Abstract:<p>The Information Content of Sarbanes-Oxley in Predicting Security Breaches</p><p>How effective is compliance with the Sarbanes-Oxley Act (SOX) in identifying and eliminating firm threats from information systems breaches? We investigated publicly reported security breaches of internal controls in corporate systems to determine whether SOX assessments are information bearing with respect to breaches which can lead to materially significant losses and misstatements. The results of our tests varied significantly between breach types. SOX Section 404 adverse decisions on effectiveness of controls occurred in 100% of credit card data breaches and around 33% of insider breaches. SOX 404 audits provided a contrarian "effective" control decision on 88% of situations where there was a control breach concerning a portable device. This suggests that employees are subverting particularly strict internal controls by using portable devices that can be carried outside the physical boundaries of the firm. We found that management and SOX 404 auditors do not general agree on the underlying internal control situation at any time. Instead the SOX 404 auditors were likely to discover material weaknesses and "educate" management and internal audit teams about the importance of these control weaknesses. SOX attestations were poor at identifying control weaknesses from unintended disclosures, physical losses, hacking and malware, stationary devices, and situations where the cause of the breach was unknown. Hazard and occupancy structural models were constructed to extrapolate to a larger population. Results showed that both SOX 302 and 404 audits provided information germane to the frequency of breaches, with SOX 404 being three times as informative as section 302 reports. The hazard model found an expected 2.88% reduction in breaches when SOX 302 controls were effective. Management's "material weakness' attestations provided no information in this structural model, whereas there would be around a 1% increase in breach occurrence when there exist significant deficiencies. SOX 404 attestations were the most informative; a negative SOX 404 attestation is projected to increase the frequency of breaches by around 8.5%. We concluded that the strength of internal controls attested in SOX reports is likely to be a significant factor in the occurrence of a security breach in a specific period.</p>

Practitioner Summary of Detection and Severity Classification of Sarbanes-Oxley Section 404 Internal Control Deficiencies

Detection and Severity Classifications of Sarbanes-Oxley Section 404 Internal Control Deficiencies

The Influence of Auditor and Client Section 404 Processes on Remediation of Internal Control Deficiencies at All Levels of Severity

Internal Control Deficiencies in Tax Reporting: A Detailed View

Determinants of the Persistence of Internal Control Weaknesses

Internal control deficiencies and the issuance of going concern opinions

Internal Control Weaknesses and Information Uncertainty

The Effect of SOX Internal Control Deficiencies on Firm Risk and Cost of Equity

Determinants of weaknesses in internal control over financial reporting

Do SOX 404 Control Audits and Management Assessments Improve Overall Internal Control System Quality

The Disciplining Effect of the Internal Control Provisions of the Sarbanes–Oxley Act on the Governance Structures of Firms

The effect of internal control deficiencies on the usefulness of earnings in executive compensation

The Effect of SOX Internal Control Deficiencies and Their Remediation on Accrual Quality

Audit committee quality, auditor independence, and internal control weaknesses

The information content of Sarbanes-Oxley in predicting security breaches

Direct and Indirect Effects of Internal Control Weaknesses on Accrual Quality: Evidence from A Unique Canadian Regulatory Setting

Business Strategy, Internal Control over Financial Reporting, and Audit Reporting Quality

The Wealth Change and Redistribution Effects of Sarbanes-Oxley Internal Control Disclosures