SEARCH

SEARCH BY CITATION

ABSTRACT

  1. Top of page
  2. ABSTRACT
  3. 1. Introduction
  4. 2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
  5. 3. Institutional Background and Reporting Environment
  6. 4. Sample and Descriptive Statistics
  7. 5. Results
  8. 6. Conclusions
  9. Appendix
  10. REFERENCES

The Sarbanes-Oxley Act (SOX) mandates management evaluation and independent audits of internal control effectiveness. The mandate is costly to firms but may yield benefits through lower information risk that translates into lower cost of equity. We use unaudited pre–SOX 404 disclosures and SOX 404 audit opinions to assess how changes in internal control quality affect firm risk and cost of equity. After controlling for other risk factors, we find that firms with internal control deficiencies have significantly higher idiosyncratic risk, systematic risk, and cost of equity. Our change analyses document that auditor-confirmed changes in internal control effectiveness (including remediation of previously disclosed internal control deficiencies) are followed by significant changes in the cost of equity that range from 50 to 150 basis points. Overall, our cross-sectional and intertemporal change test results are consistent with internal control reports affecting investors' risk assessments and firms' cost of equity.


1. Introduction

  1. Top of page
  2. ABSTRACT
  3. 1. Introduction
  4. 2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
  5. 3. Institutional Background and Reporting Environment
  6. 4. Sample and Descriptive Statistics
  7. 5. Results
  8. 6. Conclusions
  9. Appendix
  10. REFERENCES

Prior research on the impact of the Sarbanes-Oxley Act (SOX) (U.S. Congress [2002]) focuses primarily on the cost of its internal control reporting and audit requirements. In this study, we explore the relation between internal control quality and idiosyncratic and systematic risk, and the potential benefits of effective internal control in terms of cost of equity. Specifically, we investigate whether firms that disclose internal control deficiencies (ICDs) exhibit higher systematic risk, higher idiosyncratic risk, and higher cost of equity relative to firms with effective internal controls. Further, we investigate whether managements' initial disclosures of ICDs and remediation of previously reported ICDs are related to changes in firms' cost of equity.

Prior research posits that ineffective internal controls allow or introduce both intentional and unintentional misstatements into the financial reporting process that lead to lower quality accruals. Consistent with this conjecture, these studies find that firms reporting ICDs exhibit greater noise in accruals (Ashbaugh-Skaife et al. [2008], Doyle, Ge, and McVay [2007a]) and larger abnormal accruals relative to firms not reporting ICDs (Ashbaugh-Skaife et al. [2008]). In this study, we posit that ineffective internal control results in less reliable financial reporting, thus increasing the information risk faced by investors that manifests in a higher cost of equity.1

Recent theoretical work by Lambert, Leuz, and Verrecchia [2007] models the direct and indirect effects of information quality on cost of equity capital in a single-period multisecurity capital asset pricing model (CAPM) setting. With respect to direct effects, they show that low quality information increases market participants' assessed variance of a firm's cash flows and the assessed covariances with other firms' cash flows, leading to a higher cost of equity capital. Moreover, they show that the quality of information systems, which includes the effectiveness of internal controls over information and assets within the firm, has an effect on firms' real decisions, including the assets appropriated by management. Management's appropriation of firm assets reduces the expected value of cash flows to investors, thus contributing to an indirect effect on firms' cost of equity.

Based on the theoretical work in Lambert, Leuz, and Verrecchia [2007], we conduct both (1) cross-sectional tests to assess whether firms with ICDs present higher information risk to investors relative to firms having effective internal controls and (2) intertemporal tests to assess whether changes in the effectiveness of internal control yield changes in the cost of equity consistent with changes in information risk. As predicted, the results of our cross-sectional tests indicate that firms reporting ICDs exhibit significantly higher idiosyncratic risk, betas, and cost of equity relative to firms not reporting ICDs. These differences persist after controlling for other factors shown by prior research to be related to these risk measures. Our finding that differences in these risk measures predate the first disclosures of ICDs suggests that market participants' assessment of nondiversifiable market risk (beta), idiosyncratic risk, and cost of equity incorporates expectations about internal control risks based on observable firm characteristics prior to firms' initial revelation of control problems. This conjecture is consistent with Ashbaugh-Skaife, Collins, and Kinney [2007] and Doyle, Ge, and McVay [2007b], who demonstrate that firms with more complex operations, recent changes in organization structure, greater accounting risk exposure, and less investment in internal control systems are more likely to disclose ICDs.

In an attempt to assess whether a causal relation may exist between internal control quality and firms' cost of equity, we construct four sets of intertemporal change analysis tests. The first intertemporal test examines the changes in implied cost of equity around the first disclosure of an ICD. Our results reveal that ICD firms experience a statistically significant increase in market-adjusted cost of equity, averaging about 93 basis points, around the first disclosure of an ICD. Moreover, we find that ICD firms with the lowest probability of reporting internal control problems (based on observable firm characteristics) exhibit a greater cost of equity change (125 basis points on average) relative to those ICD firms with the highest likelihood of reporting control problems (49 basis points on average). This result is consistent with the market incorporating incomplete adjustments for the likelihood of internal control problems into firms' cost of equity prior to the revelation of which firms have ICDs, and then updating these risk assessments after the control problems are revealed.

Our second change analysis examines cost of equity changes for firms that remediate previously disclosed ICDs as evidenced by an unqualified SOX 404 audit opinion. If revelation of ICDs contributes to an increase in firms' cost of equity, as our first set of change results suggest, then successful remediation of those problems should lead to a decrease in cost of equity. Consistent with this prediction, we find that ICD firms that subsequently receive an unqualified SOX 404 opinion exhibit an average decrease in market-adjusted cost of equity of 151 basis points around the disclosure of the opinion. In contrast, for our third change test we find that ICD firms that subsequently receive adverse SOX 404 audit opinions, which indicate that internal control problems persist, exhibit a modest but insignificant increase in cost of equity around the SOX 404 opinion release.

For our final intertemporal change analysis, we examine the change in cost of equity for non-ICD firms (i.e., no prior disclosure of internal control problems) that receive unqualified SOX 404 opinions. We find no significant cost of equity change for firms least likely to report an ICD, but a significant decrease in the average market-adjusted cost of equity of 116 basis points around the release of an unqualified SOX 404 opinion for firms most likely to report ICDs. These findings suggest that when firms deemed most likely to report internal control problems receive an unqualified SOX 404 audit opinion, the market responds favorably with a reduction in firms' cost of equity.

Collectively our cross-sectional and intertemporal tests present consistent evidence that information risk, as proxied by ineffective internal control, is an important determinant of both idiosyncratic risk and systematic market risk that affects the market's assessment of firms' cost of equity. We document that firms with effective internal control or firms that remediate previously reported ICDs are rewarded with a significantly lower cost of equity. Thus, our study is among the first to document potential benefits of a systematic reporting structure to communicate information about changes in the quality of internal control in terms of cost of equity consequences.

Our study contributes to the literature regarding the effects of information quality on investors' risk assessments and cost of equity in two ways. First, prior research examining the effect of information quality on the cost of equity uses measures of information quality that are dependent upon researcher estimates of information attributes or subjective metrics of voluntary disclosure (Botosan [1997], Bhattacharya, Daouk, and Welker [2003], Francis et al. [2004]). We use the unique setting of SOX internal control reporting to identify firms that have ICDs, which is a less ambiguous indicator of firms' accounting information quality relative to information quality measures used in prior studies. Moreover, the independent auditors' SOX 404 opinions provide clear signals that confirm the remediation of ICDs that allow tests of changes in information quality on firms' cost of equity in ways that minimize competing explanations for our results.

A second contribution to the literature on information quality and cost of equity is that we predict and find that firms with low-quality financial information, as indicated by ICD disclosures, exhibit higher betas and higher idiosyncratic risk. Much of the prior accounting research that investigates the effect of information quality on cost of equity assesses this effect after controlling for systematic risk (Botosan [1997], Botosan and Plumlee [2002], Bhattacharya, Daouk, and Welker [2003], Francis et al. [2005]). We document linkages between information quality and systematic risk, as well as idiosyncratic risk, largely overlooked in prior empirical studies. More importantly, our results suggest that studies that investigate the effect of information quality on cost of equity after controlling for the effects of market risk (beta) are removing part of the information quality effects they seek to document.

Our study also contributes to the literature assessing the economic consequences of the SOX legislation, which is primarily focused on the costs of implementing SOX internal control auditing and reporting requirements (Li, Pincus, and Rego [2008], Zhang [2007], Berger, Li, and Wong [2005], Solomon and Bryan-Low [2004]). This paper, along with a concurrent study by Ogneva, Subramanyam, and Raghunandan [2007], is among the first to investigate the potential benefits of SOX in terms of cost of equity effects. In contrast to the Ogneva, Subramanyam, and Raghunandan [2007] study, which concludes there is no consistent association between ICDs and cost of equity, we find clear evidence that internal control risk matters to investors and that firms reporting effective internal controls or firms remediating previously disclosed ICDs benefit through lower cost of equity.2

The remainder of the paper is organized as follows. Section 2 summarizes the theoretical underpinnings of our analysis and sets forth our predictions about internal control weaknesses and remediation, market and idiosyncratic risk, and cost of equity. Section 3 provides institutional background and summarizes related work. Section 4 describes our samples and provides descriptive statistics. Section 5 presents our empirical findings along with a discussion of alternative cost of equity capital proxies. Conclusions are drawn in section 6.

2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity

  1. Top of page
  2. ABSTRACT
  3. 1. Introduction
  4. 2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
  5. 3. Institutional Background and Reporting Environment
  6. 4. Sample and Descriptive Statistics
  7. 5. Results
  8. 6. Conclusions
  9. Appendix
  10. REFERENCES

Lambert, Leuz, and Verrecchia [2007] develop a model in a single-period multisecurity CAPM setting that links the quality of accounting disclosures and information systems to firm risk and cost of equity. In the Lambert, Leuz, and Verrecchia [2007] framework, accounting information system quality is broadly defined to include not only the disclosures the firm makes to outsiders, but also the internal control systems that a firm has in place. A key insight from their analysis is that the quality of accounting information and the systems that produce that information influence a firm's cost of capital in two ways: (1) direct effects—where higher quality accounting information does not affect firm cash flows, per se, but does affect market participants' assessments of the variance of a firm's cash flows and the covariance of the firm's cash flows with aggregate market cash flows—and (2) indirect effects—where higher quality information and better internal controls affect real decisions within the firm, including the quality of operating decisions as well as the amount of firm resources that managers appropriate for themselves.

Lambert, Leuz, and Verrecchia [2007] analyze the direct effects of information system quality by introducing an accounting information signal, inline image (e.g., earnings), that provides a noisy signal about the (future) end-of-period cash flows of the firm, inline image. That is, inline image where inline image is the noise or measurement error in the information signal. Because the (future) end-of-period firm cash flows are unobservable, the market's assessment of the variance of firm j's cash flows and the covariance structure of firm j's future cash flows with all other firms in the market is conditioned by the quality or precision of firm j's accounting signal. Specifically,

  • image(1)

As equation (1) shows, investors' assessment of the variance of firm j's cash flows and covariance of firm j's cash flows with the cash flows of all other firms in the market is proportional to inline image or the noise in the information signal about firm j's future cash flows. Importantly, the effect of measurement error in the information signal does not diversify away as the number of securities grows large—the nonnegative effect is present for each and every covariance term with firm j.

