A newly published study about the effectiveness of Section 404 of the Sarbanes-Oxley Act of 2002 indicates that this portion of the law may be having the opposite effect of its intent.
SOX 404, as it’s called, is all about transparency and internal controls. It requires companies to report in their annual 10-K statements how effective their internal controls are over financial statements. (The act itself aims to protect investors in the wake of numerous high-profile financial scandals in the early 2000s at several companies.)
In “Does SOX 404 Have Teeth? Consequences of the Failure to Report Existing Internal Control Weaknesses,” which was recently published in The Accounting Review, a journal of the American Accounting Association, researchers found that companies that are transparent about internal-control problems may actually incur a variety of what they call “penalties” more often than those that don’t report weaknesses.
The study’s authors – Sarah Rice, assistant professor in the accounting department at Texas A&M University; David Weber, CPA, associate professor of accounting at the University of Connecticut; and doctoral candidate Biyu Wu of the University of Connecticut – reported that the likelihood of the so-called penalties, perhaps better stated as repercussions, incurred by those companies giving advance notice of problems were indicated as percentages in four categories:
- Enforcement actions by the US Securities and Exchange Commission (6 percent more likely)
- Class-action lawsuits (5 percent to 10 percent)
- Top management turnover (15 percent to 26 percent)
- Auditor turnover (6 percent to 9 percent)
The study’s findings also held true when researchers considered only cases in which there was evidence of intentional, as opposed to inadvertent, misstatement.
“Even for this subsample, where there is a higher likelihood of intentional misreporting, we again find no evidence of enforcement of SOX 404,” the researchers wrote. “Instead, penalties are more likely for restating firms that have previously reported control weaknesses."
The study’s authors drew their conclusions from 659 companies that filed restatements from November 2004, when SOX 404 took effect, through 2010.
Of those companies, 134 reported material weaknesses of internal controls before restatements. Of the 525 companies that did not report those weaknesses, 314 reported internal-control weaknesses at the time of restatement.
“I must admit that my colleagues and I were only mildly surprised that firms which fail to [report problems] aren't penalized,” Weber said in a prepared statement. “What surprised us a lot more is that companies which evidently take SOX 404 to heart are penalized. That's certainly no way to encourage the candor the law envisions."
What’s more, he believes the study helps answer why reports of internal-control weaknesses declined after SOX’s enactment, something that regulators have attempted to decipher.
“Was the decline a result of improved internal controls or just that weaknesses were not being reported?” Weber said. “Our paper goes a fair way, I believe, toward answering that question.”
The question all of this raises, of course, is what should be done?
Misleading or untrue statements about material facts is a violation of federal law, and that includes the internal-control requirements under SOX 404, the study states.
While control reporting is tough to enforce, it’s got to be done if SOX 404 is to “fulfill its underlying objective of enhancing investor confidence in the reliability of financial reporting by providing an early warning of the possibility of impending accounting problems,” the study states.