Reflections on a Decade of SOX 404(b) Audit Production and Alternatives

Abstract

SYNOPSIS Since passage of the quickly finalized Sarbanes-Oxley Act during July 2002, audit production in the U.S. has been substantially expanded by mandated internal control audits. The control audit mandate is unique to the U.S. and costly to apply, yet little is known about the conduct of control audits or the efficacy of lower-cost alternatives. This paper reflects our overall knowledge about control audit production and observation of a consistent message across public and limited non-public archival data, analytical studies, and numerous personal experiences of audit practitioners. Our primary observation is that, absent any financial misstatement, auditors find it difficult to identify material weaknesses in control design. Conversely, when auditors know about misstatements they can, and do, detect related material weaknesses and thereby identify most public companies found by mandated control audits to have ineffective controls. Thus, it appears possible to exploit this observation to identify and publicly disclose most companies with weak controls without incurring the cost of full internal control audits. We believe that U.S. markets could benefit from more transparency about the current U.S. audit production process and from informed debate about the best mechanism design for balancing the needs of all parties interested in internal control quality disclosure.

The occurrence and awareness of a misstatement effect in auditors' internal control severity judgments

“…However, consistent with the cognitive account of the outcome effect and empirical evidence from prior studies (Gramling et al, ; Kinney et al, ), we propose that substantive testing outcome will affect auditors' judgments of the severity of the deficiency (in terms of both the likelihood and magnitude of potential misstatements and ultimately the classification of the control deficiency). Specifically, when auditors become aware of the substantive testing outcome, they start with the outcome and work backward to connect the causal links that may have led to the outcome.…”

“…Nevertheless, PCAOB inspection reports suggest that auditors may inappropriately base their material weakness evaluations solely on the materiality of identified misstatements in the financial statements (PCAOB, ) . We label this tendency for auditors to take the non‐detection (detection) of a misstatement as evidence of the absence (presence) of a material weakness as a “misstatement effect.” Prior studies have found this misstatement effect in auditors' internal control severity judgments (e.g., Gramling, O'Donnell, & Vandervelde, ; Kinney, Martin, & Shepardson, ; PCAOB, ). These studies, however, do not provide insights as to whether this effect reflects auditors' beliefs about how the presence of a misstatement should affect their judgments.…”

“…They surmise that management is likely to question and demand hard evidence to support a conclusion of a material weakness, resulting in absence of material misstatements being taken as evidence of the absence of material weakness. Relatedly, audit partners, in an interview, suggest that they find the identification of ICOFR design weaknesses to be a particularly difficult task when no misstatements have been detected (Kinney et al, ). Further, Kinney and Shepardson (), using public data, report that most material weaknesses were the result of the auditor having identified a material misstatement as part of the financial statement audit.…”

“…The cognitive reconstruction may further be amplified by anticipating the difficulty of justifying to the client that a control deficiency that has not resulted in a misstatement is nonetheless a material weakness (Bedard and Graham, ; Jonas et al, ) and the typical absence of feedback about the true outcome (Earley, Hoffman, & Joe, ) . This “curse of knowledge” may explain why auditors say they find the identification of ICOFR design problems to be a particularly difficult task when no misstatements have been detected (Kinney et al, ).…”

Internal control through the lens of institutional work: a systematic literature review

“…Previous literature reviews on the topic of internal control have focused exclusively on the literature that relates internal control to financial reporting (Schneider et al 2009) or internal control audits (Kinney et al 2013) under SOX in the United States. In an attempt to provide a more comprehensive and timely understanding of the term 'internal control, ' Chalmers et al (2019) extend these reviews by including literature that was published in settings outside the United States.…”