The Discovery and Reporting of Internal Control Deficiencies Prior To SOX-mandated Audits

ARTICLE IN PRESS
Journal of Accounting and Economics 44 (2007) 166192 www.elsevier.com/locate/jae
The discovery and reporting of internal control deciencies prior to SOX-mandated audits$
Hollis Ashbaugh-Skaifea, Daniel W. Collinsb,, William R. Kinney Jr.c
School of Business, University of Wisconsin-Madison, Madison, WI 53707, USA b Tippie College of Business, University of Iowa, Iowa City, IA 52242, USA c McCombs School of Business, University of Texas at Austin, Austin, TX 78712, USA Received 1 March 2005; received in revised form 20 October 2006; accepted 26 October 2006 Available online 15 December 2006
a
Abstract We use internal control deciency (ICD) disclosures prior to mandated internal control audits to investigate economic factors that expose rms to control failures and managements incentives to discover and report control problems. We nd that, relative to non-disclosers, rms disclosing ICDs have more complex operations, recent organizational changes, greater accounting risk, more auditor resignations and have fewer resources available for internal control. Regarding incentives to discover and report internal control problems, ICD rms have more prior SEC enforcement actions and nancial restatements, are more likely to use a dominant audit rm, and have more concentrated institutional ownership. r 2006 Elsevier B.V. All rights reserved.
JEL classication: G34; G38; K22; M41; M49 Keywords: Internal control; Auditing; Regulation; SOX
$ We thank Andy Bailey, Dave Burgstahler, Ryan LaFond, Thomas Lys, Linda McDaniel, Pamela Murphy, Joel Horowitz, Robert Lipe, Gene Savin, Lynn Turner, Jerry Zimmerman, Editor, Andy Leone, the referee, and seminar participants at the University of Kentucky, Michigan State University, University of North Carolina at Chapel Hill, Ohio State University and the University of Wisconsin-Madison for helpful comments and suggestions. We also thank Guojin Gong, Neil Schreiber, Kwadwo Asare and John McInnis for their capable research assistance. Corresponding author. Tel.: +1 319 335 0912; fax: +1 319 335 1956. E-mail addresses: hashbaugh@bus.wisc.edu (H. Ashbaugh-Skaife), daniel-collins@uiowa.edu (D.W. Collins), william.kinney@mccombs.utexas.edu (W.R. Kinney Jr.).
0165-4101/$ - see front matter r 2006 Elsevier B.V. All rights reserved. doi:10.1016/j.jacceco.2006.10.001
ARTICLE IN PRESS
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192 167
1. Introduction This study investigates the economic factors that expose a rm to internal control risk and managements incentives to discover and report an internal control deciency (ICD). Section 404 of the SarbanesOxley Act (US Congress, 2002), denoted SOX requires that public company nancial statements led on Form 10-K and Form 10-Q contain an assessment by management of the design and operating effectiveness of its internal control over nancial reporting. Section 404 also requires that the external auditor, on an annual basis, provide an opinion on managements assessment of internal control (Securities and Exchange Commission (SEC), 2003). Before the implementation of SOX Section 404, Section 302 of SOX required that management evaluate the effectiveness of disclosure controls and procedures, report results of their evaluation, and indicate any signicant changes in internal control since the last Form 10-K or Form 10-Q ling (SEC, 2002). The SEC denes disclosure controls and procedures as controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports led or submitted by it under the Exchange Act is recorded, processed, summarized and reported, within the time periods specied in the Commissions rules and forms (SEC, 2002). However, neither the SEC nor SOX Section 302 specify particular procedures to be applied by management in evaluating internal controls nor do they require independent audits of internal controls. Furthermore, while Section 302 requires management to report any discovered material weaknesses to their external auditor and the audit committee (SEC, 2003), whether such ICDs had to be disclosed to shareholders in public SEC lings is less clear. As an example of this ambiguity, the SEC staff addressed the frequently asked question: Is a registrant required to disclose changes or improvements to controls made as a result of preparing for the registrants rst management report on internal control over nancial reporting? (SEC, 2004, Question 9). The staffs answer was that they would welcome disclosure of all material changes to controls whether before or after the Section 404 compliance date, but they would not object if a registrant did not disclose changes made in preparation for the registrants rst management report under Section 404. The staff added to its response However, if the registrant were to identify a material weakness, it should carefully consider whether that fact should be disclosed as well as changes made in response to the material weakness. Thus, under the provisions of Section 302, the review of internal control is subject to less scrutiny by both management and the auditor and the disclosure rules are less specic than subsequently exist under Section 404.1 This suggests that managers had more discretion in disclosing ICDs during the pre-Section 404 regime. We use ICD disclosures provided by rms after Section 302 became effective, but before the effective date for independent internal control audits mandated by Section 404 to study
1 Further evidence that management exercised some discretion in disclosing ICDs during the pre-Section 404 regime is provided by a Glass Lewis & Company report (Glass Lewis, 2005) that 87% of rms disclosing ICDs in the rst 3 months of 2005 certied their controls as effective under SOX 302 in the previous quarter. Some of these occurrences were due to new GAAP guidance on application of lease accounting rules provided by the SEC in February 2005 that managers were unaware of when they certied that controls over nancial reporting were effective in the prior quarter (SEC, 2005). However, a large percentage of the ICD disclosures made early in the SOX 404 regime related to more systemic control problems of long standing (e.g., inadequate recording of inventory or improper year-end roll-up procedures) suggesting that managers had either not yet detected ICDs or did not feel compelled to disclose these weaknesses during the SOX 302 regime.
ARTICLE IN PRESS
168 H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192
the rm characteristics that contribute to internal control risks and the incentives faced by managers to discover and disclose internal control problems. During this era, both accelerated and non-accelerated lers reported material weaknesses as well as lesser deciencies that are not required to be disclosed under SOX 404 reporting.2 Thus, we document the determinants of ICDs for a broad cross-section of SEC registrants. Estimating determinants of ICDs across a broad cross-section of rms is important for developing investor expectations about internal control problems given non-accelerated lers are not yet required to comply with SOX 404.3 Three conditions must exist for a registrant to disclose an ICD under Section 302. First, an ICD must exist; second, the deciency must be discovered by management or the independent auditor; and third, management, perhaps after consultation with its independent auditor, must conclude that the deciency should be publicly disclosed.4 Our sample of ICD disclosers begins with 585 rms identied by Compliance Week from November 2003 to December 31, 2004 that disclosed ICDs in any SEC ling. To control for industry and time-specic factors, we collect parallel data on more than 4000 rms in the same industries over the same time period that did not report ICDs prior to December 31, 2004. We model pre-SOX 404 ICD disclosures as a function of internal control risk factors and incentives of managers and auditors to discover and disclose ICDs. Our internal control risk factors include the complexity and scope of rms operations, changes in rms organizational structure, accounting measurement application risk (e.g., exposure to accounting errors caused by difculty or judgment in applying accounting procedures), lack of rm resources to devote to internal control and whether the auditor resigned in 2003. We use auditor dominance, sensitivity to regulatory intervention in nancial reporting due to prior restatement or SEC enforcement actions, monitoring by institutional investors, and industry litigation risk to proxy for incentives to discover and disclose ICDs. As expected, ICD disclosers have more complex operations as proxied by the number of business segments and foreign sales, and more often engage in acquisitions and restructurings relative to non-ICD disclosure rms. The results also indicate that ICD disclosers face greater accounting procedure application risk as rms with greater sales growth and levels of inventory are more likely to report an ICD. We nd that smaller rms, rms reporting a higher frequency of losses and rms in nancial distress are more likely to disclose ICD weaknesses. A highly signicant risk factor that explains the incidence of an ICD is the auditor resigning in the year prior to the ICD disclosure.
2 Non-accelerated lers are rms with total market capitalization less than $75 million. Non-accelerated lers are not required to comply with the SOX Section 404 reporting provisions until scal years ending on or after July 15, 2007. 3 Prior to SOX, public rms could voluntarily assess and report on the effectiveness of internal controls, but few rms did so. For example, McMullen et al. (1996) report that of 2221 rms listed on NAARS with December 31, 1993 scal year ends, only 55 contained a management statement that internal controls were effective as of scal year end. Furthermore, McMullen et al. (1996) do not indicate whether any of the management reports were audited or reviewed by their external auditors even though auditing standards allowed such association (AICPA, 1988). 4 See Kinney and McDaniel (1989) for parallel arguments about disclosure of misstatements of quarterly earnings.
ARTICLE IN PRESS
Regarding variables that proxy for the incentives to discover and report internal control problems, our results indicate that rms that contract with the largest US audit suppliers, have had negative publicity about nancial reporting as evidenced by prior restatements or sanctions from SEC Accounting and Auditing Enforcement Releases (AAERs), and that have concentrated institutional ownership are more likely to disclose an internal control problem. These results are robust to using alternative measures of internal control risk and incentives to report. Many have claimed that the passage of SOX imposed an extreme burden on SEC registrants by requiring them to document, evaluate, publicly report, and have audited the effectiveness of their internal controls. Contemporaneous and concurrent research examines different aspects of SOX in an attempt to evaluate the Acts costs and benets (e.g., see Ashbaugh-Skaife et al., 2006a; Beneish et al., 2006; De Franco et al., 2005; Doyle et al., 2006b; Hammersley et al., 2005; Hogan and Wilkins, 2006; Ogneva et al., 2005; Zhang, 2005). Our study contributes to this literature by investigating the causes of ICDs and managements incentives to report these deciencies during a regulatory transition period in which there was mandated certication of disclosure controls and procedures, but no review procedures specied for management, no internal control audit requirement, limited guidance on classications of severity of control deciencies, and considerable disclosure discretion on the part of management. Our research is most closely related to a concurrent study by Doyle et al. (2006a) who examine the determinants of internal control deciencies based on a sample of rms that disclosed material weakness control deciencies during both the SOX 302 and 404 reporting regimes. As in our study, Doyle et al. (2006a) nd ICDs are more likely for rms that are smaller, nancially weaker, more complex, growing rapidly and undergoing restructuring. Our study differs from the Doyle et al. (2006a) study along several dimensions. First, Doyle et al. (2006a) restrict their analysis only to rms that report material weakness ICDs, while we consider all three levels of internal control deciencies as set forth by the Public Company Accounting Oversight Board (PCAOB) in Auditing Standards (AS) No. 2material weaknesses, signicant deciencies and control deciencies (PCAOB, 2004).5 We include all levels of control deciencies because regulatory guidance dening levels of severity of control deciencies was not released until March of 2004, which is well after many rms provided their rst disclosure of control problems. As a result, the inter-rm consistency of these self-reported classications of control weaknesses is problematic.6 A second distinction between our study and Doyle et al. (2006a) is that our analysis is limited to ICDs disclosed during the SOX 302 regulatory regime. Because SOX 302 internal control disclosures are subject to less regulation and allows more management discretion than control disclosures made during the SOX 404 audit regime, our determinant model includes a number of variables designed to capture rms incentives to discover and report control deciencies variables that capture, incentives to detect and
See discussion in Section 2 for distinction between these three levels of control deciencies. For example, a deciency that one rm considers to be a material weakness, another rm might classify as a signicant deciency, or vice versa. By considering all types of ICDs in our model, we avoid errors due to inconsistencies of self-classications that are introduced when restricting the analysis to ICDs of one classication type.
6 5
ARTICLE IN PRESS
report are omitted from the Doyle et al. (2006a) study because they focus on material weakness disclosures that they deem to be required disclosures in both the 302 and 404 reporting regimes. Moreover, by restricting their analysis to material weakness disclosures, Doyle et al. (2006a) ignore lesser control problems that arguably have a signicant impact on the reliability of rms nancial statements (Ashbaugh-Skaife et al., 2006b). Finally, because we study disclosures made during a reporting regime that predated SOX 404 internal control audits, our study identies factors that contribute to internal control problems for a broad cross-section of publicly traded rms that includes both accelerated and non-accelerated lers. Thus, our ICD model facilitates the formation of expectations about the determinants of ICDs that is more representative of the underlying population of rms that face control problems because our sample cuts across rms of all sizes in contrast to the sample in the Doyle et al. (2006a) study that contains a higher proportion of accelerated ler (larger) rms. Later in our paper, we demonstrate how this difference in sample composition inuences the results. The remainder of the paper proceeds as follows. Section 2 elaborates on the regulations of SOX pertinent to reporting ICDs and introduces our conceptual framework for ICD disclosures. Section 3 describes our sample and descriptive statistics. Section 4 presents the multivariate analysis of the determinants of ICDs, as well as marginal effects, and sensitivity analyses of alternative measures of explanatory variables. Section 5 presents our summary and conclusions and identies several avenues for future research. 2. Regulatory and conceptual background The lack of guidance on distinguishing between levels of severity of internal control problems prior to AS No. 2 makes rms classication and users interpretation of ICD reporting under Section 302 somewhat difcult. AS No. 2 identies three levels of internal control deciencies based on the likelihood that a material misstatement of annual or interim nancial statements might result (PCAOB, 2004). Specically, AS No. 2 states: A control deciency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis (AS No. 2, paragraph 8). A signicant deciency is a control deciency, or combination of control deciencies, that adversely affects the companys ability to initiate, authorize, record, process, or report external nancial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the companys annual or interim nancial statement that is more than inconsequential will not be prevented or detected (AS No. 2, paragraph 9). A material weakness is a signicant deciency, or combination of signicant deciencies, that results in more than a remote likelihood that a material misstatement of the annual or interim nancial statements will not be prevented or detected (AS No. 2, paragraph 10). The three categories differ in the probability that a misstatement of a particular amount might not be prevented or detected by the companys disclosure controls and procedures. Some rms used terminology about classication of the severity of the deciency from
ARTICLE IN PRESS
ICD risk exposures

