That's the fascinating question raised in a new Association of Certified Fraud Examiners report.

First of all, the report finds that despite the purported intentions of Sarbanes-Oxley to increase focus on fraud controls, the evidence suggests that frauds are much more likely to be detected by a tip than by audits. The implication being that Sarbox has been close to useless.

And it gets even more alarming. After analyzing the impact of SOX-related controls in all reported cases of financial statement fraud, the study found that organizations with these controls in place experienced greater fraudulent financial statement manipulations than organizations lacking these controls.

Still on the other side of the equation, the study found that a lack of adequate internal controls was most commonly cited as the factor that allowed fraud to occur.

But as ACFE member Lance Rudolph told CFO.com, internal controls go only so far."Internal controls are like locks on a door. The more sophisticated a lock you have, the better a deterrent it is, but someone who is truly knowledgeable can defeat any internal control."