Prior to SOX, disclosure of significant internal control deficiencies was publicly required
only when companies changed auditors. Public firms could voluntarily report on the effectiveness
of internal controls, but few firms did so. SOX Section 404, “Management Assessment
of Internal Controls,” effective for fiscal year-ends subsequent to November 15, 2004
for accelerated filers, required a management report on internal controls over financial
reporting to be filed with Form 10-K.3 The report must contain an assessment of the effectiveness
of the internal control structure and procedures. Section 404 also requires auditors
to report on management’s assessment of internal control structures, while AS 2 required
them to provide their own attestation on the effectiveness of internal controls. The
auditor’s report must include the disclosure of any material internal control weaknesses,
and procedures and corrective actions taken regarding those weaknesses. When one or
more material internal control weakness exists, the auditor is required to issue an adverse
opinion on the effectiveness of internal controls.