Two Years and Counting: A Review of Sarbanes-Oxley Section 404 Reporting
EXECUTIVE SUMMARY * This article examines the first two years of section 404 reporting data to determine whether section 404 has accomplished its intended purpose and what small companies can learn from the experience of large companies that have implemented section 404 requirements. * The number of companies reporting material weaknesses in their internal controls over financial reporting (ICFR) went from 15.7% the first year to 10.3% the second year. The nature of material weaknesses, the most common of which was GAAP misapplication or failure, remained the same. * Smaller companies reported disproportionately higher numbers of ICFR deficiencies in both years, which were also reflected in a disproportionately higher number of ICFR deficiencies among clients of audit firms that primarily audited smaller companies. * Issuers in the retail and service sectors were most likely to have ineffective ICFR while construction and finance, insurance and real estate were the least likely to report material weaknesses in ICFR. * Research shows that companies that have implemented section 404 are less likely to restate results. Restatements among companies that implemented section 404 declined 14% in 2006 while restatements by companies not yet required to comply with section 404 (non-accelerated fliers) rose 40%. * Large companies can use findings in this article to further improve their ICFR and small companies can use the findings to target their ICFR efforts toward areas, such as GAAP misapplication and failure in tax expense and revenue recognition, that are at highest risk for material weaknesses. ********** Just two paragraphs out of a 66-page law, section 404 of the Sarbanes-Oxley Act created one of the most controversial regulatory requirements since the wave of securities regulations following the stock market crash of 1929. The first-year implementation of new requirements for public companies internal control over financial reporting (ICFR) proved more burdensome and costly than expected, resulting in an outcry from corporate America. With two full years of ICFR reporting data now available, we ask the question, has section 404 improved the quality of ICFR? What can small public companies (non-accelerated fliers) that are preparing to comply with section 404 for the first time gain from the experience of large companies? Our review is a first step toward answering such questions. OVERALL IMPROVEMENT Second-year results show that companies have learned from their first year's experience, marking clear overall improvement in the number of companies reporting material weaknesses. In year one, 3,801 issuers filed form 10-Ks containing management's report on ICFR. Of the 3,801 that filed, 598 issuers, or 15.7%, reported that one or more material weaknesses existed in their ICFR as of the reporting date. In year two, of the 3,907 issuers that filed management's report on ICFR, 402 issuers, or 10.3%, reported ineffective ICFR (see Exhibit 1). Comparing year one to year two, 154 (38%) of the issuers who reported ineffective ICFR in year two had also reported ineffective ICFR in year one. NATURE OF MATERIAL WEAKNESSES The most common material weakness in both year one and year two was GAAP misapplication or failure. In fact, the five most common internal control issues leading to material weaknesses reported in year two and year one were identical (see Table 1). Table 2 reports in order of decreasing frequency the top five GAAP misapplications or failures. Problems with internal controls associated with tax expense and revenue recognition were the most common GAAP application failures for companies in both year one and year two. CHARACTERISTICS OF COMPANIES WITH INEFFECTIVE ICFR Our review reveals a number of trends among the material weakness issuers. Companies with lower market capitalizations made up the majority of issuers with ineffective ICFR (see Table 3). …