Complexity and scope of operations Organizational change Accounting application risk Internal control resources ICD existence
+ ICD discover and disclose incentives

Auditor technology and scrutiny Regulator intervention threats Investor intervention threats Litigation risk ICD detection
=
Pre-SOX 404 audit ICD Disclosure
Fig. 1. Conceptual model of pre-SOX mandated audit disclosure of internal control deciencies (ICDs).
prior standards for internal control reporting,7 some used AS No. 2 terminology, and some used neither. Despite the ambiguities, Compliance Week and other researchers have attempted to retrot ICD disclosures into the AS No. 2 framework for investigating Section 302 disclosures (e.g., Hammersley et al., 2005; Doyle et al., 2006a). Managements incentive to provide an ICD disclosure prior to a SOX 404 audit involves trading off the expected benets from the discovery and disclosure of an ICD and the costs of disclosing an ICD. One of the potential costs of providing an early ICD disclosure is that it may expose management to criticism for lax organization and mismanagement. An ICD disclosure might also cast doubt on the reliability of managements prior nancial reports including increased concern that nancial restatements might result. An additional cost of an early ICD disclosure is the potential increase in the risk of private litigation by investors for not discovering and reporting the deciencies earlier. On the positive side, however, early disclosure of an ICD may allow management to get in front of the issues (Karr, 2005), or perhaps signal that the rm does not have more serious problems such as a material weakness or heightened likelihood of future restatements (Martinek, 2005). Furthermore, because the SEC assesses no penalties for having a material weakness or signicant deciency in internal control, there is no risk of regulatory sanctions for internal control weaknesses per se. Rather, there is risk of sanctions for not disclosing known material weaknesses in internal control or changes in internal control status. A conceptual model of the existence, detection and reporting of internal control deciencies before SOX 404 audits is presented in Fig. 1. We model the existence of internal control deciencies as a function of a number of internal control risk factors and the detection and reporting as a function of audit quality and the incentives that management and its auditor have for early reporting of internal control problems. Although we classify the determinants of ICD disclosure into the two broad categories of
Many Section 302 certications from 2003 and early 2004 refer to reportable conditions, a term from AICPA auditing and attest standards guidance that predates SOX (AICPA, 1988, 2001). AS No. 2 also species new uncertainty terminology such as a remote likelihood to characterize the likelihood of material misstatement required to make an ICD a material weakness whereas prior guidance used a relatively low level [of] risk (AICPA, 1988). The possible differences in management and auditor implementation due solely to the 2004 changes in guidance led us to combine all ICD disclosures.
7
ARTICLE IN PRESS
IC risk exposures and ICD discovery and disclosure incentives, we recognize that several of the variables we use could proxy for both risk effects and incentive effects. We highlight this potential dual role for several explanatory variables below. The IC risk factors include the complexity and scope of rms operations, changes in organizational structure, accounting measurement application risk, and rm resources (or lack thereof) invested in internal controls. We posit that rms with greater complexity and scope of operations are more likely to encounter internal control problems. The complexity of rm operations, and consequently, the intricacy of its transactions increase as the rm operates in diverse industries or in international markets. The more complicated the rms transactions, the more difcult to structure adequate internal controls. In addition, multi-segment rms potentially face more internal control problems related to the preparation of consolidated reports (e.g., the proper elimination of intracompany transactions). Moreover, the more diverse and multifaceted a rms operations the greater the chance there will be breaches in the year-end closing and roll up procedures. We use SEGMENTS, dened as the number of reported business segments in 2003, and FOREIGN_SALES, coded one if a rm reports foreign sales in 2003 and zero otherwise, to proxy for the complexity and scope of operations. Both SEGMENTS and FOREIGN_SALES are identied using the Compustat Segment le. We conjecture that rms are more likely to have ICDs when they have recently changed organization structure either through mergers or acquisitions or through restructurings. Acquiring rms face signicant internal control challenges when integrating their operations, systems, and cultures with those of acquired rms. Furthermore, failure to develop adequate controls over accounting for acquired assets can increase internal control risk for acquiring rms. Firms participating in down-sizing and restructurings are likely to face greater internal control risk due to personnel problems related to the segregation of duties, inadequate stafng and supervision problems. We use M&A and RESTRUCTURE to proxy for recent changes in organizational structure. M&A is coded one if the rm has been involved in a merger or acquisition from 2001 to 2003 (Compustat AFTNT1), and zero otherwise. RESTRUCTURE is coded one if a rm has been involved in a restructuring from 2001 to 2003 and zero otherwise, where non-zero values of Compustat data items 376, 377, 378 or 379 are used to identify sample rms engaged in restructurings. We expect a positive relation between rms ICD disclosures and M&A and RESTRUCTURE. We use GROWTH, dened as the average percentage change in sales (Compustat #12), and INVENTORY, dened as inventory (Compustat #3) as a percentage of total assets (Compustat #6), to capture rms operating characteristics that are likely to expose them to greater accounting measurement application risks (Kinney and McDaniel, 1989). Rapidly growing rms are more likely to have systems that fail to keep pace with increases in customer demand or entry into new markets. Furthermore, growing rms are more likely to encounter stafng issues as the scope and complexity of their operations expand. Firms with more inventory face increased internal control risks related to the proper measurement and recording of inventory, misreporting due to theft, and timely recognition of inventory obsolescence. Information and control systems have a large xed cost component and are costly to install and maintain. Conditional on their resources, rms will make differential investments in information and control systems. We reason that smaller rms have less to invest in sophisticated information systems (e.g., enterprise resource planning systems
ARTICLE IN PRESS
such as SAP) that can enhance internal control, and they are less likely to have adequate personnel and expertise to maintain these systems. We use SIZE, as measured by the market value of equity (Compustat #199*Compustat #25), to proxy for rms investment in information systems and internal control, where smaller rms are expected to have weaker internal controls (DeFond and Jiambalvo, 1991). Following the work of Wright and Wright (1996) who nd a negative association between rm size and accounting errors, we predict a negative relation between SIZE and ICD disclosures. We use two additional variables to capture the impact of low investment in information and control systems on the likelihood of ICDs. We posit that poorly performing rms and rms in nancial distress are more likely to under invest in systems and controls and have stafng problems that lead to IC weaknesses. We use %LOSS, dened as the proportion of years from 2001 to 2003 that the rm reported negative earnings (Compustat #118), to proxy for poor performance. Firms with a greater frequency of losses are expected to exhibit a higher likelihood of an ICD due to lack of investment in internal controls (Krishnan, 2005). We use the Altman z-score, ZSCORE, to capture distress risk with higher z-scores indicating less distress risk (Altman, 1968).8 We predict a positive coefcient on %LOSS and a negative coefcient on ZSCORE. The resignation of the auditor in the year prior to an ICD disclosure is viewed as another ICD risk factor. An auditor will resign from an audit engagement when the expected costs of being associated with an audit client exceed anticipated revenues. This might occur when the auditor believes that a clients internal controls are excessively weak and that adequate client resources are not available to remedy the problem.9 We use Audit Analytics to identify rms in both the ICD sample and the control sample that switched auditors during the 12-month period beginning in the fourth month after the close of scal year 2002 through the third month after the close of scal year 2003.10 We collect the 8-K lings for sample rms that changed auditors and code AUDITOR_RESIGN as one for rms that state their auditor resigned during this 12-month period, and zero otherwise. We predict a positive relation between ICD and AUDITOR_RESIGN as an auditor resignation may indicate unacceptable audit engagement risk due to weak operating performance and nancial distress that reects inadequate investment in internal control.11
