Audit costs, material weaknesses under SOX Section 404

Abstract

Purpose -Section 404 of the Sarbanes-Oxley Act (SOX) of 2002 required companies to report on the effectiveness of their internal controls over financial reporting. Auditors also must attest to, and report on, the assessment of the effectiveness of internal control over financial reporting made by the management of the company being audited. The purpose of this paper is to provide analyses of audit fee costs and material weaknesses reported for companies of different sizes after the effective date of Section 404 and suggest approaches to reduce SOX 404 compliance costs. Design/methodology/approach -Quantitative analysis and deductive reasoning are used to evaluate audit costs associated with Section 404. Findings -Audit fees have been increased substantially, particularly during the first year a company complied with Section 404, and have not been dropped substantially after the first year of compliance. Companies with sales of less than $1 billion reported significantly more material weaknesses than larger companies. Originality/value -This paper documents audit costs after the SOX Section 404 effective date, the typical types of material weaknesses reported, the proportion of companies of different sizes reporting material weaknesses, and describes approaches to reduce compliance costs.

When the world isn't always flat: The impact of psychological distance on auditors' reliance on specialists

“…In light of AS No. 5, such management requests are in line with standards and considered reasonable given the additional burden placed on the IAF through SOX 404 and the related significant increases in overall IAF costs (Foster et al, 2007;Kuhn and Sutton, 2010). Additionally, ancillary IT audit activities such as SOX compliance testing can be effectively executed remotely (i.e., via telework) and are among the easiest tasks for IAF to outsource (Pyzik, 2012).…”

“…The Act both eliminated the option of outsourcing IT audits to incumbent auditors (SOX 201(a)) and substantially increased internal control system evaluation and documentation requirements (SOX 404) (Aguilar, 2005). The accompanying surge in compliance costs was frequently criticized in the business press as disproportionate (Blaskovich and Mintchik, 2007;Foster et al, 2007). Reacting to this criticism, the Public Company Accounting Oversight Board (PCAOB) adopted Auditing Standard No.…”

The Use of an ERP System to Facilitate Regulatory Compliance

“…Prior studies have found that material weaknesses in internal control have been reported against SOD, period-end reporting, account-specific processes, and account reconciliation (Ge & McVay, 2005;Foster et al, 2007), potentially resulting in severe penalties. How managers use an ERP system to mitigate these weaknesses is therefore of interest to both researchers and practitioners.…”

“…Terminating the access of ex-employees is essential, as avoiding SOD disagreements is a major concern for SOX auditors, particularly in high-risk companies such as multinational organizations where there are large numbers of employees and systems access must be continually monitored and reviewed (Doyle et al, 2007). 4) Training: Lack of financial reporting expertise, including an absence of appropriate technical skills among staff, is a key reason for accounting errors and misstatements (Foster et al, 2007;Ge & McVay, 2005;Stoel & Muhanna, 2011). Unqualified staff can result in a failure to identify and solve accounting problems as well as a failure to perform effective reviews.…”

“…3) Segregation of duties (SOD): For example, segregation between payroll and other accounting employees. SOD is a significant factor related to efficient internal control because integrated roles could lead to manipulation of financial statements (Foster, Ornstein, & Shastri, 2007). Terminating the access of ex-employees is essential, as avoiding SOD disagreements is a major concern for SOX auditors, particularly in high-risk companies such as multinational organizations where there are large numbers of employees and systems access must be continually monitored and reviewed (Doyle et al, 2007).…”