SOX 404 INTERNAL CONTROL

Editor’s Note: The following post comes to us from Sarah Rice and
David Weber, both of the Department of Accounting at the University of
Connecticut.In the paper, How Effective is Internal Control Reporting
under SOX 404? Determinants of the (Non-) Disclosure of Existing
Material Weaknesses, forthcoming in the Journal of Accounting
Research, we examine the effectiveness of SOX 404 internal control
reports in identifying existing material control weaknesses, as well
as the determinants of the relative effectiveness of those reports
across firms. While SOX 404 has received significant attention,
largely due to the perceived burden of the associated compliance
costs, how reliably the resulting reports identify weaknesses has
remained largely overlooked in the academic literature. We address
this void by studying a sample of firms that restate previously-issued
financial statements to correct misstatements and that can be
identified as having had existing control weaknesses during the time
of their misstatements. We examine the internal control reports that
accompanied the original (misstated) financial statements to determine
whether firms reported their control weaknesses as required. Thus, our
paper differs from previous research such as Doyle et al. [2007] and
Ashbaugh et al. [2007] in that we are able to separate the reporting
of internal control weaknesses from their underlying existence.
Because weaknesses exist for all of our sample firms, we are able to
focus on the reporting of those weaknesses and thus provide evidence
on the factors that affect detection and disclosure. We sharpen the
interpretation of our evidence by also conducting analyses that
distinguish between factors that affect detection versus those that
affect disclosure.

Our results indicate that the majority of sample firms and their
auditors fail to report existing control weaknesses and instead report
that controls are effective. Only 32.4 percent report the existence of
a material weakness in their SOX 404 reports during the misstatement
period, and this proportion has declined over time. The usefulness of
internal control reports in providing advance warning on the
likelihood of misstatements in the financial reports is reduced if
control weaknesses are not disclosed until after the misstatements
themselves are later revealed. As such, it is important to understand
the conditions that lead to the (non-)disclosure of existing control
weaknesses.
Despite the mandatory nature of material weakness reporting under SOX
404, our empirical evidence suggests that managers’ and auditors’
incentives to detect and disclose internal control problems play an
important role in whether or not existing weaknesses are ultimately
reported. In particular, we find that firms in need of external
capital, larger firms, and firms that pay larger amounts of non-audit
fees to their auditors are less likely to report their existing
control weaknesses, consistent with these factors affecting managers’
and auditors’ incentives to disclose control problems. We also find
that clients of the largest audit firms are less likely to report
weaknesses, while poor financial health, previous financial reporting
and control problems, greater auditor effort, and recent auditor and
management changes are all positively associated with the reporting of
existing control weaknesses under SOX 404.
The results of this study make several contributions to the
literature. By documenting that SOX 404 reports are not always
effective in identifying existing control weaknesses and, further,
that the effectiveness has not improved over time, our results lend
some support to criticisms of internal control reporting in practice
and suggest that recent declines in reported material weaknesses may
not be reflective of improvements in underlying control practices,
consistent with concerns voiced by the SEC. These results also inform
recent debates over the value of requiring control reports to be
audited. Despite the audit requirement of SOX 404, our evidence
indicates that the majority of restating firms provided no advance
warning of the control problems that led to their misstatements.
Finally, our results also have implications for future academic
research. We document considerable variation in whether existing
weaknesses are actually reported and our evidence on the determinants
of that reporting should be considered by future research using public
disclosures to study internal control practices.
We close by noting that this study is subject to limitations. In
particular, our focus on restating firms provides research design
advantages but also presents a potential tradeoff in that the
generalizability of our results to firms with control weaknesses that
do not lead to restatements is unclear. This is particularly true of
our results for Big 4 vs. non-Big 4 auditors because of the direct
role that auditors play in certifying the reliability of financial
statements (and thus in the likelihood of restatement). While
restating firms are important to understand, future research could
develop additional ways to identify (unreported) internal control
weaknesses and extend this line of inquiry to other groups of firms