Reflections on a Decade of SOX 404(b) Audit Production and Alternatives

SYNOPSIS Since passage of the quickly finalized Sarbanes-Oxley Act during July 2002, audit production in the U.S. has been substantially expanded by mandated internal control audits. The control audit mandate is unique to the U.S. and costly to apply, yet little is known about the conduct of control audits or the efficacy of lower-cost alternatives. This paper reflects our overall knowledge about control audit production and observation of a consistent message across public and limited non-public archival data, analytical studies, and numerous personal experiences of audit practitioners. Our primary observation is that, absent any financial misstatement, auditors find it difficult to identify material weaknesses in control design. Conversely, when auditors know about misstatements they can, and do, detect related material weaknesses and thereby identify most public companies found by mandated control audits to have ineffective controls. Thus, it appears possible to exploit this observation to identify and publicly disclose most companies with weak controls without incurring the cost of full internal control audits. We believe that U.S. markets could benefit from more transparency about the current U.S. audit production process and from informed debate about the best mechanism design for balancing the needs of all parties interested in internal control quality disclosure.