Recognizing that inline image is a noisy signal from a broader information set Φ that conditions investors' assessment of the end-of-period cash flows, the following expression can be derived from the Lambert, Leuz, and Verrecchia [2007] formulation for expected return (cost of capital):

  • image((2a))

where

  • image((2b))

In equation (2a) and equation (2b), Rf is the risk-free rate, Φ is the information set available to investors to make their assessments regarding the distribution of future cash flows for firm j, and Nτ is the aggregate risk tolerance of the market. All other variables are defined above. As indicated in equation (2a) and equation (2b), as the noise in the firm's accounting signals inline image increases (decreases) the firm's cost of capital is expected to be higher (lower).

Within the Lambert, Leuz, and Verrecchia [2007] framework, the quality of a firm's information system, which includes its internal control, can also affect a firm's real decisions. The real decisions include, but are not limited to, the amount of firm cash flows that managers appropriate for themselves. Ceteris paribus, we conjecture that ineffective internal control increases the firm assets appropriated by management and, therefore, decreases the ratio of expected cash flows available to investors relative to the covariance of firm cash flows with the market as shown in equation (2b). This indirect real effect translates into a higher cost of equity.3

In sum, we posit that the quality of a firm's internal control over financial reporting affects investors' assessments of firm risk and cost of capital because if a firm has weak internal control, then the quality or precision of its accounting signals is impaired. Consistent with this conjecture, Ashbaugh-Skaife et al. [2008] and Doyle, Ge, and McVay [2007a] find that firms reporting ICDs exhibit noisier accruals after controlling for other firm characteristics that affect accrual quality. Combining these empirical findings with the theory in Lambert, Leuz, and Verrecchia [2007], we develop both cross-sectional and intertemporal predictions.

In the cross-section, we predict that firms with ICDs exhibit higher idiosyncratic risk, higher systematic (beta) risk, and higher cost of equity relative to firms with strong internal controls. Moreover, we expect firms' costs of equity to increase when the first public revelation of internal control problems is made under SOX 302 or 404 reporting provisions, and to decrease when external auditor SOX 404 opinions affirm that the firm's control problems are remediated. In developing testable implications of the Lambert, Leuz, and Verrecchia [2007] model, there are several key points to keep in mind.

First, in the Lambert, Leuz, and Verrecchia [2007] framework, the cost of capital effect of higher quality information is fully captured by an appropriately specified forward-looking beta, that is, the covariance of expected end-of-period cash flows. Thus, if one can properly measure forward-looking betas there is no role for an ICD indicator in explaining differences in cost of equity because all effects of internal control problems on cost of capital are subsumed by forward-looking beta. However, betas estimated using historical return data do not fully capture all information quality effects of internal control differences. Because historical beta estimates provide a noisy estimate of the forward-looking beta in the Lambert, Leuz, and Verrecchia [2007] model, we posit that the indicator variables for ICDs and remediation of ICDs used in our empirical tests have incremental explanatory power beyond beta with respect to cost of capital.

Second, the direct effects of information quality differences on investors' assessed variances and covariances of a firm's cash flows in the Lambert, Leuz, and Verrecchia [2007] framework are developed under the maintained hypothesis that the firm's real investment and operating decisions are held constant. Accordingly, our predictions of the direct effects of ICDs and remediation on cost of equity are developed under the maintained hypothesis that firms' investment/operating decisions are held constant. Given the relatively short time horizon from the initial disclosure of an ICD to its subsequent remediation as evidenced by an unqualified SOX 404 audit opinion (generally, within one year), we believe this maintained hypothesis is reasonable.

Finally, in formulating our intertemporal tests, we recognize that investors hold priors on the likelihood of ICDs based on observable firm characteristics (Ashbaugh-Skaife, Collins, and Kinney [2007], Doyle, Ge, and McVay [2007b]). Thus, we predict that the effect of a negative or positive signal about a firm's internal control quality has a greater (smaller) effect on cost of capital the smaller (greater) the probability of the firm reporting an ICD.

3. Institutional Background and Reporting Environment

  1. Top of page
  2. ABSTRACT
  3. 1. Introduction
  4. 2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
  5. 3. Institutional Background and Reporting Environment
  6. 4. Sample and Descriptive Statistics
  7. 5. Results
  8. 6. Conclusions
  9. Appendix
  10. REFERENCES

Prior to passage of SOX in July 2002, public companies in the United States are required to maintain financial records as well as internal controls that protect corporate assets and facilitate generally accepted accounting principles (GAAP)-based financial reporting (e.g., Foreign Corrupt Practices Act, U.S. Congress [1977]). However, pre-SOX statutes do not require management evaluations of internal control or public assertions about control adequacy and the statutes do not require independent audits of internal control.4 SOX changes the public assertion, audit, and audit reporting landscape in two steps.

First, section 302 of SOX (effective August 29, 2002) mandates that a firm's CEO and CFO certify in periodic (interim and annual) Securities and Exchange Commission (SEC) filings that they have “evaluated … and have presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation” (SOX 302 (a) (4) (C) and (D)). Second, section 404(b) requires the financial statement auditor to express an opinion on management's evaluation of the effectiveness of internal control over financial reporting. Auditing Standard (AS) No. 2 (effective for larger firms for fiscal years ending on or after November 15, 2004) adds a requirement that the auditor express a separate opinion about the effectiveness of the firm's internal controls based on the auditor's own review (PCAOB [2004]).

In the empirical work to follow, we use ICD disclosures made under SOX section 302 and section 404 as indicators of poor-quality accounting information. ICDs can affect firms' information quality in two principal ways. One way is through random, unintentional misstatements due to the lack of adequate policies, training, or diligence by company employees. Examples are: inventory counting and pricing errors that misreport inventory on hand and related cost of sales, omission of items such as failure to record credit purchases, variation in revenue recording due to employee discretion or lack of specific policies for revenue recognition, expensing amounts that should be capitalized and vice versa, inadequate basis for accounting estimates such as the allowance of inventory obsolescence, and unreliable procedures for “rolling up” amounts from segments and subsidiaries at fiscal year-end. These unintentional misstatements are likely to be random and can lead to increases or decreases in resulting earnings.

A second way that ICDs can adversely affect information quality is through intentional misrepresentations or omissions by employees or by management. These nonrandom misstatements typically overstate earnings for the current period, but “big bath” write-offs or “cookie jar” reserves result in opportunistic understatement of current earnings as well. For example, management's exercise of discretion in accounting choices allows financial misrepresentation through manipulation of accruals for recording important accounting estimates such as warranty liabilities, reserves for sales returns, and allowance for uncollectible receivables. Furthermore, employee fraud is made possible by inadequate segregation of internal control duties. Weak internal control in the form of inadequate segregation of duties can allow the misappropriation of assets and alteration of recorded amounts by employees that are not detected because the company has inadequate staff for monitoring or lack of action by top management because of a lax control environment. In addition, misstatements can be introduced into the financial reporting process through opportunistic “oversights” or omissions in accumulating segment and subsidiary information for consolidated reports, as well as through management emphasizing earnings targets in instructions to employees.

Determining the status of internal controls (i.e., whether effective or ineffective) and whether previously reported control problems are remediated are important aspects of our research design. In the empirical tests that follow, we rely on an independent third-party evaluation of the effectiveness of internal controls as reflected in the SOX 404 audit report. Firms that previously disclose ICDs under 302 or 404 and subsequently receive an unqualified SOX 404 audit opinion comprise our remediation subsample, while ICD firms that receive a qualified SOX 404 opinion comprise our nonremediation subsample. Control firms are firms that do not report ICDs under SOX 302 and receive unqualified SOX 404 opinions in the first SOX 404 reporting year, thus indicating that their internal controls are effective.

4. Sample and Descriptive Statistics

  1. Top of page
  2. ABSTRACT
  3. 1. Introduction
  4. 2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
  5. 3. Institutional Background and Reporting Environment
  6. 4. Sample and Descriptive Statistics
  7. 5. Results
  8. 6. Conclusions
  9. Appendix
  10. REFERENCES

4.1 ICD sample details

Our initial sample of firms providing ICD disclosures is obtained from compilations of SEC filings reported in Compliance Week and by Glass, Lewis & Co., LLC from November 2003 to September 2005.5 In addition, we supplement these two databases with hand-collected ICD disclosures from SEC filings made after September 2005 for firms that delay their SEC filings but indicate they are expecting an adverse internal control opinion.6 These procedures result in an initial sample of 1,053 firms disclosing at least one ICD in either the SOX 302 or SOX 404 reporting regime.

Of the 1,053 ICD firms, 587 have the necessary data to estimate our idiosyncratic risk and systematic risk models. Data needed to conduct cross-sectional market reaction and cost of equity tests are available for 787 and 221 firms, respectively. There are 162 firms that have the necessary data to examine the intertemporal change in cost of equity at the time of the first ICD disclosure. The remaining analyses examine the change in ICD firms' cost of equity based on the type of SOX 404 opinion received. We have data for 38 firms that report an ICD under 302 but receive an unqualified SOX 404 opinion. These 38 firms comprise our “remediation” sample. We have data for 50 firms identified as having persistent control problems because they disclose ICDs under SOX 302 and subsequently receive an adverse SOX 404 opinion. These firms comprise our “no-remediation” sample.7Table 1 displays the subsamples used to conduct our cross-sectional tests of risk differences, market reaction tests, and intertemporal cost of equity change analyses.

Table 1.  Internal Control Deficiency Samples
 Number of Firms
  1.  This table shows the number of firms reporting internal control deficiencies that also meet other data requirements for conducting market reaction, idiosyncratic risk, beta risk, and cost of equity tests reported in subsequent tables.

