SOX Section 404: Internal Controls and Corporate Governance

Background of the Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act emerged in the wake of widespread corporate scandals and significant media pressure, most notably following the collapse of Enron. The Act provides stiff penalties for executives at the helm of companies, including fines of over $5 million for violations (Snedaker, 2006). It is named after Senator Sarbanes and Representative Oxley, its principal architects. The Sarbanes-Oxley Act was designed to introduce regulation to corporate governance and financial accounting, bringing in mandatory rules regarding internal financial controls (Romano, 2005).

The Sarbanes-Oxley Act of 2002 was signed into law by the President on July 30, 2002. It principally applies to matters covered under the Securities Act — that is, public offerings and companies whose shares and securities are subscribed to by the public. All companies with assets exceeding $10 million and more than 500 security holders fall within its purview. Public companies, investment firms, securities traders, foreign companies, and others that trade securities on national securities exchanges are bound by the law (Sonnelitter, 2005).

Even before the Act was passed, there was a prevailing opinion that auditing standards at U.S. public companies were insufficiently rigorous. This concern led to reform accounting measures, including the Investor Protection Act of 2002 and the Public Company Accounting Reform. The impact of the Sarbanes-Oxley Act was most significantly felt in the creation of the Public Company Accounting Oversight Board (PCAOB), which was tasked with enforcing these earlier accounting measures. An additional key requirement was mandatory disclosure (Coates, 2007).

The Act has long-term and far-reaching consequences, not only for the governance of public companies but also for the nature of auditing and the roles of auditors and financial controllers. Compliance requires skilled professionals from accounting, auditing, and information technology working in concert. The Act established deadlines and mandated timelines for compliance, making the provisions of Section 404 — which ordered significant structural changes — central to the reform effort (Romano, 2005).

Section 404: Introduction and Scope

The Sarbanes-Oxley Act contains eleven titles, and the orders for compliance fall under Sections 302, 401, 404, 409, 802, and 906. Of these, Section 404 addresses an important aspect of internal controls within corporate structures (Romano, 2005). Section 404 is located under Title IV (Sonnelitter, 2005). Although the provisions of corporate governance under SOX 404 were not subject to extensive legislative debate, there is an ongoing argument that making SOX mandatory is inappropriate (Romano, 2005).

Section 404 makes it mandatory for companies to establish and maintain a system capable of controlling internal activities and financial reporting. This requirement applies specifically to public companies (Snedaker, 2006). The federal regulation of financial markets has historically been a response to market failures. Some scholars argue that the disclosures required under the Act could be made optional rather than mandatory (Romano, 2005).

The new requirements effectively verify whether corporate procedures exist to create financial accountability and prevent fraud of the type seen at Enron. The need to ensure the transparency of financial transactions and the accountability of financial controls resulted in the Act requiring companies to publish information about their financial compliance. These requirements concern the processes operating within a corporate entity, the controls in place, and the evaluation of financial performance. The law represents a shift in how corporate performance is understood and assessed. It now involves expertise from a wide range of specialized agencies — including information technology professionals, risk managers, and business analysts — all of whom contribute to internal control evaluation. The Act also modified financial reporting to include disclosures in both quarterly and annual statements regarding the perceived effectiveness of the internal control mechanism for financial reporting (Ramos, 2004).

Internal Controls Under Section 404

The key features of Section 404 of the SOX Act relate to internal controls within corporate structures (Shanley, 2004). Internal control is defined in the Act at Rule 13a-15(f) as the procedure formulated by, or based on the assessment of, the company's executive and financial officers, with the aim of providing accurate financial reporting and financial statements for external publication. The Act further specifies that internal control should maintain proper records of all transactions and the issuer's assets, ensure compliance with generally accepted accounting principles, and establish a system to prevent the unauthorized disposal or acquisition of funds that could adversely affect the company's finances (Chew, 1993).

The term "internal control" thus carries a broad meaning, covering all activities of the company. Section 404 makes it mandatory for the Chief Executive Officer and the Chief Financial Officer to submit a report evaluating the company's internal control over financial reporting. This report is to be filed on Form 10-K and submitted to the SEC on the annual filing date (Ramos, 2004).

The regulations and methods governing financial accounting responsibility were established long before SOX. The Committee of Sponsoring Organizations (COSO) issued regulations on internal controls as far back as 1992. Under those guidelines, internal control encompasses well-defined policies, procedures, and rules that are mandatory for management, and is expected to ensure reliable financial reporting, efficient operations, and legal compliance. The COSO framework aims to improve data analysis and storage methods, financial reporting, and the efficiency of company operations. In traditional management models, the absence of such internal controls has long been viewed as a fundamental weakness. One significant benefit of Section 404 is that the effectiveness of internal controls in relation to company risk becomes visible to investors and forms part of the company's financial report. Enterprise reporting must therefore be grounded in a rigorous assessment of enterprise risk (Lin & Wu, 2006).

Companies are now obligated to create corporate procedures that promote financial accountability and prevent fraud. The law has introduced more complex requirements, drawing on expertise from a wide range of specialized agencies (Shanley, 2004). Public companies must comply with all directives of the PCAOB and the SEC, and criminal liability applies in cases of default. The risks of noncompliance are substantial and can significantly affect a company's financial and operational structure (Lin & Wu, 2006). This rule applies to all public companies except issuers of asset-backed securities and registered investment companies. In final form, the guidelines require management to provide a statement demonstrating adequate internal control over financial reporting, a framework for assessing the effect of financial controls, an assessment of the most recent fiscal year, and a management evaluation of the effectiveness of the registrant's internal controls (Shanley, 2004).

