Internal Controls: SEC Should Consider Requiring Companies to Disclose Whether They Obtained an Auditor Attestation
Published: 2013-07-03T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Section 404(b) of the Sarbanes-Oxley Act requires a public company to have its independent auditor attest to and report on management's internal control over financial reporting; this is known as the auditor attestation requirement. In July 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act exempted companies with less than $75 million in public float from the auditor attestation requirement. The act mandated that GAO examine the impact of the permanent exemption on the quality of financial reporting by small public companies and on investors. This report discusses (1) how the number of financial statement restatements compares between exempt and nonexempt companies (i.e., those with $75 million or more in public float), (2) the costs and benefits of complying with the attestation requirement, and (3) what is known about the extent to which investor confidence is affected by compliance with the auditor attestation requirement. GAO analyzed financial restatements and audit fees data; surveyed 746 public companies with a response rate of 25 percent; interviewed regulatory officials and others; and reviewed laws, surveys, and studies.
section_title: What GAO Found
paragraphs: Since the implementation of the auditor attestation requirement of the Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley Act), companies exempt from the requirement have had more financial restatements (a company's revision of publicly reported financial information) than nonexempt companies, and the percentage of exempt companies restating generally has exceeded that of nonexempt companies. Exempt and nonexempt companies restated their financial statements for similar reasons (e.g., revenue recognition and expenses), and the majority of these restatements produced a negative effect on the companies' financial statements.
Views on the costs and benefits of auditor attestation vary among companies and others. Although companies and others reported that the costs associated with compliance can be significant, especially for smaller companies, GAO's and others' analyses show that these costs have declined for companies of all sizes since 2004. Companies and others reported benefits of compliance, such as improved internal controls and reliability of financial reports. However, measuring whether auditor attestation compliance costs outweigh the benefits is difficult and views among companies and others were mixed as to whether the costs exceeded the benefits of compliance.
A majority of empirical studies GAO reviewed suggest that compliance with the auditor attestation requirement has a positive impact on investor confidence in the quality of financial reports. Some interviewees said the independent scrutiny of a company's internal controls is an important investor protection safeguard. The Securities and Exchange Commission (SEC) does not require exempt companies to disclose in their annual report whether they voluntarily obtained an auditor attestation. SEC officials said it is not common for SEC to require a company to disclose voluntary compliance with requirements from which it is exempt. However, federal securities laws require companies to disclose relevant information to investors to aid in their investment decisions. Although information on auditor attestation status is available to investors, requiring a company to explicitly state whether it has obtained an auditor attestation on internal controls could increase transparency and investor protection.
section_title: What GAO Recommends
paragraphs: GAO recommends that SEC consider requiring public companies, where applicable, to explicitly disclose whether they obtained an auditor attestation of their internal controls. SEC responded that investors could determine attestation status from available information. But without clear disclosure, investors may misinterpret a company's status; therefore, this warrants SEC's further consideration.

section_title: Letter
paragraphs: Public and investor confidence in the accuracy, reliability, and  transparency of companies’ financial reporting is critical to the effective  functioning of U.S. capital markets. In response to a series of high-profile  corporate accounting scandals that resulted in substantial losses to  investors at the start of the last decade, Congress passed the Sarbanes- Oxley Act of 2002 (Sarbanes-Oxley Act). The act introduced major  reforms to public company financial reporting and auditing that were  intended to, among other things, improve the reliability of financial  reporting and enhance audit quality. Effective internal controls are a key  focus of these reforms. In particular, Section 404(b) of the act—the  auditor attestation requirement—requires that each public company’s  independent auditor annually attest to and report on management’s  assessment of the effectiveness of the company’s internal control over  financial reporting.weaknesses exist as of year-end.
The auditor determines whether any material  The auditor attestation requirement has been subject to much debate  since its inception. Congress, business groups, regulators, consumer,  investor and auditing groups, and academics have debated the need for  small public companies (generally considered to be public companies  with a publicly available stock value of less than $75 million) to comply  with the auditor attestation requirement. Opponents of the requirement  argue that compliance is too costly, especially for small public companies.  In contrast, proponents of the requirement argue that, generally, small  public companies lack adequate internal controls and restate their  financial statements—that is, revise their financial statements to correct  accounting errors—more often than large companies. Therefore, they  argue, the requirement provides an important investor protection  safeguard by ensuring independent scrutiny of a company’s financial  reporting process.
The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd- Frank Act) Section 989G, amended the Sarbanes-Oxley Act so that  Section 404(b) does not apply with respect to “any audit report prepared  for an issuer that is neither a ‘large accelerated filer’ nor an ‘accelerated  filer’ as those terms are defined” by the Securities and Exchange  Commission (SEC). By adding Section 404(c) to the Sarbanes-Oxley  Act, Section 989G permanently exempted smaller issuers from the  requirement to obtain an auditor’s attestation on management’s  assessment of the company’s effectiveness of internal control over   At the time of enactment in 2010, Section 989G  financial reporting.affected about 5,500 small public companies, representing about 61  percent of all public companies, by exempting them from the  requirement.
Section 989I of the Dodd-Frank Act mandated us to study and report on  the impact of the permanent exemption on the quality of financial  reporting by smaller public companies and on investors. discusses: (1) how the number of financial statement restatements  compares between exempt and nonexempt companies; (2) the costs and  benefits for nonexempt companies and exempt companies that voluntarily  comply with the auditor attestation requirement; and (3) what is known  about the extent to which investor confidence in the integrity of financial  statements is affected by whether or not companies comply with the  auditor attestation requirement. For the purposes of this report, we define  exempt companies as those with less than $75 million in public float  (nonaccelerated filers) and nonexempt companies as those with $75  million or more in public float (accelerated filers). § 989I(a)-(b).
Audit Analytics is an online market intelligence service that provides information on SEC  registrants. Audit Analytics maintains a proprietary database containing information from  the filings public companies submit to SEC, such as audit fees, audit opinions, and  financial restatements. pensions and any other issues identified in the restatement).audit costs of compliance, we analyzed data from Audit Analytics’ Auditor  Opinion database, which contains auditors’ report information, including  audit fees, nonaudit fees, auditor name, audit opinions, revenues, and  company size, for 2005 through 2011. Our analyses of audit costs do not  include 2012 data because some of the data for small companies were  incomplete as we concluded our analysis. According to Audit Analytics,  the incomplete data was often due to the fact that the small companies  had not yet filed the relevant information with SEC. In addition, although  2012 restatement data are available, we were unable to conduct some of  our analyses of restatements for 2012 because of incomplete 2012 small- company data in the Auditor Opinion database. We tested samples of the  Audit Analytics database information and found it to be reliable for our  purposes.
To obtain information on large and small public companies’ experiences  with the costs and benefits of complying with the auditor attestation  requirement and the extent to which investor confidence in the integrity of  financial statements is affected by companies’ compliance with the  requirement (referred to as auditor attestation status), we identified a  population of 4,053 companies that fit within the scope of our review. To  define the population, we obtained a list of all publicly traded companies  for calendar years 2004 through 2011 from Audit Analytics. We stratified  the population into three strata by first identifying the nonaccelerated filers  that voluntarily complied with the integrated audit requirement in any year  from 2004 through 2011. We excluded from our population any exempt  company that did not obtain an auditor attestation of its internal controls  and then stratified the remaining companies into accelerated filers and  large accelerated filers. We surveyed all nonaccelerated filers that voluntarily complied as well as a random sample of both strata of  accelerated filers for a total survey population of 746 companies. We  received valid responses from 195 companies. The weighted response  rate for this survey, which accounts for the differential sampling fractions  within each strata, was 25 percent. All percentage estimates presented in  this report have a margin of error of plus or minus 15 percentage points or  fewer, and all estimates of averages have a relative margin of error of  plus or minus 20 percent or less, unless otherwise noted.
