Does SOX 404 Have Teeth? Consequences of the Failure to Report Existing Internal Control Weaknesses

ABSTRACT We examine various penalties that could serve as enforcement mechanisms for Sarbanes-Oxley (SOX) Section 404. We focus on firms with restatements, some of which had previously reported their control weaknesses as required and some of which acknowledged them only after announcing their restatement. We find no evidence that penalties are more likely for firms, managers, or auditors that fail to report existing control weaknesses. Instead, class action lawsuits, management turnover, and auditor turnover are all more likely in the wake of a restatement when control weaknesses had previously been reported. We find similar, although weaker, evidence for Securities and Exchange Commission (SEC) sanctions. These results are consistent with disclosure of control weaknesses making it difficult for management to plausibly claim later that they were unaware of the underlying conditions that led to restatements. The results also suggest that the public and private enforcement mechanisms surrounding SOX 404 are unlikely to provide strong incentives for compliance and offer a potential explanation for why most restatements are issued by firms that previously claimed to have effective internal controls.