How Effective is Internal Control Reporting under SOX 404?

In the paper, How Effective is Internal Control Reporting under SOX 404? Determinants of the (Non-) Disclosure of Existing Material Weaknesses, forthcoming in the Journal of Accounting Research, we examine the effectiveness of SOX 404 internal control reports in identifying existing material control weaknesses, as well as the determinants of the relative effectiveness of those reports across firms. While SOX 404 has received significant attention, largely due to the perceived burden of the associated compliance costs, how reliably the resulting reports identify weaknesses has remained largely overlooked in the academic literature. We address this void by studying a sample of firms that restate previously-issued financial statements to correct misstatements and that can be identified as having had existing control weaknesses during the time of their misstatements. We examine the internal control reports that accompanied the original (misstated) financial statements to determine whether firms reported their control weaknesses as required. Thus, our paper differs from previous research such as Doyle et al. [2007] and Ashbaugh et al. [2007] in that we are able to separate the reporting of internal control weaknesses from their underlying existence. Because weaknesses exist for all of our sample firms, we are able to focus on the reporting of those weaknesses and thus provide evidence on the factors that affect detection and disclosure. We sharpen the interpretation of our evidence by also conducting analyses that distinguish between factors that affect detection versus those that affect disclosure.

Our results indicate that the majority of sample firms and their auditors fail to report existing control weaknesses and instead report that controls are effective. Only 32.4 percent report the existence of a material weakness in their SOX 404 reports during the misstatement period, and this proportion has declined over time. The usefulness of internal control reports in providing advance warning on the likelihood of misstatements in the financial reports is reduced if control weaknesses are not disclosed until after the misstatements themselves are later revealed. As such, it is important to understand the conditions that lead to the (non-)disclosure of existing control weaknesses.

Despite the mandatory nature of material weakness reporting under SOX 404, our empirical evidence suggests that managers’ and auditors’ incentives to detect and disclose internal control problems play an important role in whether or not existing weaknesses are ultimately reported. In particular, we find that firms in need of external capital, larger firms, and firms that pay larger amounts of non-audit fees to their auditors are less likely to report their existing control weaknesses, consistent with these factors affecting managers’ and auditors’ incentives to disclose control problems. We also find that clients of the largest audit firms are less likely to report weaknesses, while poor financial health, previous financial reporting and control problems, greater auditor effort, and recent auditor and management changes are all positively associated with the reporting of existing control weaknesses under SOX 404.

The results of this study make several contributions to the literature. By documenting that SOX 404 reports are not always effective in identifying existing control weaknesses and, further, that the effectiveness has not improved over time, our results lend some support to criticisms of internal control reporting in practice and suggest that recent declines in reported material weaknesses may not be reflective of improvements in underlying control practices, consistent with concerns voiced by the SEC. These results also inform recent debates over the value of requiring control reports to be audited. Despite the audit requirement of SOX 404, our evidence indicates that the majority of restating firms provided no advance warning of the control problems that led to their misstatements. Finally, our results also have implications for future academic research. We document considerable variation in whether existing weaknesses are actually reported and our evidence on the determinants of that reporting should be considered by future research using public disclosures to study internal control practices.

We close by noting that this study is subject to limitations. In particular, our focus on restating firms provides research design advantages but also presents a potential tradeoff in that the generalizability of our results to firms with control weaknesses that do not lead to restatements is unclear. This is particularly true of our results for Big 4 vs. non-Big 4 auditors because of the direct role that auditors play in certifying the reliability of financial statements (and thus in the likelihood of restatement). While restating firms are important to understand, future research could develop additional ways to identify (unreported) internal control weaknesses and extend this line of inquiry to other groups of firms.

The full paper is available for download here.