For all three objectives, we interviewed representatives of small public  companies, regulatory bodies (SEC and Public Company Accounting  Oversight Board (PCAOB)), trade associations (representing individual  and institutional investors, accounting firms, financial analysts and  investment professionals, and financial executives), industry experts, a  large pension fund, a credit rating agency, and academics knowledgeable  about accounting issues. We also reviewed relevant academic, industry,  and SEC research studies and surveys. Appendix I contains a more  detailed description of our scope and methodology.
We conducted this performance audit from May 2012 to July 2013 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Internal control generally serves as a first line of defense for public  companies in safeguarding assets and preventing and detecting errors  and fraud. Internal control is defined as a process, effected by an entity’s  board of directors, management, and other personnel, designed to  provide reasonable assurance regarding the achievement of the following  objectives: (1) effectiveness and efficiency of operations; (2) reliability of  financial reporting; and (3) compliance with laws and regulations.
Internal control over financial reporting is further defined in the SEC  regulations implementing Section 404 of the Sarbanes-Oxley Act.regulations define internal control over financial reporting as a means of  providing reasonable assurance regarding the reliability of financial  reporting and the preparation of financial statements, including those  policies and procedures that: pertain to the maintenance of records that, in reasonable detail,  accurately and fairly reflect the transactions and dispositions of the  assets of the company; provide reasonable assurance that transactions are recorded as  necessary to permit preparation of financial statements in conformity  with generally accepted accounting principles, and that receipts and  expenditures of the company are being made only in accordance with  authorizations of management and directors of the company; and provide reasonable assurance regarding prevention or timely  detection of unauthorized acquisition, use, or disposition of the  company’s assets that could have a material effect on the financial  statements.
Regulators regard an effective internal control system as a foundation for  high-quality financial reporting by companies. Title IV, Section 404 of the  Sarbanes-Oxley Act, aims to help protect investors by, among other  things, improving the accuracy, reliability, and transparency of corporate  financial reporting and disclosures. Section 404 has the following two key  sections:
Section 404(a) requires company management to state its  responsibility for establishing and maintaining an adequate internal  control structure and procedures for financial reporting and assess the  effectiveness of its internal control over financial reporting in each  annual report filed with SEC. In 2007, SEC issued guidance for  management regarding its report on internal control over financial  reporting.
Section 404(b) requires the firms that serve as external auditors for  public companies to provide an opinion on the internal control  assessment made by the companies’ management regarding the  effectiveness of the company’s internal control over financial reporting  as of year-end. In 2007, PCAOB issued Auditing Standard No. 5,  which contains the requirements that apply when an auditor is  engaged to perform an audit of management’s assessment of the  effectiveness of internal control over financial reporting.
While management is responsible for the implementation of an effective  internal control process, the external auditor obtains reasonable  assurance to provide an opinion on the effectiveness of a company’s  internal control over financial reporting through an independent audit.  Investors need to know that the financial statements on which they make  investment decisions are reliable. The auditor attestation process involves  the external auditor’s testing and evaluation of the company’s internal  control over financial reporting and relevant documentation in order to  provide an opinion on the effectiveness of the company’s internal control  over financial reporting as of year-end; a company’s internal control over  financial reporting cannot be considered effective if one or more material  weaknesses exist.
Auditor attestation of the effectiveness of internal control over financial  reporting has been required for public companies with a public float of  $75 million or more (accelerated filers) since 2004. However, SEC  delayed implementing the auditor attestation for public companies with  less than $75 million in public float (nonaccelerated filers) several times  from the original compliance date of April 15, 2005, to June 15, 2010, in  response to concerns about compliance costs and management and  auditor preparedness. On July 21, 2010, the Dodd-Frank Act  permanently exempted nonaccelerated filers from the auditor attestation  requirement. The Dodd-Frank Act did not exempt nonaccelerated filers  from Section 404(a) of the Sarbanes-Oxley Act (management’s  assessment of internal controls). See table 1 for final compliance dates  for internal control over financial reporting by issuer filer status.
The number of exempt companies exceeded the number of nonexempt  companies in each year from 2005 through 2011 (see table 2). According  to our analysis of Audit Analytics data, the number of exempt companies  fluctuated and ultimately declined from 6,333 in 2005 to 5,459 in 2011  (13.8 percent during that period). The number of nonexempt companies  also fluctuated and ultimately declined from 4,256 in 2005 to 3,671 in  2011(13.7 percent).
SEC and PCAOB have issued regulations, standards, and guidance to  implement the Sarbanes-Oxley Act. In 2007, in response to companies’  concerns about implementation costs, SEC provided implementation  guidance to company management, and PCAOB issued a new auditing  standard to external auditors to make the internal controls audit process  more efficient and more cost-effective. SEC’s guidance for management  in implementing Section 404(a) of Sarbanes-Oxley Act and PCAOB’s  Auditing Standard No. 5 for external auditors in implementing Section  404(b) of Sarbanes-Oxley Act endorsed a “top-down, risk-based  approach” that emphasizes preventing or detecting material  misstatements in financial statements by focusing on those risks that are  more likely to contribute to such misstatements. These changes were  provided to create a more flexible environment where company  management and external auditors can scale their internal controls  evaluation based on the particular characteristics of a company to reduce  costs and to align SEC and PCAOB requirements for evaluating the  effectiveness of internal controls.
Both SEC regulations and PCAOB Auditing Standard No. 5 state that  management is required to base its assessment of the effectiveness of  the company’s internal control over financial reporting on a suitable,  recognized control framework established by a body of experts that  followed due process procedures. Both the SEC guidance and PCAOB’s  auditing standard cite the Committee of Sponsoring Organizations of the  Treadway Commission (COSO) framework as an example of a suitable  framework for purposes of Section 404 compliance. In 1992, COSO  issued its “Internal Control—Integrated Framework” (the COSO  framework) to help businesses and other entities assess and enhance  their internal controls. Since that time, the COSO framework has been  recognized by regulatory standard setters and others as a comprehensive  framework for evaluating internal control, including internal control over  financial reporting. The framework consists of five interrelated  components: control environment, risk assessment, control activities,  information and communication, and monitoring.PCAOB do not mandate the use of any particular framework.
section_title: The Percentage of Exempt Companies with Financial Restatements Was Generally Greater Than the Percentage of Nonexempt Companies from 2005 through 2011
paragraphs: Since the implementation of the Sarbanes-Oxley Act, the number and  percentage of exempt companies restating their financial statements has  generally exceeded the number and percentage of nonexempt companies  restating. However, from 2005 through 2011, restatements by exempt  companies were generally proportionate to their percentage of our total  population. Specifically, on average, almost 64 percent of companies  restating were exempt companies and exempt companies made up, on  average, 60 percent of our total population. Exempt and nonexempt  companies restated their financial statements for similar reasons, and the  majority of these restatements produced a negative effect on the  companies’ financial statements.
subsections: section_title: Exempt Companies Generally Have Had More Financial Restatements Than Nonexempt Companies
paragraphs: The number of financial statement restatements by exempt and  nonexempt companies has generally declined since 2005. As illustrated  in figure 1, the number of financial restatements peaked in 2006 for  exempt companies and declined gradually until 2011, despite a slight  uptick in 2010. The number of restatements peaked in 2005 for  nonexempt companies, declined gradually until 2009, and then trended  upward for the remaining 2 years of the review period. As we have  previously reported, some industry observers noted the financial reporting  requirements of the Sarbanes-Oxley Act and PCAOB inspections may  have led to a higher than average number of restatements in 2005 and  2006. A 2010 Audit Analytics report noted that some observers  attributed the subsequent decline in restatements to a belief that SEC  relaxed standards in 2008 relating to materiality of errors and the need to  file restatements.companies exceeded the number of financial restatements by nonexempt  companies each year from 2005 through 2011. However, although the  overall number of financial restatements from 2009 through 2011  remained lower than the prior period, the number of financial  restatements by nonexempt companies increased about 23 percent from   The number of financial restatements by exempt  2010 through 2011. The number of financial restatements by exempt  companies declined almost 8 percent during the same period.
