As expected, the Securities and Exchange Commission this week moved to finalise guidelines for companies and auditors to comply with Sarbanes-Oxley. This is supposed to mark the final stage of easing the burden of the 2002 law, changes that were flagged months ago.

The aim of the exercise is to give companies and auditors more flexibility by allowing them to tailor audits to suit the circumstances of a business, encouraging auditors to use their own judgment in the process and allowing them room to determine when they can rely on work previously done by others. More in this Associated Press report.

At the same time, we have the report that the Public Company Accounting Oversight Board has proposed a new standard requiring auditors to distinguish between restatements that arise from changes in accounting principles and those that are due to errors.

These are encouraging developments but we're still to see whether US regulators will go all the way to adopt a more flexible, "principles-based" approach to corporate controls than what was set in stone under Sarbanes-Oxley nearly five years ago.

There are still some issues to sort out. Like, for instance, the differences between the SEC's "management guidance" and the PCAOB's proposed auditing standard known as AS-5 which critics have slated as too inflexible.

Even the SEC press release acknowledges (right at the end), that there's still some work to be done. It's an old trick that organisations do when they put out press releases: you put the bad news on the bottom and hope the journalist won't get that far.

According to the press release release, there's still work to be done in four areas: aligning the PCAOB's AS-5 with the SEC's proposed management guidance; scaling the 404 audit to account for the particular facts and circumstances of companies, particularly smaller companies; encouraging auditors to use professional judgment in the 404 process, particularly in using risk-assessment; and following a principles-based approach to determine when and to what extent the auditor can use the work of others.

Watch the regulators thrash those out. We're not there yet. To get some idea of how much work there's still to do, read this report.

The other question is whether the new flexibility will undermine the rationale of Sarbanes-Oxley's intent to protect investors. In other words, are the regulators tilting too far to business?