Firms either disclosing an internal control deficiency (ICD) under SOX 302 or both disclosing an ICD under SOX 404 and concurrently receiving an adverse SOX 404 opinion in SEC filings from November 2003 through September 2005 per Compliance Week and Glass Lewis. Sample is supplemented by hand-collected data from SEC filings after September 2005 for firms previously indicating delays due to expected adverse SOX 404 audit opinions. 
  “ICD firms”1,053
ICD firms having the necessary data to conduct the market reaction (returns) analyses 787
ICD firms having the necessary data to conduct the cross-sectional idiosyncratic risk and market risk analyses 587
ICD firms having the necessary data to conduct the cross-sectional cost of equity analysis 221
ICD firms having the necessary data to conduct the cost of equity change analysis surrounding the issuance of the first ICD disclosure 162
ICD firms remediating their ICD and having the necessary data to conduct a change in cost of equity analysis around the first SOX 404 opinion 
  “Remediation sample”  38
ICD firms not remediating their ICD and having the necessary data to conduct a change in cost of equity analysis around the first SOX 404 opinion 
  “No-remediation sample”  50

4.2 descriptive statistics

Table 2 reports descriptive statistics for the 587 ICD firms and the 3,024 non-ICD firms, that is, control firms, having sufficient data to conduct our cross-sectional tests of the association between internal control problems and idiosyncratic risk and systematic risk. Idiosyncratic risk (I_RISK) is the standard deviation of the residuals from the following model:

  • image(3)

where EXRET is the firm's monthly return minus the risk-free rate and RMRF is the excess return on the market. Systematic risk (BETA) is measured as the coefficient on RMRF.8Equation (3) is estimated using monthly returns requiring a minimum of 24 and maximum of 60 observations over 2004 and the prior four fiscal years.9 Consistent with Doyle, Ge, and McVay [2007a], we assume that ICDs that are first disclosed in 2004 existed for some time prior to disclosure. In addition, we assume that the market is able to form expectations about internal control quality based on observable firm characteristics, and that these expectations are incorporated in the risk measures noted above (see Ashbaugh-Skaife, Collins, and Kinney [2007], Doyle, Ge, and McVay [2007b])

Table 2.  Descriptive Statistics on Variables Used in the Idiosyncratic Risk and Beta Analyses
Panel A: Descriptive statistics for ICD firms and non-ICD (control) firms
ICDa firms (N= 587)
 
VariablesbMeancMedianQ1Q3Std. Dev.
I_RISK0.1820.168 0.1180.2300.085
BETA1.4661.205 0.6272.0631.100
STD_CFO0.0810.055 0.0320.0990.089
LEV0.1990.144 0.0070.3160.219
CFO0.0230.047−0.0090.1080.179
BM0.4840.437 0.2670.6590.349
SIZE5.9355.836 4.8606.9521.705
DIVPAYER0.2300.000 0.0000.0000.421
RET0.1590.101−0.2040.3990.545
COVCFO0.0220.013−0.0080.0400.056
INDBETA1.1931.097 0.5501.8210.676
Control (non-ICD) firms (N= 3,024)
 
 MeanMedianQ1Q3Std. Dev.
I_RISK0.1600.140 0.0950.2090.083
BETA1.2350.963 0.4691.7721.028
STD_CFO0.0800.054 0.0280.0940.094
LEV0.2010.151 0.0070.3120.215
CFO0.0410.073 0.0150.1310.190
BM0.4630.409 0.2510.6250.320
SIZE6.2936.245 4.8197.6061.969
DIVPAYER0.3580.000 0.0001.0000.479
RET0.2560.174−0.0660.4410.547
COVCFO0.0170.009−0.0080.0340.054
INDBETA1.0440.921 0.4491.5580.663
Panel B: Correlationsd
 
 ICDI_RISKBETASTD_CFOLEVCFOBMSIZEDIVPAYERRETCOVCFOINDBETA
  1.  Panel A presents descriptive statistics and tests of differences in means and medians of variables used in idiosyncratic risk and beta risk analyses between 587 firms reporting ICDs and 3,024 firms not reporting ICDs for the 2004 fiscal year.

  2.  Panel B presents Pearson (top half) and Spearman (bottom half) correlations between variables used in our analysis of idiosyncratic risk and beta risk. The correlations are based on a combined sample of 587 ICD firms and 3,024 non-ICD firms.

  3.  Variable definitions and measurements appear below.

  4.  aICD= 1 if the firm reports an internal control problem, and 0 otherwise (non-ICD firms).

  5.  bI_RISK= standard deviation of residuals from estimating EXRET01RMRF using monthly returns from 2004 and the prior four years, where EXRET= the firm's monthly return minus the risk-free rate; RMRF= excess return on the market (http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html); BETA= estimate of β1 from EXRET01RMRF using monthly returns over the 60 months prior to the firm's 2004 fiscal year-end, requiring a minimum of 18 months; STD_CFO= standard deviation of cash flow from operations defined as cash flows from operations (Compustat #308) divided by total assets (Compustat #6) calculated using 2004 and the prior four fiscal years, requiring a minimum of three years of data; LEV= total debt (Compustat #9 plus Compustat #34) divided by total assets (Compustat #6) at the firm's 2004 fiscal year-end; CFO= cash flow from operations (Compustat #308) divided by total assets (Compustat #6) at the firm's 2004 fiscal year-end; BM= book value of equity (Compustat #60) divided by market value of equity (Compustat #199 multiplied by Compustat #25) at the firm's 2004 fiscal year-end; SIZE= natural log of market value of equity (Compustat #25 multiplied by Compustat #199) at the 2004 fiscal year-end; DIVPAYER= 1 if the firm pays dividends (Compustat # 21) in its 2004 fiscal year, and 0 otherwise; RET= buy-and-hold return over the firm's fiscal year; COVCFO= covariance of firm's cash flows with market cash flows using quarterly cash flows from operations over 2004 and the prior four fiscal years, requiring a minimum of 12 quarters, divided by the total assets of the firm (market) with the result multiplied by 1,000; INDBETA1 estimated from INDRET01RMRF using monthly returns over the 60 months prior to the firm's 2004 fiscal year-end, requiring a minimum of 18 months; INDRET= monthly value-weighted return on industry portfolio (three-, two-, and one-digit SIC codes), requiring a minimum of 10 firms in the portfolio, minus RMRF.

  6.  cBold text in panel A indicates that the ICD firms are significantly different from the non-ICD firms at p= 0.05 (two-tailed). Differences in means (medians) are assessed using a t-test (Wilcoxon rank-sum test).

  7.  dBold text in panel B indicates that correlations are significantly different from 0 at p= 0.05 (two-tailed).

ICD 0.090.08 0.00 0.00−0.04 0.02−0.07−0.10−0.070.030.08
I_RISK0.11 0.640.46−0.14−0.41−0.18−0.46−0.55−0.030.050.31
BETA0.080.65 0.28−0.16−0.27−0.15−0.11−0.41−0.13 0.010.51
STD_CFO 0.020.580.41 −0.14−0.39−0.21−0.29−0.28−0.060.210.12
LEV−0.01−0.24−0.22−0.30 −0.02−0.090.110.110.04−0.08−0.21
CFO−0.09−0.34−0.26−0.19−0.03 0.080.330.240.210.13−0.03
BM 0.03−0.18−0.16−0.23 0.03−0.13 −0.230.04−0.18−0.05−0.03
SIZE−0.07−0.49−0.12−0.390.190.37−0.19 0.420.05−0.03−0.09
DIVPAYER−0.10−0.63−0.44−0.410.160.240.070.41 0.04−0.05−0.27
RET−0.08−0.18−0.21−0.150.100.26−0.160.160.14  0.02−0.11
COVCFO 0.030.04 0.010.08−0.060.12−0.06−0.02−0.04 0.03 0.03
INDBETA0.080.330.500.23−0.22−0.05−0.02−0.09−0.26−0.140.05 

The control variables included in our analysis of I_RISK and BETA are as follows:

  • • 
    Standard deviation of cash flow from operations (STD_CFO) defined as the five-year standard deviation of cash flow from operations (Compustat #308) divided by total assets (Compustat #6), requiring a minimum of three years of data;
  • • 
    Leverage (LEV), defined as total debt (Compustat #9 plus Compustat #34) divided by total assets (Compustat #6);
  • • 
    Cash flow from operations (CFO), defined as cash flow from operations divided by total assets;
  • • 
    Book-to-market (BM), defined as book value of equity (Compustat #60) divided by market value of equity (Compustat #199 times Compustat #25);
  • • 
    Firm size (SIZE), defined as the natural log of market value of equity (Compustat #199 times Compustat #25);
  • • 
    Dividend distribution (DIVPAYER), defined as one if the firm pays dividends (Compustat # 21), and zero otherwise;
  • • 
    Return (RET), defined as the buy-and-hold return over the firm's fiscal year (CRSP);
  • • 
    Covariance of the firm's cash flows with the market cash flows (COVCFO), measured as the quarterly cash flows from operations using 2004 and the prior four fiscal years, requiring a minimum of three years (12 quarters) of data, divided by total assets of the firm and market, respectively. This variable is multiplied by 1,000 to facilitate comparisons with other coefficients;
  • • 
    Industry beta (INDBETA), measured as the coefficient on RMRF in the following industry return regression: INDRET01RMRF+ɛ. The model is estimated over the 60 months prior to the firm's 2004 fiscal year-end, requiring a minimum of 18 months. INDRET is the monthly value-weighted return on a portfolio of firms in the same industry (three-, two-, and one-digit Standard Industrial Classification (SIC) codes requiring at least 10 firms in the industry) minus the risk-free rate. RMRF is the excess return on the market, which is obtained from the Website http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html.

All control variables are measured as of a firm's 2004 fiscal year-end.

The descriptive statistics reported in Table 2 indicate that, on average, ICD firms have statistically higher I_RISK, larger BETAs, and lower cash flows from operations; are smaller; and are less likely to pay dividends relative to non-ICD firms. In addition, ICD firms have statistically lower returns, higher covariance of firm cash flows with market cash flows, and larger industry betas relative to non-ICD firms.

Panel B of Table 2 displays the correlations among the control variables and the ICD indicator variable, where ICD is coded as one if the firm reports an internal control problem, and zero otherwise. The upper righthand portion of the panel presents Pearson product-moment correlations, while the lower lefthand portion presents Spearman rank-order correlations. To facilitate discussion, we focus on the Pearson correlations, but note that the Spearman rank-order correlations are generally consistent with the Pearson correlations. The ICD indicator is positively correlated with both I_RISK (0.09) and BETA (0.08). In addition, the ICD indicator is negatively correlated with CFO (−0.04), SIZE (−0.07), DIVPAYER (−0.10), and RET (−0.07), and positively correlated with COVCFO (0.03) and INDBETA (0.08). As expected, I_RISK and BETA exhibit a relatively large positive correlation (0.64) as do INDBETA and BETA (0.51).

5. Results

  1. Top of page
  2. ABSTRACT
  3. 1. Introduction
  4. 2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
  5. 3. Institutional Background and Reporting Environment
  6. 4. Sample and Descriptive Statistics
  7. 5. Results
  8. 6. Conclusions
  9. Appendix
  10. REFERENCES

5.1 cross-sectional return results

In this section we investigate whether there is a negative market reaction to firms' initial reporting of an ICD. Anecdotal evidence presented in the financial press highlights immediate material declines in the stock prices of select firms that report ICDs. For example, Flowserve's stock price declines 12% on the day after the announcement of an internal control problem (Goldman Sachs [2005]). In contrast, academic research is inconclusive as to whether there is a negative market reaction to ICD disclosures. Whisenant, Sankaraguruswamy, and Raghunandan [2003] find no pre-SOX evidence that disclosures of internal control weaknesses, as reportable events via a change in auditor reported on Form 8-K, result in significant negative abnormal returns around the 8-K filing dates. Hammersley, Myers, and Shakespeare [2008], however, find a significant negative market reaction to material weakness ICDs disclosed under SOX 302.

