Bonnie K. Klamm, associate professor of accounting, has published an article titled "SOX 404 Reported Internal Control Weaknesses: A Test of COSO Framework, Components and Information Technology," in the 2009 fall issue of the Journal of Information Systems. She wrote the article with Marcia Weidenmier Watson from Mississippi State University.
The paper examines internal controls, from both an information technology and non-information technology perspective, in relation to the five components of the Committee of Sponsoring Organization’s/Internal Control-Integrated Framework/(COSO 1992), as well as the achievement of one of the committee’s three objectives – reporting reliability.
"Our sample consists of 490 firms with material weaknesses reported under Sarbanes-Oxley Section 404 during the first year of compliance. We classify the weaknesses by COSO component and as information technology-related or non-information technology-related. Our results support the interrelationships of the COSO/Internal Control-Integrated Framework," Klamm said.
The results also show that the number of misstated accounts is positively related to the number of weak COSO components and certain weak COSO components. Klamm says firms with information technology-related weak components report more material weaknesses and misstatements than firms without information technology-related weak components, providing evidence on the pervasive negative impact of weak information technology controls, especially in control environment, risk assessment and monitoring.