articol3

7/29/2019 articol3

1/27

Journal of Accounting and Economics 44 (2007) 166192

The discovery and reporting of internal control

deficiencies prior to SOX-mandated audits$

Hollis Ashbaugh-Skaifea, Daniel W. Collinsb,,William R. Kinney Jr.c

aSchool of Business, University of Wisconsin-Madison, Madison, WI 53707, USAbTippie College of Business, University of Iowa, Iowa City, IA 52242, USA

cMcCombs School of Business, University of Texas at Austin, Austin, TX 78712, USA

Received 1 March 2005; received in revised form 20 October 2006; accepted 26 October 2006

Available online 15 December 2006

Abstract

We use internal control deficiency (ICD) disclosures prior to mandated internal control audits to

investigate economic factors that expose firms to control failures and managements incentives todiscover and report control problems. We find that, relative to non-disclosers, firms disclosing ICDs

have more complex operations, recent organizational changes, greater accounting risk, more auditor

resignations and have fewer resources available for internal control. Regarding incentives to discover

and report internal control problems, ICD firms have more prior SEC enforcement actions and

financial restatements, are more likely to use a dominant audit firm, and have more concentrated

institutional ownership.

r 2006 Elsevier B.V. All rights reserved.

JEL classification: G34; G38; K22; M41; M49

Keywords: Internal control; Auditing; Regulation; SOX

ARTICLE IN PRESS

www.elsevier.com/locate/jae

0165-4101/$ - see front matterr 2006 Elsevier B.V. All rights reserved.

doi:10.1016/j.jacceco.2006.10.001

$We thank Andy Bailey, Dave Burgstahler, Ryan LaFond, Thomas Lys, Linda McDaniel, Pamela Murphy,

Joel Horowitz, Robert Lipe, Gene Savin, Lynn Turner, Jerry Zimmerman, Editor, Andy Leone, the referee, and

seminar participants at the University of Kentucky, Michigan State University, University of North Carolina at

Chapel Hill, Ohio State University and the University of Wisconsin-Madison for helpful comments and

suggestions. We also thank Guojin Gong, Neil Schreiber, Kwadwo Asare and John McInnis for their capable

research assistance.Corresponding author. Tel.: +1 319 335 0912; fax: +1 319 335 1956.

E-mail addresses: [email protected] (H. Ashbaugh-Skaife), [email protected] (D.W. Collins),[email protected] (W.R. Kinney Jr.).
http://www.elsevier.com/locate/jaehttp://localhost/var/www/apps/conversion/tmp/scratch_8/dx.doi.org/10.1016/j.jacceco.2006.10.001mailto:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]:[email protected]://localhost/var/www/apps/conversion/tmp/scratch_8/dx.doi.org/10.1016/j.jacceco.2006.10.001http://www.elsevier.com/locate/jae

7/29/2019 articol3

2/27

1. Introduction

This study investigates the economic factors that expose a firm to internal control risk

and managements incentives to discover and report an internal control deficiency (ICD).

Section 404 of the SarbanesOxley Act (US Congress, 2002), denoted SOX requires thatpublic company financial statements filed on Form 10-K and Form 10-Q contain an

assessment by management of the design and operating effectiveness of its internal control

over financial reporting. Section 404 also requires that the external auditor, on an annual

basis, provide an opinion on managements assessment of internal control (Securities and

Exchange Commission (SEC), 2003).

Before the implementation of SOX Section 404, Section 302 of SOX required that

management evaluate the effectiveness of disclosure controls and procedures, report results

of their evaluation, and indicate any significant changes in internal control since the last

Form 10-K or Form 10-Q filing (SEC, 2002). The SEC defines disclosure controls and

procedures as controls and other procedures of an issuer that are designed to ensure that

information required to be disclosed by the issuer in the reports filed or submitted by it

under the Exchange Act is recorded, processed, summarized and reported, within the time

periods specified in the Commissions rules and forms (SEC, 2002). However, neither the

SEC nor SOX Section 302 specify particular procedures to be applied by management in

evaluating internal controls nor do they require independent audits of internal controls.

Furthermore, while Section 302 requires management to report any discovered material

weaknesses to their external auditor and the audit committee (SEC, 2003), whether such

ICDs had to be disclosed to shareholders in public SEC filings is less clear. As an example

of this ambiguity, the SEC staff addressed the frequently asked question: Is a registrantrequired to disclose changes or improvements to controls made as a result of preparing for

the registrants first management report on internal control over financial reporting?

(SEC, 2004, Question 9). The staffs answer was that they would welcome disclosure of all

material changes to controls whether before or after the Section 404 compliance date, but

they would not object if a registrant did not disclose changes made in preparation for

the registrants first management report under Section 404. The staff added to its response

However, if the registrant were to identify a material weakness, it should carefully

consider whether that fact should be disclosed as well as changes made in response to the

material weakness. Thus, under the provisions of Section 302, the review of internal

control is subject to less scrutiny by both management and the auditor and the disclosurerules are less specific than subsequently exist under Section 404.1 This suggests that

managers had more discretion in disclosing ICDs during the pre-Section 404 regime.

We use ICD disclosures provided by firms after Section 302 became effective, but before

the effective date for independent internal control audits mandated by Section 404 to study

ARTICLE IN PRESS

1Further evidence that management exercised some discretion in disclosing ICDs during the pre-Section 404

regime is provided by a Glass Lewis & Company report (Glass Lewis, 2005) that 87% of firms disclosing ICDs in

the first 3 months of 2005 certified their controls as effective under SOX 302 in the previous quarter. Some of these

occurrences were due to new GAAP guidance on application of lease accounting rules provided by the SEC in

February 2005 that managers were unaware of when they certified that controls over financial reporting wereeffective in the prior quarter (SEC, 2005). However, a large percentage of the ICD disclosures made early in the

SOX 404 regime related to more systemic control problems of long standing (e.g., inadequate recording of

inventory or improper year-end roll-up procedures) suggesting that managers had either not yet detected ICDs or

did not feel compelled to disclose these weaknesses during the SOX 302 regime.

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192 167

7/29/2019 articol3

3/27

the firm characteristics that contribute to internal control risks and the incentives faced by

managers to discover and disclose internal control problems. During this era, both

accelerated and non-accelerated filers reported material weaknesses as well as lesser

deficiencies that are not required to be disclosed under SOX 404 reporting.2 Thus, we

document the determinants of ICDs for a broad cross-section of SEC registrants.Estimating determinants of ICDs across a broad cross-section of firms is important for

developing investor expectations about internal control problems given non-accelerated

filers are not yet required to comply with SOX 404.3

Three conditions must exist for a registrant to disclose an ICD under Section 302. First,

an ICD must exist; second, the deficiency must be discovered by management or the

independent auditor; and third, management, perhaps after consultation with its

independent auditor, must conclude that the deficiency should be publicly disclosed.4

Our sample of ICD disclosers begins with 585 firms identified by Compliance Week

from November 2003 to December 31, 2004 that disclosed ICDs in any SEC filing. To

control for industry and time-specific factors, we collect parallel data on more than 4000

firms in the same industries over the same time period that did not report ICDs prior to

December 31, 2004.

We model pre-SOX 404 ICD disclosures as a function of internal control risk factors

and incentives of managers and auditors to discover and disclose ICDs. Our internal

control risk factors include the complexity and scope of firms operations, changes in firms

organizational structure, accounting measurement application risk (e.g., exposure to

accounting errors caused by difficulty or judgment in applying accounting procedures),

lack of firm resources to devote to internal control and whether the auditor resigned in

2003. We use auditor dominance, sensitivity to regulatory intervention in financialreporting due to prior restatement or SEC enforcement actions, monitoring by

institutional investors, and industry litigation risk to proxy for incentives to discover

and disclose ICDs.

As expected, ICD disclosers have more complex operations as proxied by the number of

business segments and foreign sales, and more often engage in acquisitions and

restructurings relative to non-ICD disclosure firms. The results also indicate that ICD

disclosers face greater accounting procedure application risk as firms with greater sales

growth and levels of inventory are more likely to report an ICD. We find that smaller

firms, firms reporting a higher frequency of losses and firms in financial distress are more

likely to disclose ICD weaknesses. A highly significant risk factor that explains theincidence of an ICD is the auditor resigning in the year prior to the ICD disclosure.

ARTICLE IN PRESS

2Non-accelerated filers are firms with total market capitalization less than $75 million. Non-accelerated filers

are not required to comply with the SOX Section 404 reporting provisions until fiscal years ending on or after July

15, 2007.3Prior to SOX, public firms could voluntarily assess and report on the effectiveness of internal controls, but few

firms did so. For example, McMullen et al. (1996) report that of 2221 firms listed on NAARS with December 31,

1993 fiscal year ends, only 55 contained a management statement that internal controls were effective as of fiscal

year end. Furthermore, McMullen et al. (1996) do not indicate whether any of the management reports wereaudited or reviewed by their external auditors even though auditing standards allowed such association (AICPA,

1988).4See Kinney and McDaniel (1989) for parallel arguments about disclosure of misstatements of quarterly

earnings.

