ABSTRACT: Software vendors that market enterprise resource planning (ERP) systems have taken advantage of the increased focus on internal controls that grew out of the Sarbanes-Oxley (SOX) legislation by emphasizing that a key feature of ERP systems is the use of “built-in” controls that mirror a firm’s infrastructure. They argue that these built-in controls and other features will help firms improve their internal control over financial reporting as required by SOX. This study tests that assertion by examining SOX Section 404 compliance data for a sample of firms that implemented ERP systems between 1994 and 2003. The results suggest that ERP-implementing firms are less likely to report internal control weaknesses (ICW) than a matched control sample of non-ERP-implementing firms. It also finds that this difference exists for both general (entity-wide), and individual (account-level) controls.
