March 2005 was the first month that a large number of public companies filed annual reports with internal control attestations as required by Section 404 of the Sarbanes-Oxley Act. According to a review by Compliance Week, a corporate governance newsletter, only about 5 percent of the 1,852 10-Ks filed that month disclosed a material weakness—that is, a deficiency substantial enough that it could prevent a company from detecting a problem with its financial statement in a timely manner—well below the 20 percent that auditors were predicting last fall. In toto, 116 companies disclosed a material weakness in March. Of those, only three— 99 Cents Only Stores, Internap Network Services and AAON (an air-conditioning equipment maker)—had weaknesses related to IT controls, according to CIO’s review of the Securities and Exchange Commission filings. Additionally, two companies—Brookstone and The Genlyte Group—warned the SEC in March that they would disclose material weaknesses because of IT controls in upcoming filings.
At press time, the SEC had not disciplined any of the companies that failed their audits. More surprisingly, neither had Wall Street. According to a study published in Compliance Week, the median stock price change of the 116 flunking companies was zero. Only 18 companies saw their stock price drop more than 5 percent (the same number that saw their stock price rise), and most of the declines could be attributed to other causes, such as lower than expected sales forecasts.