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192168

7/29/2019 articol3

4/27

Regarding variables that proxy for the incentives to discover and report internal control

problems, our results indicate that firms that contract with the largest US audit suppliers,

have had negative publicity about financial reporting as evidenced by prior restatements or

sanctions from SEC Accounting and Auditing Enforcement Releases (AAERs), and that

have concentrated institutional ownership are more likely to disclose an internal controlproblem. These results are robust to using alternative measures of internal control risk and

incentives to report.

Many have claimed that the passage of SOX imposed an extreme burden on SEC

registrants by requiring them to document, evaluate, publicly report, and have audited the

effectiveness of their internal controls. Contemporaneous and concurrent research

examines different aspects of SOX in an attempt to evaluate the Acts costs and benefits

(e.g., see Ashbaugh-Skaife et al., 2006a; Beneish et al., 2006; De Franco et al., 2005; Doyle

et al., 2006b; Hammersley et al., 2005; Hogan and Wilkins, 2006; Ogneva et al., 2005;

Zhang, 2005). Our study contributes to this literature by investigating the causes of ICDs

and managements incentives to report these deficiencies during a regulatory transition

period in which there was mandated certification of disclosure controls and procedures,

but no review procedures specified for management, no internal control audit requirement,

limited guidance on classifications of severity of control deficiencies, and considerable

disclosure discretion on the part of management.

Our research is most closely related to a concurrent study by Doyle et al. (2006a) who

examine the determinants of internal control deficiencies based on a sample of firms that

disclosed material weakness control deficiencies during both the SOX 302 and 404

reporting regimes. As in our study, Doyle et al. (2006a) find ICDs are more likely for firms

that are smaller, financially weaker, more complex, growing rapidly and undergoingrestructuring.

Our study differs from the Doyle et al. (2006a) study along several dimensions. First,

Doyle et al. (2006a) restrict their analysis only to firms that report material weakness

ICDs, while we consider all three levels of internal control deficiencies as set forth by the

Public Company Accounting Oversight Board (PCAOB) in Auditing Standards (AS)

No. 2material weaknesses, significant deficiencies and control deficiencies (PCAOB,

2004).5 We include all levels of control deficiencies because regulatory guidance

defining levels of severity of control deficiencies was not released until March of 2004,

which is well after many firms provided their first disclosure of control problems. As a

result, the inter-firm consistency of these self-reported classifications of control weaknessesis problematic.6

A second distinction between our study and Doyle et al. (2006a) is that our analysis is

limited to ICDs disclosed during the SOX 302 regulatory regime. Because SOX 302

internal control disclosures are subject to less regulation and allows more management

discretion than control disclosures made during the SOX 404 audit regime, our

determinant model includes a number of variables designed to capture firms incentives

to discover and report control deficiencies variables that capture, incentives to detect and

ARTICLE IN PRESS

5

See discussion in Section 2 for distinction between these three levels of control deficiencies.6For example, a deficiency that one firm considers to be a material weakness, another firm might classify as a

significant deficiency, or vice versa. By considering all types of ICDs in our model, we avoid errors due to

inconsistencies of self-classifications that are introduced when restricting the analysis to ICDs of one classification

type.


7/29/2019 articol3

5/27

report are omitted from the Doyle et al. (2006a) study because they focus on

material weakness disclosures that they deem to be required disclosures in both the 302

and 404 reporting regimes. Moreover, by restricting their analysis to material weakness

disclosures, Doyle et al. (2006a) ignore lesser control problems that arguably have a

significant impact on the reliability of firms financial statements (Ashbaugh-Skaife et al.,2006b).

Finally, because we study disclosures made during a reporting regime that predated

SOX 404 internal control audits, our study identifies factors that contribute to internal

control problems for a broad cross-section of publicly traded firms that includes both

accelerated and non-accelerated filers. Thus, our ICD model facilitates the formation of

expectations about the determinants of ICDs that is more representative of the underlying

population of firms that face control problems because our sample cuts across firms of all

sizes in contrast to the sample in the Doyle et al. (2006a) study that contains a higher

proportion of accelerated filer (larger) firms. Later in our paper, we demonstrate how this

difference in sample composition influences the results.

The remainder of the paper proceeds as follows. Section 2 elaborates on the regulations

of SOX pertinent to reporting ICDs and introduces our conceptual framework for ICD

disclosures. Section 3 describes our sample and descriptive statistics. Section 4 presents the

multivariate analysis of the determinants of ICDs, as well as marginal effects, and

sensitivity analyses of alternative measures of explanatory variables. Section 5 presents our

summary and conclusions and identifies several avenues for future research.

2. Regulatory and conceptual background

The lack of guidance on distinguishing between levels of severity of internal control

problems prior to AS No. 2 makes firms classification and users interpretation of ICD

reporting under Section 302 somewhat difficult. AS No. 2 identifies three levels of internal

control deficiencies based on the likelihood that a material misstatement of annual or

interim financial statements might result (PCAOB, 2004). Specifically, AS No. 2 states:

A control deficiency exists when the design or operation of a control does not

allow management or employees, in the normal course of performing their

assigned functions, to prevent or detect misstatements on a timely basis (AS

No. 2, paragraph 8).

A significant deficiency is a control deficiency, or combination of control deficiencies,

that adversely affects the companys ability to initiate, authorize, record, process, or

report external financial data reliably in accordance with generally accepted

accounting principles such that there is more than a remote likelihood that a

misstatement of the companys annual or interim financial statement that is more

than inconsequential will not be prevented or detected (AS No. 2, paragraph 9).

A material weakness is a significant deficiency, or combination of significant

deficiencies, that results in more than a remote likelihood that a material

misstatement of the annual or interim financial statements will not be prevented or

detected (AS No. 2, paragraph 10).The three categories differ in the probability that a misstatement of a particular amount

might not be prevented or detected by the companys disclosure controls and procedures.

Some firms used terminology about classification of the severity of the deficiency from

ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166192170

7/29/2019 articol3

6/27

prior standards for internal control reporting,7 some used AS No. 2 terminology, and some

used neither. Despite the ambiguities, Compliance Week and other researchers have

attempted to retrofit ICD disclosures into the AS No. 2 framework for investigating

Section 302 disclosures (e.g., Hammersley et al., 2005; Doyle et al., 2006a).

Managements incentive to provide an ICD disclosure prior to a SOX 404 audit involves

trading off the expected benefits from the discovery and disclosure of an ICD and the costs

of disclosing an ICD. One of the potential costs of providing an early ICD disclosure is

that it may expose management to criticism for lax organization and mismanagement. AnICD disclosure might also cast doubt on the reliability of managements prior financial

reports including increased concern that financial restatements might result. An additional

cost of an early ICD disclosure is the potential increase in the risk of private litigation by

investors for not discovering and reporting the deficiencies earlier. On the positive side,

however, early disclosure of an ICD may allow management to get in front of the issues

(Karr, 2005), or perhaps signal that the firm does not have more serious problems such as a

material weakness or heightened likelihood of future restatements (Martinek, 2005).

Furthermore, because the SEC assesses no penalties for having a material weakness or

significant deficiency in internal control, there is no risk of regulatory sanctions for internal

control weaknesses per se. Rather, there is risk of sanctions for not disclosing knownmaterial weaknesses in internal control or changes in internal control status.

A conceptual model of the existence, detection and reporting of internal control

deficiencies before SOX 404 audits is presented in Fig. 1. We model the existence of

internal control deficiencies as a function of a number of internal control risk factors and

the detection and reporting as a function of audit quality and the incentives that

management and its auditor have for early reporting of internal control problems.

Although we classify the determinants of ICD disclosure into the two broad categories of

ARTICLE IN PRESS

ICD risk exposuresComplexity and scope of operations

Organizational change

Accounting application riskInternal control resources

ICD existence

ICD discover and disclose incentivesAuditor technology and scrutiny

Regulator intervention threats

Investor intervention threats

Litigation risk

ICD detection

+

=

Pre-SOX 404 audit

ICD Disclosure

Fig. 1. Conceptual model of pre-SOX mandated audit disclosure of internal control deficiencies (ICDs).

7Many Section 302 certifications from 2003 and early 2004 refer to reportable conditions, a term from

AICPA auditing and attest standards guidance that predates SOX ( AICPA, 1988, 2001). AS No. 2 also specifiesnew uncertainty terminology such as a remote likelihood to characterize the likelihood of material misstatement

required to make an ICD a material weakness whereas prior guidance used a relatively low level [of] risk

(AICPA, 1988). The possible differences in management and auditor implementation due solely to the 2004

changes in guidance led us to combine all ICD disclosures.