SEC officials and one market expert with whom we spoke indicated that  there is no clear explanation for these restatement trends. They also said  that a review of each individual financial restatement would be necessary  to determine the reasons for the restatement trends, but they offered a  few factors to consider when assessing the trends. In particular, a recent  Audit Analytics report found that approximately 57 percent of  restatements disclosed in 2011 were defined as revision restatements,  the highest level since 2005 (the first full year of the disclosure  requirement). According to the report, revision restatements generally  do not undermine reliance on past financials and are less disruptive to the  market. SEC officials noted that although restatements by nonexempt  companies have increased, as illustrated in the Audit Analytics report,  they may be less severe as a result of higher numbers of revision  restatements, fewer issues per restatement, and a lower cumulative  impact on the company’s net income. According to our analysis of Audit  Analytics data, in 2011, the percentage of restatements that were revision  restatements was approximately 62 percent for exempt companies  compared to approximately 70 percent for nonexempt companies. SEC  officials also suggested that the detection rate of financial restatements  could affect restatement trends, especially when looking only at a one or  two year period. The officials said that the lag time on detection and the  likelihood of detection could be different between exempt and nonexempt  companies. Finally, SEC officials said that it is important to consider the  nature and severity of restatements.
Except for 2005, the percentage of exempt companies restating their  financial statements exceeded the percentage of nonexempt companies  restating. From 2006 through 2009, there was a decline in the percentage  of restatements for both exempt companies and nonexempt companies.  The percentage of exempt companies restating their financial statements  rose in 2010 to 7.6 percent and remained constant in 2011 (see fig. 2).  At the same time, starting in 2010, the percentage of nonexempt  companies restating has been on the increase. In addition, from 2005 to  2011, on average, almost 64 percent of companies restating were exempt  companies, which made up 60 percent of our total population.
Our analysis is generally consistent with a number of studies that have  found that exempt companies restate their financial statements at a  higher rate than nonexempt companies.having an auditor attest to the effectiveness of a company’s internal  control over financial reporting generally reduces the likelihood of  financial restatements. For example, in 2009, Audit Analytics found that  for companies that did not obtain an auditor attestation and stated that   These studies suggest that  they had effective internal controls, their financial restatement rate was 46  percent higher than the restatement rate for companies that had obtained  an auditor attestation and stated that they had effective internal controls.
section_title: Exempt Companies That Voluntarily Complied with Auditor Attestation Issued Fewer Restatements Than Exempt Companies That Did Not
paragraphs: Exempt companies that voluntarily complied with the auditor attestation  requirement constitute a small percentage of exempt companies (see  table 3). Prior to the passage of the Dodd-Frank Act in July 2010, the  number of exempt companies voluntarily complying with the auditor  attestation requirement grew 70 percent from 2008 through 2009.  Although SEC deferred the requirement for nonaccelerated filers to  comply until June 15, 2010, some exempt companies likely voluntarily  complied in anticipation of SEC’s implementation of the requirement.  Nonetheless, in 2009 during the peak compliance period for exempt  companies that voluntarily complied, 6.9 percent (435) of a total  population of 6,285 exempt companies voluntarily complied with the  auditor attestation requirement. According to one academic study, exempt  companies that voluntarily comply with the auditor’s attestation  requirement are more likely than companies that do not comply to have  evidence of the superior quality of their internal control over financial  reporting and fewer restatements, among other factors.
As table 3 also shows, the percentage of financial restatements by  exempt companies that voluntarily complied with the requirement is  generally lower than that of exempt companies that did not voluntarily  comply. From 2005 through 2011, on average, 7.5 percent of exempt  companies that voluntarily complied restated their financial statements  compared to 8.9 percent of restating exempt companies that did not  voluntarily comply.
section_title: Reasons for Financial Restatement and Industry Trends Are Generally Consistent for Both Exempt and Nonexempt Companies
paragraphs: From 2005 through 2011, based on our analysis of Audit Analytics data,  the majority of exempt and nonexempt companies that restated their  financial statements did so as the result of an accounting rule  misapplication. That is, a company revised previously issued public  financial information that contained an accounting inaccuracy. To analyze  the reasons for financial restatements, we used Audit Analytics’ 69  classifications to classify the type of financial restatements into six  categories (see table 4): revenue recognition, core expenses, noncore  expenses, reclassifications and disclosures, underlying events, and  other.
Based on our classification, core expenses (i.e., ongoing operating  expenses) were the most frequently identified category of restatement for  both exempt and nonexempt companies. Specifically, core expenses  accounted for 30.2 percent of disclosures by exempt companies and 28.5  percent of disclosures by nonexempt companies from 2005 through 2011  (see fig. 3). Core expenses include cost of sales, compensation  expenses, lease and depreciation costs, selling, general and  administrative expenses, and research and development costs. Noncore  expenses (i.e., nonoperating expenses) were the second most frequently  identified reason for restatement across exempt and nonexempt  companies during this period. Each of the other reasons for restatements  represented less than 20 percent of all restatements by exempt and  nonexempt companies during the period.
From 2005 through 2011, the majority of financial restatements by  exempt and nonexempt companies negatively impacted the company’s  financial statements. Specifically, 87.6 percent of financial restatements  by exempt companies resulted in a negative net effect on the financial  statements—the income statement, the balance sheet, the statement of  cash flows, or the statement of shareholder’s equity—of these  companies. Similarly, 80.6 percent of financial restatements by  nonexempt companies resulted in a negative net effect on the company’s  financial statements.
