Public companies now have until November to comply with Sarbanes-Oxley provisions requiring that they document their internal financial controls. CIOs can thank Microsoft.In March, the SEC extended for the second time the deadline for compliance with Section 404, so far the most expensive and IT-intensive part of law. The decision was in response to a January letter drafted by Microsoft and signed by its CFO, along with the CFOs of Cardinal Health, Costco, Procter & Gamble and the WD-40 company. The group argued that the existing June deadline didn\u2019t allow enough time to react to anticipated rules defining how auditors should evaluate companies\u2019 internal financial controls. Three of the five companies, including Microsoft, have fiscal years that end in June. The others\u2019 fiscal years end in August.The five companies argued that they need more time to test their systems and financial-reporting processes against the new standard, which was eventually issued by the Public Company Accounting Oversight Board on March 9. Says Steve David, CIO of P&G: "We don\u2019t want to spend extra money to prepare for something that won\u2019t be audited, and not prepare for things that will."It\u2019s no coincidence that the CIOs at the five companies are involved with Sarbox compliance. But Richard Roth, chief research officer with the Hackett Group, says lots of CIOs are still out of the loop. Now, they will have more time to get involved.