Section 404 of the Sarbanes-Oxley Act of 2002 (SOX) mandates reporting on the effectiveness of internal control over financial reporting (ICFR) by public company management and auditors. Such reporting began for fiscal years ended Nov 15, 2004 for accelerated filers and is scheduled to be fully implemented for non-accelerated filers in mid-2010. Section 404(a) of SOX requires public company management to include an assessment of the effectiveness of the company\u27s ICFR in its annual internal control report, and Section 404(b) requires attestation by the company\u27s auditor. The authors review the literature on internal control reporting under both Sections 302 and 404 in the post-SOX period. The internal control literature has grown substantially since the passage of SOX due to the availability of data regarding ICFR effectiveness that were not previously available. They conducted a literature search through mid-2009 resulting in the inclusion of many published papers and working papers that address ICFR issues covered in our taxonomy
