The discovery and reporting of internal control

deficiencies prior to SOX-mandated audits

(Hollis Ashbaugh-Skaifea, Daniel W. Collinsb, William R. Kinney Jr.c)

1. Introduction

This study investigates the economic factors that expose a firm to internal control risk and

management’s incentives to discover and report an internal control deficiency (ICD). Section

404 of the Sarbanes–Oxley Act (US Congress, 2002), denoted SOX requires that public

company financial statements filed on Form 10-K and Form 10-Q contain an assessment by

management of the design and operating effectiveness of its internal control over financial

reporting. Section 404 also requires that the external auditor, on an annual.