A regulation that is supposed to provide a warning bell and greater transparency for investors is hampered by a lack of enforcement, according to new research conducted by accounting professor David Weber.

The School of Business has awarded one of its 2015 Best Paper Awards to Weber for his research titled, “Does SOX 404 Have Teeth? Consequences of the Failure to Report Existing Internal Control Weaknesses,” co-authored with UConn doctoral student Biyu Wu and Sarah Rice of Texas A&M. It will appear in the American Accounting Association’s premier journal, The Accounting Review.

“Dr. Weber’s paper addresses the requirement that corporations and their auditors publicly disclose internal control weaknesses, which is one of the most contentious and costly provisions of the Sarbanes-Oxley Act,” said Mohamed Hussein, accounting department head. “The study is important because it shows that the enforcement mechanisms surrounding internal control reporting are often ineffective and in some cases may even provide disincentives for compliance.”

The Sarbanes-Oxley Act was created in 2002 as the government’s response to several high-profile accounting scandals. The far-reaching regulation was aimed at public firms and requires them, in part, to report on the effectiveness of their internal controls over financial reporting, to make sure their information is accurate, timely and transparent to investors and the public.

“This requirement has been very controversial, largely because of the high costs of control audits,” Weber said. “Some question whether the benefits justify those costs. Ironically, one could argue that the scandals that motivated Sarbanes-Oxley represented a failure for the audit industry, yet the new requirements benefited audit firms by creating additional billable hours for control audits.”

While the requirement was built on laudable intensions, Weber wanted to know how it was working in practice.

“In an earlier paper, we showed that, unfortunately, many firms fail to report their control weaknesses to the public, despite the requirement,” he said. “Instead, we don’t learn of them until they cause a restatement of the financial statements. When the financials are corrected, then firms acknowledge the underlying control problems. But by then, it’s too late. The point of the requirement is to give investors fair warning of control issues ahead of time.”

Weber’s latest research examines the consequences when firms fail to report control weaknesses. He and his co-authors studied 659 firms that had restatements to correct misreporting in their financial statements. Only about 20 percent of these firms disclosed control weaknesses before their reporting problems emerged. The rest all claimed to have effective controls prior to their restatements.

“We would anticipate that if enforcement is strong, there should be consequences,” said Weber, who joined the UConn faculty in 2005.

What he found was surprising.

“There were very few consequences to firms or their managers or auditors. Perhaps one of the reasons that control weaknesses don’t get reported as often as they should is that penalties for failure to comply appear to be rare,” he said.

“We began this research partly because we hadn’t heard of any large financial penalties being imposed. We expected to find penalties, although we thought they’d be light, like managers or auditors getting fired,” he said. “But in many cases we found the opposite result. For example, management turnover was about 15 percent more likely in companies that had been upfront in disclosing their control weaknesses.”

Further complicating the issue, investors can sue a company under securities laws for misreporting, but they must establish intent. Acknowledging control weaknesses, Weber and his co-authors write, “makes it difficult for management to plausibly claim later they had been unaware of the underlying conditions in the control environment that led to their restatements.”

“Similarly, it’s much easier for the Securities and Exchange Commission to successfully pursue a company if its top management admits, up front, that they knew something was wrong, than if they say they were caught off guard,” Weber said. “The study finds that both SEC sanctions and investor lawsuits are more likely for firms with restatements if they had previously disclosed control weaknesses.”

The SEC has been redirected in recent years, focusing on the banking and financial sector. Weber notes that the pendulum, though, is swinging back now, with the recent creation of an accounting fraud task force. “It will be interesting to see if more scrutiny is applied to those corporations that fail to disclose control weaknesses,” he said. “Without vigorous enforcement, this regulation may be unlikely to fulfill its objective of enhancing investor confidence in financial reporting.”