A recent study from Audit Analytics, “SOX 404 Disclosures: A Fifteen-Year Review,” that analyzed internal control over financial reporting (ICFR) disclosures over the past 15 years reveals some interesting trends.
Part of the original Sarbanes Oxley Act of 2002, Section 404—or SOX 404 as it is often referred—mandates large companies (accelerated filers) review their ICFR to determine whether those controls are effective. That determination, known as adverse auditor attestations, helps those companies establish whether their financial statements are accurate and complete.
As seen in the chart below, a whopping 15.9 percent of accelerated filers disclosed ineffective ICFR in 2004, which was followed by six years of consecutive improvement, dropping all the way to just 3.5 percent in 2010. The percentage rose steadily over the next six years.
Why the change? According to Audit Analytics, “during 2010 and 2011 … [Public Company Accounting Oversight Board] inspections of audits began to determine if the audit process obtained adequate evidence to substantiate the auditor’s attestation of the management’s assessment regarding the effectiveness of ICFR.” That involvement from the PCAOB, notes the study, had a significant impact on the results. The figure rose to 6.7 percent in 2016, fell again in 2017 to 5.2 percent, and rebounded to 6 percent in 2018 (a value, notes the report, similar to 2014 and 2015).
Small companies (non-accelerated filers), while not required to produce adverse auditor attestations, are mandated to report management-only assessments. According to Audit Analytics, just 30 percent of small companies reported ineffective ICFR in 2007—the first year non-accelerated filers were mandated to make those assessments. The report shows that from 2008 through 2014, the percentage of non-accelerated filers reporting ineffective ICFR progressed steadily, rising to 40.9 percent before dropping down to values between 39 and 40 percent. Those percentages have stayed above 39 percent since 2013—a significantly higher ineffective reporting rate than that disclosed by accelerated filers, notes the report. Small companies ranked personnel concerns, such as inadequate training and segregation of duties issues, as the primary reason for the lower ranking.
“The totals and trends noted above are more significant now that the SEC demonstrated in 2019 that it will not tolerate a habitual status of ineffective ICFRs and is prepared to fine companies that are unable or unwilling to correct such deficiencies,” says Don Whalen, general counsel and director of research at Audit Analytics.
Click here to purchase the full report.
No comments yet