To provide further insights into the market's immediate reaction to firms' initial announcements of an internal control problem, we calculate market-adjusted returns (BHAR) measured over a three-day window starting one day before and including the day after the announcement that contains the ICD disclosure.10 Panel A of Table 3 reports a mean (median) drop in share price of −0.76% (−0.41%) over the three-day window, which is significant at p= 0.00 (0.01). The average market cap of our sample firms at the beginning of fiscal year 2004 is $2,860 million, so a −0.76% abnormal return translates into a $21.74 million decline in market value, on average. Below, we link this negative market reaction to increases in the cost of equity.

Table 3.  Market Reaction to First Disclosure of Internal Control Deficiencies
Panel A: Market reaction to first internal control deficiency disclosure
 
VariablesMean Three-Day BHARaMedian Three-Day BHAR
ICD (N= 787)−0.76%***−0.41%**
Panel B: OLS regression testing for differences in market reactions between types of ICDs
inline image
 
VariablesPredicted SignCoefficient EstimateStandard Error
  1.  Panel A reports mean and median values of buy-and-hold three-day market adjusted returns (BHAR) centered on the first day that internal control deficiencies (ICDs) are disclosed in SEC filings for 787 firms for which daily return data are available from CRSP, and tests of whether the mean (median) values are significantly different from zero.

  2.  Panel B reports parameter estimates from the OLS estimation of BHAR (buy-and-hold three-day market-adjusted return centered on the ICD announcement) on the material weakness dummy variable for the 787 firms reporting an internal control deficiency. There are 149 observations where MATERIAL_WEAKNESS= 0 and 638 observations where MATERIAL_WEAKNESS= 1.

  3.  aMean BHAR (median BHAR) is assessed using a t-test (one-sample median test).

  4.  bMATERIAL_WEAKNESS= 1 for ICDs reported as material weaknesses, and 0 for significant deficiencies or control deficiencies.

  5.  ** and *** indicate significant difference from 0 at the 5% and 1% levels, respectively.

Intercept −0.001(0.006)
MATERIAL_WEAKNESSb−0.008(0.007)
Adjusted R2  0.00  
N 787 

When ICD disclosures are partitioned by the severity of the internal control problem, we find no significant difference between the market's response to material weaknesses and the market's response to significant deficiencies or control deficiencies. Specifically, we regress BHAR on a binary variable (MATERIAL_WEAKNESS) coded one for material weakness ICD disclosures, and zero otherwise. The regression results reported in panel B of Table 3 indicate an insignificant coefficient on MATERIAL_WEAKNESS, which is contrary to the findings in Hammersley, Myers, and Shakespeare [2008], who document a greater negative market reaction to material weakness ICDs compared to those that firms self-classify as being of lesser severity.11

Overall, our market reaction tests provide evidence that the market reacts negatively to signals that firms' internal controls are ineffective. However, it appears that the uncertainty about the differences between material weaknesses and significant deficiencies or control deficiencies (as discussed in Ashbaugh-Skaife, Collins, and Kinney [2007]) results in the market not making a significant distinction between the severity of ICDs.12

5.2 cross-sectional risk results

We begin our empirical tests of the risk effects of weak internal controls by investigating whether firms that report ICDs exhibit higher idiosyncratic risk (I_RISK) relative to non-ICD firms using an ordinary least squares (OLS) regression that controls for other factors that prior research shows to be related to idiosyncratic risk (Rajgopal and Venkatachalam [2005], Hanlon, Rajgopal, and Shevlin [2006], Pastor and Veronesi [2003], Wei and Zhang [2006]). Specifically, we estimate the following model:

  • image(4)

where all variables are as previously defined.

Based on the modeling in Lambert, Leuz, and Verrecchia [2007], we predict a positive coefficient on ICD as firms with internal control problems generate noisier (lower quality) accounting signals, thereby increasing the information risk faced by investors. Equation (4) controls for a number of innate firm characteristics that are shown to be related to idiosyncratic risk. CFO and STD_CFO are used to capture operating performance and the volatility of operations, respectively. We expect firms with underperforming operations and more volatile operations to exhibit greater I_RISK. Thus, we predict a negative (positive) coefficient on CFO (STD_CFO). SIZE and DIVPAYER represent firm size and firm maturity, where large firms and more mature firms are expected to be less risky. Therefore, we predict a negative relation among SIZE, DIVPAYER, and I_RISK. Finally, we expect firms with higher leverage (LEV) to exhibit greater I_RISK. We make no prediction about the association between BM and I_RISK or between RET and I_RISK. BM can reflect financial distress, which leads to a positive association between BM and the risk measure, or can proxy for growth opportunities, which leads to a negative association between BM and the risk measure. Rajgopal and Venkatachalam [2005] document a negative association between I_RISK and RET. However, Duffee [1995] finds that the association between I_RISK and RET is sensitive to the sample of firms used in the analysis. Specifically, he finds that the association varies depending on the treatment of firms that experience events such as bankruptcies, takeovers, and delistings. Therefore, while we include RET in the model, we leave the prediction unsigned.

The model 1 column of Table 4 displays the results of estimating equation (4). As expected, we find that larger firms, firms that more often pay dividends, firms with better operating performance, and firms with lower volatility of cash flows from operations exhibit lower idiosyncratic risk. We find a significant negative coefficient on BM that is consistent with the findings of Rajgopal and Venkatachalam [2005] and suggests that firms with greater growth opportunities have lower idiosyncratic risk. The results indicate a significant negative coefficient on LEV, contrary to expectations. However, when we eliminate from the sample firms that have little or no debt (i.e., LEV less than 0.10), we find, as expected, a positive coefficient on LEV, which indicates that firms with more financing risk exhibit higher idiosyncratic risk.13

Table 4.  Internal Control Deficiencies and Idiosyncratic Risk Model 1 inline imageModel 2 inline image
VariablesbPredicted SignModel 1Model 2
Coefficient EstimateStandard ErrorCoefficient EstimateStandard Error
  1.  This table reports the parameter estimates and standard errors from the OLS estimation of I_RISK (idiosyncratic risk) on the ICD dummy and other control variables. In model 1, 3,024 firms have ICD values of 0, while 587 firms have ICD values of 1. In model 2, 2,222 firms have ICD values of 0 and 513 firms have ICD values of 1. Variable definitions and measurements appear below.

  2.  aI_RISK= standard deviation of residuals from estimating EXRET01RMRF using monthly returns from 2004 and the prior four years, where EXRET= the firm's monthly return minus the risk-free rate and RMRF= excess return on the market obtained from the Website http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html.

  3.  bICD= 1 if the firm reports an internal control problem, and 0 otherwise; STD_CFO= standard deviation of cash flow from operations defined as cash flows from operations (Compustat #308) divided by total assets (Compustat #6) calculated using 2004 and the prior four fiscal years, requiring a minimum of three years of data; LEV= total debt (Compustat #9 plus Compustat #34) divided by total assets (Compustat #6) at the firm's 2004 fiscal year-end; CFO= cash flow from operations (Compustat #308) divided by total assets (Compustat #6) at the firm's 2004 fiscal year-end; BM= book value of equity (Compustat #60) divided by market value of equity (Compustat #199 multiplied by Compustat #25) at the firm's 2004 fiscal year-end; SIZE= natural log of market value of equity (Compustat #25 multiplied by Compustat #199) at the 2004 fiscal year-end; DIVPAYER= 1 if the firm pays dividends (Compustat # 21) in its 2004 fiscal year, and 0 otherwise; RET= buy-and-hold return over the firm's fiscal year; SEGMENTS= number of reported business segments (Compustat Segment file); FOREIGN_SALES= 1 if the firm reports foreign sales (Compustat Segment file), and 0 otherwise; M&A= 1 if the firm has a merger or acquisition from 2001 to 2003 (Compustat AFNT #1), and 0 otherwise; RESTRUCTURE= 1 if the firm restructures as indicated by a nonzero amount in any of the Compustat data items #376, 377, 378, or 379 from 2001 to 2003, and 0 otherwise; RGROWTH= decile rank of average sales growth rate from 2001 to 2003 (Compustat #12); INVENTORY= average of inventory to total assets from 2001 to 2003 (Compustat #3 divided by Compustat #6);%LOSS= proportion of years from 2001 to 2003 that the firm reports negative earnings; RZSCORE= decile rank of Altman [1980]z-score; AUDITOR_RESIGN= 1 if the auditor resigns in 2003, and 0 otherwise (8-K filings); RESTATEMENT= 1 if the firm has a restatement or an SEC Auditing Enforcement Release from 2001 to 2003, and 0 otherwise; AUDITOR = one if firm's auditor for 2003 (Compustat #149) is PricewaterhouseCoopers, Deloitte & Touche, Ernst & Young, KPMG, Grant Thornton, or BDO Seidman, and 0 otherwise; INST_CON= percentage of shares held by institutional investors divided by the number of institutions owning its stock (Thomson Financial Securities data) multiplied by 100; and LITIGATION= 1 if the firm is in a litigious industry (SIC codes 2833–2836, 3570–3577, 3600–3674, 5200–5961, and 7370), and 0 otherwise.

  4.  ** and *** indicate significant difference from 0 at the 5% and 1% levels, respectively.

Intercept 0.266***(0.005)0.290***(0.009)
ICD+0.010***(0.003)0.005**(0.003)
STD_CFO+0.161***(0.013)0.106***(0.014)
LEV+−0.029***(0.005)−0.037***(0.006)
CFO−0.073***(0.006)−0.003(0.007)
BM±−0.046***(0.003)−0.033***(0.004)
SIZE−0.011***(0.001)−0.015***(0.001)
DIVPAYER−0.060***(0.002)−0.034***(0.003)
RET±0.002(0.002)0.006***(0.002)
SEGMENTS   −0.002**(0.001)
FOREIGN_SALES   −0.001(0.003)
M&A   0.005**(0.002)
RESTRUCTURE   0.008***(0.002)
RGROWTH   0.002***(0.000)
INVENTORY   −0.008(0.009)
%LOSS   0.055***(0.004)
RZSCORE   −0.004***(0.001)
AUDITOR_RESIGN   0.009(0.011)
RESTATEMENT   0.002(0.004)
AUDITOR   −0.003(0.005)
INST_CON   −0.014***(0.002)
LITIGATION   0.019***(0.002)
Adjusted R2 0.49 0.57 
N 3,611 2,735 

Turning to the variable of interest, we find a positive and significant coefficient on ICD. This result indicates that, after controlling for operating, financing, and other risk attributes, firms with ineffective internal controls exhibit greater idiosyncratic risk than firms that do not report internal control problems.

