I blasted Sarbanes-Oxley Section 404 in both of my books that dealt with the statute:
The Complete Guide To Sarbanes-Oxley: Understanding How Sarbanes-Oxley Affects Your Business
Corporate Governance after the Financial Crisis
A new paper confirms that--over 15 years later--Section 404 is still quackery:
... our results suggest that the costs associated with compliance remain significant and compliance does not appear to be accompanied by reporting benefits in the form of more informative internal control reports or more reliable financial statements.
Go read the whole thing.