season marked a rough stretch for corporate America. That's because of a tiny163-word nugget of Sarbanes-Oxley called section 404. It calls for public companies to assess their own financial reporting internal controls (essentially the system of checks and balances that every company has to prevent fraud or error) at fiscal year-end. More important, they have to pass muster with auditors. The rolling deadline began Nov. 15 (with exceptions for certain types of companies) and will continue until every company reaches its next fiscal year-end. But for the hordes of companies whose year ends Dec. 31, Christmas was crunch time. "It's created a lot of stress in the system," says Dennis Nally, chairman of PricewaterhouseCoopers in the U.S. His firm recently surveyed 700 clients and found that about 10% were at severe risk of not finishing work in time for auditors to even render an opinion, 70% of the companies were working on a tight timeline, and just 20% seemed to be swimming along. As for firms that may have to report a "material weakness," estimates vary but run as high as 20% or more.

Some companies are beating the regulators to the punch by disclosing problems early. Industry newsletter Compliance Week said disclosures of material weakness or significant deficiency in internal controls nearly doubled from October to November (DuPont and ISG are just two of the companies that have already hinted at potential problems). And even for those that are on schedule, the tab for section 404 is hefty: Financial Executives International, a professional organization, found that the average company they surveyed expected to spend $3.14 million to get 404-ready. --Ellen Florian Kratz