Since its passage in 2002 in response to financial scandals that shook the corporate world, the Sarbanes-Oxley Act, or SOX, has steadily been a target for critics. No provision of the law has provoked more complaints than Section 404(b), which requires companies to have external auditors assess the adequacy of their internal controls over financial reporting.

Paul Sarbanes, left, and Michael Oxley

Indeed, the criticism shows no sign of letting up. Testifying before a Congressional panel in July of this year, New York Stock Exchange president Thomas Farley claimed that 404(b) deserved much of the blame for the dwindling number of public corporations in the United States. He lamented that the provision has saddled companies with “significant cost” but “doesn’t show clearly that we’ve reduced fraud and [hasn’t] greatly inspired confidence.”

However, some new research may inspire greater confidence.

A study in the current issue of Auditing: A Journal of Practice & Theory, an American Accounting Association publication, concludes that 404(b) provides “an early warning system” for company fraud. The research finds “a statistically and economically significant association between material weaknesses [in internal controls] and the future revelation of fraud.”

This result, the paper says, “is driven entirely by instances where the internal control issue reflects a general opportunity to commit fraud.”

According to the research, the incidence of fraud disclosures at companies previously found to have material weaknesses is about 80% to 90% greater than is the case among companies generally. Further, of the 127 fraud cases identified by the study, 36 of them, or almost 30%, were preceded by auditor reports of material weakness in internal controls.

“Although material-weakness reports mostly reflect accounting errors and portend revelations of fraud only infrequently, the fact that they precede almost 30% of the instances where fraud does, in fact, come to light should lead investors, regulators, and legislators to take notice,” says Matthew Ege of Texas A&M University, who carried out the study with Dain Donelson and John McInnis of the University of Texas at Austin.

Whether material weakness in internal controls is connected to fraud has been a hotly debated issue in accounting. At the time SOX was implemented, SEC commissioners expressed strong confidence that requiring internal-control assessments would deter the kind of massive fraud that had recently been exposed at Enron and other companies. Yet, scholars and accounting professionals alike have expressed skepticism, contending that top company managers could override the best-laid internal controls.

In fact, some have argued that devious corporate leaders would favor strong controls, since it would reduce the chance of discovery of their own malfeasance and its fruits would fall to them personally rather than to fraudsters in the ranks.

The paper asserts that the research has broken new ground. While earlier studies have well established that material weaknesses lead to financial restatements and low accounting quality, “these studies generally do not distinguish between errors and fraud…. We provide the first evidence that weak internal controls are associated with a higher risk of unrevealed accounting fraud.

The professors collected some 14,000 internal-control opinions that auditors issued for large and midsized corporations and analyzed the relationship between reports of material weaknesses and revelations of company fraud within the following three years. Fraud was identified through review of (1) settled securities class-action lawsuits for violations of generally accepted accounting principles, and (2) federal enforcement actions by the SEC or Department of Justice.

Within the sample, auditors issued some 1,500 reports of material weakness, of which 127 (about 8.5%) were followed within three years by legal actions that revealed fraud. This infrequency notwithstanding, if the time frame is turned around, 36 of the 127 fraud revelations (about 30%) turn out to have been preceded by reports of material weakness. CEOs were named in 111 of the 127 fraud cases and CFOs in 108 cases.

In three-fourths of the 36 cases preceded by material-weakness reports, the fraudulent activity that later came to light was taking place undetected at the time of the audit. How did the weakness enable fraud? The professors test three plausible mechanisms: (1) opportunity created by a specific account or process; (2) opportunity stemming from a company-wide operational lapse (such as general accounting incompetency); and (3) cultural failings, such as habitual tolerance of misconduct.

The evidence, the researchers conclude, supports the second route — a finding, they believe, that should make investors and regulators especially wary of shrugging off operational weaknesses that are company-wide.

The paper takes note of earlier research finding that only a minority of companies made timely reports of material weaknesses in their financial statements and took regulators to task for failure to penalize companies for not doing so.

As for whether their findings argue for saving Section 404(b), the authors demur. “Much of the criticism of the provision has to do with the cost it imposes on companies, an issue that our research doesn’t engage,” Ege notes. “What this study certainly should do is persuade regulators and legislators to think extra hard before repealing or curtailing this rule.”