• SOX 404 Not Helping: Study

    By | April 29, 2015

    A recent study by Sarah Rice of Texas A&M and David Weber and Biyu Wu of the University of Connecticut has found that everyone's favorite section of the Sarbanes-Oxley Act of 2002 is falling short on expectations:

    The study, which appears in in the new issue of the American Accounting Association’s journal The Accounting Review, found that not only do companies that give advance warning of internal-control problems gain nothing by their transparency but they are actually penalized compared to companies that divulge such problems only when forced to restate their finances, which is too late to be of help to investors.

    Wait, wait, wait, wait, wait. Are they saying that a company, in the spirit of the law, that discloses internal control weaknesses in a timely fashion is no better off than if they just keept their traps shut about it until it's too late?!   

    Yep, that's what they're saying.

    "We find no evidence that penalties following a restatement are more likely for firms that fail to detect and disclose their control weakness as required,” said the study. “Instead, firms that do report their control weaknesses in a timely manner are generally more likely to face [varied] penalties in the event of a later restatement. These results are consistent with the disclosure of control weaknesses making it difficult for management to plausibly claim later that they had been unaware of the underlying conditions in the control environment that led to their restatements." 

    Welp. Shall we pack it in then, opiners? 

    [AT]

    • buthurt

      I’m a strong believer that SOX 404 was the greatest scam the public accounting industry, regulators, and public companies pulled off on the investors. Correct me if I’m wrong but only material weakness would be disclosed on the 10-K, so the auditors have every incentive to downgrade material weakness to significant deficiency (sure they still have to discuss the significant deficiency with Audit Committee, who only care about lowering audit fees), and thus the investors have no clue how fucked up a company’s internal control is. At the end of the day, auditors (well partners really, all the underlings get crushed on new quality requirements for SOX as a result of PCAOB’s inspection finds) get slightly higher fees, and companies look good (hey we have a GREAT control environment – just look at all these freaking signoffs on random papers). As investors become smarter over the years, they realize how stupid auditing controls is, which is why we have this research report.

      • MWCPA

        This plus the SEC’s realization that after a decade there is still no consensus (or even a plurality) on how the hell management review controls should be designed, much less audited, is pretty damning.

        • buthurt

          Agreed. The expectation that a bunch of 24/25 year-olds can understand the business enough to audit management review controls is ridiculous. What’s much much worse is when 24/25 year-olds think they DO understand the business enough that they are capable of auditing management review controls.

          Looking back at some of my engagements, I got an insane amount of BS explanations from some clients which at that time I considered to be gold

          • FartDude

            Auditors aren’t very good at their jobs?

            Shocking!

            • MWCPA

              Shit, we’ll audit the piss out of something if the regulators can agree on how to do that. Problem is – they don’t.

      • IndenturedServant

        In my experience, the internal SOX specialist has always been the most underworked and overpaid person in the accounting department.

    • Point and Clique

      Even more than the fact that clients pay the auditors’ bill, auditing’s never going to change as long as the mental, physical, and emotional health of audit teams is dependent on getting out of there as fast as possible. When finding and documenting exceptions means working 18-hour days the last week of an audit instead of 14-hour days, can the team really be expected to impartially deal with possible problems?