Could Sarbanes-Oxley be working? Four years after the financial scandals rocking Enron and other large companies prompted Congress to toughen disclosure and governance laws, defenders and detractors of the legislation remain as divided as ever over whether the high costs of compliance are worth whatever benefits it's bringing about. To date, defenders have had a hard time making their case, if simply because the law wasn't crafted as a quick fix but as a solution that would gradually yield benefits over time. Critics of the law had plenty of ammunition as auditing fees shot up into the millions for most companies. And there have been many critics. Last year, Financial Executives International said that 94% of companies it surveyed felt the costs were outweighing the benefits. In February, the executive recruiting firm Korn/Ferry found that 58% of corporate board directors felt the law "should be repealed or overhauled." However, another, less-publicized survey from Deloitte showed that companies do expect benefits to kick in over the next few years: 71% said Section 404 -- the most contested provision, which requires complex internal controls -- would help them better understand and mitigate risks, while 67% said it reduced material misstatements. Other benefits included a stronger corporate culture and more confidence in their financial reports. Only 6% were expecting no benefits at all. "None of us likes more regulation, but I actually think SOX 404 is helpful," General Electric ( GE) CEO Jeffrey Immelt said in a letter to shareholders, noting that GE had spent $33 million on compliance in a single year. "It takes the process control discipline we use in our factories and applies it to our financial statements." Granted, CEOs penning shareholder letters try to put a sunny light on all expenditures, but Immelt's point suggests something many investors are waking up to: The best-run companies would be taking controls seriously even without the law. And if a company's financial controls are in disorder, you have to wonder: What else isn't working?