Sarbanes-Oxley and Public Reporting on Internal Control: Hasty Reaction or Delayed Action?

Abstract

SYNOPSIS Since its passage, the Sarbanes-Oxley Act of 2002 has been criticized, and praised, by many on numerous grounds and claims. However, no single provision of this law has come under more attack than Section 404, which mandates public reporting of internal control effectiveness by an issuer's management as well as its independent auditors. Even after 10 years, the opposition to the Section 404 internal control requirements has continued to the point where the U.S. Congress through two separate Acts—the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act, and the 2012 Jump Start Our Business Startups (JOBS) Act—have permanently exempted the non-accelerated SEC filers and the “emerging growth” issuers with revenues of $1 billion or less from Section 404(b) of the Sarbanes-Oxley Act of 2002. Many of those who oppose the Section 404 requirements rest their claim on grounds that the U.S. Congress acted in haste in mandating the public reporting of internal controls by U.S.-listed companies and that the issue was not well thought out or debated. They also contend that the U.S. Congress acted under pressure because of the public outrage over the bankruptcy filings of Enron and WorldCom. To the contrary, this paper shows that the debate over public reporting of internal control by U.S. public companies is more than six decades old, dating back to the McKesson & Robbins fraud. This paper reviews relevant legislative proposals, bills introduced in both the House and the Senate, regulatory efforts by the SEC, and the recommendations of many commissions set up by the private sector to inform the reader how these efforts were the deliberative precursors to what was eventually codified in Section 404 of the Sarbanes-Oxley Act of 2002.