Abstract:<p>The Information Content of Sarbanes-Oxley in Predicting Security Breaches</p><p>How effective is compliance with the Sarbanes-Oxley Act (SOX) in identifying and eliminating firm threats from information systems breaches? We investigated publicly reported security breaches of internal controls in corporate systems to determine whether SOX assessments are information bearing with respect to breaches which can lead to materially significant losses and misstatements. The results of our tests varied significantly between breach types. SOX Section 404 adverse decisions on effectiveness of controls occurred in 100% of credit card data breaches and around 33% of insider breaches. SOX 404 audits provided a contrarian "effective" control decision on 88% of situations where there was a control breach concerning a portable device. This suggests that employees are subverting particularly strict internal controls by using portable devices that can be carried outside the physical boundaries of the firm. We found that management and SOX 404 auditors do not general agree on the underlying internal control situation at any time. Instead the SOX 404 auditors were likely to discover material weaknesses and "educate" management and internal audit teams about the importance of these control weaknesses. SOX attestations were poor at identifying control weaknesses from unintended disclosures, physical losses, hacking and malware, stationary devices, and situations where the cause of the breach was unknown. Hazard and occupancy structural models were constructed to extrapolate to a larger population. Results showed that both SOX 302 and 404 audits provided information germane to the frequency of breaches, with SOX 404 being three times as informative as section 302 reports. The hazard model found an expected 2.88% reduction in breaches when SOX 302 controls were effective. Management's "material weakness' attestations provided no information in this structural model, whereas there would be around a 1% increase in breach occurrence when there exist significant deficiencies. SOX 404 attestations were the most informative; a negative SOX 404 attestation is projected to increase the frequency of breaches by around 8.5%. We concluded that the strength of internal controls attested in SOX reports is likely to be a significant factor in the occurrence of a security breach in a specific period.</p>

Do SOX 404 Control Audits and Management Assessments Improve Overall Internal Control System Quality

A Comprehensive and Quantitative Internal Control Index: Construction, Validation, and Impact

Internal control deficiencies and the issuance of going concern opinions

The Effect of SOX Internal Control Deficiencies on Firm Risk and Cost of Equity

The Effect of SOX Internal Control Deficiencies and Their Remediation on Accrual Quality

Direct and Indirect Effects of Internal Control Weaknesses on Accrual Quality: Evidence from A Unique Canadian Regulatory Setting

The Disciplining Effect of the Internal Control Provisions of the Sarbanes–Oxley Act on the Governance Structures of Firms

The discovery and reporting of internal control deficiencies prior to SOX-mandated audits

Internal Control Quality: The Role of Critical Audit Matters Reporting

The Wealth Change and Redistribution Effects of Sarbanes-Oxley Internal Control Disclosures

Business Strategy, Internal Control over Financial Reporting, and Audit Reporting Quality

Detection and Severity Classifications of Sarbanes-Oxley Section 404 Internal Control Deficiencies

Audit committee quality, auditor independence, and internal control weaknesses

Internal control in accounting research: A review

The Influence of Auditor and Client Section 404 Processes on Remediation of Internal Control Deficiencies at All Levels of Severity

The information content of Sarbanes-Oxley in predicting security breaches

Auditor realignment, voluntary SOX 404 adoption, and internal control material weakness remediation: Further evidence from U.S.-listed foreign firms

Internal Control Quality: The Role of Auditor-Provided Tax Services

Former Audit Partners on the Audit Committee and Internal Control Deficiencies

The effect of internal control deficiencies on the usefulness of earnings in executive compensation