The characteristics of exempt and nonexempt companies with financial  restatements varied from 2005 through 2011. For example, in terms of  industry characteristics, on average, most exempt companies restating  were in the manufacturing sector (29.4 percent), followed by agriculture,  construction, and mining (14.6 percent). On average, most of the  nonexempt companies restating were in the manufacturing sector (29.3  percent), followed by the financial sector (16.6 percent). Further, in 2011,  91.4 percent of nonexempt companies restating compared to 35.3  percent of exempt companies were listed on an exchange. In addition,  nonexempt companies had an average financial restatement period that  was longer than that of exempt companies. Specifically, from 2005  through 2011, nonexempt companies had an average financial  restatement period of 9 quarters compared to an average financial  restatement period of almost 6 quarters for exempt companies.
section_title: Views on the Costs and Benefits of Auditor Attestation Vary among Companies and Others
paragraphs: Companies and others identified various costs of the auditor attestation  requirement. A number of studies and surveys show that since the  passage of the Sarbanes-Oxley Act, and especially since the 2007  reforms by SEC and PCAOB, audit costs have declined for companies of  all sizes. These studies and surveys also show that these costs, as a  percentage of revenues, affect smaller companies disproportionately  compared to their larger counterparts. Companies and others also  identified benefits of compliance, including stronger internal controls and  more transparent and reliable financial reports. However, determining  whether auditor attestation compliance costs outweigh the benefits is  difficult because many costs and benefits cannot be readily quantified.
subsections: section_title: Auditor Attestation Costs Can Be Significant, Especially for Small Companies, but Costs Are Declining
paragraphs: A number of studies and surveys show that the estimated costs of  obtaining an external auditor attestation on internal control over financial  reporting are significant for companies of all sizes. Obtaining an auditor  attestation incurs both direct and indirect costs, according to one study.  Direct costs are expenses incurred to fulfill the auditor attestation  requirement, such as the audit fees, external fees paid to outside  contractors and vendors that help companies comply with the  requirement, salaries of internal staff for hours spent preparing for auditor  attestation compliance, and nonlabor expenses (e.g., technology,  software, travel, and computers related to compliance). Indirect costs are  those costs not directly linked to obtaining the auditor attestation. Two  examples of indirect costs cited by one interviewee and one study are the  time spent by management in preparing for and addressing auditors’  inquiries, which diverts their attention from strategic planning, and the  diversion of funds from capital investments to auditor attestation-related  expenses.
Audit fees are a significant direct cost of the auditor attestation  requirement. Sarbanes-Oxley Act and PCAOB standards require that the  financial statement audit and the auditor attestation audit be conducted  on an integrated basis. As a result, the auditor attestation is included in  the total audit fees—that is, the total amount companies pay to their  external auditors to conduct the integrated audit. Audit fees are based on  several factors, including but not limited to the scope of an audit, which is  a function of a company’s complexity and risk; the total effort required by  the external auditor to complete the audit; and the risk associated with  performing the audit. However, according to SEC’s 2011 study and one  interviewee, the costs incurred by a company to comply with the auditor  attestation requirement generally decline after the initial year.
We analyzed total audit fees as a percentage of revenues from 2005  through 2011 for exempt and nonexempt companies. We found that  exempt companies, which tend to be smaller, had higher average total  audit costs, measured as a percentage of revenues, compared to  nonexempt companies (see table 5). Among exempt companies, the data  indicate that exempt companies that do not voluntarily comply with the  auditor attestation requirement have (except for 2006) higher average  total audit fees as a percentage of revenues than the exempt companies  that voluntarily comply. While two academics we contacted about this  trend could not provide a definitive explanation, there are many factors  beside company size that can affect audit fees.
Our data analysis results are consistent with our previous work on audit  fees. Specifically, in 2006, we reported that smaller public companies  paid disproportionately higher audit fees compared to larger public  companies. Smaller public companies noted that they incur higher audit  fees and other costs, such as hiring more staff or paying outside  consultants to comply with the internal control provisions of the Sarbanes- Oxley Act. One study noted that historically, these higher audit fees and  other costs increased regulatory costs for smaller public companies  because regulatory compliance, in general, involves a significant number  of fixed costs regardless of the size of a company. Thus, smaller  companies with lower revenues are forced to bear these fixed costs over  a smaller revenue base compared to larger companies.
However, the auditor attestation is one element of the total audit fees. To  gauge the amount spent on the auditor attestation, we asked respondents  to our survey to provide us with the amount of total audit fees and the  approximate amount attributable to complying with the auditor attestation  requirement. Based on our survey results, we estimate that all companies  with a market capitalization of less than $10 billion that obtained an  auditor attestation in 2012 spent, on average, about $350,000 for auditor  attestation fees, representing about 29 percent of their average total audit  fees.
Although these costs remain significant for many companies, the cost of  implementing the auditor attestation provision has been declining and  varies by company size. For example, SEC’s 2009 study on internal  control over financial reporting found that, among other things, the mean  auditor attestation costs declined from about $821,000 to about $584,000  (approximately 29 percent) pre- and –post 2007 reforms for all companies  that obtained an auditor attestation. Median costs declined from about  $358,000 to $275,000 (approximately 23 percent) pre- and –post 2007  reforms. According to the study and an academic we interviewed, costs  have been declining for a variety of reasons, including companies and  auditors gaining experience in the auditor attestation environment and the  2007 SEC and PCAOB guidance. The academic further stated that in the  early years of implementation of Section 404(b), initial costs were high for  all companies, in part, because they had not previously implemented  effective internal controls.
section_title: Companies and Others Also Identified Perceived Benefits of Compliance
paragraphs: There are two types of potential benefits or positive impacts—direct and  indirect—that companies can receive from complying with the auditor  attestation requirement according to one study. Direct benefits are those  directly related to improvements in the company’s financial reporting  process, such as the quality of the internal control structure, the audit  committee’s confidence in the internal control structure, the quality of  financial reporting, and the company’s ability to prevent and detect fraud.  Indirect benefits are other dimensions that may be affected by changes in  the quality of the financial reporting process, such as a company’s ability  to raise capital, the liquidity of the common stock, and the confidence  investors and other users of financial statements may have in the  company.
Respondents to our survey identified a number of benefits or positive  impacts stemming from compliance with the auditor attestation  requirement, although fewer of them perceived indirect benefits compared  to direct benefits. Many survey respondents noted that they experienced  a number of direct benefits. For example, we estimate that:
80 percent of all companies view the quality of their company’s  internal control structure as benefiting from the auditor attestation;
73 percent view their audit committee’s confidence in internal  control over financial reporting as benefiting from the auditor  attestation;
53 percent view their financial reporting as benefiting from the
46 percent view their ability to prevent and detect fraud as  benefiting from the auditor attestation (see table 6).
Our findings are consistent with other surveys. In particular, Protiviti’s  2013 survey found that, among other things, 80 percent of respondents  reported that their company’s internal control over financial reporting  structure had improved since they began complying with the auditor  attestation requirement.improved confidence in the financial reports of other Section 404(b)  compliant companies, fewer companies’ perceived indirect benefits of the  requirement. Specifically, based on our survey results, no more than 30  percent of all companies with less than $10 billion in market capitalization  perceived any of the identified indirect benefits (see table 6) as stemming  from the auditor attestation requirement.
section_title: Auditor Attestations Appear to Positively Affect Investor Confidence, and Disclosure of Compliance Status Could Enhance Investor Protection
paragraphs: Research suggests that auditor attestation generally has a positive effect  on investor confidence. Although exempt companies are currently not  required to disclose whether they voluntarily complied with the auditor  attestation requirement in their annual reports, doing so would provide  investors with important information that may influence their investment  decisions.
subsections: section_title: Most Empirical Studies We Reviewed Suggest That Auditor Attestation Has a Positive Impact on Investor Confidence
paragraphs: Recent empirical studies we reviewed found that auditor attestation of  internal controls generally has a positive impact on investor confidence.  Investor confidence is considered an indirect benefit to companies that  comply with the auditor attestation requirement. Specifically, an auditor  attestation of internal controls helps to reduce information asymmetries  between a company’s management and investors. With increased  transparency and better financial reporting due to reliable third-party  attestation, investors face a lower risk of losses from fraud. This lowered  risk has a number of positive consequences for companies, such as  enabling them to pay less for the capital as more confident investors  require a lower rate of return on their money.
Because investor confidence is difficult to measure directly, empirical  research has examined the impact of auditor attestation on other  variables that are considered proxies for investor confidence, including  the cost of equity and debt capital, stock performance, and liquidity.