8 Prior and concurrent research often times uses accounting-based performance metrics such as return-on-equity (ROE) or return-on-assets (ROA) as a proxy for the resources available to invest in internal control systems. While useful in assessing rm performance, we elect not to use ROE or ROA as a determinant in our ICD disclosure model because using these measures implicitly assumes a monotonically increasing investment in internal control as performance improves. As stated above, much of the investment in internal control is xed, and as such, we argue %LOSS and ZSCORE are better indicators of lack of investment in IC. 9 An auditors decision to resign from an engagement is complex and may result from various causes (Shu, 2000). For example, auditor resignation may reect the auditors belief that client management lacks integrity and may commit fraud by overriding internal controls. Alternatively, the auditor may believe that it can earn higher returns with other clients and therefore resigns from the audit. Auditor resignation due to the latter reason introduces noise in this explanatory variable. 10 We allow for a 3-month window after scal year-end because most auditor changes occur after the scal yearend closing date but before the annual shareholder meeting (typically held in the fourth month after scal yearend) at which time a proxy vote for appointment of the external auditor takes place. 11 Firms changing auditors have long been required to disclose any internal control problems identied by predecessor auditors (AICPA, 1988; SEC, 1988; Whisenant et al., 2003). In the sensitivity section of the paper, we report the results of our ICD determinant model after deleting the 12 ICD rms that disclosed an internal control deciency in conjunction with reporting a change in their external auditor.
ARTICLE IN PRESS
Fig. 1 also models the factors that contribute to the detection and reporting of an ICD. We use auditor dominance, regulatory oversight in nancial reporting due to prior restatement or SEC enforcement actions, monitoring by institutional investors, and industry litigation risk to proxy for incentives to discover and disclose ICDs. The quality of the external auditor is one factor that contributes to the detection of an ICD even in the era prior to mandated audits of internal control under Section 404. This is because detection of an ICD by the auditor is a function of its strategy and scrutiny in conducting nancial statement audits and the quality of any optional audit technology that might be used in evaluating internal control as part of the nancial statement audit. We expect dominant audit suppliers to be more likely to uncover, as well as to require management disclosure of any known ICD for several reasons. First, dominant audit suppliers are likely to provide higher quality nancial statement audits that include more systematic examination and review of internal controls relative to other audit suppliers because dominant audit suppliers face greater loss of reputation by conducting poor quality audits (DeAngelo, 1981; Shu, 2000). Second, dominant audit suppliers invest more in technology and training that facilitates the discovery of internal control problems. Third, based on Dyes (1993) work that links audit quality to auditor wealth, dominant audit suppliers hold greater litigation risk and thus face greater incentives to require ICD disclosure in order to avoid costly lawsuits. We classify BDO Seidman, Deloitte and Touche, Ernst and Young, Grant Thornton, KPMG, and PricewaterhouseCoopers as the dominant audit suppliers. We include BDO Seidman and Grant Thornton in the dominant auditor classication because these two rms acquired a signicant number of SEC reporting clients following the demise of Arthur Andersen, which results in these rms facing additional litigation risk related to ICD reporting.12 AUDITOR is coded one for rms that contract with a dominant audit supplier, and zero otherwise. We predict a positive relation between AUDITOR and ICD disclosures. Fig. 1 also links managers incentives to discover and report internal control problems with the likelihood of an ICD disclosure. In general, management faces greater incentives to discover and report internal control weaknesses when the rm is subject to greater monitoring by stakeholders and when those stakeholders have greater incentives to initiate litigation if the rms nancial reporting process is deemed to be decient. We use three variables to capture managers incentives to discover and report ICDs prior to SOX 404 auditseither prior restatements or an SEC AAER, concentrated institutional ownership, and industry litigation risk. RESTATEMENT is coded one if the rm restated its nancial statements or was the object of an AAER from 2001 to 2003, and zero otherwise.13 We view RESTATEMENT
In the sensitivity section of the paper we report the results when classifying Deloitte and Touche, Ernst and Young, KPMG, and PricewaterhouseCoopers as the dominant audit suppliers. 13 Restatements announced by public companies from January 1, 2001 to December 31, 2003 are identied from various sources using the procedure outlined in Kinney et al. (2004), and the population of AAERs released by the SEC during the same time period comprises the AAER component of RESTATEMENT. Specically, restatements are identied from public sources by searching the Lexis-Nexis News and Form 8-K library les, the Securities Class Action Alert, and various business journals such as the Wall Street Journal, New York Times, Washington Post, and Los Angeles Times. The key word search used restat, revis, adjust, and error, and phrases such as responding to guidance from the SEC. Our AAER search identied specic issuers that were the subject of the release.
12
ARTICLE IN PRESS
as a proxy for managers incentives to discover and report ICDs because we posit that rms are more likely to be forthcoming about control problems when the quality of their nancial statements has been questioned by market regulators or auditors in the past.14 Prior research suggests that rms suffer, on average, a 25% decline in stock price when earnings restatements are announced (Richardson et al., 2003). Thus, the market imposes a heavy penalty on rms that restate earnings. We expect that management of rms that have incurred such penalties in the recent past will have strong incentives to avoid incurring these penalties in the near future and, therefore, will be particularly diligent about discovering and reporting ICDs to reduce the risk of another restatement or AAER. Accordingly, we predict a positive relation between RESTATEMENT and ICD disclosures.15 We also posit that managers of rms with more concentrated ownership face greater incentives to discover and disclose ICDs due to increased monitoring and greater litigation threats from concentrated owners. Prior research suggests that institutional owners that hold large blocks of shares have both the incentives to monitor management and they have the voting power to bring pressure to bear on management to effect change when control problems surface (Jensen, 1993; Shleifer and Vishny, 1997). We use INST_CON, measured as the percentage of shares held by institutions divided by the number of institutions that own a rms stock (Compact D), as our measure of concentrated institutional ownership. We predict a positive relation between INST_CON and ICD disclosures. The last variable used to proxy for managers incentives to discover and disclose ICDs is LITIGATION, which is coded one if a rm operates in a litigious industry and zero otherwise.16 Managers of rms facing greater risk of lawsuits have greater incentives to disclose the adverse news of an IC problem to minimize potential share price declines that can trigger shareholder litigation. The LITIGATION variable could also serve as a proxy for IC risk if industries are subject to litigation because there is signicant reporting control risk. For either reason, we expect a positive relation between LITIGATION and ICD disclosures. In summary, we posit that the disclosure of an ICD prior to a SOX 404 audit is a joint function of rm-specic economic attributes that expose rms to internal control risks and the incentives of rms management and external auditors to discover and disclose internal
14 One might conjecture that restatements are primarily due to internal control problems. However, for our Section 302 ICD sample rms with restatements, only 12% mention internal control problems as the primary restatement cause, while 15%, 27%, and 12%, respectively, mention management fraud, judgment error, and GAAP interpretation different from the SECs, with 34% silent about cause. 15 RESTATEMENT might also be viewed as an internal control risk proxy. But the predicted relation between RESTATEMENT and ICD is ambiguous in this case. On the one hand, rms with prior restatements may exhibit lower incidence of ICDs in the future because they have improved their accounting processes in order to avoid the negative market consequences of reporting another restatement, making it less likely that ICDs will exist (and be reported) going forward. On the other hand, one could argue that rms with prior restatements are more likely to have additional internal control problems that will resurface in the future, leading to a predicted positive relation between RESTATEMENT and ICD. Thus, if RESTATEMENT serves as an internal control risk proxy, its predicted relation with an ICD disclosure is indeterminate. Based on extant guidance and analysis of stated reasons for prior restatements noted in footnote 15, we conclude that our samples restatements more likely proxy for incentives to report than internal control risk. However, we acknowledge that the signicance of this variable may reect both internal control risk effects and incentive to discovery and report effects. 16 Consistent with Francis et al. (1994) rms with primary SIC codes of 28332836 (biotechnology), 35703577 (computer equipment), 36003674 (electronics), 52005961 (retailing), and 73707374 (computer services) are coded one, and zero otherwise.
ARTICLE IN PRESS
176 H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192 Table 1 Variable denitions Variables Predicted sign Denitions and data source
