Audit Analytics recently released a new report, SOX 404 Disclosures: A Seventeen-Year Review. This annual report, containing an updated format, takes a closer look at trends in internal controls over financial reporting (ICFR) disclosures, spanning from 2004 to 2020.
Section 404 of the Sarbanes-Oxley Act of 2002 (SOX 404) requires companies to review their ICFR and disclose whether they are “effective” or “ineffective”. Effective internal controls are essential in ensuring financial statements are accurate and complete. This updated report breaks down the components of SOX 404 requirements for ICFR into three groups:
- Management’s report on ICFR, unaccompanied by an auditor attestation (“management-only reports”), as required by SOX 404(a).
- Management’s report on ICFR, accompanied by an auditor attestation, as required by SOX 404(a).
- Auditor attestation of management’s report on ICFR, as required by SOX 404(b).
In 2020, 4.6% of SOX 404(b) auditor attestations disclosed ineffective controls over financial reporting (ICFR). This percentage is significantly less than the 21.4% and 38.6% observed in management reports and management-only reports, respectively. The higher levels of adverse controls in management reports reflects the underlying population of smaller companies.
Additionally, our latest analyses reveal interesting trends in 2020 SOX 404 data. Above all, the impact of the SEC’s amended accelerated filer definition that became effective in 2020. The amended definition, enacted to reduce regulatory burdens on smaller companies, altered the underlying population of companies filing SOX reports. As a result, 2020 saw an 11.5% decrease in total auditor attestations filed. Conversely, the number of management-only reports increased 13.9% year-over-year. The increase in management-only reports, and corresponding decrease in adverse internal controls, primarily relates to former accelerated filers qualifying as non-accelerated filers in 2020.
Consequently, the amended accelerated filer definition impacted several aspects of internal control disclosures in 2020.
Key highlights of this report include:
- Population of all SOX 404 assessments and all adverse SOX 404 assessments;
- Insights into 2020 trends;
- Trends in issues cited in adverse SOX 404 assessments;
- Trends in first SOX 404 assessments.
Further, this year’s SOX 404 report by Audit Analytics includes several new analyses. This includes a seventeen-year historical trend snapshot of adverse SOX 404(a) and SOX 404(b) assessments. The snapshot is broken down in three ways: by company size, by company location, and, finally, by company industry.
To access the full report, click here. Audit Analytics subscribers can download the report from their dashboard.
Interested in our content? Be sure to subscribe to receive our email notifications.