Auditing Section Research Summaries Space

A Database of Auditing Research - Building Bridges with Practice

This is a public Custom Hive  public

research summary

    Reflections on a Decade of SOX 404(b) Audit...
    research summary posted March 10, 2015 by Jennifer M Mueller-Phillips, tagged 01.0 Standard Setting, 01.05 Impact of SOX, 07.0 Internal Control, 07.05 Impact of 404 on Fees and Financial Reporting Quality 
    Reflections on a Decade of SOX 404(b) Audit Production and Alternatives
    Practical Implications:

    Public interest demands more transparency and analysis about how control audits are conducted, how they might be improved, and what might be better alternatives for the future. Thus investors, auditors, standard setters, academics, auditing students and U.S. markets could all benefit in the long run, from more transparency about the current U.S. audit production process and from informed debate about the best mechanism design for balancing the needs of all parties interested in internal control quality disclosure.

    For more information on this study, please contact William R. Kinney Jr.


    Kinney Jr, W. R., R. D. Martin, and M. L. Shepardson. 2013. Reflections on a Decade of SOX 404 (b) Audit Production and Alternatives. Accounting Horizons 27(4): 799-813.

    Sarbanes-Oxley Act of 2002; regulation alternatives; internal control audits; 404(b).
    Purpose of the Study:

    Since the passage Sarbanes-Oxley Act during July 2002, audit production in the U.S. has been substantially expanded by mandated internal control audits. The control audit mandate is unique to the U.S. and costly to apply, yet little is known about the conduct of control audits or the efficacy of lower-cost alternatives. Hence, this paper reflects the authors overall knowledge about control audit production and observation of a consistent message across public and limited non-public archival data. 

    Design/Method/ Approach:

    The authors have followed 404(b) audit implementation from perspectives as auditing educators, academic fellows at the Securities and Exchange Commission (SEC), advisor to the Public Company Accounting Oversight Board (PCAOB), standards setter as an International Auditing and Assurance Standards Board (IAASB) member, and a Big 4 audit manager applying 404(b).

    Other methods include: research projects; theoretical, archival, and behavioral research of others; and numerous control audit conversations regarding implementation with U.S. and foreign regulators, standards setters, practitioners, directors, corporate officers, and investors.


    Main observations

    • Audits of internal control processes are fundamentally different from audits of financial statements as to objective, value, and approach, although they share some attributes.
    • The three sources of control audit evidence required by PCAOB standards differ substantially in incremental costs, audit expertise required, and ability to identify material weaknesses so that:
      • Relative to design evaluation and implementation testing, auditors are effective and efficient at identifying control weaknesses that have resulted in known accounting misstatements—even if the misstatements are immaterial.
      • Absent knowledge of accounting misstatements, identification of weaknesses in control process design is difficult.
      • The appropriate scope of operating effectiveness testing remains unclear, as does when entity-level control tests can substitute for process-level control tests.

    Alternatives to mandated control audits:

    • No other country or auditing standards-setting body has adopted the U.S. control audit legislated mandate, even though it has been considered in multiple countries.
    • Some other countries have developed alternatives that partially apply the U.S. requirements and provide some control information to investors, but at less cost of production.
    Internal Control, Standard Setting
    Impact of 404 on Fees and Financial Reporting Quality, Impact of SOX