AMERICAN ACCOUNTING ASSOCIATION
http://aaahq.org
CONTACT: Ben Haimowitz (718-398-7642 or 917-903-9287)
Email: hhaimowitz@aol.com
Now further reason for doubt about SOX 404: it is failing it to achieve its basic purpose, study finds
Far from rewarding transparency, provision actually penalizes it
The SEC has been much concerned lately with companies' internal controls, the systems firms establish to guide management of assets, assure compliance with laws and regulations, and see that financial statements are reliable and in accord with generally accepted accounting principles. In a March 3 speech, a high agency official said that increased attention by top executives to strong internal controls was "one of the most important shifts of the past 10 or 15 years" among public companies and noted with pride that "internal-control problems have prominently featured in recent enforcement cases."
Enforcement focuses in large part on section 404 of the Sarbanes-Oxley act of 2002, passed in the wake of notorious corporate accounting scandals, a provision requiring firms and their auditors to formally attest in annual reports to the effectiveness of company internal controls over financial reporting. Much criticized for saddling companies with a costly and complicated requirement, SOX 404 now comes into question on another score. The SEC's vaunted enforcement efforts notwithstanding, a new study entitled "Does SOX 404 Have Teeth?" casts doubt on whether the provision is fulfilling its basic purpose -- namely to provide advance warning to investors of potential company problems.
The paper, in the new issue of the American Accounting Association journal The Accounting Review, finds that not only do companies that give advance warning of internal-control problems gain nothing by their transparency but they are actually penalized compared to firms that divulge such problems only when forced to restate their finances – too late to be of help to investors.
As the authors report, "We find no evidence that penalties following a restatement are more likely for firms that fail to detect and disclose their control weakness as required. Instead, firms that do report their control weaknesses in a timely manner are generally more likely to face [varied] penalties in the event of a later restatement. These results are consistent with the disclosure of control weaknesses making it difficult for management to plausibly claim later that they had been unaware of the underlying conditions in the control environment that led to their restatements."
As an example of the fate that awaits restating companies and executives that provided advance notice of control weakness, the study notes that doing so increases the likelihood of SEC action by about 6%, probably because it aids the agency "in identifying cases where potential enforcement actions are likely to succeed and make it difficult for management to claim they were unaware of the problems that led to the restatement."
Further, "class action lawsuits are 5 to 10% more likely when firms report internal control weaknesses prior to restatements...Top management turnover is 15 to 26% more likely...Auditor turnover is 6 to 9% more likely."
Two of the authors of the new study, Sarah C. Rice of Texas A&M University and David P. Weber of the University of Connecticut found in earlier research that only a minority of firms that issue restatements stemming from control weaknesses reported the weaknesses prior to the restatements. Now they take their investigations a step further and, with Biyu Wu of the University of Connecticut, find a likely cause for their previous findings.
Comments Prof. Weber: "For as long as anyone can recall, investors have complained about being blindsided by companies, where one day everything is fine and the next day it all falls apart. SOX 404 is supposed reduce the incidence of that sort of thing, but to do its job there has to be an incentive for top execs and auditors to divulge control problems in the company annual report, as mandated by the provision. I must admit that my colleagues and I were only mildly surprised that firms which fail to do so aren't penalized. What surprised us a lot more is that companies which evidently take SOX 404 to heart are penalized. That's certainly no way to encourage the candor the law envisions."
He adds: "For some time now, regulators have been puzzling over a decline in reported internal-control weaknesses since the years right after SOX's enactment, when the spectacle of top executives in handcuffs was still fresh in people's minds. Was the decline a result of improved internal controls or just that weaknesses were not being reported? Our paper goes a fair way, I believe, toward answering that question."
The study's findings derive from an analysis of the incidence of weakness-reporting or lack of it among 659 firms that filed financial restatements from the effective date of SOX 404 (Nov. 14, 2004) through 2010. In all, 134 reported material weaknesses (the most serious category) of internal controls prior to restatements, and 525 did not. Of the latter group 314 explicitly acknowledged internal-control weaknesses in hindsight at restatement time.
The study compares the subsequent experiences of reporters and non-reporters in four ways, specifically how many 1) were subject to SEC enforcement actions; 2) became defendants in class-action lawsuits; 3) replaced their CEO or CFO within one year of a restatement announcement; and 4) changed their external auditor. In all analyses, the researchers controlled for a variety of factors that could affect these outcomes, including the magnitude of the financial misreporting, the length of the misstatement period, and how the stock market responded to restatement announcements.
For all four outcomes, firms that reported weaknesses in advance fared no better than or (as was more often the case) worse than those that did not. Interestingly, this remained true even when analysis was restricted to cases where there was evidence of intentional, as opposed to inadvertent, financial misstatement. In the words of the study, "even for this subsample, where there is a higher likelihood of intentional misreporting, we again find no evidence of enforcement of SOX 404. Instead, penalties are more likely for restating firms that have previously reported control weaknesses."
What should be done? Federal statutes, the authors point out, "prohibit registrants from making untrue or misleading statements about material facts," which, they contend, would include internal-control certification under SOX 404. "The very nature of control reporting, which involves a high degree of judgment, and the inherent difficulty of assessing the effectiveness of processes are likely to make stringent enforcement a challenge," they concede. Still, stringent enforcement is required, they conclude, if this controversial provision of SOX is to "fulfill its underlying objective of enhancing investor confidence in the reliability of financial reporting."
Entitled "Does SOX 404 Have Teeth? Consequences of the Failure to Report Existing Internal-Control Weaknesses," the study is in the May/June issue of The Accounting Review, published every other month by the American Accounting Association, a worldwide organization devoted to excellence in accounting education, research, and practice. Other journals published by the AAA and its specialty sections include Auditing: A Journal of Practice and Theory, Accounting Horizons, Issues in Accounting Education, Behavioral Research in Accounting, Journal of Management Accounting Research, Journal of Information Systems, and The Journal of the American Taxation Association.