Background, prior research and hypothesis development
Background
Prior to SOX, disclosure of significant internal control deficiencies was publicly required only when companies changed auditors. Public firms could voluntarily report on the effectiveness of internal controls, but few firms did so. SOX Section 404, “Management Assessment of Internal Controls,” effective for fiscal year-ends subsequent to November 15, 2004 for accelerated filers, required a management report on internal controls over financial reporting to be filed with Form 10-K.3 The report must contain an assessment of the effectiveness of the internal control structure and procedures. Section 404 also requires auditors to report on management’s assessment of internal control structures, while AS 2 required them to provide their own attestation on the effectiveness of internal controls. The auditor’s report must include the disclosure of any material internal control weaknesses, and procedures and corrective actions taken regarding those weaknesses. When one or more material internal control weakness exists, the auditor is required to issue an adverse opinion on the effectiveness of internal controls