IC risk attributes SEGMENTS FOREIGN_SALES M&A RESTRUCTURE
+ + + +
GROWTH INVENTORY SIZE %LOSS RZSCORE AUDITOR_RESIGN
+ + + +
Number of reported business segments in 2003 (Compustat Segment le). Coded one if a rm reports foreign sales in 2003, and zero otherwise (Compustat Segment le). Coded one if a rm is involved in a merger or acquisition from 2001 to 2003, and zero otherwise (Compustat AFNT #1). Coded one if a rm was involved in a restructuring from 2001 to 2003, and zero otherwise. This variable is coded one if any of the following Compustat data items are non-zero: 376, 377, 378 or 379. Average growth rate in sales from 2001 to 2003 (Percent change in Compustat #12). Average inventory to total assets from 2001 to 2003 (Compustat #3/#6). Average market value of equity from 2001 to 2003 in $ billions (Compustat #199 * #25). Proportion of years from 2001 to 2003 that a rm reports negative earnings. Decile rank of Altman (1980) z-score measure of distress risk. Coded 1 if auditor resigned from the client during the 12-month period beginning in the fourth month after the close of scal year 2002 through the third month after the close of scal year 2003, zero otherwise (Audit Analytics and 8-K lings). Coded one if a rm engaged one of the largest six audit rms for 2003, and zero otherwise (Compustat). Largest six audit rms include PWC, Deloitte & Touche, Ernst and Young, KPMG, Grant Thornton and BDO Seidman. Coded one if a rm had a restatement or an SEC AAER from 2001 to 2003 and zero otherwise. Percentage of shares held by institutional investors divided by the number of institutions that own the stock as of December 31, 2003 (Compact D). Coded one if a rm was in a litigious industrySIC codes 28332836; 35703577; 36003674; 52005961; and 7370, and zero otherwise.
Proxies for incentives to discover and disclose AUDITOR +
RESTATEMENT INST_CON
+ +
LITIGATION
control problems. The variables used to capture the determinants of pre-404 ICD disclosures are summarized in Table 1. 3. Sample and descriptive statistics 3.1. Sample Our initial sample of rms providing disclosure of ICDs is obtained from monthly compilations of SEC lings reported in Compliance Week, a weekly electronic newsletter
ARTICLE IN PRESS
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192 Table 2 Sample selection criteria Number of rms disclosing internal control deciencies 11-03 through 12-04a Elimination of duplicate rms Elimination of rms from nancial services and utilities industries Firms not covered by Compustat Firms with insufcient Compustat data Firms with insufcient return/price data Internal control deciency (ICD) sample Control sampleb
a b
177
585 (47) (16) (73) (108) (15) 326 4484
Source: Compliance week. All rms having the necessary data on Compustat and CRSP to estimate the ICD disclosure model.
published by Bostons Financial Media Holdings Group. The sample period spans lings made from November 2003 to December 2004 and includes 585 separate disclosures made by 538 rms.17 Additional data requirements to estimate the multivariate logit model (described more fully below) reduced the nal sample to 326 rms as detailed in Table 2. Henceforth, we refer to this group of rms as the ICD sample. All remaining rms on the Compustat Annual Industrial Full Coverage and Research les not identied as providing a disclosure of ICD prior to December 31, 2004 and with the required data for estimating our model of ICD reporting comprise our control sample of 4484 rms.18 3.2. Descriptive statistics and univariate results Panel A of Table 3 presents descriptive statistics and the results of univariate tests that statistically assess the comparisons between the ICD and control samples. Summary statistics for the continuous variables, which represent the average value calculated over the 3 years prior to the ling of the ICD report (i.e., from 2001 to 2003), include the mean, standard deviation (std. dev.), rst quartile, third quartile, and median. The mean values reported for the categorical variables show the proportion of treatment or control rms that possess the indicated characteristic. With few exceptions, the descriptive statistics in Table 3 support our predictions about the determinants of ICD disclosures. For the ICD risk attributes, we nd that rms reporting control deciencies have more segments and are more likely to have foreign sales, be involved in mergers and acquisitions, and engage in restructurings. For GROWTH and INVENTORY, the two variables that proxy for accounting measurement application risk, we nd signicantly higher median values for both variables for the ICD rms relative to control rms as predicted. The univariate results on SIZE as a proxy for
17 Through the end of 2004, Compliance Week identied ICD rms by ltering all SEC lings of all registrants for the key words that would indicate an internal control deciency. We read the ICD rms SEC lings over 20012004 to determine the date of the rst public disclosure of an ICD. These lings include forms 10-K, 10-Q, 8-K, S-3, S-4 and proxy statements. We nd that all rms identied by Compliance Week as having an internal control problem did disclose an ICD in a SEC ling, but approximately 39% of the rms disclosed an ICD in an earlier SEC ling than the one reported in Compliance Week. Beginning January 1, 2005, Compliance Week lters only the SEC lings of rms comprising the Russell 3000, suggesting that samples drawn from Compliance Week after December 31, 2004 are not representative of the US equity market. 18 Accelerated lers comprise 59.8% of our ICD sample and 52.9% of our control sample.
ARTICLE IN PRESS
investment in internal controls are mixed; the average size of the ICD sample ($.885 billion) is slightly smaller than the control sample ($1.164 billion), while the median size of the ICD rms ($.140 billion) is signicantly larger than the control rms ($0.091 billion). Turning to the three other variables used to proxy for rms investment in internal controls (%LOSS, ZSCORE and AUDITOR_RESIGN), the descriptive statistics indicate that ICD rms have a higher incidence of losses and more often have their auditors resign from the engagement. The descriptive statistics on ZSCORE show that this variable is highly negatively skewed. Accordingly, we focus on median tests that suggest there is no difference in bankruptcy risk between ICD and control rms. The univariate tests also suggest signicant differences between the ICD rms and control rms ability to detect IC weaknesses and incentives to disclose ICDs. A higher proportion of rms in the ICD sample are audited by a dominant audit rm, are more likely to have restated earnings or have SEC AAERs sometime during the period from 2001 to 2003, and have a higher concentration of institutional shareholders. There is, however, no signicant difference in the proportion of ICD rms versus control rms that operate in litigious industries. We present pair-wise correlations in Panel B of Table 3, where the upper right-hand portion of the table presents Pearson productmoment correlations and the lower lefthand portion presents the Spearman rankorder correlations. We discuss the Pearson correlations, but note that the patterns of the two correlations are quite similar. The largest correlations are a signicant positive correlation of 0.372 between ZSCORE and AUDITOR, followed by a signicant positive correlation of 0.307 between RESTRUCTURE and AUDITOR. The vast majority of other correlations fall between 70.20, which suggests that the variables included in our determinant model capture distinct features of rms internal control risks and incentives to report. Overall, the descriptive statistics suggest that rms disclosing ICDs prior to SOX 404 audits face greater operating and reporting risks relative to non-ICD rms. In the next section we conduct more formal tests of our hypotheses using multivariate logistic regression. 4. Multivariate analysis of ICD disclosure We use the following logistic regression model to assess the extent to which internal control risk attributes and incentives to discover and early report internal control problems are associated with rms ICD disclosures: ICD_DISCLOSURE b0 b1 SEGMENTS b2 FOREIGN_SALES b3 M&A b4 RESTRUCTURE b5 RGROWTH b6 INVENTORY b7 SIZE b8 %LOSS b9 RZSCORE b10 AUDITOR_RESIGN b11 AUDITOR b12 RESTATEMENT b13 INST_CON b14 LITIGATION e, 1
where ICD_DISCLOSURE is coded one for ICD rms and zero for control rms. We transform GROWTH to be the decile rank of the average sales growth from 2001 to 2003
Table 3 Descriptive statistics on the determinants of internal control deciency disclosures Mean Panel A: Distributional properties of independent variables IC risk attributes SEGMENTS ICD sample 2.150*** Control sample 1.945 FOREIGN_SALES ICD sample 0.715*** Control sample 0.636 M&A ICD sample 0.420*** Control sample 0.319 RESTRUCTURE ICD sample 0.485*** Control sample 0.371 GROWTH ICD sample 0.206 Control sample 0.181 INVENTORY ICD sample 0.127* Control sample 0.115 SIZE ICD sample 0.885* Control sample 1.164 %LOSS ICD sample 0.581*** Control sample 0.519 ZSCORE ICD sample 1.827** Control sample 3.377 AUDITOR_RESIGN ICD sample 0.058*** Control sample 0.008 Proxies for incentives to discover and disclose AUDITOR1 ICD sample 0.847*** Std. dev. Q1 Median Q3
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192
1.547 1.461 0.606 0.642 0.137 0.137 3.113 3.982 0.399 0.425 15.167 20.506
1.000 1.000 0.049 0.069 0.008 0.001 0.028 0.014 0.333 0.000 0.476 0.327
1.000*** 1.000 0.048** 0.033 0.084*** 0.061 0.140*** 0.091 0.667*** 0.667 1.513 1.639
3.000 3.000 0.212 0.185 0.197 0.180 0.419 0.522 1.000 1.000 2.556 2.826
ARTICLE IN PRESS
179
180