7/29/2019 articol3

7/27

IC risk exposures and ICD discovery and disclosure incentives, we recognize that several of

the variables we use could proxy for both risk effects and incentive effects. We highlight

this potential dual role for several explanatory variables below.

The IC risk factors include the complexity and scope of firms operations, changes in

organizational structure, accounting measurement application risk, and firm resources(or lack thereof) invested in internal controls. We posit that firms with greater complexity

and scope of operations are more likely to encounter internal control problems. The

complexity of firm operations, and consequently, the intricacy of its transactions increase

as the firm operates in diverse industries or in international markets. The more

complicated the firms transactions, the more difficult to structure adequate internal

controls. In addition, multi-segment firms potentially face more internal control problems

related to the preparation of consolidated reports (e.g., the proper elimination of intra-

company transactions). Moreover, the more diverse and multifaceted a firms operations

the greater the chance there will be breaches in the year-end closing and roll up procedures.

We use SEGMENTS, defined as the number of reported business segments in 2003, and

FOREIGN_SALES, coded one if a firm reports foreign sales in 2003 and zero otherwise,

to proxy for the complexity and scope of operations. Both SEGMENTS and

FOREIGN_SALES are identified using the Compustat Segment file.

We conjecture that firms are more likely to have ICDs when they have recently changed

organization structure either through mergers or acquisitions or through restructurings.

Acquiring firms face significant internal control challenges when integrating their

operations, systems, and cultures with those of acquired firms. Furthermore, failure to

develop adequate controls over accounting for acquired assets can increase internal control

risk for acquiring firms. Firms participating in down-sizing and restructurings are likely toface greater internal control risk due to personnel problems related to the segregation of

duties, inadequate staffing and supervision problems. We use M&A and RESTRUC-

TURE to proxy for recent changes in organizational structure. M&A is coded one if the

firm has been involved in a merger or acquisition from 2001 to 2003 (Compustat

AFTNT1), and zero otherwise. RESTRUCTURE is coded one if a firm has been involved

in a restructuring from 2001 to 2003 and zero otherwise, where non-zero values of

Compustat data items 376, 377, 378 or 379 are used to identify sample firms engaged in

restructurings. We expect a positive relation between firms ICD disclosures and M&A and

RESTRUCTURE.

We use GROWTH, defined as the average percentage change in sales (Compustat #12),and INVENTORY, defined as inventory (Compustat #3) as a percentage of total assets

(Compustat #6), to capture firms operating characteristics that are likely to expose them

to greater accounting measurement application risks (Kinney and McDaniel, 1989).

Rapidly growing firms are more likely to have systems that fail to keep pace with increases

in customer demand or entry into new markets. Furthermore, growing firms are more

likely to encounter staffing issues as the scope and complexity of their operations expand.

Firms with more inventory face increased internal control risks related to the proper

measurement and recording of inventory, misreporting due to theft, and timely recognition

of inventory obsolescence.

Information and control systems have a large fixed cost component and are costly toinstall and maintain. Conditional on their resources, firms will make differential

investments in information and control systems. We reason that smaller firms have less

to invest in sophisticated information systems (e.g., enterprise resource planning systems


7/29/2019 articol3

8/27

such as SAP) that can enhance internal control, and they are less likely to have adequate

personnel and expertise to maintain these systems. We use SIZE, as measured by the

market value of equity (Compustat #199*Compustat #25), to proxy for firms investment

in information systems and internal control, where smaller firms are expected to have

weaker internal controls (DeFond and Jiambalvo, 1991). Following the work of Wrightand Wright (1996) who find a negative association between firm size and accounting errors,

we predict a negative relation between SIZE and ICD disclosures.

We use two additional variables to capture the impact of low investment in information

and control systems on the likelihood of ICDs. We posit that poorly performing firms and

firms in financial distress are more likely to under invest in systems and controls and have

staffing problems that lead to IC weaknesses. We use %LOSS, defined as the proportion of

years from 2001 to 2003 that the firm reported negative earnings (Compustat #118), to

proxy for poor performance. Firms with a greater frequency of losses are expected to

exhibit a higher likelihood of an ICD due to lack of investment in internal controls

(Krishnan, 2005). We use the Altman z-score, ZSCORE, to capture distress risk with

higher z-scores indicating less distress risk (Altman, 1968).8 We predict a positive

coefficient on %LOSS and a negative coefficient on ZSCORE.

The resignation of the auditor in the year prior to an ICD disclosure is viewed as another

ICD risk factor. An auditor will resign from an audit engagement when the expected costs

of being associated with an audit client exceed anticipated revenues. This might occur

when the auditor believes that a clients internal controls are excessively weak and that

adequate client resources are not available to remedy the problem.9 We use Audit

Analytics to identify firms in both the ICD sample and the control sample that switched

auditors during the 12-month period beginning in the fourth month after the close of fiscalyear 2002 through the third month after the close of fiscal year 2003.10 We collect the 8-K

filings for sample firms that changed auditors and code AUDITOR_RESIGN as one for

firms that state their auditor resigned during this 12-month period, and zero otherwise. We

predict a positive relation between ICD and AUDITOR_RESIGN as an auditor

resignation may indicate unacceptable audit engagement risk due to weak operating

performance and financial distress that reflects inadequate investment in internal control.11

ARTICLE IN PRESS

8Prior and concurrent research often times uses accounting-based performance metrics such as return-on-equity

(ROE) or return-on-assets (ROA) as a proxy for the resources available to invest in internal control systems.While useful in assessing firm performance, we elect not to use ROE or ROA as a determinant in our ICD

disclosure model because using these measures implicitly assumes a monotonically increasing investment in

internal control as performance improves. As stated above, much of the investment in internal control is fixed, and

as such, we argue %LOSS and ZSCORE are better indicators of lack of investment in IC.9An auditors decision to resign from an engagement is complex and may result from various causes (Shu,

2000). For example, auditor resignation may reflect the auditors belief that client management lacks integrity and

may commit fraud by overriding internal controls. Alternatively, the auditor may believe that it can earn higher

returns with other clients and therefore resigns from the audit. Auditor resignation due to the latter reason

introduces noise in this explanatory variable.10We allow for a 3-month window after fiscal year-end because most auditor changes occur after the fiscal year-

end closing date but before the annual shareholder meeting (typically held in the fourth month after fiscal year-

end) at which time a proxy vote for appointment of the external auditor takes place.11Firms changing auditors have long been required to disclose any internal control problems identified by

predecessor auditors (AICPA, 1988; SEC, 1988; Whisenant et al., 2003). In the sensitivity section of the paper, we

report the results of our ICD determinant model after deleting the 12 ICD firms that disclosed an internal control

deficiency in conjunction with reporting a change in their external auditor.


7/29/2019 articol3

9/27

Fig. 1 also models the factors that contribute to the detection and reporting of an ICD.

We use auditor dominance, regulatory oversight in financial reporting due to prior

restatement or SEC enforcement actions, monitoring by institutional investors, and

industry litigation risk to proxy for incentives to discover and disclose ICDs.

The quality of the external auditor is one factor that contributes to the detection of anICD even in the era prior to mandated audits of internal control under Section 404. This is

because detection of an ICD by the auditor is a function of its strategy and scrutiny in

conducting financial statement audits and the quality of any optional audit technology that

might be used in evaluating internal control as part of the financial statement audit.

We expect dominant audit suppliers to be more likely to uncover, as well as to require

management disclosure of any known ICD for several reasons. First, dominant audit

suppliers are likely to provide higher quality financial statement audits that include more

systematic examination and review of internal controls relative to other audit suppliers

because dominant audit suppliers face greater loss of reputation by conducting poor

quality audits (DeAngelo, 1981; Shu, 2000). Second, dominant audit suppliers invest more

in technology and training that facilitates the discovery of internal control problems.

Third, based on Dyes (1993) work that links audit quality to auditor wealth, dominant

audit suppliers hold greater litigation risk and thus face greater incentives to require ICD

disclosure in order to avoid costly lawsuits.

We classify BDO Seidman, Deloitte and Touche, Ernst and Young, Grant Thornton,

KPMG, and PricewaterhouseCoopers as the dominant audit suppliers. We include BDO

Seidman and Grant Thornton in the dominant auditor classification because these two

firms acquired a significant number of SEC reporting clients following the demise of

Arthur Andersen, which results in these firms facing additional litigation risk related toICD reporting.12 AUDITOR is coded one for firms that contract with a dominant audit

supplier, and zero otherwise. We predict a positive relation between AUDITOR and ICD

disclosures.

