Audit Analytics recently released a new report, SOX 404 Disclosures: An Eighteen-Year Review. This annual report takes a closer look at trends in internal controls over financial reporting (ICFR) disclosures, spanning from fiscal years 2004 to 2021.
Section 404 of the Sarbanes-Oxley Act of 2002 (SOX 404) requires companies to review their ICFR and disclose whether they are “effective” or “ineffective.” Effective internal controls are essential in ensuring financial statements are accurate and complete. Ineffective internal controls pose a risk for stakeholders, as vital information disseminated by the company may be incorrect.
The report breaks down the components of SOX 404 requirements for ICFR into three groups:
- Management’s report on ICFR, unaccompanied by an auditor attestation (“management-only reports”), as required by SOX 404(a).
- Management’s report on ICFR, accompanies by an auditor attestation, as required by SOX 404(a).
- Auditor attestation of management’s report on ICFR, as required by SOX 404(b).
In FY 2021, 5.8% of SOX 404(b) auditor attestations disclosed ineffective internal controls. In contrast, 23.7% of management reports and 41.9% of management-reports disclosed ineffective controls. These percentages represent increases from the levels seen in FY 2020, across all three report types.
Management reports historically have higher rates of ineffective controls. This is due, in part, to the demographics of the companies required to issue each type of report. Auditor attestations are required from larger companies, whereas smaller companies, with less resources, are only required to furnish a management report.
Control Issues in Adverse ICFR Reports
The report includes a thorough breakdown of the control and accounting issues contributing to an ineffective control assessment. Notably, in FY 2021, a recurring control issue cited in adverse SOX 404 reports related to a lack of qualified accounting personnel. Other issues stem from this lack of highly trained company accounting professionals. This includes the inability to enforce a “segregation of duties” within the accounting function.
As noted by Bloomberg Tax, a global accountant shortage “could weaken the reliability of corporate results.” The increased level of ineffective controls noted this year reflects that harrowing prediction.
Key highlights of this report include:
- Population of all SOX 404 assessments vs. all adverse assessments;
- Trends in control issues and accounting issues cited in adverse SOX 404 assessments;
- Trends in first issued internal control reports.
Further, this report by Audit Analytics includes an eighteen-year historical trend analysis of adverse internal control reports. These trend analyses are broken down in three ways: by company filer status, by company location, and by industry.
To access the full report, click here. Audit Analytics subscribers can download the report from their dashboard.
Interested in our content? Be sure to subscribe to receive our email notifications.