As  described below, such research has found that the auditor attestation  increases investor confidence.
A 2012 study examined exempt and nonexempt companies with  market capitalization between $25 million and $125 million. This  study found that the market value of equity—as measured by the  common stock price—is positively associated with the book value  of equity—which is an element in financial statements—but that  this relationship is stronger for nonexempt companies. In other  words, investors appear to put greater trust on the book value of  equity of companies that are subject to auditor attestation  compared to those companies that are not. As a result, book value  is more likely to have a positive effect on market value if the  auditor attestation is present. These results are consistent with the  notion that the auditor attestation provides useful and relevant  information to investors.
A 2013 study found that exempt companies that voluntarily comply  with the auditor attestation enjoy a lower cost of capital.  Specifically, both the cost of equity and the cost of debt are  significantly lower for companies that voluntarily comply with the  requirement compared to those exempt companies that do not.
C. A. Cassell, L.A. Myers, and J. Zhou, “The Effects of Voluntary Internal Control Audits  on the Cost of Capital,” Working paper, (Feb. 13, 2013).
75 million. The study found a negative market response to the  exemption but less so for those companies that voluntarily  complied before 2009. It also found that to reduce information  asymmetry, companies that voluntarily comply use their  compliance as a signal to the marketplace of the superior quality  of their financial reporting—a signal that is credible because it is  costly and difficult to imitate by companies with weak internal  controls. Also, companies that voluntarily complied with auditor  attestation had significant increases in liquidity.
Other research supports the view that auditor attestation of internal  control effectiveness matters for investors and other market participants  insofar as adverse auditor reports have negative consequences for  companies. Such consequences include higher cost of debt (and possibly  higher cost of equity), lower probability that lenders will extend lines of  credit, stricter loan terms, and unfavorable stock recommendations.
While most research findings we reviewed suggest auditor attestation  provides valuable information to investors and has a positive effect on  confidence, a 2011 study questions the value of the auditor attestation for  small companies. Looking at exempt and small nonexempt companies  with market capitalization of $300 million or less, the study finds that small  companies that became nonexempt, and therefore subject to the auditor  attestation requirement, in 2004 experienced a statistically significant  increase in their material weakness disclosure rate, but companies that  remained exempt saw similar increases through their management  reports under Section 404(a) of the Sarbanes-Oxley Act. The results  suggest that auditor attestation provides little additional information to  investors in terms of detecting material weaknesses because there is no  statistically significant difference in the rate of disclosure of material  weakness between the two types of companies.
section_title: Anecdotal Information Also Suggests Auditor Attestation Can Positively Impact Investor Confidence
paragraphs: The majority of academics and market participants we interviewed  suggest that having auditor attestation positively impacts investor  confidence. Specifically, they told us that the involvement of auditors in  attesting to the effectiveness of internal controls improves the reliability of  the financial reporting and serves to protect investors. As a result, they  said, the exemption granted to small companies is likely to reduce  investor confidence because these companies already have greater  informational asymmetry. They said that according to academic and other  studies, small companies are also more likely than large ones to have  serious internal control problems. Furthermore, they commented that  management’s report on internal controls alone is often uninformative  because management often fails to detect internal control deficiencies or  classifies them as less severe than they are. Some market participants  also told us that any company accessing capital markets, regardless of  size, should be required to comply with the auditor attestation  requirement as investors in any company, large or small, are entitled to  the same investor protection.
Our survey results also indicate that some companies view auditor  attestation as contributing to investor confidence, which is similar to  findings from others’ studies and surveys. Our survey results show that  the majority of respondents are more confident in the financial reports of  companies that comply with the auditor attestation requirement than  companies that do not. In addition, we estimate that 30 percent of  responding nonexempt and exempt companies that voluntarily comply  thought that the requirement increased investor confidence in their own  company, while 20 percent were not sure and the remaining 50 percent  reported no impact. This perspective is consistent with the results from an  in-depth 2009 telephone survey SEC conducted of a small group of  financial statement users—such as lenders, securities analysts, credit  rating agencies, and other investors—regarding their views on the  benefits of auditor attestation. These SEC survey respondents indicated  that the auditor’s attestation report provides additional benefits to users  and other investors beyond the management’s report under Section  404(a) and that the requirement generally has a positive impact on their  confidence in companies’ financial reports. Moreover, in response to a  2010 Center for Audit Quality (CAQ) survey of individual investors, almost  two-thirds of investors said they were concerned about exempting  companies with annual revenues of under $75 million from the  independent auditor attestation requirement, suggesting that the  requirement has a positive effect on individual investors’ confidence in the  financial information generated by smaller companies. Similarly, in a  2012 survey of investors conducted by the PCAOB Investor Advisory  Group on the role, relevance, and value of the audit, over 60 percent of  respondents said that the auditor’s opinion on the effectiveness of internal  controls is critical in making investment decisions. Further, in a 2012  survey of individual investors by CAQ, 70 percent of the respondents  identified independent audits in general as the most effective means of  protecting their interests.
section_title: Disclosure of Auditor Attestation Status Could Enhance Transparency
paragraphs: Explicit disclosure of auditor attestation status in exempt companies’  annual reports could quickly provide investors useful information that may  influence their investment decisions. Currently, exempt companies are  not required to disclose in their annual reports whether they have  voluntarily obtained an auditor attestation on their internal controls. From  2005 through 2010, SEC granted small public companies multiple  extensions from having to comply with the auditor attestation requirement.  During this time of forbearance, SEC required exempt companies to  include a general statement in their annual report that the company was  not required to comply with the auditor attestation requirement because of  SEC’s grant of temporary exemption status. According to SEC officials,  the statement served to provide investors who may have been looking for  the attestation an explanation of its absence. SEC granted its final  temporary exemption to take effect on June 15, 2010, prior to the  passage of the Dodd-Frank Act. SEC did not require exempt companies  to include the disclosure statement when implementing the provision of  the Dodd-Frank Act that created the permanent exemption.
SEC officials said that it is not common for the agency to require a  company to disclose compliance status for requirements that are not  applicable to the company—which, according to SEC officials, could  potentially influence a company’s behavior. Further, SEC officials noted  that information on the company’s filing status—and, therefore exemption  status—can be found in the company’s annual reports and other  documents, which are available to all investors.stated that such information allows investors to determine whether an  attestation has been obtained. However, while this information is  available, a company’s attestation status is not readily apparent without  some knowledge or interpretation of the current reporting requirements.  As noted earlier, SEC has previously required companies to provide  additional clarity on their compliance with the auditor attestation  requirement. Thus, requiring companies to explicitly disclose their auditor  attestation status would be consistent with its past action.
