Sarbanes-Oxley and Internal Control

The Sarbanes-Oxley Act of 2002 (SOX), among other things, created a requirement that publically traded companies have an adequate system of internal controls in place and that management those companies prepare an annual report on the adequacy of those controls (the infamous Section 404). SOX also requires that an independent auditor examine each covered company's internal controls and express an opinion on the management report.

According to James Doty, chair of the SOX created Public Company Accounting Oversight Board (PCAOB), the outside auditors are not doing an acceptable job of evaluating the assertions made by company managements. A Reuters article is here.

A major motivation that led to SOX being enacted was the need to ensure better detection and prevention of corporate fraud as perpetrated by the management of Enron, Xerox and a number of other companies. A major tool in achieving that goal is to have an effective system of internal control in place. The problem described by Mr. Doty means that tests of internal control are inadequate to detect weaknesses in the system, weaknesses that could be exploited by people inside these publically traded corporations.

Regulations and laws do little good if not enforced. Since the PCAOB is the single most important regulator of both reporting by publically traded companies and auditing of those companies by CPA firms, it will be interesting to see what he and the PCAOB do about this problem.