Does SOX 404 Have Teeth?

Internal controls represent an organization’s processes and procedures used to meet its goals and objectives and serve as a defense in safeguarding assets and preventing and detecting errors, fraud, and abuse. Effective internal controls provide reasonable assurance that an organization’s objectives are achieved through (1) reliable financial reporting, (2) compliance with laws and regulations, and (3) effective and efficient operations. The passing of the Sarbanes-Oxley Act of 2002, as well as the numerous corporate frauds and bankruptcies over the past decade—including some

One must therefore assume that all of the increase in compliance costs post Section 404 is due to a mix of increased audit effort, higher auditor liability risk and higher internal audit costs. Raghunandan & Rama(2006) study the audit fee component of SOX Section 404 compliance by US firms using data on a sample of manufacturing companies from Jan 2003 to Sep 2005. They find that the mean total compliance costs is $2.2 million among the firms that voluntarily disclosed this information.2 (Bedard, Carson and Simnett 2009) study the relationship between cross-listing and the pricing of audit

There are eleven titles to the Sarbanes Oxley act and the orders for compliance fall under the sections 302, 302, 401, 404, 409, 802 and 906. Of these sections section 404 deals with an important aspect of internal controls in corporate structures. (Romano, 2005) Section 404 is found under title IV. (Sonnelitter, 2005) The provisions of corporate governance (404) SOX was not a point of detailed debate. However there is an accusation that SOX being made mandatory is wrong. (Romano, 2005) The section 404 makes it mandatory for the company to establish and maintain a system that can control the internal activities of the company and financial reporting. This comes as a directive for public companies. (Snedaker, 2006) The federal regulation of financial markets is always the result of market problems. There is a school of thought that maintains that the disclosures under the act could be made optional instead of mandatory. (Romano,

Sarbanes-Oxley Act was enforced in the past but caught everyone’s attention when drastic audit failures from Enron and Worldcom happened. An enhanced act (SOX) was enacted in 2002 improving audit quality. In particular, section 404 provides guidance of assessment to internal control. For an accounting perspective, internal control is a system for internal and external auditors to measure performance and recommend the improvement of the control. It is definitely correct that both enforcement and the system are to address the risks of frauds. In the meantime, a new regulatory agency, the Public Company Accounting Oversight Board (PCAOB) was created to monitor the work of public accountants. Among SOX and the PCAOB, accounting

The SOX act was put in place to force companies to obtain audits of the internal operation. The internal investigations were put in place to reduce the amount of in house fraud that businesses receive from their employees. Based on SOX audits, “Markets have been able to use the information to assess companies more effectively, managers have improved internal processes, and the internal control testing has become more cost-effective over time, per Srinivasan (Hanna, 2014)”. Companies that use the internal audits to properly manage their companies, will see a decline in fraud within their

The Sarbanes-Oxley Act (SOX) of 2002, aims to combat fraud, improve the reliability of financial reporting and restores investor confidence. Section 404 of Sarbanes-Oxley emphasize the management’s responsibility in maintaining a sound internal-control structure of financial reporting and assessing its own effectiveness. While the auditors’ responsibility is to attest to the soundness of management’s assessment and to report on the state of the overall financial control system. Although it has been a question by most executives, however, some approached the new law with gratitude. As SOX went into effect, more executives had realized the need for internal reforms; they were startled by the weaknesses and gaps of their internal control that compliance reviews and assessments had exposed.

The first internal control weakness that is persistent is the FCC’s financial reporting processes is inadequate manual reporting process and financial system integration. Another significant deficiency of the internal control system identified is the information technology controls of the FCC. The two weaknesses are considered to be significant deficiencies however; the auditors never specified whether the deficiencies were material. A significant deficiency in internal control is a deficiency or combination of deficiencies that is not severe than a material weakness, though important enough for

Section 404 of the Sarbanes-Oxley Act requires management to evaluate and test the effectiveness of their company’s internal controls over financial reporting. The company’s auditor has to issue a formal report on management’s evaluation of its controls.

     The second standard requires public accounting firms to audit internal controls in conjunction with an audit of financial statements. The second standard requires public accounting firms to attest that the internal controls documented and set forth by the company audited are sufficient to ensure the integrity of the financial statements (Griggs). This second standard is a real breakthrough in ensuring the financial statements of a company are sound. It is impossible for a public accounting firm to audit every detail of large multi-national company. Strong internal controls reduce the risk of material misstatements to a company’s financials caused by negligence or fraud. Maintaining internal controls is no longer enough. Companies must now analyze and document their internal processes (Calabro). When a public accounting firm issues an unqualified opinion on the internal controls of a company, which will be required starting November 15, they are stating that the internal checks set forth adequately protect the assets of a company from negligence or fraud.

Finally, Title IV section 404 requires management to include an internal controls assessment in its annual report to the SEC. The purpose of this legislative action now requires management to be responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting; provide an assessment of the effectiveness of the company’s internal controls. (Williams, 2011)

A recent study by Xue Wang (Emory University) tackles how SOX has affected the compensation and turnover rates of CFOs.   They play a critical role in developing firms’ financial reporting and making voluntary disclosure decisions.   Moreover, CFOs are ultimately responsible for the quality of internal control systems.   The study provides some important insights about the impact of SOX on the executive labor market.   It shows that requiring more disclosure of information about a firm’s internal controls provides some positive benefits with respect to corporate governance, in this case making it easier for boards to monitor the activities of CFOs.   In comparing and contrasting firms with strong internal controls received an increase in salary, bonus, and total compensation in the post-SOX time periods.   In contrast, CFOs of corporations reporting a problem with their internal controls incurred a significant reduction in their compensation packages.   With respect to CFO turnover, Wang did find that CFO turnover rates generally increased form the pre- to post-SOX period.

When it comes to top-down versus bottom-up approach, Trinity used a top-down approach with Mr. Collum leading the project on compliance. He and his steering committee laid out all of the factors for sox compliance and internal controls. A bottom-up approach would have started from manufacturing line of the business. Bottom-up has material risks but can easily be identified and corrected compared to top-down where it can stall an investigation into the risk. This would also improve the financial reporting for Trinity.

The final responsibility for the integrity of an SEC registrant’s internal controls lies on the management team. U.S. companies need to refer to a comprehensive framework of internal control when assessing the quality of financial reporting to determine that financial statements are being presented under General Accepted Accounting Principles, GAAP. The widely used framework is referred as COSO, Committee of Sponsoring Organizations of the Treadway Commission, sponsored by the following organizations American Accounting Association, the American Institute of CPA’s, Financial Executives International, the Institute of Internal Auditors, and the Institute of Management Accountants. COSO’s defines internal control as:

In comparison to Doyle et al. study, Doyle and his colleagues hypothesized that the “complexity of the firm is a driver of internal control weaknesses (Doyle et al., 9).” To measure the business complexity of a firm, Doyle et al. used three measures to include the number of special purpose entities, number of operating segments and the existence of foreign currency adjustment. The findings of Doyle et al. were as predicted. The three complexity measures were higher in firms that reported material weaknesses in comparison to the 2003 Compustat firms, who did not report any material weaknesses. This indicates that company complexity is positively correlated to the disclosure of material misstatements.

Internal control is the process designed, implemented and maintained by those charged with governance, management and other personnel to provide reasonable assurance about the achievement of an entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations. The term “controls” refers to any aspects of one or more of the components of internal control. (Ifac, 2010, p. 264)