The results reported in the model 1 column of Table 4 serve to benchmark the relation between firms' information quality as a function of internal controls and I_RISK after controlling for firm fundamentals documented in prior research to be related to idiosyncratic risk. Ashbaugh-Skaife, Collins, and Kinney [2007] report that firms are more likely to have ICDs when they have more segments, engage in foreign sales, participate in mergers and acquisitions, and engage in restructurings. These economic events also influence firms' operating performance and the volatility of operations. To ensure that our ICD variable is not proxying for some other inherent operating risk, we expand the I_RISK model with the ICD determinants documented in Ashbaugh-Skaife, Collins, and Kinney [2007] and estimate the following OLS regression:

  • image(5)

where:

SEGMENTS

the number of reported business segments in 2003 (Compustat Segment file);

FOREIGN_SALES

one if a firm reports foreign sales in 2003, and zero otherwise (Compustat Segment file);

M&A

one if a firm is involved in a merger or acquisition from 2001 to 2003, and zero otherwise (Compustat AFNT #1);

RESTRUCTURE

one if a firm is involved in a restructuring from 2001 to 2003, and zero otherwise (this variable is coded one if any of the following Compustat data items is nonzero: 376, 377, 378, or 379);

RGROWTH

the decile rank of average growth rate in sales from 2001 to 2003 (the percent change in Compustat #12);

INVENTORY

the average inventory to total assets from 2001 to 2003 (Compustat #3/Compustat #6);

%LOSS

the proportion of years from 2001 to 2003 that a firm reports negative earnings;

RZSCORE

the decile rank of the Altman [1968]z-score measure of distress risk;

AUDITOR_RESIGN

one if the auditor resigns from the client in 2003, and zero otherwise (8-K filings);

RESTATEMENT

one if a firm has a restatement or an SEC Accounting and Auditing Enforcement Release (AAER) from 2001 to 2003, and zero otherwise;

AUDITOR

one if the firm engages one of the largest six audit firms for 2003, and zero otherwise (Compustat #149), where the largest six audit firms include PricewaterhouseCoopers, Deloitte & Touche, Ernst & Young, KPMG, Grant Thornton, and BDO Seidman;

INST_CON

the percentage of shares held by institutional investors divided by the number of institutions that own the stock as of December 31, 2003 (Thomson Financial Securities data);

LITIGATION

one if a firm is in a litigious industry—SIC codes 2833–2836, 3570–3577, 3600–3674, 5200–5961, and 7370—and zero otherwise;

and all other variables are as previously defined. All ICD determinants are measured as of the firm's 2003 fiscal year-end or the average of the 2001 to 2003 values since prior economic events affect the likelihood of internal control problems reported in fiscal 2004 and after (Ashbaugh-Skaife, Collins, and Kinney [2007]). We do not make predictions on the sign of the ICD determinant coefficients because many of the ICD determinants proxy for similar constructs included in the basic I_RISK model (e.g., more risky operations).

The model 2 column of Table 4 displays the results of estimating equation (5). Eight of the 13 ICD determinants are significantly related to I_RISK and we continue to find significant coefficients on STD_CFO, LEV, BM, SIZE, and DIVPAYER. The CFO coefficient is no longer significant after including the ICD determinants, which also serve as measures of firm operating performance. One other finding that differs from the results reported in the model 1 column of Table 3 is that the coefficient on RET is now significantly positive. Most importantly, after including the additional control variables in the I_RISK model, we continue to find a positive and significant coefficient on ICD.14 This indicates that, after controlling for operating, financing, and internal control risk factors, firms with greater information risk due to internal control problems exhibit greater idiosyncratic risk.

Our next cross-sectional analysis examines the relation between ICDs and market risk (BETA). Similar to our I_RISK analysis, we estimate two models of BETA:

  • image(6)
  • image(7)

where all variables are as previously defined.

Equation (6) is the baseline model that includes the risk factors previously documented in the literature as being related to BETA (e.g., see Beaver, Kettler, and Scholes [1970]). We predict a positive coefficient on STD_CFO and COVCFO because firms with more volatile cash flows from operations are considered to be more risky firms. We expect CFO, SIZE, and DIVPAYER to be negatively related to BETA because firms with better operating performance, large firms, and more mature firms are expected to be less risky. We expect a positive coefficient on LEV because firms with greater financial risk are expected to have greater market risk. In addition, we expect a positive coefficient on INDBETA because firms that operate in riskier industries are expected to have greater market risk. Similar to our I_RISK analysis, we make no prediction on the association between BM and BETA because BM can proxy for growth or for financial distress. Equation (7) is the expanded model that controls for the determinants of ICDs.

The model 1 column of Table 5 displays the results of estimating equation (6). Consistent with expectations, we find a significantly positive coefficient on STD_CFO and significantly negative coefficients on CFO and DIVPAYER, indicating that firms with more volatile operation, firms with weak operating performance, and less mature firms exhibit larger market risk. Similar to the results presented in Table 4, we find a significantly negative coefficient on LEV. However, when we eliminate firms with little or no debt in their capital structure, the coefficient on LEV becomes insignificant. Inconsistent with expectations, we find a positive coefficient on SIZE. As noted earlier, many of the firm fundamentals in our risk models are highly correlated. A reduced form estimate of equation (6) that excludes DIVPAYER yields a negative relation between SIZE and BETA as shown in prior research (Beaver, Kettler, and Scholes [1970]).

Table 5.  Internal Control Deficiencies and Systematic Risk (Beta) Model 1 inline imageModel 2 inline image
VariablesbPredicted SignModel 1Model 2
Coefficient EstimateStandard ErrorCoefficient EstimateStandard Error
  1.  This table reports the parameter estimates and standard errors from the OLS estimation of BETA (systematic risk) on the ICD dummy and other control variables. In model 1, 3024 firms have ICD values of 0, while 587 firms have ICD values of 1. In model 2, 2222 firms have ICD values of 0 and 513 firms have ICD values of 1. Differences in sample sizes are due to data requirements for additional variables in model 2. Variable definitions and measurements appear below.

  2.  aBETA= estimate of β1 from EXRET01RMRF using monthly returns over the 60 months prior to the firm's 2004 fiscal year-end, requiring a minimum of 18 months, where EXRET= the firm's monthly return minus the risk-free rate; RMRF= excess return on the market obtained from the Website http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html.

  3.  bICD= 1 if the firm reports an internal control problem, and 0 otherwise; STD_CFO= standard deviation of cash flow from operations defined as cash flows from operations (Compustat #308) divided by total assets (Compustat #6) calculated using 2004 and the prior four fiscal years, requiring a minimum of three years of data; LEV= total debt (Compustat #9 plus Compustat #34) divided by total assets (Compustat #6) at the firm's 2004 fiscal year-end; CFO= cash flow from operations (Compustat #308) divided by total assets (Compustat #6) at the firm's 2004 fiscal year-end; BM= book value of equity (Compustat #60) divided by market value of equity (Compustat #199 multiplied by Compustat #25) at the firm's 2004 fiscal year-end; SIZE= natural log of market value of equity (Compustat #25 multiplied by Compustat #199) at the 2004 fiscal year-end; DIVPAYER= 1 if the firm pays dividends (Compustat # 21) in its 2004 fiscal year, and 0 otherwise; COVCFO= covariance of the firm's cash flows with market cash flows using quarterly cash flows from operations over 2004 and the prior four fiscal years, requiring a minimum of 12 quarters, divided by total assets of the firm (market) with the result multiplied by 1,000; INDBETA1 estimated from INDRET01RMRF using monthly returns over the 60 months prior to the firm's 2004 fiscal year-end, requiring a minimum of 18 months, where INDRET= the monthly value-weighted return on the industry portfolio (three-, two-, and one-digit SIC codes), requiring a minimum of 10 firms in the portfolio, minus RMRF; SEGMENTS= number of reported business segments (Compustat Segment file); FOREIGN_SALES= 1 if the firm reports foreign sales (Compustat Segment file), and 0 otherwise; M&A= 1 if the firm has a merger or acquisition from 2001 to 2003 (Compustat AFNT #1), and 0 otherwise; RESTRUCTURE= 1 if the firm restructures as indicated by a nonzero amount in any of the Compustat data items #376, 377, 378, or 379 from 2001 to 2003, and 0 otherwise; RGROWTH= decile rank of average sales growth rate from 2001 to 2003 (Compustat #12); INVENTORY= average of inventory to total assets from 2001 to 2003 (Compustat #3 divided by Compustat #6);%LOSS= proportion of years from 2001 to 2003 that firm reports negative earnings; RZSCORE= decile rank of Altman [1980]z-score; AUDITOR_RESIGN= 1 if the auditor resigns in 2003, and 0 otherwise (8-K filings); RESTATEMENT= 1 if firm has a restatement or an SEC AAER from 2001 to 2003, and 0 otherwise; AUDITOR= 1 if the firm's auditor for 2003 (Compustat #149) is PricewaterhouseCoopers, Deloitte & Touche, Ernst & Young, KPMG, Grant Thornton, or BDO Seidman, and 0 otherwise; INST_CON= percentage of shares held by institutional investors divided by the number of institutions owning its stock (Thomson Financial Securities data) multiplied by 100; and LITIGATION= 1 if the firm is in a litigious industry (SIC codes 2833–2836, 3570–3577, 3600–3674, 5200–5961, and 7370), and 0 otherwise.

  4.  *, **, and *** indicate significant difference from 0 at the 10%, 5%, and 1% levels, respectively.

Intercept 0.446***(0.073)0.599***(0.123)
ICD+0.068**(0.037)0.048*(0.037)
STD_CFO+1.214***(0.173)0.803***(0.194)
LEV+−0.225***(0.065)−0.447***(0.079)
CFO−1.010***(0.082)−0.200**(0.095)
BM±−0.205***(0.045)−0.042(0.051)
SIZE0.064***(0.008)0.029**(0.012)
DIVPAYER−0.585***(0.033)−0.355***(0.040)
COVCFO+−0.364(0.258)−0.149(0.271)
INDBETA+0.654***(0.021)0.481***(0.024)
SEGMENTS   −0.057***(0.010)
FOREIGN_SALES   0.102***(0.035)
M&A   0.045(0.032)
RESTRUCTURE   0.156***(0.032)
RGROWTH   0.001(0.006)
INVENTORY   −0.292**(0.126)
%LOSS   0.795***(0.051)
RZSCORE   −0.033***(0.008)
AUDITOR_RESIGN   0.185(0.146)
RESTATEMENT   0.036(0.057)
AUDITOR   0.112*(0.061)
INST_CON   −0.172***(0.022)
LITIGATION   0.184***(0.034)
      
Adjusted R2 0.41 0.51 
N 3,611 2,735 

The key result reported in model 1 of Table 5 is the positive coefficient on ICD, which indicates that firms with ineffective internal control exhibit higher BETAs relative to firms with effective internal control after controlling for known sources of beta risk. Results of estimating equation (7), which controls for known risk factors and ICD determinants (model 2 column of Table 5), provide additional evidence that firms with ineffective internal control have greater market risk as the coefficient on ICD is positive and significant at conventional p-values.

Overall, the results reported in Table 4 and Table 5 suggest that firms with ineffective internal control present greater information risk to investors, as investors assess larger variances in cash flows (I_RISK) and covariances in cash flows (BETA) for firms with low-quality financial information (Lambert, Leuz, and Verrecchia [2007]).

