Corporate Governance Quality and Internal Control Reporting Under SOX Section 302

Abstract

I examine the impact of corporate governance quality on firm reporting of internal control deficiencies (ICDs) prior to SOX-mandated audits holding constant the existence of a control weakness. I find companies that were audited by industry leading auditors and that have higher quality audit committees are more likely to disclose ICDs under the SOX section 302 regime—prior to the mandatory audit of internal controls. I also find that companies that have a CFO with financial accounting experience are more likely to accurately assess the seriousness of ICDs and classify them properly as material weaknesses rather than the less-serious significant deficiencies. These results have implications for the current debate over whether smaller public companies should be exempted from the audit of internal controls as mandated by the Sarbanes-Oxley Act of 2002 (SOX) section 404. Specifically, some have argued that attempting to improve financial reporting quality by improving corporate governance quality might be a less costly alternative to the audit of internal controls (SEC 2005). I provide evidence that higher quality corporate governance does lead to a higher probability of ICD disclosure in the SOX 302 regime when audits of internal controls were not required. Additionally, my findings suggest that while improving the audit committee and the external auditor may help improve the likelihood of disclosures in a setting void of the external audit requirements, assuring the CFO has necessary experience and knowledge can impact the likelihood that ICD is reported at the correct level of seriousness.