A global review of internal control practices indicates the prescriptive, rules-based approach that drives Sarbanes-Oxley and its Section 404 reporting requirements does not breed good business practices, but merely a check-the-box compliance mentality.