Fig. 1 also links managers incentives to discover and report internal control problems

with the likelihood of an ICD disclosure. In general, management faces greater incentives

to discover and report internal control weaknesses when the firm is subject to greater

monitoring by stakeholders and when those stakeholders have greater incentives to initiate

litigation if the firms financial reporting process is deemed to be deficient. We use three

variables to capture managers incentives to discover and report ICDs prior to SOX 404

auditseither prior restatements or an SEC AAER, concentrated institutional ownership,and industry litigation risk.

RESTATEMENT is coded one if the firm restated its financial statements or was the

object of an AAER from 2001 to 2003, and zero otherwise.13 We view RESTATEMENT

ARTICLE IN PRESS

12In the sensitivity section of the paper we report the results when classifying Deloitte and Touche, Ernst and

Young, KPMG, and PricewaterhouseCoopers as the dominant audit suppliers.13Restatements announced by public companies from January 1, 2001 to December 31, 2003 are identified from

various sources using the procedure outlined in Kinney et al. (2004), and the population of AAERs released by the

SEC during the same time period comprises the AAER component of RESTATEMENT. Specifically,

restatements are identified from public sources by searching the Lexis-Nexis News and Form 8-K library files,the Securities Class Action Alert, and various business journals such as the Wall Street Journal, New York Times,

Washington Post, and Los Angeles Times. The key word search used restat, revis, adjust, and error, and

phrases such as responding to guidance from the SEC. Our AAER search identified specific issuers that were

the subject of the release.


7/29/2019 articol3

10/27

as a proxy for managers incentives to discover and report ICDs because we posit that

firms are more likely to be forthcoming about control problems when the quality of their

financial statements has been questioned by market regulators or auditors in the past.14

Prior research suggests that firms suffer, on average, a 25% decline in stock price when

earnings restatements are announced (Richardson et al., 2003). Thus, the market imposes aheavy penalty on firms that restate earnings. We expect that management of firms that

have incurred such penalties in the recent past will have strong incentives to avoid

incurring these penalties in the near future and, therefore, will be particularly diligent

about discovering and reporting ICDs to reduce the risk of another restatement or AAER.

Accordingly, we predict a positive relation between RESTATEMENT and ICD

disclosures.15

We also posit that managers of firms with more concentrated ownership face greater

incentives to discover and disclose ICDs due to increased monitoring and greater litigation

threats from concentrated owners. Prior research suggests that institutional owners that

hold large blocks of shares have both the incentives to monitor management and they have

the voting power to bring pressure to bear on management to effect change when control

problems surface (Jensen, 1993; Shleifer and Vishny, 1997). We use INST_CON, measured

as the percentage of shares held by institutions divided by the number of institutions that

own a firms stock (Compact D), as our measure of concentrated institutional ownership.

We predict a positive relation between INST_CON and ICD disclosures.

The last variable used to proxy for managers incentives to discover and disclose ICDs is

LITIGATION, which is coded one if a firm operates in a litigious industry and zero

otherwise.16 Managers of firms facing greater risk of lawsuits have greater incentives to

disclose the adverse news of an IC problem to minimize potential share price declines thatcan trigger shareholder litigation. The LITIGATION variable could also serve as a proxy

for IC risk if industries are subject to litigation because there is significant reporting

control risk. For either reason, we expect a positive relation between LITIGATION and

ICD disclosures.

In summary, we posit that the disclosure of an ICD prior to a SOX 404 audit is a joint

function of firm-specific economic attributes that expose firms to internal control risks and

the incentives of firms management and external auditors to discover and disclose internal

ARTICLE IN PRESS

14One might conjecture that restatements are primarily due to internal control problems. However, for our

Section 302 ICD sample firms with restatements, only 12% mention internal control problems as the primaryrestatement cause, while 15%, 27%, and 12%, respectively, mention management fraud, judgment error, and

GAAP interpretation different from the SECs, with 34% silent about cause.15RESTATEMENT might also be viewed as an internal control risk proxy. But the predicted relation between

RESTATEMENT and ICD is ambiguous in this case. On the one hand, firms with prior restatements may exhibit

lower incidence of ICDs in the future because they have improved their accounting processes in order to avoid the

negative market consequences of reporting another restatement, making it less likely that ICDs will exist (and be

reported) going forward. On the other hand, one could argue that firms with prior restatements are more likely to

have additional internal control problems that will resurface in the future, leading to a predicted positive relation

between RESTATEMENT and ICD. Thus, if RESTATEMENT serves as an internal control risk proxy, its

predicted relation with an ICD disclosure is indeterminate. Based on extant guidance and analysis of stated

reasons for prior restatements noted in footnote 15, we conclude that our samples restatements more likely proxy

for incentives to report than internal control risk. However, we acknowledge that the significance of this variablemay reflect both internal control risk effects and incentive to discovery and report effects.

16Consistent with Francis et al. (1994) firms with primary SIC codes of 28332836 (biotechnology), 35703577

(computer equipment), 36003674 (electronics), 52005961 (retailing), and 73707374 (computer services) are

coded one, and zero otherwise.


7/29/2019 articol3

11/27

control problems. The variables used to capture the determinants of pre-404 ICD

disclosures are summarized in Table 1.

3. Sample and descriptive statistics

3.1. Sample

Our initial sample of firms providing disclosure of ICDs is obtained from monthly

compilations of SEC filings reported in Compliance Week, a weekly electronic newsletter

ARTICLE IN PRESS

Table 1

Variable definitions

Variables Predicted

sign

Definitions and data source

IC risk attributes

SEGMENTS + Number of reported business segments in 2003 (Compustat

Segment file).

FOREIGN_SALES + Coded one if a firm reports foreign sales in 2003, and zero

otherwise (Compustat Segment file).

M&A + Coded one if a firm is involved in a merger or acquisition from

2001 to 2003, and zero otherwise (Compustat AFNT #1).

RESTRUCTURE + Coded one if a firm was involved in a restructuring from 2001 to

2003, and zero otherwise. This variable is coded one if any of the

following Compustat data items are non-zero: 376, 377, 378 or

379.

GROWTH + Average growth rate in sales from 2001 to 2003 (Percent change

in Compustat #12).

INVENTORY + Average inventory to total assets from 2001 to 2003 (Compustat

#3/#6).

SIZE Average market value of equity from 2001 to 2003 in $ billions

(Compustat #199 * #25).

%LOSS + Proportion of years from 2001 to 2003 that a firm reports

negative earnings.

RZSCORE Decile rank of Altman (1980) z-score measure of distress risk.

AUDITOR_RESIGN + Coded 1 if auditor resigned from the client during the 12-month

period beginning in the fourth month after the close of fiscal year

2002 through the third month after the close of fiscal year 2003,zero otherwise (Audit Analytics and 8-K filings).

Proxies for incentives to discover and disclose

AUDITOR + Coded one if a firm engaged one of the largest six audit firms for

2003, and zero otherwise (Compustat). Largest six audit firms

include PWC, Deloitte & Touche, Ernst and Young, KPMG,

Grant Thornton and BDO Seidman.

RESTATEMENT + Coded one if a firm had a restatement or an SEC AAER from

2001 to 2003 and zero otherwise.

INST_CON + Percentage of shares held by institutional investors divided by the

number of institutions that own the stock as of December 31,

2003 (Compact D).LITIGATION + Coded one if a firm was in a litigious industrySIC codes

28332836; 35703577; 36003674; 52005961; and 7370, and

zero otherwise.


7/29/2019 articol3

12/27

published by Bostons Financial Media Holdings Group. The sample period spans filings

made from November 2003 to December 2004 and includes 585 separate disclosures made

by 538 firms.17 Additional data requirements to estimate the multivariate logit model

(described more fully below) reduced the final sample to 326 firms as detailed in Table 2.

Henceforth, we refer to this group of firms as the ICD sample. All remaining firms on the

Compustat Annual Industrial Full Coverage and Research files not identified as providing

a disclosure of ICD prior to December 31, 2004 and with the required data for estimating

our model of ICD reporting comprise our control sample of 4484 firms.18

3.2. Descriptive statistics and univariate results

Panel A of Table 3 presents descriptive statistics and the results of univariate tests that

statistically assess the comparisons between the ICD and control samples. Summary

statistics for the continuous variables, which represent the average value calculated over

the 3 years prior to the filing of the ICD report (i.e., from 2001 to 2003), include the mean,

standard deviation (std. dev.), first quartile, third quartile, and median. The mean values

reported for the categorical variables show the proportion of treatment or control firms

that possess the indicated characteristic.