5.3 cost of capital analysis

5.3.1. Discussion and Validation of Alternative Implied Cost of Equity Measures Prior to presenting our cross-sectional tests of the effects of ICDs on cost of equity, we provide an overview of alternative cost of equity proxies and justification for our proxy. Conceptually, the cost of equity capital is the discount rate the market applies to a firm's future cash flows to determine its current stock price. We measure firms' implied cost of equity by taking the average of Value Line's high and low annualized expected return for a three- to five-year horizon.15 Value Line's expected return is the discount rate that equates their three- to five-year target price forecasts and dividend forecasts to a firm's current price. The target prices are provided quarterly, and Value Line updates the current prices and subsequently updates firms' expected returns between Value Line report dates. For our cross-sectional tests we measure firms' cost of equity capital, labeled CC, as the average expected return over the firm's fiscal year.16 Averages are comprised of a minimum of 4 and a maximum of 12 expected return measures.

The fact that the Value Line expected return proxy for firms' implied cost of equity is updated frequently is an important research design feature in our setting because the ICDs whose effects we seek to capture are potentially short lived in nature. After ICDs are discovered and publicly reported, management faces added incentives to develop and implement an action plan to remediate these deficiencies. For a significant number of our sample firms that disclose ICDs in fiscal 2004, the deficiency is remediated within a 6- to 18-month period. If the market anticipates that most ICDs are remediated within a relatively short time frame, then a higher discount rate should be assigned to the near-term cash flows and a lower discount rate should be applied to cash flows further into the future when the control deficiencies are expected to be resolved.17 Therefore, to better detect a cost of equity effect of internal control problems and their remediation it is important that the cost of equity estimates be updated in a timely fashion and that the estimates be based upon a technique that does not require that the same discount rate be applied to all future periods. If the method used to estimate cost of equity assumes the same discount rate for all periods, it may be harder to detect the short-term ICD effects hypothesized in this study because the estimated cost of equity is an average of a higher discount rate applied to shorter term cash flows and a lower, more normal, rate applied to cash flows further into the future. The Value Line expected return does not restrict the discount rates for periods beyond the target price horizon to be the same as the near term (three- to five-year) discount rates. In contrast, other popular implied cost of capital estimation techniques typically assume that the same discount rate applies before and after the terminal value year.18

A variety of implied cost of capital estimates have been proposed in the literature (see Botosan and Plumlee [2005] for a detailed discussion of these alternative approaches). Theoretical and empirical research indicates that a “good” measure of implied cost of capital is positively related to beta and the book-to-market ratio and negatively related to size (Sharpe [1964], Lintner [1965], Black [1972], Berk [1995], Fama and French [2006], Botosan and Plumlee [2005]). Using these criteria, we find that the Value Line expected return measure is positively related to beta and the book-to-market ratio and negatively related to size.

Guay, Kothari, and Shu [2005] develop an alternative technique for evaluating implied cost of equity measures. Their evaluation is based on the association between measures of expected return and future realized returns. Based on the premise that expected returns, on average, should equal realized returns if the market's expected returns reflect rational expectations, they posit that regressing future realized returns on an estimate of expected returns should yield a coefficient of one for good estimates of expected returns, or in the following equation, δ1 should equal one.

  • image(8)

where RETt is the firms' realized returns in period t, and E(RETt) is a proxy for the firms' expected return at the beginning of period t. Thus, the appropriateness of an implied cost of equity measure is evaluated based on whether the estimated δ1 in equation (8) is not significantly different from one.

We validate our cost of equity measure using the methodology developed by Guay, Kothari, and Shu [2005]. Specifically, following the approach in Fama and MacBeth [1973], we regress future monthly returns on estimated monthly expected returns, calculated as the Value Line expected return divided by 12.19 The average monthly δ1 coefficient is 0.66, which is significantly different from zero at p= 0.08 (two-tailed). As noted by Guay, Kothari, and Shu [2005], if the expected return measure in equation (8) is a good proxy for the market's rational expectations of future returns, the δ1 coefficient is predicted to be one. The p-value associated with the test of whether 0.66 equals one is 0.47, two-tailed. Thus, we conclude that the Value Line expected return serves as a reasonably good proxy for firms' cost of equity.

To determine whether we should incorporate alternative cost of equity capital measures into our empirical tests, we investigate the reasonableness of the positive earnings growth (PEG) ratio (Easton [2004]) as a cost of equity proxy. The results of Botosan and Plumlee [2005] suggest that this measure performs well as a proxy for firms' cost of equity relative to other estimates used in prior literature.20 We use I/B/E/S consensus analysts' earnings forecast data to calculate PEG ratio estimates of firms' cost of equity. In untabled analyses, we find that the PEG ratio cost of capital estimates are positively related to beta and the book-to-market ratio and negatively related to size, as expected. However, when we estimate equation (8) using the PEG ratio, the δ1 coefficient is −0.02, insignificantly different from zero and significantly different from one.21 Thus, for our sample, the PEG ratio proxy for implied cost of equity fails the rational expectations test of Guay, Kothari, and Shu [2005].

To summarize, the results indicate that our implied cost of equity measure, based on the Value Line expected return, serves as a better proxy for firms' cost of equity because it meets the criteria of reasonableness outlined above whereas the PEG ratio proxy fails to meet the Guay, Kothari, and Shu [2005] rational expectations criteria. Moreover, in test results reported below, we demonstrate that changes in Value Line expected returns are sensitive to whether ICDs are remediated or are more persistent, which is consistent with this implied cost of equity measure being more appropriate for the setting that we investigate.

5.3.2. Cost of Capital Cross-sectional ResultsTable 6 displays the descriptive statistics for the Value Line cost of capital estimate (CC) and the risk measures that serve as control variables in our cost of capital tests: BETA, SIZE, BM, and I_RISK. The mean (median) CC value for ICD firms is 15.006% (13.750%), whereas the mean and median CC values for the non-ICD firms are significantly less (12.523% and 11.500%, respectively). The univariate tests also indicate that both the means and medians for BETA, BM, and I_RISK are larger for ICD firms. However, on average, ICD firms are smaller than non-IDC firms based on market value of equity.

Table 6.  Descriptive Statistics for Cost of Equity Subsamples
ICDa firms (N= 221)
 
Variablesb,cMeand,eMedianQ1Q3Std. Dev.
  1.  This table presents descriptive statistics and tests of differences in means and medians of cost of equity (CC), systematic risk (BETA), SIZE, book-to-market ratio (BM), and idiosyncratic risk (I_RISK) between 221 firms reporting ICDs and 1,183 firms not reporting ICDs for which Value Line data are available to estimate cost of equity. Variable definitions and measurements appear below.

  2.  aICD= 1 if the firm reports an internal control problem, and 0 otherwise (non-ICD firms).

  3.  bCC= average annual Value Line three- to five-year expected return over the 12 months encompassing the firm's 2004 fiscal year; BETA= estimate of β1 from EXRET01RMRF using monthly returns over the 60 months prior to the firm's 2004 fiscal year-end, requiring a minimum of 18 months, where EXRET= the firm's monthly return minus the risk-free rate and RMRF= excess return on the market obtained from the Website http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html; SIZE= natural log of market value of equity (Compustat #25 multiplied by Compustat #199) at the 2004 fiscal year-end; BM= book value of equity (Compustat #60) divided by market value of equity (Compustat #199 multiplied by Compustat #25) at the firm's 2004 fiscal year-end; and I_RISK= standard deviation of residuals from estimating EXRET01RMRF using monthly returns from 2004 and the prior four years.

  4.  cVariables measured as of the firm's fiscal 2004 year-end.

  5.  dDifferences in means (medians) are assessed using a t-test (Wilcoxon rank sum test).

  6.  eBold text indicates that ICD firms are significantly different from non-ICD firms at p= 0.05 (two-tailed).

CC15.00613.75010.50018.1256.370
BETA1.3671.108 0.556 1.9991.057
SIZE7.3497.158 6.428 8.2421.447
BM0.4950.460 0.285 0.6320.278
I_RISK0.1400.129 0.095 0.1750.064
 
Non-ICD firms (N= 1,183)
 
VariablesMeanMedianQ1Q3Std. Dev.
 
CC12.52311.5008.75015.0005.477
BETA1.0110.7570.378 1.4100.891
SIZE8.0257.8966.961 8.9951.478
BM0.4270.4010.260 0.5690.230
I_RISK0.1170.1000.078 0.1400.057

As an initial test of our predictions regarding the effects of ICDs on the cost of equity, we use the following model:

  • image(9)

where all variables are as previously defined. This simplified model that omits BETA and I_RISK allows us to measure the full effect of internal control problems on firms' cost of equity through the γ1 coefficient because the effects of ICDs on BETA and I_RISK are not removed, as is typically done in prior research.

The model 1 column of Table 7 reports results of estimating equation (9). The signs of the coefficients on the risk factors are as expected in that we find that CC is positively related to BM and negatively related to SIZE. We also find a significantly positive γ1 coefficient on ICD of 1.938. The model 2 column of Table 7 reports results of estimating equation (9) after expanding the CC model to include BETA and I_RISK.22 Although the coefficient on the ICD variable is considerably smaller (1.141), it is still highly significant, indicating that control weaknesses have an effect on firms' cost of equity beyond the effects captured through historical BETA and I_RISK estimates.23 This result supports our general hypothesis that firms that have ICDs exhibit higher costs of equity than firms that do not.

Table 7.  Internal Control Deficiencies and Cost of Equityinline image
VariablesbPredicted SignModel 1Model 2Model 3
Coefficient EstimateStandard ErrorCoefficient EstimateStandard ErrorCoefficient EstimateStandard Error
  1.  This table reports the parameter estimates and standard errors from the OLS estimation of cost of equity (CC) on the ICD dummy, other determinants of cost of equity, and control variables. In model 1 and model 2, 1,183 firms have ICD values of 0 and 221 firms have ICD values of 1. In model 3, 834 firms have ICD values of 0 and 193 firms have ICD values of 1. Differences in sample sizes are due to data requirements for additional variables in model 3. Variable definitions and measurements appear below.

  2.  aCC= average annual Value Line three- to five-year expected return over the 12 months encompassing the firm's 2004 fiscal year.