Although the procedures imposed by Section 404 are costly for companies, investors stand to gain significantly. Management must provide a statement of adequate internal control over financial reporting, and the framework used to assess financial controls — along with the most recent fiscal year's assessment — is made available to investors. This enables investors to make informed decisions and to optimize risk rather than rely on hearsay. For companies, the Act has ushered in improved accounting practices and management upgrades in technology and competence. Staff training and management development will be required to meet the demands of the proposed systems and controls. Section 404 also offers companies a competitive advantage by providing investors with high-quality, timely information (Shanley, 2004).

For officers, shareholders, and other stakeholders, the Act ensures that financially literate directors are in charge and that internal controls make the company relatively safe. It should be noted, however, that the Act applies only to public companies, and some companies have restructured to avoid its provisions. Auditing firms and auditing processes have also undergone substantial changes as a result of the Act. Auditors now carry a primary and specific responsibility when presenting audit reports. To comply with the regulation, auditors must first understand the internal framework of the company, making them more deeply involved in corporate decision-making and bearing greater responsibility. The Act has created a demand for restructuring information systems, including IT infrastructure and personnel training. Since data manipulation is the primary method of committing financial deception, establishing security and data integrity in systems processing large volumes of data has necessitated the creation of comprehensive IT policies and procedures (Lin & Wu, 2006).

IT controls are critically important for regulatory compliance in the digital age. This in turn requires competent IT personnel and management training in IT and management information systems (MIS). Since most companies already have an internal reporting system in place, compliance often means reworking an existing framework rather than building one from scratch. Controls over IT systems — including access restrictions, data security and integrity, and governance of system usage — must all be taken into account when redesigning the system (Fox, 2006).

The guidelines thus require companies to build a structure within the existing financial system, incur associated costs, recruit or train competent personnel, and achieve a higher standard of corporate management. Compliance with the Act helps companies avoid risk, and the annual financial report must now also contain an attested internal control report. This makes the company's affairs more transparent, and the Act may therefore have genuinely benefited companies as a long-term solution to corporate governance needs (Shanley, 2004).

Section 404 is a mandatory provision for the annual review of internal procedures and the evaluation of controls for financial reporting. The annual report must include a statement from the CEO or CFO affirming their responsibility for maintaining and evaluating internal financial controls, as well as a declaration that the company's internal auditor has attested to management's evaluation. All public companies must comply (Shanley, 2004).

Companies must take several concrete steps to comply. Companies that already have internal controls in place will find the transition easier. Internal control responsibilities are often vested in the board of directors, the CEO, or a special steering committee. The use of software and electronic analysis tools is becoming essential, and most companies are likely to adopt the COSO model. The COSO framework divides internal control into the following components: (a) the control environment, which encompasses ethics and employee competence enhancement; (b) risk assessment, identifying risks that may prevent the business from achieving its objectives; (c) control activities, comprising the internal measures taken to mitigate known risks; (d) information and communication, assessing the flow of relevant information between staff and management; and (e) monitoring, which evaluates the overall internal control system on an ongoing basis. All companies will therefore need to create a dedicated disclosure function to review SEC filings and conduct periodic reviews of internal controls (Shanley, 2004).

The benefits of this approach to accounting are numerous. The Sarbanes-Oxley Act can help companies gain the trust of investors, access high-quality and timely information, conserve resources, and achieve a competitive advantage. Failure to comply, on the other hand, exposes the company to lawsuits, loss of public confidence, negative perceptions, SEC enforcement actions, and the risk of fraud (Shanley, 2004).

From the shareholder's perspective, the provisions of Section 404 ensure that corporate entities do not engage in unethical behavior, and that financially literate directors maintain internal controls that make the company relatively safe. Private companies are not legally obligated to comply with the Sarbanes-Oxley Act, though they may voluntarily adopt some of its internal fiscal control provisions. Public companies fall squarely under the Act's purview, which also specifies qualifications for management personnel (Shanley, 2004).

Conclusion

We must take into account both the criticism and the merits of the Act to arrive at a valid conclusion. One important fact that cannot be overlooked is that the Act has left unaddressed the problem of unanticipated business transactions such as mergers and acquisitions, which pose major compliance challenges. Those previously involved in mergers and acquisitions were not focused on internal controls. This shift in paradigm may make mergers and acquisitions more costly propositions and could introduce certain inequalities — a concern that extends to the area of transfer pricing as well.

The problems at Enron and WorldCom resulted more from management decisions than from failures in financial accounting. Despite the provisions of this Act, frauds and other irregularities cannot be entirely ruled out. In that context, we may consider whether the Act itself requires further refinement. At a minimum, one may argue that an extended transition period — of at least two years — should be afforded to corporate structures to put the required mechanisms in place, and to allow auditors and other professionals to develop the necessary competencies. During such a transition period, the Act's mandatory requirements might be applied more gradually. The demands placed on IT systems and overall organizational capacity must also be carefully considered. We can therefore conclude that Section 404 represents a turning point in corporate governance, and that further time and a phased approach to compliance would serve both companies and the investing public well.