With few exceptions, the descriptive statistics in Table 3 support our predictions about

the determinants of ICD disclosures. For the ICD risk attributes, we find that firms

reporting control deficiencies have more segments and are more likely to have foreign

sales, be involved in mergers and acquisitions, and engage in restructurings. For

GROWTH and INVENTORY, the two variables that proxy for accounting measurement

application risk, we find significantly higher median values for both variables for the ICD

firms relative to control firms as predicted. The univariate results on SIZE as a proxy for

ARTICLE IN PRESS

Table 2

Sample selection criteria

Number of firms disclosing internal control deficiencies 11-03 through 12-04a 585

Elimination of duplicate firms (47)

Elimination of firms from financial services and utilities industries (16)

Firms not covered by Compustat (73)

Firms with insufficient Compustat data (108)

Firms with insufficient return/price data (15)

Internal control deficiency (ICD) sample 326

Control sampleb 4484

aSource: Compliance week.bAll firms having the necessary data on Compustat and CRSP to estimate the ICD disclosure model.

17Through the end of 2004, Compliance Week identified ICD firms by filtering all SEC filings of all registrants

for the key words that would indicate an internal control deficiency. We read the ICD firms SEC filings over

20012004 to determine the date of the first public disclosure of an ICD. These filings include forms 10-K, 10-Q,

8-K, S-3, S-4 and proxy statements. We find that all firms identified by Compliance Week as having an internal

control problem did disclose an ICD in a SEC filing, but approximately 39% of the firms disclosed an ICD in anearlier SEC filing than the one reported in Compliance Week. Beginning January 1, 2005, Compliance Week filters

only the SEC filings of firms comprising the Russell 3000, suggesting that samples drawn from Compliance Week

after December 31, 2004 are not representative of the US equity market.18Accelerated filers comprise 59.8% of our ICD sample and 52.9% of our control sample.


7/29/2019 articol3

13/27

investment in internal controls are mixed; the average size of the ICD sample ($.885

billion) is slightly smaller than the control sample ($1.164 billion), while the median size of

the ICD firms ($.140 billion) is significantly larger than the control firms ($0.091 billion).

Turning to the three other variables used to proxy for firms investment in internal controls

(%LOSS, ZSCORE and AUDITOR_RESIGN), the descriptive statistics indicate thatICD firms have a higher incidence of losses and more often have their auditors resign from

the engagement. The descriptive statistics on ZSCORE show that this variable is highly

negatively skewed. Accordingly, we focus on median tests that suggest there is no

difference in bankruptcy risk between ICD and control firms.

The univariate tests also suggest significant differences between the ICD firms and

control firms ability to detect IC weaknesses and incentives to disclose ICDs. A higher

proportion of firms in the ICD sample are audited by a dominant audit firm, are more

likely to have restated earnings or have SEC AAERs sometime during the period from

2001 to 2003, and have a higher concentration of institutional shareholders. There is,

however, no significant difference in the proportion of ICD firms versus control firms that

operate in litigious industries.

We present pair-wise correlations in Panel B of Table 3, where the upper right-hand

portion of the table presents Pearson productmoment correlations and the lower left-

hand portion presents the Spearman rankorder correlations. We discuss the Pearson

correlations, but note that the patterns of the two correlations are quite similar. The largest

correlations are a significant positive correlation of 0.372 between ZSCORE and

AUDITOR, followed by a significant positive correlation of 0.307 between RESTRUC-

TURE and AUDITOR. The vast majority of other correlations fall between 70.20, which

suggests that the variables included in our determinant model capture distinct features offirms internal control risks and incentives to report.

Overall, the descriptive statistics suggest that firms disclosing ICDs prior to SOX 404

audits face greater operating and reporting risks relative to non-ICD firms. In the next

section we conduct more formal tests of our hypotheses using multivariate logistic

regression.

4. Multivariate analysis of ICD disclosure

We use the following logistic regression model to assess the extent to which internal

control risk attributes and incentives to discover and early report internal control problems

are associated with firms ICD disclosures:

ICD_DISCLOSURE

b0 b1 SEGMENTS b2 FOREIGN_SALES

b3 M&A b4 RESTRUCTURE b5RGROWTH

b6 INVENTORY b7 SIZE b8 %LOSS b9RZSCORE

b10AUDITOR_RESIGN b11 AUDITOR

b12 RESTATEMENT b13 INST_CON

b14 LITIGATION e, 1

where ICD_DISCLOSURE is coded one for ICD firms and zero for control firms. We

transform GROWTH to be the decile rank of the average sales growth from 2001 to 2003


7/29/2019 articol3

14/27

Table 3

Descriptive statistics on the determinants of internal control deficiency disclosures

Mean Std. dev. Q1

Panel A: Distributional properties of independent variables

IC risk attributes

SEGMENTS

ICD sample 2.150*** 1.547 1.000 Control sample 1.945 1.461 1.000

FOREIGN_SALES

ICD sample 0.715***

Control sample 0.636

M&A

ICD sample 0.420***


RESTRUCTURE

ICD sample 0.485***


GROWTH

ICD sample 0.206 0.606 0.049 Control sample 0.181 0.642 0.069

INVENTORY

ICD sample 0.127* 0.137 0.008

Control sample 0.115 0.137 0.001

SIZE

ICD sample 0.885* 3.113 0.028


%LOSS

ICD sample 0.581*** 0.399 0.333


ZSCORE

ICD sample 1.827** 15.167 0.476

Control sample 3.377 20.506 0.327

AUDITOR_RESIGN

ICD sample 0.058***



AUDITOR1

ICD sample 0.847***

7/29/2019 articol3

15/27

Table 3 (continued)

Mean Std. dev. Q1


RESTATEMENT

ICD sample 0.156***


INST_CON

ICD sample 0.009*** 0.010 0.003


LITIGATION

ICD sample 0.273


A B C D E F G H I

Panel B: Correlations

SEGMENTS2 A 0.221 0.122 0.186 0.069 0.009 0.270 0.215 0.136 0

FOREIGN_SALES B 0.230 0.044 0.252 0.152 0.099 0.154 0.217 0.186 0

M&A C 0.129 0.044 0.118 0.111 0.138 0.076 0.072 0.024 0

RESTRUCTURE D 0.187 0.252 0.118 0.143 0.033 0.159 0.035 0.137 0

GROWTH E 0.027 0.097 0.200 0.177 0.107 0.031 0.105 0.058 0

INVENTORY F 0.116 0.169 0.113 0.201 0.078 0.051 0.194 0.139 0

SIZE G 0.270 0.271 0.238 0.315 0.188 0.019 0.221 0.077 0

%LOSS H 0.214 0.219 0.071 0.033 0.154 0.241 0.432 0.295 0

ZSCORE I 0.138 0.202 0.018 0.014 0.039 0.327 0.362 0.603 0

AUDITOR_RESIGN J 0.011 0.014 0.015 0.004 0.009 0.008 0.067 0.062 0.065

RESTATEMENT K 0.029 0.033 0.015 0.078 0.002 0.014 0.054 0.027 0.018 0

AUDITOR L 0.165 0.235 0.094 0.307 0.017 0.040 0.584 0.259 0.326 0

INST_CON M 0.072 0.187 0.017 0.154 0.034 0.120 0.132 0.122 0.285 0

LITIGATION N 0.143 0.034 0.035 0.010 0.017 0.088 0.053 0.107 0.024 0

***, **, *Indicates significance at the 0.01, 0.05, and 0.10 level or better, respectively, based on t-statistic for difference in m

in medians. There are 326 firms in the ICD sample and 4484 firms in the Control sample. All continuous variables have

values. See Table 1 for variable definitions.1In Table 6, we report the results of a sensitivity analysis where we set auditor equal to one if the firm uses one of the

Touche, Ernst and Young and KPMG) and zero otherwise. The proportion of ICD (Control) firms that use Big Four aud

ICD sample firms use BDO Seidman or Grant Thortnon and 7.6% of the control firms use these two auditors (these pr2The upper right-hand portion of the table presents Pearson productmoment correlations and the lower left-hand p

correlations. Bold text indicates significance at the 0.01 level or better. n 4810. See Table 1 for variable definitions.

7/29/2019 articol3

16/27

(RGROWTH) because we expect the relation between growth and ICDs to be ordinal

rather than cardinal.19 We also convert ZSCORE to decile ranks (RZSCORE) because of

the documented skewness in the distribution of ZSCORE (see Panel A of Table 3).