  3.  bICD= 1 if the firm reports an internal control problem, and 0 otherwise; BETA= estimate of β1 from EXRET01RMRF using monthly returns over the 60 months prior to the firm's 2004 fiscal year-end, requiring a minimum of 18 months, where EXRET= the firm's monthly return minus the risk-free rate, RMRF= excess return on the market obtained from the Website http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html; SIZE= natural log of market value of equity (Compustat #25 multiplied by Compustat #199) at the 2004 fiscal year-end; BM= book value of equity (Compustat #60) divided by market value of equity (Compustat #199 multiplied by Compustat #25) at the firm's 2004 fiscal year-end; I_RISK= standard deviation of residuals from estimating EXRET01RMRF using monthly returns from 2004 and the prior four years; SEGMENTS= number of reported business segments (Compustat Segment file); FOREIGN_SALES= 1 if the firm reports foreign sales (Compustat Segment file), and 0 otherwise; M&A= 1 if the firm has a merger or acquisition from 2001 to 2003 (Compustat AFNT #1), and 0 otherwise; RESTRUCTURE= 1 if the firm restructures as indicated by a nonzero amount in any of Compustat data items #376, 377, 378, or 379 from 2001 to 2003, and 0 otherwise; RGROWTH= decile rank of average sales growth rate from 2001 to 2003 (Compustat #12); INVENTORY= average of inventory to total assets from 2001 to 2003 (Compustat #3 divided by Compustat #6);%LOSS= proportion of years from 2001 to 2003 that the firm reports negative earnings; RZSCORE= decile rank of Altman [1980]z-score; AUDITOR_RESIGN= 1 if the auditor resigns in 2003, and 0 otherwise (8-K filings); RESTATEMENT= 1 if the firm has a restatement or an SEC AAER from 2001 to 2003, and 0 otherwise; AUDITOR= 1 if the firm's auditor for 2003 (Compustat #149) is PricewaterhouseCoopers, Deloitte & Touche, Ernst & Young, KPMG, Grant Thornton, or BDO Seidman, and 0 otherwise; INST_CON= percentage of shares held by institutional investors divided by the number of institutions owning its stock (Thomson Financial Securities data) multiplied by 100; and LITIGATION= 1 if the firm is in a litigious industry (SIC codes 2833–2836, 3570–3577, 3600–3674, 5200–5961, and 7370), and 0 otherwise.

  4.  *, **, and *** indicate significant difference from 0 at the 10%, 5%, and 1% levels, respectively.

Intercept 17.933***(0.949)7.375***(1.112)12.783***(3.101)
ICD+1.938***(0.411)1.141***(0.369)0.667**(0.410)
BETA+  1.355***(0.204)0.879***(0.268)
SIZE−0.719***(0.103)−0.063(0.103)−0.390**(0.185)
BM+0.849***(0.638)2.358***(0.579)3.209***(0.735)
I_RISK+  27.992***(3.493)15.446***(4.440)
SEGMENTS     −0.056(0.097)
FOREIGN_SALES     −0.854*(0.488)
M&A     −0.455*(0.335)
RESTRUCTURE     −0.053(0.366)
RGROWTH     0.215***(0.086)
INVENTORY     2.361(1.539)
%LOSS     3.270***(0.671)
RZSCORE     −0.257***(0.096)
AUDITOR_RESIGN     0.924(2.550)
RESTATEMENT     −0.230(0.653)
AUDITOR     −0.034(2.258)
INST_CON     −0.991*(0.767)
LITIGATION     0.988***(0.392)
Adjusted R2 0.06 0.25 0.28 
N 1,404 1,404 1,027 

To provide further evidence on the effect of ICDs on the cost of equity, we expand our CC model with the ICD determinants of the Ashbaugh-Skaife, Collins, and Kinney [2007] model:

  • image(10)

where all variables are as previously defined.

The model 3 column of Table 7 presents results of the cross-sectional CC model after including the additional control variables (equation (10)). While the magnitude of the coefficient on the ICD variable reported in the last column of Table 7 is reduced relative to the results in the model 1 and model 2 columns, we continue to find a positive and significant association between the cost of equity and ICD after controlling for ICD determinants that capture differences in firms' operating risks.

Collectively, the findings reported in Table 7 provide support for the notion that information risk due to ineffective internal control is associated with a higher cost of equity.

5.3.3. Change in Cost of Equity Analysis The cross-sectional results reported above suggest that ineffective internal control is associated with a higher cost of equity, but these results provide little basis for inferring causality. To help assess whether a causal relation may exist between ICDs and cost of equity, we conduct four intertemporal change tests. The first analysis tests whether there is a change in the cost of equity when firms first report an ICD under SOX. Furthermore, because the market holds expectations for the quality of firms' internal controls based on observable events (see Ashbaugh-Skaife, Collins, and Kinney [2007], Doyle, Ge, and McVay [2007b]), we examine whether the magnitude of the change in cost of equity is inversely related to the market's assessed likelihood that a firm reports an ICD.

We start by identifying the first ICD report date for 162 sample firms for which we have Value Line CC estimates both before and after the ICD report date and data necessary to estimate the ICD determinant model in the appendix that is used to calculate the firm-specific probability of reporting an ICD (see Ashbaugh-Skaife, Collins, and Kinney [2007] for a complete discussion of the variables used in the ICD determinant model). We then compare the CC estimate predisclosure to the CC estimate postdisclosure.24 In addition, we divide the 162 firms into deciles based on the likelihood of reporting an ICD to assess whether there are differences in the magnitude of changes in cost of equity conditional on the likelihood of a firm reporting an ICD.

Panel A of Table 8 reports the mean and median cost of equity estimates for the 162 firms. We report both raw and market-adjusted CC estimates, where the market-adjusted cost of equity is the difference between the firm's cost of equity and the average cost of equity for all firms on Value Line not reporting an ICD over the same time interval. The descriptive statistics indicate that both the raw and market-adjusted cost of equity increase after firms' first disclosure of an ICD.

Table 8.  Change in Cost of Equity: Pre- versus Post–First ICD Disclosure
Panel A: Descriptive statistics on cost of equity (CC) pre- and post–first ICD disclosure (N= 162)
 
Cost of Equity MeasuresMeanMedianQ1Q3Std. Dev.
Pre–first ICD CCa15.87814.75011.00018.2507.391
Post–first ICD CC16.99015.00011.75019.7508.289
Pre–first ICD market-adjusted CC 4.042 2.917−0.500 6.5007.420
Post–first ICD market-adjusted CC 4.969 2.9790.000 7.7508.272
Panel B: Firm-specific change in market-adjusted cost of equity (ΔCC) (post–first ICD CC minus pre–first ICD CC)
 MeanbMedian
ΔCCc full sample (N= 162)0.927**1.042**
ΔCC for least likely firms to report ICDs (N= 48)d1.254*1.375
ΔCC for most likely firms to report ICDs (N= 48)0.4900.750
Panel C: OLS regression of three-day BHAR regressed on firm-specific change in market-adjusted cost of of capital (ΔCC) and change in expected earnings growth (ΔEG)
inline image
VariablesPredicted SignCoefficient EstimateStandard Error
  1.  Panel A presents descriptive statistics for implied cost of equity (CC) estimates pre- and post–first disclosure of an internal control deficiency (ICD). The first two rows provide descriptive statistics for unadjusted CC estimates and the last two rows provide descriptive statistics for market-adjusted CC estimates.

  2.  Panel B presents mean and median estimates and tests of significance of the change in the market-adjusted cost of equity from before to after the first disclosure of an ICD for the sample of ICD firms with sufficient Value Line data to estimate the change in cost of equity and with sufficient data to estimate the logit model for the existence and disclosure of ICDs (see appendix). The partitioning of firms into least likely and most likely to report ICDs is based on the logit model parameter estimates reported in the appendix.

  3.  Panel C reports the parameter estimates and standard errors from the OLS estimation of the three-day buy-and-hold market-adjusted return centered on the first disclosure of an ICD on the change in the market-adjusted cost of equity (ΔCC) and the forecasted three- to five-year earnings growth estimated by Value Line.

  4.  Variable definitions and measurements are reported below.

  5.  aPre–first ICD CC and post–first ICD CC are calculated as the Value Line expected returns averaged over a maximum of 180 days before and after the first ICD disclosure, respectively. The number of Value Line expected returns reported during these 180-day windows ranges from two to six. CC= cost of equity capital measured as the average annual Value Line expected return for a three- to five-year horizon; market-adjusted cost of capital = difference between the firm's cost of capital and the average cost of capital for all firms on Value Line not reporting an ICD over the same time interval.

  6.  bMeans (medians) are assessed using a t-test (one-sample median test) testing whether the mean and median values are different from 0.

  7.  cΔCC= post–first ICD CC minus pre–first ICD CC; ΔEG= Value Line forecasted three- to five-year earnings growth following the initial ICD disclosure less the same forecast prior to the first ICD disclosure.

  8.  dLeast likely (most likely) firms to report ICDs represents the firms falling in the lower (upper) three deciles of probability of reporting an ICD based on the Ashbaugh-Skaife, Collins, and Kinney [2007] ICD model presented in the appendix.

  9.  *, **, and *** indicate significant difference from 0 at the 10%, 5%, and 1% levels, respectively.

Intercept −0.974***(0.372)
ΔCC−0.176***(0.068)
ΔEG+0.062(0.056)
Adjusted R2 0.03 
N 162 

Panel B of Table 8 reports that the mean (median) firm-specific change in cost of equity for the 162 firms is 0.927% (1.042%),25 which is significantly different from zero at p= 0.02.26 In addition, panel B of Table 8 reports the firm-specific change in cost of equity for subsamples of the 162 firms, where subsamples are partitioned by the likelihood of disclosing an ICD (where firms in the lower three deciles are deemed less likely and firms in the upper three deciles are deemed more likely). As expected, we find that the cost of equity increase following the ICD report is greater for firms deemed least likely to report an ICD (1.254% and significant at p= 0.06) relative to firms deemed most likely to report ICDs (0.490% and not significant at conventional p-values).27

As a further validation of the cost of equity change results, we investigate the relation between the three-day market-adjusted buy-and-hold return (BHAR) associated with the initial ICD disclosures reported in Table 3 and the change in cost of equity (ΔCC) and change in forecasted earnings growth (ΔEG) following the approach outlined in Hail and Leuz [2008]. This approach attempts to decompose the price reaction to the first ICD announcement into a portion that is due to changes in risk assessment and a portion due to changes in expected future cash flows (proxied by ΔEG). We estimate the following OLS regression for the 162 firms for which we have the necessary data and expect a negative (positive) relation between BHAR and ΔCCEG).

  • image(11)

where ΔCC is equal to the CC estimate after the first ICD disclosure minus the CC estimate before the first ICD disclosure, ΔEG is the Value Line forecasted three- to five-year earnings growth rate immediately following the first ICD disclosure minus this forecast just prior to the first ICD disclosure.

The results reported in panel C of Table 8 indicate a negative and significant coefficient on ΔCC and a positive, but insignificant, coefficient on ΔEG. Thus, in the cross-section, firms with a larger negative market reaction on the initial disclosure of an ICD exhibit a larger increase in cost of equity. This finding provides additional evidence that changes in firms' cost of equity are the result of firms' disclosure of ICDs to the market. Based on the results reported in Table 8, we conclude that the initial revelation of an ICD results in investors assigning a higher cost of equity to firms and that this revision in cost of equity is greater for firms that are least likely to report an ICD based on observable firm characteristics.

As a second test to link ICD disclosures to changes in firms' cost of equity, we investigate whether there is a change in the cost of equity when investors learn that firms remediated their ICDs. Specifically, we examine the change in the cost of equity surrounding the release of an unqualified SOX 404 opinion for the sample of firms that previously disclosed an ICD under SOX 302. In conducting this analysis, we require firms to have at least two months between the release of the SOX 302 ICD and the unqualified SOX 404 audit opinion to ensure that investors have sufficient time to revise their cost of equity estimates.