Table 3 (continued ) Mean Control sample RESTATEMENT ICD sample Control sample INST_CON ICD sample Control sample LITIGATION ICD sample Control sample A Panel B: Correlations SEGMENTS2 FOREIGN_SALES M&A RESTRUCTURE GROWTH INVENTORY SIZE %LOSS ZSCORE AUDITOR_RESIGN RESTATEMENT AUDITOR INST_CON LITIGATION 0.759 0.156*** 0.062 0.009*** 0.007 0.273 0.287 B C D Std. dev. 0.010 0.010 E F G H Q1 0.003 0.001 I J Median 0.006*** 0.005 K L M Q3
0.010 0.009 N
ARTICLE IN PRESS
A B C D E F G H I J K L M N
0.230 0.129 0.187 0.027 0.116 0.270 0.214 0.138 0.011 0.029 0.165 0.072 0.143
0.221 0.044 0.252 0.097 0.169 0.271 0.219 0.202 0.014 0.033 0.235 0.187 0.034
0.122 0.044 0.118 0.200 0.113 0.238 0.071 0.018 0.015 0.015 0.094 0.017 0.035
0.186 0.252 0.118 0.177 0.201 0.315 0.033 0.014 0.004 0.078 0.307 0.154 0.010
0.069 0.152 0.111 0.143 0.078 0.188 0.154 0.039 0.009 0.002 0.017 0.034 0.017
0.009 0.099 0.138 0.033 0.107 0.019 0.241 0.327 0.008 0.014 0.040 0.120 0.088
0.270 0.154 0.076 0.159 0.031 0.051 0.432 0.362 0.067 0.054 0.584 0.132 0.053
0.215 0.217 0.072 0.035 0.105 0.194 0.221 0.603 0.062 0.027 0.259 0.122 0.107
0.136 0.186 0.024 0.137 0.058 0.139 0.077 0.295 0.065 0.018 0.326 0.285 0.024
0.002 0.014 0.015 0.004 0.012 0.005 0.036 0.061 0.027 0.047 0.054 0.001 0.004
0.028 0.033 0.015 0.078 0.001 0.012 0.021 0.028 0.038 0.050 0.075 0.038 0.005
0.165 0.235 0.094 0.307 0.128 0.005 0.158 0.259 0.372 0.054 0.075 0.369 0.067
0.011 0.102 0.074 0.058 0.076 0.115 0.155 0.016 0.139 0.013 0.014 0.158 0.002
0.140 0.034 0.035 0.010 0.039 0.105 0.033 0.106 0.010 0.003 0.005 0.067 0.028
***, **, *Indicates signicance at the 0.01, 0.05, and 0.10 level or better, respectively, based on t-statistic for difference in means or based on Z-statistic for difference in medians. There are 326 rms in the ICD sample and 4484 rms in the Control sample. All continuous variables have been winsorized at the 1 and 99 percentile values. See Table 1 for variable denitions. 1 In Table 6, we report the results of a sensitivity analysis where we set auditor equal to one if the rm uses one of the Big Four audit rms (PWC, Deloitte and Touche, Ernst and Young and KPMG) and zero otherwise. The proportion of ICD (Control) rms that use Big Four auditors is 0.724 (0.683) whereas 12.2% of the ICD sample rms use BDO Seidman or Grant Thortnon and 7.6% of the control rms use these two auditors (these proportions are different at the 0.05 level). 2 The upper right-hand portion of the table presents Pearson productmoment correlations and the lower left-hand portion presents the Spearman rank-order correlations. Bold text indicates signicance at the 0.01 level or better. n 4810. See Table 1 for variable denitions.
ARTICLE IN PRESS
(RGROWTH) because we expect the relation between growth and ICDs to be ordinal rather than cardinal.19 We also convert ZSCORE to decile ranks (RZSCORE) because of the documented skewness in the distribution of ZSCORE (see Panel A of Table 3). Model 1 of Table 4 displays the results of estimating Eq. (1) using only the variables classied as IC risk attributes, which serves as a benchmark for assessing the incremental effect of reporting incentives on the likelihood of rms disclosing ICDs. All of the estimated coefcients on the internal control risk attributes have the expected sign and are signicant at conventional levels with the exception of RZSCORE, which has the predicted sign but is insignicant. We nd that rms with more complex operations as reected in the number of business segments and being engaged in foreign operations, as captured by FOREIGN_SALES, hold greater internal control risk than rms that only operate in domestic markets. The results document that rms engaged in organizational change via participation in a M&A or restructuring face greater internal control risk and are more likely to report an ICD. In addition, we nd that rms with higher sales growth and rms with relatively larger inventory holdings are more likely to have problems with their internal controls and are thus more likely to report ICDs. After controlling for the scope and complexity of operations, we nd that smaller rms and rms with a higher incidence of losses are more likely to report ICDs consistent with our conjecture that smaller, less protable rms make fewer investments in sophisticated information and operating systems. We also nd that the resignation of the auditor is positively related to an ICD disclosure supporting the notion that an auditor resignation may indicate unacceptable audit engagement risk due to weak operating performance and nancial distress that reects inadequate investment in internal control. The benchmark model yields a Likelihood ratio w2 of 98.31, which is signicant at the 0.01 level or better. Model 2 of Table 4 displays the logit results incorporating the variables that we use to proxy for the incentives to discover and disclose an ICD. The coefcients on the internal control risk attribute variables are signicant with the predicted signs, including RZSCORE, after the addition of the variables that proxy for reporting incentives. After controlling for internal control risk attributes, we document that rms that contract with a dominant auditor supplier are more likely to make an ICD disclosure. This nding suggests that the quality of the external audit has an impact on the detection and reporting of a rms internal control problems. We also nd that rms that face more reporting risk because they have previously disappointed the market with low quality nancial information, as proxied by having to restate their nancial statements or being involved in a SEC AAER action during the 20012003 period, are more likely to disclose an ICD. Consistent with our prediction, we nd that rms with greater concentrated institutional ownership are more likely to voluntarily report ICDs during the SOX 302 reporting regime. Finally, contrary to expectations, we fail to nd that rms operating in litigious industries are more likely to report ICDs. The expanded model is highly signicant with a Likelihood ratio w2 of 137.69. The Wald 2 w of 41.96 (signicant at 0.01) indicates that the addition of the incentives to discover and disclose variables, as a group, add signicant incremental explanatory power to the model based only on internal control risk attributes. Overall, the results of the logistic regression support the hypothesis that the early disclosure of ICDs is a joint function of rm-specic
In the sensitivity analysis section of the paper, we present results when coding GROWTH as a continuous variable.
19
ARTICLE IN PRESS
182 H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192 Table 4 Logistic regression of the determinants of internal control deciency disclosures
ICD_DISCLOSURE b0 b1 SEGMENTS b2 FOREIGN_SALES b3 M&A b4 RESTRUCTURE b5 RGROWTH b6 INVENTORY b7 SIZE b8 %LOSS b9 RZSCORE b10 AUDITOR_RESIGN b11 AUDITOR b12 RESTATEMENT b13 INST_CON b14 LITIGATION e,
Predicted sign Model 1 Intercept IC risk attributes SEGMENTS FOREIGN_SALES M&A RESTRUCTURE RGROWTH INVENTORY SIZE %LOSS RZSCORE AUDITOR_RESIGN Proxies for incentives to discover and disclose AUDITOR RESTATEMENT INST_CON LITIGATION Likelihood ratio, w2 Wald, w2 Sample size + + + + + + + + + + + + 0.087 (4.606)** 0.361 (6.757)*** 0.402 (10.314)*** 0.417 (10.910)*** 0.059 (7.581)*** 1.163 (6.943)*** 0.036 (3.081)** 0.475 (6.702)*** 0.015 (0.304) 2.008 (45.912)*** 7 3.996 (199.26)***
Estimated coefcients Model 2 4.379 (202.55)***
0.074 (3.243)** 0.278 (3.968)** 0.416 (10.78)*** 0.249 (3.579)** 0.060 (7.262)*** 1.346 (8.774)*** 0.032 (2.425)* 0.502 (7.229)*** 0.037 (1.701)* 2.024 (43.619)***
0.565 (9.681)*** 0.839 (23.964)*** 10.260 (3.176)** 0.136 (0.996) 98.31*** 103.95*** 4810 137.69*** 41.96*** 4810
ICD_DISCLOSURE is coded one for rms that le an internal control deciency report (n 326) and zero otherwise (n 4484). RGROWTH is the decile rank of GROWTH, where GROWTH and other variables are dened in Table 1. Wald w2 values in parentheses. ***Indicates signicance at the 0.01 level or better, **Indicates signicance at the 0.05 level or better, *Indicates signicance at 0.10 level or better.
ARTICLE IN PRESS
economic attributes that expose rms to internal control risks and the incentives of rms management and external auditors to provide early warning of internal control problems. 4.1. Marginal analysis In order to provide some insight into what factors are most important in determining the likelihood that a rm will disclose an ICD, we calculate the change in probability of a rm disclosing an ICD as a result of changing the levels of various explanatory variables in Eq. (1). The change in probability is calculated using the following steps. First, we calculate the probability of a rm disclosing an ICD from our logitistic regression model using the following expression: p X e b X = 1 e b X ,
0 0
(2)
where b is the vector of coefcients from Model 2 in Table 4 and X is the vector of independent variables set equal to their mean values across the sample of all rms. Conditional on the mean values of the independent variables, the likelihood of reporting an ICD is 4.9%. Next, we calculate the marginal changes in the probability of a rm reporting an ICD for a one standardized unit increase in each explanatory variable while holding the other independent variables at their mean values.20 Each marginal effect is measured by qpX =qxi bi pX 1 pX calculated at the mean value of the regressors. These marginal effects are reported in column 3 of Table 5. Among the IC risk factors, the variables with the greatest marginal effects are AUDITOR_RESIGN (0.227), and %LOSS (0.210) and M&A (0.193). For incentives to discover and report, AUDITOR (0.268) and RESTATEMENT (0.201) have the greatest marginal impact. An alternative way of assessing the effect of various IC risk factors and incentives to discover and report an ICD is to calculate the values of the logit function, p(X), at selected xi values such as their lower and upper quartiles (Agresti, 2002, p. 167). This entails substituting the quartile values for each xi explanatory variable into Eq. (1) while holding the other variables constant at their means. The linear approximation to changes in p(X) is obtained by multiplying the interquartile range of xi values (see Table 3 for the interquartile ranges) by the marginal effects based on the unstandardized value of the variables (Agresti, 2002, Chapter 5). These values are reported in the last column of Table 5. We rst calculate the probability of disclosing an ICD for a hypothetical rm that takes on the lower (upper) quartile values of determinants of an ICD disclosure for variables that are positively (negatively) related to ICDs.21 This yields a probability of disclosing an ICD of about 1.2%. We next repeat this process but now use upper (lower) quartile values of explanatory variables that are positively (negatively) related to the incidence of an ICD. This yields a probability of an ICD of 77.9% with AUDIT_RESIGN accounting for nearly 35%. Leaving AUDIT_RESIGN out of the model lowers the probability of an ICD to 31.7%. Thus, the probability of reporting an ICD is dramatically higher when a rm