Model 1 of Table 4 displays the results of estimating Eq. (1) using only the variables

classified as IC risk attributes, which serves as a benchmark for assessing the incrementaleffect of reporting incentives on the likelihood of firms disclosing ICDs. All of the

estimated coefficients on the internal control risk attributes have the expected sign and are

significant at conventional levels with the exception of RZSCORE, which has the predicted

sign but is insignificant. We find that firms with more complex operations as reflected in the

number of business segments and being engaged in foreign operations, as captured by

FOREIGN_SALES, hold greater internal control risk than firms that only operate in

domestic markets. The results document that firms engaged in organizational change via

participation in a M&A or restructuring face greater internal control risk and are more

likely to report an ICD. In addition, we find that firms with higher sales growth and firms

with relatively larger inventory holdings are more likely to have problems with their

internal controls and are thus more likely to report ICDs. After controlling for the scope

and complexity of operations, we find that smaller firms and firms with a higher incidence

of losses are more likely to report ICDs consistent with our conjecture that smaller, less

profitable firms make fewer investments in sophisticated information and operating

systems. We also find that the resignation of the auditor is positively related to an ICD

disclosure supporting the notion that an auditor resignation may indicate unacceptable

audit engagement risk due to weak operating performance and financial distress that

reflects inadequate investment in internal control. The benchmark model yields a

Likelihood ratio w

2

of 98.31, which is significant at the 0.01 level or better.Model 2 of Table 4 displays the logit results incorporating the variables that we use to

proxy for the incentives to discover and disclose an ICD. The coefficients on the internal

control risk attribute variables are significant with the predicted signs, including

RZSCORE, after the addition of the variables that proxy for reporting incentives. After

controlling for internal control risk attributes, we document that firms that contract with a

dominant auditor supplier are more likely to make an ICD disclosure. This finding

suggests that the quality of the external audit has an impact on the detection and reporting

of a firms internal control problems. We also find that firms that face more reporting risk

because they have previously disappointed the market with low quality financial

information, as proxied by having to restate their financial statements or being involvedin a SEC AAER action during the 20012003 period, are more likely to disclose an ICD.

Consistent with our prediction, we find that firms with greater concentrated institutional

ownership are more likely to voluntarily report ICDs during the SOX 302 reporting

regime. Finally, contrary to expectations, we fail to find that firms operating in litigious

industries are more likely to report ICDs.

The expanded model is highly significant with a Likelihood ratio w2 of 137.69. The Wald

w2 of 41.96 (significant at 0.01) indicates that the addition of the incentives to discover and

disclose variables, as a group, add significant incremental explanatory power to the model

based only on internal control risk attributes. Overall, the results of the logistic regression

support the hypothesis that the early disclosure of ICDs is a joint function of firm-specific

ARTICLE IN PRESS

19In the sensitivity analysis section of the paper, we present results when coding GROWTH as a continuous

variable.


7/29/2019 articol3

17/27

ARTICLE IN PRESS

Table 4

Logistic regression of the determinants of internal control deficiency disclosures

ICD_DISCLOSURE b0 b1 SEGMENTS b2 FOREIGN_SALES

b3 M&A b4 RESTRUCTURE b5RGROWTH b6 INVENTORY b7 SIZE

b8 %LOSS b9RZSCORE b10AUDITOR_RESIGN b11 AUDITOR

b12 RESTATEMENT b13 INST_CON b14 LITIGATION e,

Predicted sign Estimated coefficients

Model 1 Model 2

Intercept 7 3.996 4.379

(199.26)*** (202.55)***

IC risk attributes

SEGMENTS + 0.087 0.074

(4.606)** (3.243)**

FOREIGN_SALES + 0.361 0.278

(6.757)*** (3.968)**

M&A + 0.402 0.416

(10.314)*** (10.78)***

RESTRUCTURE + 0.417 0.249

(10.910)*** (3.579)**

RGROWTH + 0.059 0.060

(7.581)*** (7.262)***

INVENTORY + 1.163 1.346

(6.943)*** (8.774)***

SIZE 0.036 0.032(3.081)** (2.425)*

%LOSS + 0.475 0.502

(6.702)*** (7.229)***

RZSCORE 0.015 0.037

(0.304) (1.701)*

AUDITOR_RESIGN + 2.008 2.024

(45.912)*** (43.619)***


AUDITOR + 0.565

(9.681)***

RESTATEMENT + 0.839

(23.964)***INST_CON + 10.260

(3.176)**

LITIGATION + 0.136

(0.996)

Likelihood ratio, w2 98.31*** 137.69***

Wald, w2 103.95*** 41.96***

Sample size 4810 4810

ICD_DISCLOSURE is coded one for firms that file an internal control deficiency report ( n 326) and zero

otherwise (n 4484). RGROWTH is the decile rank of GROWTH, where GROWTH and other variables are

defined in Table 1. Wald w2 values in parentheses. ***Indicates significance at the 0.01 level or better, **Indicates

significance at the 0.05 level or better, *Indicates significance at 0.10 level or better.


7/29/2019 articol3

18/27

economic attributes that expose firms to internal control risks and the incentives of firms

management and external auditors to provide early warning of internal control problems.

4.1. Marginal analysis

In order to provide some insight into what factors are most important in determining the

likelihood that a firm will disclose an ICD, we calculate the change in probability of a firm

disclosing an ICD as a result of changing the levels of various explanatory variables in

Eq. (1). The change in probability is calculated using the following steps. First, we

calculate the probability of a firm disclosing an ICD from our logitistic regression model

using the following expression:

pX eb0X=1 eb

0X, (2)

where b is the vector of coefficients from Model 2 in Table 4 and X is the vector of

independent variables set equal to their mean values across the sample of all firms.

Conditional on the mean values of the independent variables, the likelihood of reporting

an ICD is 4.9%. Next, we calculate the marginal changes in the probability of a firm

reporting an ICD for a one standardized unit increase in each explanatory variable while

holding the other independent variables at their mean values.20 Each marginal effect is

measured by qpX=qxi bipX1 pX calculated at the mean value of the regressors.These marginal effects are reported in column 3 of Table 5. Among the IC risk factors,

the variables with the greatest marginal effects are AUDITOR_RESIGN (0.227), and

%LOSS (0.210) and M&A (0.193). For incentives to discover and report, AUDITOR

(0.268) and RESTATEMENT (0.201) have the greatest marginal impact.

An alternative way of assessing the effect of various IC risk factors and incentives to

discover and report an ICD is to calculate the values of the logit function, p(X), at selected

xi values such as their lower and upper quartiles (Agresti, 2002, p. 167). This entails

substituting the quartile values for each xi explanatory variable into Eq. (1) while holding

the other variables constant at their means. The linear approximation to changes in p(X)

is obtained by multiplying the interquartile range of xi values (see Table 3 for the

interquartile ranges) by the marginal effects based on the unstandardized value of

the variables (Agresti, 2002, Chapter 5). These values are reported in the last column of

Table 5.We first calculate the probability of disclosing an ICD for a hypothetical firm that takes

on the lower (upper) quartile values of determinants of an ICD disclosure for variables

that are positively (negatively) related to ICDs.21 This yields a probability of disclosing an

ICD of about 1.2%. We next repeat this process but now use upper (lower) quartile values

of explanatory variables that are positively (negatively) related to the incidence of an ICD.

This yields a probability of an ICD of 77.9% with AUDIT_RESIGN accounting for

nearly 35%. Leaving AUDIT_RESIGN out of the model lowers the probability of an ICD

to 31.7%. Thus, the probability of reporting an ICD is dramatically higher when a firm

ARTICLE IN PRESS

20

We use standardized values because the various explanatory variables are measured in different units.Without standardization the marginal probabilities are difficult to compare and interpret ( Agresti, 2002, Chapter

5).21For attributes measured as a binary variable, the benchmark probability is determined with the zero (one)

value when the attribute is positively (negatively) related to reporting an ICD.


7/29/2019 articol3

19/27

takes on upper quartile values of the IC risk attributes and factors that are associated with

the incentives to discover and report ICDs.22

4.2. Sensitivity analysis

The validity of the inferences drawn from our model of ICD disclosure is conditional onthe quality of the variables that we use to proxy for IC risk attributes and incentives to

discover and disclose ICDs. In this sub-section, we assess the robustness of our results to

alternative measures of IC risk and other proxies for incentives to discover and disclose

ICDs.

The first sensitivity test that we conduct relates to our proxy for audit quality,

AUDITOR. As stated earlier, we consider BDO Seidman and Grant Thornton to be

dominant audit suppliers in the US audit market during our analysis period because these

two firms gained more SEC reporting clients and held a larger US audit market share after

ARTICLE IN PRESS

Table 5

Assessment of changes in probabilities of firm disclosing an ICD for selected changes in independent variables

Variables Predicted sign Marginal effect Change in probability

Standardized variables Q1 vs. Q3 values

IC risk attributes

SEGMENTS + 0.108 0.025

FOREIGN_SALES + 0.131 0.048

M&A + 0.193 0.072

RESTRUCTURE + 0.117 0.043

RGROWTH + 0.169 0.010

INVENTORY + 0.180 0.042

SIZE 0.113 0.003

%LOSS + 0.210 0.087

RZSCORE 0.120 0.032

AUDITOR_RESIGN + 0.227 0.349


AUDITOR + 0.268 0.097

RESTATEMENT + 0.201 0.145

INST_CON + 0.087 0.313

LITIGATION + 0.066 0.023

The Marginal Effects column shows the change in probability of a firm disclosing an ICD due to a one unit

change in the variable of interest after standardizing the independent variables. Marginal effects are computed as:

pX eb0 X=1 eb

0X where b0X is evaluated at the mean values of X. Tabled values in the Change in

Probability column show the change in the probability of a firm disclosing an ICD as a result of moving from the

first to the third quartile value of the variable of interest, holding all other variables constant at their mean values.

