Where particular manifestations of BRA may have suffered in the immediate post Enron period, criticisms of the implementation of section 404 of the Sarbanes-Oxley legislation, and of related audit guidance, suggest that risk assessment is now regarded as part of the common sense of both auditing and regulating.