20 We use standardized values because the various explanatory variables are measured in different units. Without standardization the marginal probabilities are difcult to compare and interpret (Agresti, 2002, Chapter 5). 21 For attributes measured as a binary variable, the benchmark probability is determined with the zero (one) value when the attribute is positively (negatively) related to reporting an ICD.
ARTICLE IN PRESS
184 H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192 Table 5 Assessment of changes in probabilities of rm disclosing an ICD for selected changes in independent variables Variables Predicted sign Marginal effect Standardized variables Change in probability Q1 vs. Q3 values
IC risk attributes SEGMENTS FOREIGN_SALES M&A RESTRUCTURE RGROWTH INVENTORY SIZE %LOSS RZSCORE AUDITOR_RESIGN
+ + + + + + + +
0.108 0.131 0.193 0.117 0.169 0.180 0.113 0.210 0.120 0.227 0.268 0.201 0.087 0.066
0.025 0.048 0.072 0.043 0.010 0.042 0.003 0.087 0.032 0.349 0.097 0.145 0.313 0.023
Proxies for incentives to discover and disclose AUDITOR + RESTATEMENT + INST_CON + LITIGATION +
The Marginal Effects column shows the change in probability of a rm disclosing an ICD due to a one unit change in the variable of interest after standardizing the independent variables. Marginal effects are computed as: 0 0 pX eb X =1 eb X where b0 X is evaluated at the mean values of X. Tabled values in the Change in Probability column show the change in the probability of a rm disclosing an ICD as a result of moving from the rst to the third quartile value of the variable of interest, holding all other variables constant at their mean values. RGROWTH is the decile rank of GROWTH and LOGSIZE is the natural log of SIZE, where GROWTH and SIZE, as well as other variables are dened in Table 1.
takes on upper quartile values of the IC risk attributes and factors that are associated with the incentives to discover and report ICDs.22 4.2. Sensitivity analysis The validity of the inferences drawn from our model of ICD disclosure is conditional on the quality of the variables that we use to proxy for IC risk attributes and incentives to discover and disclose ICDs. In this sub-section, we assess the robustness of our results to alternative measures of IC risk and other proxies for incentives to discover and disclose ICDs. The rst sensitivity test that we conduct relates to our proxy for audit quality, AUDITOR. As stated earlier, we consider BDO Seidman and Grant Thornton to be dominant audit suppliers in the US audit market during our analysis period because these two rms gained more SEC reporting clients and held a larger US audit market share after
22 We hasten to note that this illustration does not reect the typical rm in our sample because any given rm will likely not start from a position of having low IC risk factors or incentives to report (1Q or zero value for dummy variables) along all of the multiple dimensions we consider. Nor is it likely that any given rm would be able to move to a position of having high IC risk factors and incentives to report along all dimensions (3Q or one for dummy variables).
ARTICLE IN PRESS
the demise of Arthur Andersen. An additional partitioning of audit rm dominance based on historical market share considers Deloitte, Ernst and Young, KPMG, and PricewaterhouseCoopers to be the dominant audit suppliers as these four rms, along with Arthur Andersen, audited the vast majority of SEC reporting rms since 1995. Model 1 of Table 6 reports the results of our ICD disclosure determinant model adding an additional indicator variable, AUDITOR(BIGFOUR), that is set equal to one if the rm contracts with Deloitte, Ernst and Young, KPMG, and PricewaterhouseCoopers and zero otherwise. With AUDITOR(BIGFOUR) in the model, the coefcient on AUDITOR picks up the marginal likelihood of a client of BDO Seidman or Grant Thornton reporting an ICD. Interestingly, the coefcient on AUDITOR(BIGFOUR) is negative and signicant at a 0:10, while the coefcient on AUDITOR is positive and highly signicant.23 One interpretation of these results is that BDO Seidman and Grant Thornton audit clients with greater internal control risk. Alternatively, the results suggest that BDO Seidman and Grant Thornton, in building their reputation with SEC clients, exercise more diligence in identifying internal control problems. The signs and signicance of the coefcients on the remaining variables are similar to those of Model 2 reported in Table 4 with the exception that the coefcient on RZSCORE, which becomes insignicant. Our second set of sensitivity tests uses alternative measures of rm growth and litigation risk. Model 2 column of Table 6 displays the results of estimating Eq. (1) using a continuous measure of growth (SALESGRWTH), where SALESGRWTH is dened as the 3-year average sales growth over 20012003. The coefcient on SALESGRWTH is marginally signicant as compared to the highly signicant coefcient on the rank growth measure (RGROWTH) in Table 4. Using this measure of growth does not change inferences drawn about other variables in the model. In Model 3 of Table 6, we replace LITIGATION, a categorical variable capturing high litigation risk industries, with SHU_LIT, which is based on the work of Shu (2000).24 After controlling for other factors that provide incentives for managers to discover and report ICDs, we do not nd that rms with high litigation risk as measured by Shu (2000) are any more likely to provide an ICD disclosure than other rms. Thus, this result afrms our earlier nding reported in Table 4 that ICD disclosure is not related to litigation risk. There were 12 ICD rms that concurrently reported an auditor resignation and an ICD in 2003 and early 2004 on an 8-K ling. Because there is a one-to-one mapping of ICD disclosure and the independent variable of AUDITOR_RESIGN, it is important to see if our ndings are robust to deleting these observations. In the Model 4 column of Table 6, we report the results of estimating our logistic model after deleting these 12 rms. The most important point is that the deletion of these observations does not adversely affect the signicance of the coefcient on AUDITOR_RESIGN. Moreover, except for RZSCORE, the signs and signicance of the other coefcients remain unchanged from those reported in Table 4. Thus, we conclude that the inferences drawn from the primary analysis are robust to the deletion of these 12 rms.
23 Obviously, there is a high correlation between AUDITOR and AUDITOR(BIGFOUR), r 0.82. If we exclude AUDITOR from the model, the coefcient on AUDITOR(BIGFOUR) is positive and signicant. 24 Shu (2000) models litigation risk as a function of rm size, inventory holdings, receivables, return-on-assets, current ratio, nancial leverage, sales growth, stock return, stock volume, beta, stock turnover, delisting decision, operating in technology-related industries, and receiving a qualied audit opinion. To calculate SHU_LIT, we take the parameter estimates from Table 3 of Shu (2000) and apply them to the accounting and market measures of the sample rms that have the necessary data to calculate the measures.
186
Table 6 Logistic regression results of determinants of ICD disclosures-sensitivity analysis Variables Estimated coefcient Model 1 IC risk attributes SEGMENTS FOREIGN_SALES M&A RESTRUCTURE RGROWTH INVENTORY SIZE %LOSS RZSCORE AUDITOR_RESIGN SALESGRWTH Model 2 Model 3 Model 4 Model 5 Model 6
+ + + + + + + + +
0.075 (3.341)** 0.277 (3.975)*** 0.423 (11.334)*** 0.265 (4.032)*** 0.061 (7.514)*** 1.269 (7.680)*** 0.031 (2.241)* 0.487 (6.754)*** 0.034 (1.415) 1.980 (40.928)***
0.070 (2.912)** 0.261 (3.493)** 0.472 (14.328)*** 0.200 (2.365)* 1.305 (8.235)*** 0.031 (2.225)* 0.423 (5.258)*** 0.039 (1.915)* 2.021 (43.557)*** 0.128 (1.892)* 0.594 (10.625)***
0.096 (4.395)** 0.096 (0.310) 0.494 (10.627)*** 0.212 (1.813)* 0.022 (0.581) 1.723 (9.333)*** 0.034 (2.410)* 0.668 (9.561)*** 0.040 (1.189) 1.137 (6.013)***
0.074 (3.164)** 0.238 (2.855)** 0.408 (10.082)*** 0.295 (4.885)*** 0.067 (8.797)*** 1.349 (8.543)*** 0.031 (2.241)* 0.493 (6.786)*** 0.033 (1.294) 1.935 (36.051)***
0.074 (3.197)*** 0.273 (3.826)** 0.412 (10.470)*** 0.241 (3.359)** 0.059 (7.018)*** 1.312 (8.252)*** 0.028 (1.978)* 0.496 (6.987)*** 0.042 (2.151)* 2.112 (47.244)***
0.096 (3.760)** 0.412 (4.544)** 0.457 (8.039)*** 0.708 (17.578)*** 0.104 (11.086)*** 0.987 (2.391)* 0.030 (2.155)* 0.367 (2.453)** 0.009 (0.056) 1.819 (16.701)***
ARTICLE IN PRESS
Proxies for incentives to discover and disclose AUDITOR + AUDITOR (BIGFOUR) +
0.801 (11.446)*** 0.295 (2.294)*
0.415 (1.959)*
0.578 (9.687)***
0.631 (12.107)***
2.173 (21.444)***
RESTATEMENT INST_CON LITIGATION SHU_LIT AUDITOR_DIMISS Likelihood ratio, w2 Sample size ICD sample Control sample
+ + + + +