Further, federal securities laws require public companies to disclose  relevant information to investors to aid them in their investment  decisions. Many market participants we interviewed consider the  external auditor’s assessment of the effectiveness of a company’s internal  control over financial reporting to be important information for investors.  Thus, many market participants we interviewed and companies we  surveyed noted that exempt companies should be required to explicitly  disclose whether or not they obtained an auditor attestation to make the  information more transparent for investors. In particular, according to the  results of our survey, we estimate that 57 percent of all companies with  less than $10 billion in market capitalization are in favor of requiring  exempt companies to disclose whether they have voluntarily obtained an  auditor attestation. A representative from one company said “I believe  there is an assumption that SEC-listed companies are in compliance with  404. If companies are not, they should disclose such.” A representative  from another company said that “If investors value the independent audit,  then they should be made aware of situations where such audit has not  been performed. Investors should not have to interpret the regulations to  know if the audit is required.” Some companies we surveyed that were  not in favor of such disclosure generally believed that investors can get  the information from the audit opinion in the annual report. As of year-end  2011, approximately 300 exempt companies had voluntarily complied with  the auditor attestation requirement. Although information on voluntary  compliance with the auditor attestation requirement is determinable,  having the information explicitly disclosed could benefit investors. Such  disclosure would increase transparency and investor protection by  making investors more aware of this important investment information.
section_title: Conclusions
paragraphs: Investors need accurate financial information with which to make  informed investment decisions, and effective internal controls are  necessary for accurate and reliable financial reporting. The attestation  requirement is part of legislation aimed at helping to protect investors by,  among other things, improving the quality of corporate financial reporting  and disclosures. Perceptions of the costs and benefits of auditor  attestation continue to vary among companies and others, but among  other benefits, obtaining auditor attestation appears to have a positive  impact on investor confidence. In addition, our analysis found that  companies (both exempt and nonexempt) that obtained an auditor  attestation generally had fewer financial restatements than those that did  not, which suggests that knowing whether a company has obtained the  auditor attestation may be useful for investors in gauging the reliability of  a company’s financial reporting. However, because SEC regulations  currently do not require explicit statements regarding the voluntary  attainment of auditor attestation, investors may have to interpret reporting  requirements and filings to determine whether exempt companies have  obtained an auditor attestation. Previously, when certain companies were  temporarily exempt from the auditor attestation requirement, SEC  required explicit disclosure of exemption status in companies’ annual  reports. However, SEC eliminated this requirement in 2010 when  companies of certain sizes were permanently exempted. Federal  securities laws require public companies to disclose relevant information  to investors to aid them in their investment decisions. Although  information on a company’s exempt status is available to investors,  explicit disclosure would increase transparency and investor protection by  making investors readily aware of whether a company has obtained an  auditor attestation on internal controls. The disclosure could serve as an  important indicator of the reliability of a company’s financial reporting,  which may influence investors’ decisions.
section_title: Recommendation for Executive Action
paragraphs: To enhance transparency and investor protection, we recommend that  SEC consider requiring public companies, where applicable, to explicitly  disclose whether they obtained an auditor attestation of their internal  controls.
section_title: Agency and Third- Party Comments and Our Evaluation
paragraphs: We provided a draft of the report to the SEC Chairman for her review and  comment. SEC provided written comments that are summarized below  and reprinted in appendix II. We also provided a draft of the report to  PCAOB and relevant excerpts of the draft report to Audit Analytics for  technical review. We received technical comments from SEC, PCAOB,  and Audit Analytics that were incorporated as appropriate.
In its written comments, SEC did not comment on our recommendation  that it consider requiring public companies to explicitly disclose whether  they have obtained an internal control attestation. Rather, SEC confirmed,  as described in the draft report, that a nonaccelerated filer (referred to as  an exempt company in our report) does not have to explicitly disclose  whether it obtained an auditor attestation report on its internal controls in  its annual report. However, SEC stated that this fact can be easily  determined by investors from information that is already disclosed in the  annual report. In addition, SEC stated that investors can also find  information regarding the existence of an opinion on internal controls by  looking at the audit report in the company’s filing. SEC also noted that  PCAOB standards permit an auditor that is not engaged to opine on  internal controls to include a statement in its report on the financial  statements indicating that it is not opining on the internal controls. In our  report, we acknowledge that information needed to determine a  company’s auditor attestation status is available. However, because an  explicit statement on the company’s status is not required, investors must  deduce the company’s status from the available information. Explicit  disclosure could significantly decrease the potential for investors to  misinterpret the information regarding a company’s audit attestation  status. Such disclosure would increase transparency and investor  protection by making investors readily aware of this important investment  information. We therefore maintain that the disclosure warrants further  consideration by SEC.
We are sending copies of this report to appropriate congressional  committees, SEC, PCAOB, Audit Analytics and other interested parties.  In addition, the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-8678 or clowersa@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report discusses: (1) how the number of financial statement  restatements compares between exempt and nonexempt companies; (2)  the costs and benefits for nonexempt companies as well as exempt  companies that voluntarily comply with the auditor attestation  requirement; and (3) what is known about the extent to which investor  confidence in the integrity of financial statements is affected by whether  or not companies comply with the auditor attestation requirement. We  define exempt companies as those with less than $75 million in public  float (nonaccelerated filers) and nonexempt companies as those with $75  million or more in public float (accelerated filers). For the purposes of this  report, we define exempt companies as those with less than $75 million in  public float (nonaccelerated filers) and nonexempt companies as those  with $75 million or more in public float (accelerated filers).
To address all three objectives, we reviewed and analyzed information  from a variety of sources, including the Sarbanes-Oxley Act of 2002  (Sarbanes-Oxley Act), the Dodd-Frank Wall Street Reform and Consumer  Protection Act (Dodd-Frank Act), relevant regulatory press releases and  related public comment letters, and available research studies. We also  interviewed officials from the Securities and Exchange Commission  (SEC) and the Public Company Accounting Oversight Board (PCAOB),  and we interviewed chief financial officers of small public companies,  representatives of relevant trade associations (representing individual and  institutional investors, accounting companies, financial analysts and  investment professionals, and financial executives), a large pension fund,  a credit rating agency, academics knowledgeable about accounting  issues, and industry experts.
subsections: section_title: Comparison of Exempt and Nonexempt Financial Restatements
paragraphs: To determine the number of financial statement restatements (referred to  as financial restatements) and trends, we analyzed data from the Audit  Analytics database from 2005 through 2011. We used the Audit  Analytics’ Auditor Opinion database to generate the population of exempt  and nonexempt companies in each year from 2005 through 2011. Our  analysis does not include 2012 data because 2012 small-company data  was incomplete. According to Audit Analytics, the incomplete data was  often due to the fact that small companies had not yet filed the relevant  information with SEC. The sample we used to produce the population of  exempt and nonexempt companies does not include subsidiaries of a  public company, registered investment companies, or asset-backed  securities issuers. Once we excluded these companies from the entire  population, we grouped the remaining companies based on their filing  status (i.e., nonaccelerated filer, smaller reporting company, accelerated  filer, large accelerated filer, and filers that did not disclose their filing  status). Exempt companies are nonaccelerated filers, including smaller  reporting companies. For our purposes, we grouped companies that did  not disclose their filing status but whose market capitalization was less  than $75 million with exempt companies. We also identified for each year  from 2005 through 2011 exempt companies that voluntarily complied with  the integrated audit requirement as indicated in the data. Nonexempt  companies are accelerated filers and large accelerated filers. For our  purposes, we grouped companies that did not disclose their filing status  but whose market capitalization was equal to or greater than $75 million  with nonexempt companies. We excluded companies that did not disclose  their filing status and did not have a reported market capitalization.
