August 9, 2022
SOX 404: 18 Years of Internal Control Assessments
Section 404 of the Sarbanes-Oxley Act requires companies to review their internal control over financial reporting and report whether or not it is effective. Non-accelerated filers are required to provide management’s assessment of the effectiveness of their ICFR, while larger companies are required to accompany that assessment with an attestation from their outside auditors.
Audit Analytics recently issued its annual report on the most recent round of auditor attestations & management-only assessments of ICFR. This recent blog reviews the results of the past 18 years of experience under SOX 404, and makes several interesting observations:
– In FY 2021, 5.8% of SOX 404(b) auditor attestations disclosed ineffective internal controls. In contrast, 23.7% of management reports and 41.9% of management-only reports disclosed ineffective controls. These percentages represent increases from the levels seen in FY 2020, across all three report types.
– The report includes a thorough breakdown of the control and accounting issues contributing to an ineffective control assessment. Notably, in FY 2021, a recurring control issue cited in adverse SOX 404 reports related to a lack of qualified accounting personnel. Other issues stem from this lack of highly trained company accounting professionals. This includes the inability to enforce a “segregation of duties” within the accounting function.
The blog notes that the significantly higher percentage of management-only reports disclosing ineffective controls reflect the demographics of companies required to file these reports. Large companies must file auditor attestations along with management reports on ICFR, while smaller companies are permitted to file management-only reports.
The recurring references to the lack of qualified accounting personnel are particularly troubling. Over the past few years, there have been numerous media reports about a potential shortage of accountants. It looks like the chickens have come home to roost on this issue this year, and that the shortage will continue to place stress on companies’ internal controls in the future.
– John Jenkins