0.840 (23.944)*** 9.925 (2.985)** 0.139 (1.031) 139.88*** 4810 326 4484
0.847 (24.519)*** 9.586 (2.781)** 0.131 (0.920) 132.18*** 4810 326 4484
0.951 (21.611)*** 8.771 (1.295) 1.434 (0.209) 77.755*** 2894 224 2670
0.785 (19.673)*** 11.016 (3.598)** 0.117 (0.716) 124.36*** 4798 314 4484
0.794 (21.159)*** 8.912 (2.346)* 0.147 (1.153) 1.127 (28.467)*** 114.07*** 4021 303 4324
1.045 (27.731)*** 15.820 (2.185)* 0.107 (0.372) 176.95*** 4679 195 4484
ARTICLE IN PRESS
***Indicates signicance at the 0.01 level or better, **indicates signicance at the 0.05 level or better, *Indicates signicance at 0.10 level or better. See Table 1 for variable denitions. Model 1Base model with BIGFOUR auditor, where BIGFOUR is coded one if the rm contracts with Deloitte & Touche, Ernst & Young, KPMG, or PricewaterhouseCoopers, else zero. As shown in footnote 1 to Table 3, 72.4% (68.3%) of the ICD rms (control rms) use BIGFOUR audit rms. Model 2Base model with continuous sales growth, where SALESGRWTH is dened as the average percentage change in sales from 2001 to 2003. Model 3Base model with the Shu litigation measure, where SHU_LIT is calculated as the parameter estimates from Table 3 of Shu (2000) applied to the accounting and market measures of the sample rms that have the necessary data to calculate the measures. Model 4Base model estimated with concurrent auditor change and ICD disclosures observations (n 12) deleted. Model 5Base model with AUDITOR_DISMISS as an additional incentive to discover and disclose measure. AUDITOR_DISMISS 1 if the client dismissed its auditor during the twelve month period beginning in the fourth month after the close of scal year 2002 through the third month after the close of scal year 2003, zero otherwise (auditor dismissals were determined from Audit Analytics and 8-K lings). Model 6Base model estimated deleting observations of ICD rms that are non-accelerated lers. Estimated coefcients in italics represent estimates that result in different inferences drawn from those of our primary analysis. See Table 1 for all other variable denitions.
ARTICLE IN PRESS
Our fth sensitivity test explores whether the termination of a rms auditor signals problems with internal control. One potential reason why a rm terminates its contract with the incumbent auditor is for unsatisfactory performance after management discovers internal control problems in preparation for a SOX 404 audit that the incumbent auditor had not discovered in a prior audit.25 If the auditor is dismissed, managers have incentives to make an ICD disclosure in conjunction with pointing the nger at the terminated auditor for poor internal control oversight. AUDITOR_DISMISS is coded one for rms that disclose in an 8-K ling the dismissal of their auditor in 2003 (and zero otherwise). The results when adding AUDITOR_DISMISS to the ICD disclosure determinant model are displayed in the Model 5 column of Table 6. The coefcient on AUDITOR_DISMISS is positive and highly signicant and the signs and signicance of the coefcients on the other independent variables are similar to those of Model 2 reported in Table 4. The signicantly positive coefcient on AUDITOR_DISMISS is consistent with the notion that rms that dismissed their auditors in 2003 are more likely to report ICDs as managers take steps to improve internal control scrutiny. Our last sensitivity test is motivated by the fact that our sample includes both accelerated and non-accelerated lers because our study focuses on the Section 302 reporting era. In contrast, the Doyle et al. (2006a) study uses a sample that includes disclosures made in both the SOX 302 and 404 reporting regimes, with observations from the later period being heavily weighted towards accelerated lers. To investigate how the differences in samples affect the inferences drawn on internal control risk, we re-estimate our ICD reporting model deleting ICD rms that are non-accelerated lers.26 The Model 6 column of Table 6 displays the results. We continue to include our variables that proxy for the incentives to detect and report ICDs because we posit that even though accelerated lers are required to report material weaknesses in internal control under SOX 404, these rms still faced differential incentives to detect and report internal control problems during the SOX 302 regime. We nd the signs and signicance on several of the internal control risk and reporting variables to be different from those of our benchmark results reported in the Model 2 column of Table 4. Specically, we nd restructurings to increase in importance in explaining ICDs and the effect of inventory levels, frequency of losses, and likelihood of nancial distress on the likelihood of ICDs disclosures to be less signicant. More importantly, the results indicate a signicant negative relation between INST_CON and ICD reporting, whereas we found a positive relation in our Table 4 results when nonaccelerated lers were included in the ICD sample.27
25 This point highlights the fact that AUDITOR can be considered an endogenous choice. Prior research examining rms auditor choices models auditor choice as a function of operating risk, nancial risk and the demand for external monitoring (see e.g., Chow, 1982). Our empirical model of ICD disclosure includes many of the same variables used in prior audit choice research to proxy for these risks, and as such, our research design inherently controls for selection effects. Furthermore, the majority of sample rms made their auditor choices across different years much earlier than our year of analysis (i.e., the average auditor tenure for our sample of rms is over 6 years) and as such we think it reasonable to consider AUDITOR as an exogenous variable for this sensitivity test. 26 It is important to note that in order to draw strong inferences regarding the determinants of ICD reporting in the SOX 404 regime, non-accelerated lers also should be deleted from the control sample. We do not take this step to allow more direct comparisons to the Doyle et al. (2006a) study. 27 To be more similar to the ICD risk model of Doyle et al. (2006a), we extend this sensitivity analysis by adding rm AGE, dened as the natural log of the number of years on CRSP, to the model. Unlike Doyle et al. (2006a),
ARTICLE IN PRESS
Based on the sensitivity analysis reported above, it appears that it is important to control for rms incentives to detect internal control problems when evaluating the likelihood of ICD reporting. We also nd that including rms of all sizes (both accelerated and nonaccelerated lers) affects the signicance of several of the variables in our ICD determinant model. 4.3. Factors deterring managers from disclosing ICDs We model ICD disclosures as a function of factors that proxy for managers incentives to discover and disclose an ICD, but we do not include any explicit factors that deter managers from providing early ICD disclosures. One potential factor that may deter managers from making an early ICD disclosure is management reputation. Managers may forego disclosing an ICD to avoid criticism in the market for lax organization or mismanagement of operations ultimately reducing their employment options. If reputation is an incentive factor, we would expect new managers to be more likely to disclose ICDs because they can place the blame of internal control problems on prior management. Therefore, we expect rms that have management with longer tenure to be less likely to disclose ICDs. To investigate this issue we collect CEO tenure for all sample rms covered by the Board Analyst database and add CEO tenure to our ICD determi nant model. We code CEO tenure both as a continuous variable as well as a binary variable that is set equal to one if the CEO tenure is less than 2 years, and zero otherwise. In untabulated results, we do not nd a statistically signicant difference between the CEO tenure of ICD rms and control rms after controlling for other ICD risk and reporting determinants. Another potential factor deterring managers from making an early ICD disclosure is management compensation. An ICD disclosure might cast doubt on the reliability of managements nancial reporting, which impacts the uncertainty of information quality thereby increasing the rms cost of capital (Easley and OHara, 2004) and decreasing its market value. A CEO that has a large number of stock options (or stock option awards) might not want to disclose an ICD. On the other hand, a CEO that has stock grants as part of his compensation package may actually have incentives to disclose ICDs prior to receiving grants in the hopes that such disclosure would lower the strike price on the options granted during the year, thus raising the value of his options. Given the prediction about the effects of stock-based compensation on managements incentives to disclose ICDs is not clear-cut and requires collecting detailed information on the timing of the release of stock option grants relative to disclosure of the ICD, we leave this question to future research. 5. Summary and future research Many have claimed that the passage of the SarbanesOxley Act of 2002 imposed an extreme burden on SEC registrants by requiring them to document, evaluate, publicly report, and have audited the effectiveness of their internal controls. This paper investigates
(footnote continued) we do not nd a signicant coefcient on AGE after controlling for the other ICD risk and reporting determinants.
ARTICLE IN PRESS
