Do Control Effectiveness Disclosures Require SOX 404(b) Internal Control Audits? A Natural Experiment with Small U.S. Public Companies

We use incremental and joint implementation of multiple SOX‐based control effectiveness disclosure and audit mandates to assess relative performance of alternatives for small U.S. public companies. Using data from several low‐ and high‐effort management disclosure and audit regimes implemented from 2003 to 2008, we find substantial and statistically significant increases in material weakness disclosure rates for small firms undergoing initial SOX 404(b) internal control audits, but find quantitatively and statistically similar increases for initial management reports of small firms exempt from such audits. As to audit cost, fees more than double for initial 404(b) audits in 2004 and remain high, while 404(b)‐exempt firms’ fees grow about 10% annually. Our results support the view that, for small firms, management internal control reports and traditional financial audits may be a cost effective disclosure alternative to full application of SOX 404(b). Also, our results suggest that, even without management reports on internal control, analysis of the cause of known accounting mistakes may yield substantial material weakness disclosures.