A new academic study has found evidence that Sarbanes-Oxley 404 audits of companies’ internal controls significantly reduce the likelihood of issuing materially misstated financial statements.

Albert Nagy

The report, by Albert L. Nagy, an accounting professor at John Carroll University in Cleveland, and published in the current issue of the American Accounting Association’s journal Accounting Horizons, provides evidence that SOX 404 is meeting its objective of improving the quality of financial reports.

Section 404 of the Sarbanes-Oxley Act requires firms and auditors to annually assess the systems of internal control that govern company operations and financial reports. Nagy’s study found that 20 percent of the financial reports from non-complying companies had to be reissued because of material misstatements, compared to only 14.5 percent of the reports from compliers. In other words, non-complying companies proved almost 40 percent more likely than compliers to restate.

Much of the difference is attributable to factors other than compliance, however. Particularly prone to misreporting were companies that achieved four successive quarters or more of earnings growth, as well as firms that had recently sustained losses and companies that acknowledged material weaknesses in their internal-control systems. Controlling for these factors, Nagy estimates that compliance reduced the probability of misstatements by the companies in his sample by 6.3 percent.

“Whether a reduction of this magnitude justifies the expense companies incur as a result of SOX 404 is something that this study can’t answer,” said Nagy. “But it strikes me as a sizeable effect, and, given the progress that regulators have made over time in enforcing the rule efficiently, this finding may serve to moderate the controversy and criticism that S404 set off.”

The Dodd-Frank Wall Street Reform and Consumer Protection Act that Congress passed earlier this year permanently exempts companies with less than $75 million in market capitalization from a key provision of 404 requiring an outside auditor to attest annually to firms’ internal-control evaluations. The small-company exemption becomes law just as the new study suggests that SOX 404 substantially lowers the incidence of financial misstatements.

“It may raise doubts about whether Dodd-Frank should have permanently exempted small companies from having an independent auditor attest to their internal-control assessments,” said Nagy. “The audit report arguably gives S404 its teeth. Evaluation of internal control is rather subjective, and it is questionable whether companies will perform quality assessments without the auditor attestation requirement.”

The Dodd-Frank Act directs the U.S. Comptroller General to investigate whether companies that are exempt from the requirement issue more restatements. Nagy believes his research has essentially done that already. “While the findings do not provide an answer to precisely that question, they certainly come close,” he noted.

The study takes advantage of the fact that SOX 404 was phased in over time, with companies below $75 million in capitalization initially exempt from the rule even while subject to other provisions of SOX. This temporary exemption created a population of complying companies, with capitalizations above the threshold, and a second population of non-complying companies, with capitalizations below that line.

The study’s sample included about 1,000 firms capitalized within $50 million of the threshold — one group capitalized at $25 million to $75 million, and the second at $75 million to $125 million. Firms were observed over the two-year period of 2005-2006, when they issued a total of 1,951 financial statements, of which 375 had to be restated.

“Section 404 eliminates lack of awareness of flawed management as a handy excuse for financial misstatements,” said Nagy. “Now that small firms are exempt from the rule's auditor-attestation requirement, it will behoove regulators to keep a sharp eye on their financial reporting. Although these companies do not dominate the market in terms of capitalization, they represent by far the largest number of public corporations, and there is considerable potential for harm to investors if the financial information they disseminate is inaccurate or misleading.”