RGROWTH is the decile rank of GROWTH and LOGSIZE is the natural log of SIZE, where GROWTH and

SIZE, as well as other variables are defined in Table 1.

22

We hasten to note that this illustration does not reflect the typical firm in our sample because any given firmwill likely not start from a position of having low IC risk factors or incentives to report (1Q or zero value for

dummy variables) along all of the multiple dimensions we consider. Nor is it likely that any given firm would be

able to move to a position of having high IC risk factors and incentives to report along all dimensions (3Q or one

for dummy variables).


7/29/2019 articol3

20/27

the demise of Arthur Andersen. An additional partitioning of audit firm dominance based

on historical market share considers Deloitte, Ernst and Young, KPMG, and

PricewaterhouseCoopers to be the dominant audit suppliers as these four firms, along

with Arthur Andersen, audited the vast majority of SEC reporting firms since 1995. Model

1 of Table 6 reports the results of our ICD disclosure determinant model adding anadditional indicator variable, AUDITOR(BIGFOUR), that is set equal to one if the firm

contracts with Deloitte, Ernst and Young, KPMG, and PricewaterhouseCoopers and zero

otherwise. With AUDITOR(BIGFOUR) in the model, the coefficient on AUDITOR picks

up the marginal likelihood of a client of BDO Seidman or Grant Thornton reporting an

ICD. Interestingly, the coefficient on AUDITOR(BIGFOUR) is negative and significant

at a 0:10, while the coefficient on AUDITOR is positive and highly significant.23 Oneinterpretation of these results is that BDO Seidman and Grant Thornton audit clients with

greater internal control risk. Alternatively, the results suggest that BDO Seidman and

Grant Thornton, in building their reputation with SEC clients, exercise more diligence in

identifying internal control problems. The signs and significance of the coefficients on the

remaining variables are similar to those of Model 2 reported in Table 4 with the exception

that the coefficient on RZSCORE, which becomes insignificant.

Our second set of sensitivity tests uses alternative measures of firm growth and litigation

risk. Model 2 column of Table 6 displays the results of estimating Eq. (1) using a

continuous measure of growth (SALESGRWTH), where SALESGRWTH is defined as

the 3-year average sales growth over 20012003. The coefficient on SALESGRWTH is

marginally significant as compared to the highly significant coefficient on the rank growth

measure (RGROWTH) in Table 4. Using this measure of growth does not change

inferences drawn about other variables in the model.In Model 3 of Table 6, we replace LITIGATION, a categorical variable capturing high

litigation risk industries, with SHU_LIT, which is based on the work of Shu (2000).24 After

controlling for other factors that provide incentives for managers to discover and report

ICDs, we do not find that firms with high litigation risk as measured by Shu (2000) are any

more likely to provide an ICD disclosure than other firms. Thus, this result affirms our

earlier finding reported in Table 4 that ICD disclosure is not related to litigation risk.

There were 12 ICD firms that concurrently reported an auditor resignation and an ICD

in 2003 and early 2004 on an 8-K filing. Because there is a one-to-one mapping of ICD

disclosure and the independent variable of AUDITOR_RESIGN, it is important to see if

our findings are robust to deleting these observations. In the Model 4 column of Table 6,we report the results of estimating our logistic model after deleting these 12 firms. The most

important point is that the deletion of these observations does not adversely affect the

significance of the coefficient on AUDITOR_RESIGN. Moreover, except for RZSCORE,

the signs and significance of the other coefficients remain unchanged from those reported

in Table 4. Thus, we conclude that the inferences drawn from the primary analysis are

robust to the deletion of these 12 firms.

ARTICLE IN PRESS

23Obviously, there is a high correlation between AUDITOR and AUDITOR(BIGFOUR), r 0.82. If we

exclude AUDITOR from the model, the coefficient on AUDITOR(BIGFOUR) is positive and significant.24

Shu (2000) models litigation risk as a function of firm size, inventory holdings, receivables, return-on-assets,current ratio, financial leverage, sales growth, stock return, stock volume, beta, stock turnover, delisting decision,

operating in technology-related industries, and receiving a qualified audit opinion. To calculate SHU_LIT, we

take the parameter estimates from Table 3 ofShu (2000) and apply them to the accounting and market measures

of the sample firms that have the necessary data to calculate the measures.


7/29/2019 articol3

21/27

Table 6

Logistic regression results of determinants of ICD disclosures-sensitivity analysis

Variables Estimated coefficient

Model 1 Model 2 Model 3 Model 4

IC risk attributes

SEGMENTS + 0.075 0.070 0.096 0.074

(3.341)** (2.912)** (4.395)** (3.164)**

FOREIGN_SALES + 0.277 0.261 0.096 0.238

(3.975)*** (3.493)** (0.310) (2.855)**

M&A + 0.423 0.472 0.494 0.408

(11.334)*** (14.328)*** (10.627)*** (10.082)***

RESTRUCTURE + 0.265 0.200 0.212 0.295

(4.032)*** (2.365)* (1.813)* (4.885)***

RGROWTH + 0.061 0.022 0.067 (7.514)*** (0.581) (8.797)***

INVENTORY + 1.269 1.305 1.723 1.349

(7.680)*** (8.235)*** (9.333)*** (8.543)***

SIZE 0.031 0.031 0.034 0.031

(2.241)* (2.225)* (2.410)* (2.241)*

%LOSS + 0.487 0.423 0.668 0.493

(6.754)*** (5.258)*** (9.561)*** (6.786)***

RZSCORE 0.034 0.039 0.040 0.033

(1.415) (1.915)* (1.189) (1.294)

AUDITOR_RESIGN + 1.980 2.021 1.137 1.935

(40.928)*** (43.557)*** (6.013)*** (36.051)***

SALESGRWTH + 0.128

(1.892)*


AUDITOR + 0.801 0.594 0.415 0.578

(11.446)*** (10.625)*** (1.959)* (9.687)***

AUDITOR (BIGFOUR) + 0.295

(2.294)*

7/29/2019 articol3

22/27

RESTATEMENT + 0.840 0.847 0.951 0.785

(23.944)*** (24.519)*** (21.611)*** (19.673)***

INST_CON + 9.925 9.586 8.771 11.016

(2.985)** (2.781)** (1.295) (3.598)**

LITIGATION + 0.139 0.131 0.117

(1.031) (0.920) (0.716)

SHU_LIT + 1.434

(0.209)

AUDITOR_DIMISS +

Likelihood ratio, w2 139.88*** 132.18*** 77.755*** 124.36***

Sample size 4810 4810 2894 4798

ICD sample 326 326 224 314

Control sample 4484 4484 2670 4484

***Indicates significance at the 0.01 level or better, **indicates significance at the 0.05 level or better, *Indicates significa

variable definitions.

Model 1Base model with BIGFOUR auditor, where BIGFOUR is coded one if the firm contracts with Deloitte

PricewaterhouseCoopers, else zero. As shown in footnote 1 to Table 3, 72.4% (68.3%) of the ICD firms (control firms) Model 2Base model with continuous sales growth, where SALESGRWTH is defined as the average percentage chang

Model 3Base model with the Shu litigation measure, where SHU_LIT is calculated as the parameter estimates from Tab

and market measures of the sample firms that have the necessary data to calculate the measures.

Model 4Base model estimated with concurrent auditor change and ICD disclosures observations ( n 12) deleted.

Model 5Base model with AUDITOR_DISMISS as an additional incentive to discover and disclose measure. AUDITO

auditor during the twelve month period beginning in the fourth month after the close of fiscal year 2002 through the thir

zero otherwise (auditor dismissals were determined from Audit Analytics and 8-K filings).

Model 6Base model estimated deleting observations of ICD firms that are non-accelerated filers. Estimated coefficients

different inferences drawn from those of our primary analysis.

See Table 1 for all other variable definitions.

7/29/2019 articol3

23/27

Our fifth sensitivity test explores whether the termination of a firms auditor signals

problems with internal control. One potential reason why a firm terminates its contract

with the incumbent auditor is for unsatisfactory performance after management discovers

internal control problems in preparation for a SOX 404 audit that the incumbent auditor

had not discovered in a prior audit.25 If the auditor is dismissed, managers have incentivesto make an ICD disclosure in conjunction with pointing the finger at the terminated

auditor for poor internal control oversight. AUDITOR_DISMISS is coded one for firms

that disclose in an 8-K filing the dismissal of their auditor in 2003 (and zero otherwise).