We then used Audit Analytics’ Restatement database, which contains  company information (e.g., assets, revenues, restatements, market  capitalization, location, and industry classification code) to identify the  number of financial restatements from 2005 through 2011 based on our  population of exempt companies, exempt companies that voluntarily  complied, and nonexempt companies. Using this database, we identified  6,436 financial restatements by 4,536 public companies, 2,834 of which  were exempt companies. We used Audit Analytics’ 69 classifications to  classify the type of financial restatements into six categories: core  expenses (i.e., ongoing operating expenses), noncore expenses (i.e.,  nonoperating or nonrecurring expenses), revenue recognition (i.e.,  improperly record revenues), reclassifications and disclosures, underlying  events (i.e., accounting for mergers and acquisitions), and other. The  majority of restatements we classified were the result of an accounting  rule misapplication. To identify audit costs of compliance, we analyzed  data from Audit Analytics’ Auditor Opinion database, which contains  auditors’ report information such as audit fees, nonaudit fees, auditor  name, audit opinions, revenues, and company size, among other  information from 2005 through 2011. Our analyses of audit costs do not  include 2012 data because 2012 small-company data was incomplete.  The incomplete data was often due to the fact that small companies had  not yet filed the relevant information with SEC. We tested a sample of the  Audit Analytics database information and found it to be reliable for our  purposes. For example, we cross-checked random samples from each of  Audit Analytics’ databases with information on financial restatements,  filing status, and internal controls from SEC’s Electronic Data Gathering,  Analysis, and Retrieval system. We also spoke with other users of Audit  Analytics data as well as Audit Analytics officials. In addition, we reviewed  relevant research studies and papers on the impact of compliance with  the internal control audits on financial restatements. We consider the  information to be reliable for our purpose of determining financial  statement restatement trends and audit fee calculations.
section_title: Costs and Benefits of Auditor Attestation Compliance
paragraphs: To examine the characteristics of publicly traded companies that  complied, either voluntarily or because required, with the requirement to  obtain an independent auditor attestation of their internal controls, we  conducted a web-based survey of companies that had either voluntarily  complied or were required to comply with the integrated audit requirement  in any year between 2004 and 2011. Based on a list of publicly traded  companies obtained from Audit Analytics, we identified 4,053 companies  that had either voluntarily complied with the integrated audit requirement  in any year from 2004 through 2011 or that were required to comply in  2011 as determined by their filing status. We stratified the population into  three strata by first identifying the nonaccelerated voluntary filers. These  are companies that voluntarily complied with the integrated audit  requirement in any year from 2004 through 2011. Since our primary focus  was on the nonaccelerated voluntary filers, we selected all 392 of these  companies. From the remaining companies in the population, we created  two additional strata based on 2011 filing status, and we took a random  sample of companies from the remaining strata. The sample sizes for the  remaining strata were determined to produce a proportion estimate within  each stratum that would achieve a precision of plus or minus 10  percentage points or less, at the 95 percent confidence level. Finally, we  increased the sample size based on the expected response rate of 40  percent. We submitted our survey to a total of 850 companies from the  original population of 4,053.
We identified 104 companies in our sample that were closed, merged with  another company, or improperly included in the sampling frame. We  received valid responses from 195 out of the remaining 746 sampled  companies (see table 7). The weighted response rate, which accounts for  the differential sampling fractions within strata, is 25 percent.
We conducted this survey in a web-based format. The questionnaire was  designed by a GAO survey specialist in collaboration with GAO staff with  subject-matter expertise. The questionnaire was also reviewed by experts  at SEC. We pretested drafts of our questionnaire with three public  companies of different sizes to ensure that the questions and response  categories were clear, that terminology was used correctly, and that the  questions did not place an undue burden on the respondents. The  pretests were conducted by telephone with company financial executives  in Iowa, Virginia, and Washington, D.C. Pretests included GAO  methodologists and GAO subject-matter experts. Based on the feedback  received from the pretests, we made changes to the content and format  of some survey questions. We directed our survey to the chief executive  officer, chief financial officer, or chief accounting officer, whose names  and email addresses we obtained from Nexis. We activated our web- based survey on December 17, 2012, and closed the survey on February  19, 2013. We sent follow-up emails on three occasions to remind  respondents to complete the survey and conducted telephone follow-ups  to increase the response rate.
Because our survey was based on a random sample of the population, it  is subject to sampling errors. In addition, the practical difficulties of  conducting any survey may introduce nonsampling errors. For example,  difference in how a particular question is interpreted or the sources of  information available to respondents may introduce errors. We took steps,  such as those described above, to minimize such nonsampling errors in  the development of the questionnaire and the data collection and data  analysis stages as well. For example, because this was a web-based  survey, respondents entered their responses directly into the database,  reducing the possibility of data-entry error. Finally, when the data were  analyzed, a second independent analyst reviewed all computer programs.  We conducted an analysis of our survey results to identify potential  sources of nonresponse bias using two methods. First, we examined the  response propensity of the sampled companies by several demographic  characteristics. These characteristics included market capitalization size  categories, region, and sector. Our second method consisted of  comparing weighted estimates from respondents and nonrespondents to  known population values for total market capitalization. We conducted  statistical tests of differences, at the 95 percent confidence level, between  estimates and known population values, and between respondents and  nonrespondents. We determined that there was significant bias induced  by the largest companies (measured by market capitalization) not  responding to the survey. In other words, we found that companies with  market capitalization over $10 billion were underrepresented in our  sample. However, we found no evidence of substantial nonresponse bias  based on these characteristics when generalizing to the population of  companies with market capitalization less than or equal to $10 billion.  Therefore, we adjusted the scope of our survey to include only those  companies with market capitalization of less than or equal to $10 billion  (see table 8).
Because we found no evidence of substantial nonresponse bias when  generalizing to the adjusted target population and the weighted response  rate of 25 percent, we determined that weighted estimates generated  from these survey results are generalizable to the population of in-scope  companies. We generated weighted estimates and generalized the  results to the estimated in-scope population of 3,432 companies (plus or  minus 42 companies).
Because we followed a probability procedure based on random  selections, our sample is only one of a large number of samples that we  might have drawn. Since each sample could have provided different  estimates, we express our confidence in the precision of our particular  sample’s results as a 95 percent confidence interval. This is the interval  that would contain the actual population value for 95 percent of the  samples we could have drawn. As a result, we are 95 percent confident  that each of the confidence intervals in this report includes the true values  in the study population. All percentage estimates presented in this report  have a margin of error of plus or minus 15 percentage points or fewer,  and all estimates of averages have a relative margin of error of plus or  minus 20 percent or less, unless otherwise noted.
To obtain information on the impact of obtaining an auditor attestation on  a company’s cost of capital, we included questions in our web-based  survey to large and small public companies of various industries about  this matter, interviewed trade associations, industry experts, a large  pension fund, and academics; and reviewed relevant academic and SEC  research studies.
section_title: Investor Confidence and Integrity of Financial Statements
paragraphs: To examine the extent to which investor confidence in the integrity of  financial statements is affected by companies’ compliance with the  auditor attestation requirement, we reviewed relevant empirical literature  written by academic researchers, as well as recent surveys, studies,  reports, and articles by others. To identify these studies, we asked for  recommendations from academics, SEC, PCAOB, and representatives of  organizations that address issues related to the auditor attestation  requirement. We reviewed bibliographies of papers we obtained to  identify additional material. In addition, we conducted searches of online  databases such as ProQuest and Nexis using keywords to link Section  404(b) of the Sarbanes-Oxley Act with investor confidence. We also  conducted interviews with agencies and organizations, as well as  academics and other knowledgeable individuals who focus on issues  related to investor confidence and the auditor attestation requirement.  Moreover, we interviewed small public companies exempt from auditor  attestation but who nonetheless complied with the requirement. In  addition, we reviewed surveys undertaken by various government  agencies and organizations to gauge the impact of the auditor attestation  on investor confidence. We conducted a focused review of the research  related to Section 404(b) of the Sarbanes-Oxley Act and summarized the  recent studies most relevant to our objective. The empirical research  discussed may have limitations, such as accuracy of measures and  proxies used. We reviewed published works by academic researchers,  government agencies, and organizations with expertise in the field. We  performed our searches from September 2012 through May 2013. We  assessed the reliability of these studies for use as corroborating evidence  and found them to be reliable for our purposes. We also included  questions in our web-based survey to large and small public companies  of various industries about this matter. Lastly, we reviewed relevant  federal securities laws, the Securities Act of 1933 and the Securities  Exchange Act of 1934.
