The Discovery and Reporting of Internal Control Deficiencies Prior to Sox-Mandated Audits

This paper uses firms' disclosures of internal control problems prior to audits mandated by Section 404 of the Sarbanes-Oxley Act (SOX) to investigate the economic factors that expose firms to internal control failure risks and managements' incentives to discover and report internal control deficiencies (ICDs). We find that firms making pre-SOX 404 ICD disclosures typically have more complex operations, recent changes in organization structure, more accounting risk exposure, fewer resources to invest in internal control and higher incidence of auditor resignation relative to firms that do not report internal control problems. Regarding incentives to discover and report internal control problems, we find that ICD firms have more prior SEC enforcement actions and restatements of financial statements, are more likely to use a dominant audit firm, and are more likely to have concentrated institutional ownership. Our findings are important in developing expectations about determinants of internal control problems across all SEC registrants including non-accelerated filers that are not yet required to comply with SOX 404, as well as providing baseline evidence for evaluating the discovery and reporting of ICDs under mandated internal control audits