The requirements in the Sarbanes-Oxley Act for outside audits of internal control may actually be penalizing companies that reveal problems with their controls, according to a new study.
The study, which appears in the new issue of the American Accounting Association’s journal The Accounting Review, found that not only do companies that give advance warning of internal-control problems gain nothing by their transparency but they are actually penalized compared to companies that divulge such problems only when forced to restate their finances, which is too late to be of help to investors.
The study, by Sarah C. Rice of Texas A&M University and David P. Weber and Biyu Wu of the University of Connecticut, examined the impact of Section 404 of Sarbanes-Oxley, also known as SOX 404. The Sarbanes-Oxley Act of 2002 was passed in the wake of notorious corporate accounting scandals such as Enron and WorldCom.
The provision requires public companies and their auditors to formally attest in annual reports to the effectiveness of company internal controls over financial reporting. Often criticized for saddling companies with a costly and complicated requirement, SOX 404 now comes into question on another score. The new study casts doubt on whether the provision is fulfilling its basic purpose, that is, to provide advance warning to investors of potential company problems.
"We find no evidence that penalties following a restatement are more likely for firms that fail to detect and disclose their control weakness as required,” said the study. “Instead, firms that do report their control weaknesses in a timely manner are generally more likely to face [varied] penalties in the event of a later restatement. These results are consistent with the disclosure of control weaknesses making it difficult for management to plausibly claim later that they had been unaware of the underlying conditions in the control environment that led to their restatements."
As an example of the fate that awaits restating companies and executives that provided advance notice of control weakness, the study notes that doing so increases the likelihood of SEC action by approximately 6 percent, probably because it aids the agency “in identifying cases where potential enforcement actions are likely to succeed and make it difficult for management to claim they were unaware of the problems that led to the restatement.”
The study also found that class-action lawsuits are 5 to 10 percent more likely when companies report internal control weaknesses prior to restatements. In addition, top management turnover is 15 to 26 percent more likely, while auditor turnover is 6 to 9 percent more likely.
Rice and Weber found in earlier research that only a minority of companies that issue restatements stemming from control weaknesses reported the weaknesses prior to the restatements. Now they take their investigations a step further have found a likely cause for their previous findings.
"For as long as anyone can recall, investors have complained about being blindsided by companies, where one day everything is fine and the next day it all falls apart,” Weber said in a statement. “SOX 404 is supposed reduce the incidence of that sort of thing, but to do its job there has to be an incentive for top execs and auditors to divulge control problems in the company annual report, as mandated by the provision. I must admit that my colleagues and I were only mildly surprised that firms which fail to do so aren't penalized. What surprised us a lot more is that companies which evidently take SOX 404 to heart are penalized. That's certainly no way to encourage the candor the law envisions.
“For some time now, regulators have been puzzling over a decline in reported internal-control weaknesses since the years right after SOX's enactment, when the spectacle of top executives in handcuffs was still fresh in people's minds,” he added. “Was the decline a result of improved internal controls or just that weaknesses were not being reported? Our paper goes a fair way, I believe, toward answering that question."
The study's findings come from an analysis of the incidence of weakness-reporting or lack of it among 659 firms that filed financial restatements from the effective date of SOX 404 (Nov. 14, 2004) through 2010. In all, 134 reported material weaknesses (the most serious category) of internal controls prior to restatements, and 525 did not. Of the latter group 314 explicitly acknowledged internal-control weaknesses in hindsight at restatement time.
The study compares the subsequent experiences of reporters and non-reporters in four ways, specifically how many were subject to SEC enforcement actions; became defendants in class-action lawsuits; replaced their CEO or CFO within one year of a restatement announcement; and changed their external auditor. In all their analyses, the researchers controlled for a variety of factors that could affect these outcomes, including the magnitude of the financial misreporting, the length of the misstatement period, and how the stock market responded to restatement announcements.
For all four outcomes, companies that reported weaknesses in advance fared no better than or (as was more often the case) worse than those that did not. Interestingly, this remained true even when analysis was restricted to cases where there was evidence of intentional, as opposed to inadvertent, financial misstatement. In the words of the study, "even for this subsample, where there is a higher likelihood of intentional misreporting, we again find no evidence of enforcement of SOX 404. Instead, penalties are more likely for restating firms that have previously reported control weaknesses."
What should be done? Federal statutes, the authors point out, "prohibit registrants from making untrue or misleading statements about material facts," which, they contend, would include internal-control certification under SOX 404. "The very nature of control reporting, which involves a high degree of judgment, and the inherent difficulty of assessing the effectiveness of processes are likely to make stringent enforcement a challenge," they wrote. Still, stringent enforcement is required, they conclude, if this controversial provision of SOX is to "fulfill its underlying objective of enhancing investor confidence in the reliability of financial reporting."
