SOX Costs: Auditor Attestation under Section 404

Abstract

This study examines the cost of the new internal control audit required by the Sarbanes-Oxley Act of 2002 (SOX) for a sample of Fortune 1000 companies. The average audit fee increase from 2003 to 2004 of $2.3 million is significant and is primarily attributable to the new SOX audit. SOX audit costs appear to be based on company size, asset growth, and the effectiveness of internal controls in addition to the 2003 financial statement audit rate. Specifically, the SOX audit costs increase with size, but the SOX audit unit costs vary inversely with size. This inverse relationship is consistent with larger companies benefiting from returns to scale and smaller companies spending fewer resources on internal controls and being more likely to have material weaknesses in internal controls. The positive relationship between SOX audit costs and asset growth supports the notion that rapidly growing firms may not be able to update their internal control systems in a timely manner and, therefore, may be more likely to experience internal control weaknesses. Firms that reported ineffective internal controls experienced higher SOX audit costs than those that reported effective internal controls. We also find evidence that financial services firms paid significantly lower SOX audit rates and electronic equipment and electronics firms paid significantly higher SOX audit rates than firms in other industries.