Internal Controls After Sarbanes-Oxley: Revisiting Corporate Law's Duty of Care as Responsibility for Systems

Abstract:     
Section 404 of the Sarbanes-Oxley Act has generated a firestorm of controversy. This essay, part of a retrospective on Robert Clark's classic volume, Corporate Law, tries to explain the controversy as the natural product of indeterminacy with respect to both the benefits and costs of internal controls. The indeterminacy has led a variety of groups that benefit from an inflated construction of the liability threat (accountants, lawyers, consultants, IT professionals) to try to capture the interpretation of the requirement in a self-serving fashion. Much of the behavior in the aftermath of the new internal controls standards - especially the emphasis on expensive bottom up detail - is consistent with this account. Though significant benefits have also been generated, the risk is that internal controls resources have not been put to their best use, and that a statutory provision that makes a good deal of sense if thoughtfully administered misses the real reason why internal controls are important: countering the strategic incentives that managers have to hide information and allow information flow to be distorted.

Number of Pages in PDF File: 32

JEL Classification: M49, M41, G34, G38

working papers series