While the number of material weaknesses being disclosed by companies in their Section 404 auditor and management reports has dropped dramatically over the three years in which companies began filing, rating agency Moody's Investors Service has uncovered a disturbing pattern–controls-related problems seem primarily to be reported after a company has already restated their financials or reported a material audit adjustment. Of the some 3,600 Moody's corporate clients that reported in calendar year 2006, 72 disclosed material weaknesses. What Moody's found concerning was the fact that 92% of those had already been forced to issue restatements or material audit adjustments prior to the discovery of the material weakness. "What we think is happening is a lot like a doctor telling a patient after they have had a heart attack that they also have high blood pressure," says Gregory Jonas, one of the authors of the report. "We are not seeming to learn about material weaknesses in these reports until after there has been some reporting problem like restatements or material audit adjustments."

This auditor reluctance or failure to find weaknesses before they are manifested in reporting problems penalizes shareholders, and Jonas believes that reporting must become more "proactive rather than reactive"–that is, uncovering control problems before restatements–for shareholders to really reap benefits.

Jonas thinks that policymakers attempting to reduce the costs of compliance may be able to achieve their goals simply by getting auditors to take a more proactive approach and companies to focus more on fraud prevention. "Enormous sums of money are being spent [for controls] in areas that are far removed from senior management cooking the books," says Jonas. "I fear that we're not spending nearly enough money on the real reason that we got 404."