We conducted this performance audit from May 2012 to July 2013 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Securities and Exchange Commission
section_title: Appendix III: GAO Survey of Accelerated Filers and Nonaccelerated Filers
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Karen Tremba, (Assistant  Director), James Ashley, Bethany Benitez, William Chatlos, Janet  Eackloff, Joe Hunter, Cathy Hurley, Stuart Kaufman, Marc Molino, Lauren  Nunnally, Jennifer Schwartz, and Seyda Wentworth made key  contributions to this report.
section_title: Bibliography
paragraphs: Alexander, C. R., S. W. Bauguess, G. Bernile, Y. A. Lee, and J. Marietta- Westberg. “The Economic Effects of SOX Section 404 Compliance: A  Corporate Insider Perspective.” Working paper. March 2010.
Asare, S. K., and A. Wright. “The Effect of Type of Internal Control Report  on Users’ Confidence in the Accompanying Financial Statement Audit  Report.” Contemporary Accounting Research, vol. 29, no. 1 (2012).
Ashbaugh-Skaife, H., D. Collins, W. Kinney, and R. LaFond. “The Effect  of Internal Control Deficiencies on Firm Risk and Cost of Equity.” Journal  of Accounting Research, vol. 47, no. 1 (2009).
Audit Analytics. “2011 Financial Restatements: An Eleven Year  Comparison.” Sutton, Mass.: 2012.
Audit Analytics, “2009 Financial Restatements: A Nine Year Comparison.”  (Sutton, Mass.: February 2010).
Audit Analytics. “Restatements Disclosed by the Two Types of SOX 404  Issuers: (1) Auditor Attestation Filers and (2) Management-Only Report  Filers.” Sutton, Mass.: November 2009.
Brown, K., P. Pacharn, J. Li, E. Mohammad, F. A. Elayan, and F. Chu.  “The Valuation Effect and Motivations of Voluntary Compliance with  Auditor’s Attestation Under Sarbanes-Oxley Act Section 404 (B).”  Working paper. January 15, 2012.
Cassell, C.A., L. A. Myers, and J. Zhou. “The Effects of Voluntary Internal  Control Audits on the Cost of Capital.” Working paper. February 13, 2013.
Chief Financial Officers’ Council and the President’s Council on Integrity  and Efficiency, Estimating the Costs and Benefits of Rendering an  Opinion on Internal Control over Financial Reporting.
Coates IV, J. C. “The Goals and Promise of the Sarbanes-Oxley Act.”  Journal of Economic Perspective, vol. 21, no. 1 (2007).
Crabtree, A., and J. J. Mahler. “Credit ratings, Cost of Debt, and Internal  Control Disclosures: A Comparison of SOX 302 and SOX 404.” The  Journal of Applied Business Research, vol. 28, no. 5 (2012).
Dhaliwal, D., C. Hogan, R. Trezevant, and M. Wilkins. “Internal Control  Disclosures, Monitoring, and the Cost of Debt.” The Accounting Review,  vol. 86, no. 4 (2011).
GAO. Community Banks and Credit Unions: Impact of the Dodd-Frank  Act Depends Largely on Future Rule Makings. GAO-12-881. Washington,  D.C.: September 13, 2012.
GAO. Financial Restatements: Update of Public Company Trends, Market  Impacts, and Regulatory Enforcement Activities. GAO-06-678.  Washington, D.C.: March 5, 2007.
GAO. Sarbanes-Oxley Act: Consideration of Key Principles Needed in  Addressing Implementation for Smaller Public Companies. GAO-06-361.  Washington, D.C.: April 13, 2006.
Holder, A. D., K. E. Karim, and A. Robin. “Was Dodd-Frank Justified in  Exempting Small Firms from Section 404b Compliance?” Accounting  Horizons, vol. 27, no. 1 (2013).
Iliev, P. “The Effect of SOX Section 404: Costs, Earnings Quality, and  Stock Prices.” Journal of Finance, vol. 65, no. 3 (2010).
Kim, J. B., B. Y. Song, and L. Zhang. “The Internal Control Weakness and  Bank Loan Contracting: Evidence from SOX Section 404 Disclosures.”  The Accounting Review, vol. 86, no. 4 (2011).
Kinney, W. R., and M. L. Shepardson. “Do Control Effectiveness  Disclosures Require SOX 404(b) Internal Control Audits?: A Natural  Experiment with Small U.S. Public Companies.” Journal of Accounting  Research, vol. 49, no. 2 (2011).
Krishnan, G.V., and W. Yu. “Do Small Firms Benefit from Auditor  Attestation of Internal Control Effectiveness?” Auditing: A Journal of  Practice and Theory, vol. 34, no. 4 (2012).
Nagy, A. L. “Section 404 Compliance and Financial Reporting Quality.”  Accounting Horizons, vol. 24, no. 3 (2010).
Orcutt, J. L. “The Case Against Exempting Smaller Reporting Companies  from Sarbanes-Oxley Section 404: Why Market-Based Solutions are  Likely to Harm Ordinary Investors.” Fordham Journal of Corporate and  Financial Law, vol. 14, no. 2 (2009).
Schneider, A., A. Gramling, D. R. Hermanson, and Z. Ye. “A Review of  Academic Literature on Internal Control Reporting Under SOX.” Journal of  Accounting Literature, vol. 28 (2009).
Schneider, A., and B. K. Church. “The Effect of Auditors’ Internal Control  Opinions on Loan Decisions.” Journal of Accounting and Public Policy,  vol. 27, no.1 (2008).
Scholz, Susan. The Changing Nature and Consequences of Public  Company Financial Restatements: 1997-2006. A special report prepared  at the request of the Department of the Treasury. April 2008.
U.S. Securities and Exchange Commission. Study and  Recommendations on Section 404(b) of the Sarbanes-Oxley Act of 2002  For Issuers with Public Float Between $75 and $250 Million. Washington,  D.C.: 2011.
U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley  Act of 2002 Section 404 Internal Control over Financial Reporting  Requirements. Washington, D.C.: 2009.
subsections: section_title: Surveys
paragraphs: Center for Audit Quality. The CAQ’s Sixth Annual Main Street Investor  Survey, September 2012.
Center for Audit Quality. The CAQ’s Fourth Annual Individual Investor,  September 2010.
Financial Executives International and Financial Executives Research  Foundation, 2012 Audit Fee Survey. Morristown, N.J.: 2012.
Financial Executives International and Financial Executives Research  Foundation, Special Survey on Sarbanes-Oxley Section 404  Implementation. Morristown, N.J.: 2005.
PCAOB. 2012 SOX Compliance Survey: Role, Relevancy and Value of  the Audit. 2012.
Protiviti, 2013 Sarbanes-Oxley Compliance Survey: Building Value in  Your SOX Compliance Program. 2013.
Protiviti, 2012 Sarbanes-Oxley Compliance Survey: Where U.S.-Listed  Companies Stand – Reviewing Cost, Time, Effort and Process. 2012.