The results when adding AUDITOR_DISMISS to the ICD disclosure determinant model

are displayed in the Model 5 column ofTable 6. The coefficient on AUDITOR_DISMISS

is positive and highly significant and the signs and significance of the coefficients on the

other independent variables are similar to those of Model 2 reported in Table 4. The

significantly positive coefficient on AUDITOR_DISMISS is consistent with the notion

that firms that dismissed their auditors in 2003 are more likely to report ICDs as managers

take steps to improve internal control scrutiny.

Our last sensitivity test is motivated by the fact that our sample includes both

accelerated and non-accelerated filers because our study focuses on the Section 302

reporting era. In contrast, the Doyle et al. (2006a) study uses a sample that includes

disclosures made in both the SOX 302 and 404 reporting regimes, with observations from

the later period being heavily weighted towards accelerated filers. To investigate how the

differences in samples affect the inferences drawn on internal control risk, we re-estimate

our ICD reporting model deleting ICD firms that are non-accelerated filers.26 The Model 6

column ofTable 6 displays the results. We continue to include our variables that proxy for

the incentives to detect and report ICDs because we posit that even though acceleratedfilers are required to report material weaknesses in internal control under SOX 404, these

firms still faced differential incentives to detect and report internal control problems during

the SOX 302 regime. We find the signs and significance on several of the internal control

risk and reporting variables to be different from those of our benchmark results reported in

the Model 2 column of Table 4. Specifically, we find restructurings to increase in

importance in explaining ICDs and the effect of inventory levels, frequency of losses, and

likelihood of financial distress on the likelihood of ICDs disclosures to be less significant.

More importantly, the results indicate a significant negative relation between INST_CON

and ICD reporting, whereas we found a positive relation in our Table 4 results when non-

accelerated filers were included in the ICD sample.27

ARTICLE IN PRESS

25This point highlights the fact that AUDITOR can be considered an endogenous choice. Prior research

examining firms auditor choices models auditor choice as a function of operating risk, financial risk and the

demand for external monitoring (see e.g., Chow, 1982). Our empirical model of ICD disclosure includes many of

the same variables used in prior audit choice research to proxy for these risks, and as such, our research design

inherently controls for selection effects. Furthermore, the majority of sample firms made their auditor choices

across different years much earlier than our year of analysis (i.e., the average auditor tenure for our sample of

firms is over 6 years) and as such we think it reasonable to consider AUDITOR as an exogenous variable for this

sensitivity test.26

It is important to note that in order to draw strong inferences regarding the determinants of ICD reporting inthe SOX 404 regime, non-accelerated filers also should be deleted from the control sample. We do not take this

step to allow more direct comparisons to the Doyle et al. (2006a) study.27To be more similar to the ICD risk model of Doyle et al. (2006a), we extend this sensitivity analysis by adding

firm AGE, defined as the natural log of the number of years on CRSP, to the model. Unlike Doyle et al. (2006a),


7/29/2019 articol3

24/27

Based on the sensitivity analysis reported above, it appears that it is important to control

for firms incentives to detect internal control problems when evaluating the likelihood of

ICD reporting. We also find that including firms of all sizes (both accelerated and non-

accelerated filers) affects the significance of several of the variables in our ICD determinant

model.

4.3. Factors deterring managers from disclosing ICDs

We model ICD disclosures as a function of factors that proxy for managers incentives

to discover and disclose an ICD, but we do not include any explicit factors that

deter managers from providing early ICD disclosures. One potential factor that may deter

managers from making an early ICD disclosure is management reputation. Managers

may forego disclosing an ICD to avoid criticism in the market for lax organization

or mismanagement of operations ultimately reducing their employment options. Ifreputation is an incentive factor, we would expect new managers to be more likely to

disclose ICDs because they can place the blame of internal control problems on prior

management. Therefore, we expect firms that have management with longer tenure to be

less likely to disclose ICDs. To investigate this issue we collect CEO tenure for all sample

firms covered by the Board Analyst database and add CEO tenure to our ICD determi

nant model. We code CEO tenure both as a continuous variable as well as a binary

variable that is set equal to one if the CEO tenure is less than 2 years, and zero otherwise.

In untabulated results, we do not find a statistically significant difference between the CEO

tenure of ICD firms and control firms after controlling for other ICD risk and reporting

determinants.Another potential factor deterring managers from making an early ICD disclosure is

management compensation. An ICD disclosure might cast doubt on the reliability of

managements financial reporting, which impacts the uncertainty of information quality

thereby increasing the firms cost of capital (Easley and OHara, 2004) and decreasing its

market value. A CEO that has a large number of stock options (or stock option awards)

might not want to disclose an ICD. On the other hand, a CEO that has stock grants as part

of his compensation package may actually have incentives to disclose ICDs prior to

receiving grants in the hopes that such disclosure would lower the strike price on the

options granted during the year, thus raising the value of his options. Given the prediction

about the effects of stock-based compensation on managements incentives to discloseICDs is not clear-cut and requires collecting detailed information on the timing of the

release of stock option grants relative to disclosure of the ICD, we leave this question to

future research.

5. Summary and future research

Many have claimed that the passage of the SarbanesOxley Act of 2002 imposed an

extreme burden on SEC registrants by requiring them to document, evaluate, publicly

report, and have audited the effectiveness of their internal controls. This paper investigates

ARTICLE IN PRESS

(footnote continued)

we do not find a significant coefficient on AGE after controlling for the other ICD risk and reporting

determinants.


7/29/2019 articol3

25/27

the economic events, strategic operating decisions, and investments in internal controls

that expose firms to internal control risks. Because our study uses data prior to audits

mandated by Section 404 of the SarbanesOxley Act, we are also able to investigate the

incentives to discover and report internal control deficiencies (ICDs) in the absence of well

defined ICD discovery and reporting criteria and no mandated internal control audit.More importantly, because we restrict our sample to pre-404 disclosures made by

accelerated and non-accelerated filers, our study provides insights into the determinants of

ICDs for a broad cross-section of SEC registrants, which is important for developing

expectations of internal control problems given that non-accelerated filers are not required

to comply with SOX 404 until 2007.

We find that firms that report ICDs have more complex operations as proxied by the

number of business segments and foreign sales, more often engage in mergers and

acquisitions and restructurings, hold more inventory and are faster growing relative to

firms that do not disclose internal control weaknesses. In addition, the results indicate that

firms with fewer resources to invest in internal control, as proxied by the frequency of

losses and greater financial distress, more often disclose problems with their internal

controls. Moreover, the higher incidence of auditor resignations prior to ICD disclosures

suggests auditors have greater concerns about ICD firms accounting application risk and

status as going concerns.

With respect to incentives to discover and report internal control problems, we find that

firms that provide early (pre-SOX 404) warnings of ICDs are more likely to be audited by

dominant auditors, have a higher incidence of restatements of financial statements and

SEC AAERs in prior years, and are more likely to have concentrated institutional owners.

Collectively, these results support our conjecture that firms that face greater internalcontrol risk and have greater reporting incentives are more likely to disclose internal

control deficiencies prior to the SOX-mandated internal control audit reporting

requirements.

The vast majority of firms that reported control deficiencies in the first 3 months of 2005

as a result of SOX 404 audits previously certified their controls as effective under SOX 302

(Glass Lewis, 2005). Future research can investigate whether there are significant

differences in internal control risk profiles and incentives to report for firms that disclosed

internal control deficiencies prior to SOX-mandated audits versus firms that report

deficiencies under Section 404 of the SarbanesOxley Act. Exploring the relation between

internal control weaknesses and the quality of externally reported numbers is anothernatural extension of the present analysis (Ashbaugh-Skaife et al., 2006b; Doyle et al.,

2006b). Finally, another avenue of fruitful research is to investigate whether internal

control deficiencies result in higher information risk that increases firms cost of equity

capital (Ashbaugh-Skaife et al., 2006a; Ogneva et al., 2005).

References

Agresti, A., 2002. Categorical Data Analysis. Wiley, New York.

Altman, E., 1968. Financial ratios, discriminant analysis, and the prediction of corporate bankrupcy. Journal ofFinance 23, 589609.

American Institute of Certified Public Accountants (AICPA), 1988. Statement on Auditing Standards

No. 60: Communication of Internal Control Structure Related Matters Noted in an Audit, AICPA,

New York.


7/29/2019 articol3

26/27

American Institute of Certified Public Accountants (AICPA), 2001. Statement on Standards for Attestation

Engagements No. 10: Reporting on an Entitys Internal Control Over Financial Reporting, AICPA,

New York.

Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006a. The Effect of Internal Control Deficiencies on

Firm Risk and Cost of Equity Capital, Working paper, University of Iowa.

Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006b. Internal Control Deficiencies, Remediation

and Accrual Quality, Working paper, University of Iowa.

Beneish, M., Billings, M., Hodder, L., 2006. Internal Control Weaknesses and Information Uncertainty, Working

paper, Indiana University.

Chow, C., 1982. The demand for

articol3

Documents