1.
Introduction

Today’s n
ew era of corporate governance requires higher levels of information disclosure and data
integrity due to regulations such as the Sarbanes
-
Oxley (SOX), the Gramm
-
Leach
-

Bliley Act
(GLBP) and the Health Insurance Portability and Accountability Act (HIPAA).
Each of these laws
imposes strict requirements on enterprises to establish or identify, document, test, and monitor
internal control processes (Schneier 2004). The Sarbanes
-
Oxley (SOX) Act was formulated to
LQFUHDVHFRPSDQLHVFRPSOLDQFHZLWK6(&GLVFORVXU
e laws. In the aftermath of Enron, World Com,
Tyco and other high
-
profile business scandals between December 2001 and June 2002, Congress
rapidly approved the passage of the SOX Act (SOA). What prompted the government to create this
provision was a concern

stemming from the lack of sufficient controls at these scandal
-
ridden firms,
DQGWKHQHHGIRUILUPVILQDQFLDOVWDWHPHQWVWREHDFFXUDWHDQGGHYRLGRIDQ\NLQGRIDFFRXQWLQJ
manipulation. Thus, the SOX Act required managers to implement controls over the
financial
reporting process and state whether they were effective.

In particular, the SOX Act introduced significant changes to financial practice and corporate
governance regulation, including stringent new rules designed to protect investors by improvi
ng the
accuracy and reliability of corporate disclosures made pursuant to the securities laws. Perhaps the
part of the Act having the most impact was Section 404. Section 404 requires management to submit
WRWKH6(&ZLWKWKHFRPSDQ\VDQQXDOO\ILOHGILQDQF
ial statements, an internal control report, which
shall state the responsibility of management for establishing and maintaining an adequate internal
control structure and procedures for financial reporting. It should also contain an assessment, as of
the e
nd of the fiscal year, of the effectiveness of the internal control structure and procedures for
ILQDQFLDOUHSRUWLQJ,WDOVRUHTXLUHVDXGLWRUVWRDWWHVWWRDQGUHSRUWRQWKHPDQDJHPHQWVDVVHVVPHQW
of the internal control systems. Such reports should inc
lude a description of material weaknesses in
such internal controls and of any material noncompliance. Furthermore, where significant
deficiencies exist, they need to be identified as required under SOX. For an interesting study that
examined the cause of
significant deficiencies in internal control that required identification, see Ge
DQG0F9D\7KH\IRXQGWKDWSRRULQWHUQDOFRQWUROLVUHODWHGWRDQLQVXIILFLHQWFRPPLWPHQW
RIUHVRXUFHVIRUDFFRXQWLQJFRQWUROV