Internal controls have long been recognized as important in ensuring highquality
financial reporting (Committee of Sponsoring Organizations [COSO]
1987; Kinney, Maher, and Wright 1990; Kinney 2000). However, prior to
the Sarbanes-Oxley Act of 2002 (SOX; U.S. Congress 2002), the only
required public disclosures on internal controls concerned deficiencies
therein, which were revealed in Securities and Exchange Commission (SEC)
Form 8-K ‘‘change of auditor’’ disclosures. One of the significant provisions
of SOX is Section 404, which requires public firms and their external auditors
to report on the effectiveness of firms’ internal controls over financial
reporting (ICOFR) or to reveal the presence of internal control material
weaknesses (ICMWs).1 Auditing Standard No. 5 defines ICOFR as