the economic events, strategic operating decisions, and investments in internal controls that expose rms to internal control risks. Because our study uses data prior to audits mandated by Section 404 of the SarbanesOxley Act, we are also able to investigate the incentives to discover and report internal control deciencies (ICDs) in the absence of well dened ICD discovery and reporting criteria and no mandated internal control audit. More importantly, because we restrict our sample to pre-404 disclosures made by accelerated and non-accelerated lers, our study provides insights into the determinants of ICDs for a broad cross-section of SEC registrants, which is important for developing expectations of internal control problems given that non-accelerated lers are not required to comply with SOX 404 until 2007. We nd that rms that report ICDs have more complex operations as proxied by the number of business segments and foreign sales, more often engage in mergers and acquisitions and restructurings, hold more inventory and are faster growing relative to rms that do not disclose internal control weaknesses. In addition, the results indicate that rms with fewer resources to invest in internal control, as proxied by the frequency of losses and greater nancial distress, more often disclose problems with their internal controls. Moreover, the higher incidence of auditor resignations prior to ICD disclosures suggests auditors have greater concerns about ICD rms accounting application risk and status as going concerns. With respect to incentives to discover and report internal control problems, we nd that rms that provide early (pre-SOX 404) warnings of ICDs are more likely to be audited by dominant auditors, have a higher incidence of restatements of nancial statements and SEC AAERs in prior years, and are more likely to have concentrated institutional owners. Collectively, these results support our conjecture that rms that face greater internal control risk and have greater reporting incentives are more likely to disclose internal control deciencies prior to the SOX-mandated internal control audit reporting requirements. The vast majority of rms that reported control deciencies in the rst 3 months of 2005 as a result of SOX 404 audits previously certied their controls as effective under SOX 302 (Glass Lewis, 2005). Future research can investigate whether there are signicant differences in internal control risk proles and incentives to report for rms that disclosed internal control deciencies prior to SOX-mandated audits versus rms that report deciencies under Section 404 of the SarbanesOxley Act. Exploring the relation between internal control weaknesses and the quality of externally reported numbers is another natural extension of the present analysis (Ashbaugh-Skaife et al., 2006b; Doyle et al., 2006b). Finally, another avenue of fruitful research is to investigate whether internal control deciencies result in higher information risk that increases rms cost of equity capital (Ashbaugh-Skaife et al., 2006a; Ogneva et al., 2005).
References
Agresti, A., 2002. Categorical Data Analysis. Wiley, New York. Altman, E., 1968. Financial ratios, discriminant analysis, and the prediction of corporate bankrupcy. Journal of Finance 23, 589609. American Institute of Certied Public Accountants (AICPA), 1988. Statement on Auditing Standards No. 60: Communication of Internal Control Structure Related Matters Noted in an Audit, AICPA, New York.
ARTICLE IN PRESS
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192 191 American Institute of Certied Public Accountants (AICPA), 2001. Statement on Standards for Attestation Engagements No. 10: Reporting on an Entitys Internal Control Over Financial Reporting, AICPA, New York. Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006a. The Effect of Internal Control Deciencies on Firm Risk and Cost of Equity Capital, Working paper, University of Iowa. Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006b. Internal Control Deciencies, Remediation and Accrual Quality, Working paper, University of Iowa. Beneish, M., Billings, M., Hodder, L., 2006. Internal Control Weaknesses and Information Uncertainty, Working paper, Indiana University. Chow, C., 1982. The demand for external auditing: Size, debt, and ownership inuences. The Accounting Review 57, 272291. DeAngelo, L., 1981. Auditor size and audit quality. Journal of Accounting and Economics 3, 183200. DeFond, M., Jiambalvo, J., 1991. Incidence and circumstances of accounting errors. The Accounting Review 66, 643655. De Franco, G., Guan, Y., Lu, H., 2005. The Wealth Change and Redistribution Effects of SarbanesOxley Internal Control Disclosures. Working paper, University of Toronto. Doyle, J., Ge, W., McVay, S., 2006a. Determinants of Weaknesses in Internal Control over Financial Reporting, Working paper, New York University. Doyle, J., Ge, W., McVay, S., 2006b. Accruals Quality and Internal Control over Financial Reporting, Working paper, New York University. Dye, R., 1993. Auditing standards, legal liabilities, and auditor wealth. Journal of Political Economy 101, 887914. Easley, D., OHara, M., 2004. Information and the Cost of Capital, Working paper, Cornell University. Francis, J., Philbrick, D., Schipper, K., 1994. Shareholder litigation and corporate disclosures. Journal of Accounting Research 32, 137164. Glass Lewis & Company, 2005. Interim Control Deciency Disclosures-Interim Alert, Yellow Card Interim Alert, Glass-Lewis and Company, LLC, April 12, p. 3. Hammersley, J., Myers, L., Shakespeare, C., 2005. Market Reactions to Internal Control Disclosures, Working paper, University of Michigan. Hogan, C., Wilkins, M., 2006. Evidence on the Audit Risk Model: Do Auditors Increase Audit Effort in the Presence of Internal Control Weaknesses? Working paper, Southern Methodist University. Jensen, M., 1993. The modern industrial revolution, exit, and the failure of internal control systems. Journal of Finance 48, 831880. Karr, S., 2005. 404 Disclosure: Experts Say Get in Front of the Issue, Compliance Week, February 15. Kinney, W., McDaniel, L., 1989. Characteristics of rms correcting previously reported quarterly earnings. Journal of Accounting and Economics 11, 7193. Kinney, W., Palmrose, Z., Scholz, S., 2004. Auditor independence, non-audit services, and restatements: Was the US government right? Journal of Accounting Research 42, 561588. Krishnan, J., 2005. Audit committee quality and internal control: An empirical analysis. The Accounting Review 80, 649675. Martinek, P., 2005. SOX Catch 22: Certifying Controls Later Found Weak, Compliance Week, February 22. McMullen, D., Raghunandan, A., Rama, K., 1996. Internal control reports and nancial reporting problems. Accounting Horizons 10, 6775. Ogneva, M., Raghunandan, K., Subramanyam, K.R., 2005. Internal Control Weakness and Cost of Equity: Evidence from SOX Section 404 Certications, Working paper, University of Southern California. Public Company Accounting Oversight Board, 2004. Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with An Audit of Financial Statements, PCAOB, March 9. Richardson, S., Tuna, I., Wu, M., 2003. Predicting Earnings Management: The Case of Earnings Restatements, Working paper, University of Pennsylvania, Wharton School. Securities and Exchange Commission (SEC), 1988. Disclosure Amendments to Regulation S-K, Form 8-K and Schedule 14A Regarding Changes in Accountants and Potential Opinion Shopping Situations. Financial Reporting Release No. 31, SEC, Washington, DC. Securities and Exchange Commission (SEC), 2002. Certication of Disclosure in Companies Quarterly and Annual Reports. Release Nos. 33-8124, 34-46427, SEC, Washington, DC, August 29.
ARTICLE IN PRESS
192 H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192 Securities and Exchange Commission (SEC), 2003. Final Rule: Managements Reports on Internal Control Over Financial Reporting and Certication of Disclosure in Exchange Act Periodic Reports. Release Nos. 33-8238, 34-47986, SEC, Washington, DC, June 11. Securities and Exchange Commission (SEC), 2004. Managements Reports on Internal Control Over Financial Reporting and Certication of Disclosure in Exchange Act Period ReportsFrequently Asked Questions, SEC, Washington, DC, October 6. Securities and Exchange Commission (SEC), 2005. Letter from the SEC Chief Accountant, SEC, Washington, DC, February 7. Shleifer, A., Vishny, R., 1997. A survey of corporate governance. Journal of Finance 52, 737783. Shu, S., 2000. Auditor resignations: clientele effects and legal liability. Journal of Accounting and Economics 29, 173205. US Congress, 2002. The SarbanesOxley Act of 2002. 107th Congress of the United States of America. H.R. 3763. Government Printing Ofce, Washington, DC. Whisenant, S., Sankaraguruswamy, S., Raghunandan, K., 2003. Market reactions to disclosure of reportable events. Auditing: A Journal of Practice and Theory 22, 181194. Wright, A., Wright, S., 1996. The relationship between assessments of internal control strength and error occurrence, impact and cause. Accounting and Business Research 27, 5871. Zhang, I., 2005. Economic Consequences of the SarbanesOxley Act of 2002, Working paper, University of Rochester.

The Discovery and Reporting of Internal Control Deficiencies Prior To SOX-mandated Audits

Hochgeladen von

Dokumentinformationen

Originalbeschreibung:

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

The Discovery and Reporting of Internal Control Deficiencies Prior To SOX-mandated Audits

Hochgeladen von

Copyright:

Verfügbare Formate

ARTICLE IN PRESS

Journal of Accounting and Economics 44 (2007) 166192 www.elsevier.com/locate/jae

ICD risk exposures

+ ICD discover and disclose incentives

IC risk attributes SEGMENTS FOREIGN_SALES M&A RESTRUCTURE

GROWTH INVENTORY SIZE %LOSS RZSCORE AUDITOR_RESIGN

Proxies for incentives to discover and disclose AUDITOR +

585 (47) (16) (73) (108) (15) 326 4484

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192

Estimated coefcients Model 2 4.379 (202.55)***

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192

Proxies for incentives to discover and disclose AUDITOR + AUDITOR (BIGFOUR) +

0.801 (11.446)*** 0.295 (2.294)*

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192 187

Das könnte Ihnen auch gefallen