Senior Executives' IT Management Responsibilities: Serious IT-Related Deficiencies and CEO/CFO Turnover

The Sarbanes-Oxley Act of 2002 (SOX) was established to strengthen internal controls over financial reporting by U.S. public firms and, as a consequence, to increase investor and stakeholder confidence in published financial reports. Among the many SOX provisions, SOX 404 requires an annual assessment by the firm’s executive management and external auditor of the firm’s internal controls over financial reporting (SEC 2003). The U.S. Securities and Exchange Commission (SEC) formally defines internal controls over financial reporting as (SEC 2003: Section II.A.3.):