As you probably recall, SOX 404 requires public reporting companies to disclose the effectiveness of their internal control over financial reporting. SOX 404(a) public companies to provide an assessment of ICFR by management; SOX 404(b) requires public companies—other than non-accelerated filers and emerging growth companies—to provide an auditor attestation regarding management’s assessment of the effectiveness of ICFR. A new study by Audit Analytics examining the most recent trends in SOX 404 disclosures over 17 years showed a decline in the number of adverse auditor attestations—auditor attestations indicating ineffective ICFR—and adverse management assessments, while the number of adverse management-only assessments increased. Why that variation? Could it reflect the effect of the recent SEC carve-out from the 404(b) requirement for low-revenue companies?
Audit Analytics has published its annual review of financial restatements, which this year covered a 17-year period. The review showed a double-digit percentage decline in the total number of restatements for the last three years in a row, resulting in a new 17-year low of 553 total restatements. Compare that to 1,859 restatements in 2006! As discussed in this article in Compliance Week, the percentage decline was 19% in 2017, 10% in 2016 and almost 12% in 2015. Stepping back, what the data shows is that, following SOX, the number of restatements skyrocketed, as the new act imposed “new discipline to the financial reporting process through its requirement to report on the effectiveness of internal control over financial reporting.” But by 2007, companies seemed to have gained a better handle on the demands of SOX, as the numbers of restatements began to decline.