Panel A of Table 9 reports descriptive statistics on the cost of equity for the 38 “remediation” firms with sufficient Value Line data to conduct our change analysis. We posit that when investors receive confirmation from a firm's independent auditor that prior ICDs are resolved, the information risk they face goes down, leading to a reduction in the firm's cost of equity. Consistent with this prediction, we find that the mean (median) cost of equity (both raw and market-adjusted) decreases from the 180 days prior to the 180 days after the filing of the unqualified SOX 404 opinion. In addition, the results reported in panel B of Table 9 indicate that there is a significant reduction in the remediation firms' market-adjusted cost of equity following release of the unqualified SOX 404 opinion (mean change =−1.513%, median change =−1.313%). Collectively, the findings reported in Table 9 are consistent with the market responding to the reduction in information risk due to improved internal control by reducing firms' cost of equity.

Table 9.  Change in Cost of Equity: Remediation of Internal Control Deficiencies
Panel A: Descriptive statistics on cost of equity (CC) for firms disclosing an ICD under 302 and receiving an unqualified SOX 404 opinion (N= 38)a
VariablesMeanMedianQ1Q3Std. Dev.
Pre–404 CCb15.83613.75010.50019.0008.500
Post–404 CC14.50312.7509.00016.0008.593
Pre–404 market-adjusted CC4.0962.125−1.6257.2928.501
Post–404 market-adjusted CC2.5830.792−2.7504.3338.592
Panel B: Firm-specific change in market-adjusted cost of equity (ΔCC) for firms disclosing an ICD under 302 and receiving an unqualified SOX 404 opinion (post-404 CC minus pre-404 CC)
VariablesMeancMedian
  1.  Panel A presents descriptive statistics for implied cost of equity (CC) estimates pre- and postreceipt of an unqualified SOX 404 audit opinion indicating remediation of a previously disclosed internal control deficiency (ICD). The first two rows provide descriptive statistics for unadjusted CC estimates and the last two rows provide descriptive statistics for market-adjusted CC estimates.

  2.  Panel B presents mean and median estimates and tests of significance of the change in market-adjusted cost of equity from before to after receipt of an unqualified SOX 404 audit opinion for firms that previously disclosed an ICD.

  3.  Variable definitions and measurements are reported below.

  4.  aThe sample for panels A and B consists of firms that disclose an ICD under section 302 at least two months prior to the issuance of an unqualified SOX 404 opinion that has Value Line cost of equity estimates in both the pre-404 and post-404 periods (N= 38).

  5.  bPre-404 CC and post-404 CC are calculated using a maximum of 180 days before and after the issuance of the SOX 404 internal control audit report, respectively. CC= cost of equity defined as the average annual Value Line three- to five-year expected return over the 12 months encompassing the firm's 2004 fiscal year; market-adjusted cost of equity = difference between the firm's cost of equity and the average cost of equity for all firms on Value Line not reporting an ICD over the same time interval.

  6.  cMeans (medians) are assessed using a t-test (one-sample median test) testing whether the mean and median values are different from 0.

  7.  dΔCC= post-404 CC minus pre-404 CC.

  8.  ** indicates significant difference from 0 at the 5% level.

ΔCCd for firms that remediated their ICDs (n= 38)−1.513**−1.313**

In contrast to the remediating firms, our third change test investigates whether the cost of equity changes around the release of an adverse SOX 404 audit opinion for the 50 ICD firms with necessary Value Line data that fail to remediate their ICDs. For these firms, one might expect no increase in cost of equity at the release of an adverse SOX 404 opinion because the market has already increased its cost of equity assessments to reflect the initial ICD disclosure (Table 8). Alternatively, there may be a modest increase in cost of equity because the adverse SOX 404 audit opinion may indicate that the firm is unwilling or unable to remediate its internal control problems or perhaps new ICDs have surfaced upon closer scrutiny by the auditor. In panel A of Table 10, we report descriptive statistics on raw and market-adjusted CC for the 50 firms that failed to remediate their control problems prior to the SOX 404 audit. Panel B of Table 10 reports the mean and median market-adjusted ΔCC around the SOX 404 audit opinion. We find a modest, but insignificant, increase in cost of equity around the adverse opinion release (mean = 0.671%, median = 0.146%).

Table 10.  Change in Cost of Equity: No Remediation of Internal Control Deficiencies
Panel A: Descriptive statistics on cost of equity (CC) for firms disclosing an ICD under 302 and an ICD under 404 (N= 50)a
VariablesMeanMedianQ1Q3Std. Dev.
Pre-404 CCb16.77515.50012.00017.5007.991
Post-404 CC17.48515.43812.00020.0008.643
Pre-404 market-adjusted CC 4.921 3.708 0.042 5.4588.000
Post-404 market-adjusted CC 5.591 3.542 0.333 8.4508.615
Panel B: Firm-specific change in the market-adjusted cost of equity (ΔCC) for firms disclosing an ICD under 302 and an ICD under 404 (post-404 CC minus pre-404 CC)
VariablesMeancMedian
  1.  Panel A presents descriptive statistics for implied cost of equity (CC) estimates pre- and postreceipt of a qualified SOX 404 audit opinion indicating nonremediation of a previously disclosed internal control deficiency (ICD). The first two rows provide descriptive statistics for unadjusted CC estimates and the last two rows provide descriptive statistics for market-adjusted CC estimates.

  2.  Panel B presents mean and median estimates and tests of significance of the change in market-adjusted cost of equity from before to after receipt of an adverse SOX 404 audit opinion for firms that previously disclosed an ICD.

  3.  Variable definitions and measurements are reported below.

  4.  aThe sample for panels A and B consists of all firms that disclose ICDs before the implementation of section 404 internal control audits, that receive an adverse SOX 404 opinion, and that have Value Line cost of equity estimates in both the pre-404 and post-404 periods (N= 50).

  5.  bPre-404 CC and post-404 CC are calculated using a maximum of 180 days before and after the issuance of the SOX 404 internal control audit report, respectively. CC= cost of equity defined as the average annual Value Line three- to five-year expected return over the 12 months encompassing the firm's 2004 fiscal year; market-adjusted cost of equity = the difference between the firm's cost of equity and the average cost of equity for all firms on Value Line not reporting an ICD over the same time interval.

  6.  cMeans (medians) are assessed using a t-test (one-sample median test) testing whether the mean and median values are different from 0.

  7.  dΔCC= post-404 CC minus pre-404 CC.

ΔCCd for ICD firms not remediating the ICD (N= 50)0.6710.146

Our last set of intertemporal change tests uses the “control sample” of firms that did not disclose ICDs under SOX 302 or 404 and received unqualified SOX 404 opinions, that is, firms that never reported internal control problems and the effectiveness of internal controls was confirmed by an independent review by the outside auditor. Following the work in Ashbaugh-Skaife, Collins, and Kinney [2007] and Doyle, Ge, and McVay [2007b], we posit that the market sets expectations for the quality of firms' internal controls based on observable economic events or firm characteristics prior to receiving a SOX 404 audit opinion. Our final change analysis investigates whether there are changes in cost of equity around the release of an unqualified SOX 404 opinion for firms that investors expect (do not expect) to report an ICD.

Panel A of Table 11 displays descriptive statistics for the cost of equity pre- and postissuance of the unqualified SOX 404 opinion for the 685 non-ICD firms with available expected returns from Value Line. In panel B of Table 11, we partition the sample based on the likelihood of a firm reporting an ICD. We find that the subsample of firms most likely to report an ICD (top three deciles) exhibits a significant reduction in the cost of equity following the release of an unqualified SOX 404 opinion. Specifically, the mean change in the market-adjusted cost of equity is −1.159% (significant at p= 0.01) and the median change is −0.583% (significant at p= 0.05). In contrast, we find no significant change in cost of equity for the firms least likely to report an ICD (bottom three deciles).28 Thus, the market appears to reward firms expected to have ineffective controls after the SOX 404 opinion confirms internal control effectiveness. This finding provides evidence that the reporting requirements of SOX 404 provide a cost of equity benefit to firms with effective internal controls.

Table 11.  Change in Cost of Equity: No Internal Control Deficiencies (Control Firms)
Panel A: Descriptive statistics on the cost of equity (CC) for firms receiving an unqualified SOX 404 opinion and having no prior disclosures of ICDs (N= 685)a
VariablesMeanMedianQ1Q3Std. Dev.
Pre-404 CCb13.61212.000 9.00016.2506.628
Post-404 CC13.81612.500 9.00017.5007.512
Preperiod market-adjusted CC 1.612 0.167−2.833 4.4176.633
Postperiod market-adjusted CC 1.622 0.333−3.333 5.2507.514
Panel B: Firm-specific change in the market-adjusted cost of equity (ΔCC) for firms receiving an unqualified SOX 404 opinion and having no prior disclosures of ICDs
VariablesMeancMedian
  1.  Panel A presents descriptive statistics for implied cost of equity (CC) estimates pre- and postreceipt of an unqualified SOX 404 audit opinion for firms with no previously disclosed internal control deficiency (ICD). The first two rows provide descriptive statistics for unadjusted CC estimates and the last two rows provide descriptive statistics for market-adjusted CC estimates.

  2.  Panel B presents mean and median estimates and tests of significance of the change in market-adjusted cost of equity from before to after receipt of an unqualified SOX 404 audit opinion for firms that previously do not disclose an ICD. The partitioning of firms into least likely and most likely to report ICDs is based on the logit model parameter estimates reported in the appendix.

  3.  aThe sample consists of all firms receiving an unqualified SOX 404 opinion that do not disclose prior ICDs under section 302 (N= 685) and that have Value Line cost of equity estimates in both the pre-404 and post-404 periods.

  4.  bPre-404 CC and post-404 CC are calculated using a maximum of 180 days before and after the issuance of the SOX 404 internal control audit report, respectively. CC= cost of equity defined as the average annual Value Line three- to five-year expected return over the 12 months encompassing the firm's 2004 fiscal year; market-adjusted cost of equity = the difference between the firm's cost of equity and the average cost of equity for all firms on Value Line not reporting an ICD over the same time interval. ΔCC= post-404 CC minus pre-404 CC.

  5.  cMeans (medians) are assessed using a t-test (one-sample median test), testing whether the mean (median) values are different from 0.

  6.  dLeast likely (most likely) firms to report ICDs represents the firms falling in the lower (upper) three deciles of probability of reporting an ICD based on the Ashbaugh-Skaife, Collins, and Kinney [2007] ICD model presented in the appendix.

  7.  ** and *** indicate significant difference from 0 at the 5% and 1% levels, respectively.

ΔCCd for firms that do not report ICDs (N= 685) 0.010 0.250
ΔCC for least likely firms to report ICDs that do not (N= 205)d 0.141 0.250
ΔCC for most likely firms to report ICDs that do not (N= 205)−1.159***−0.583**

In summary, the results presented in Table 8 through Table 11 provide evidence consistent with the revelation of information about ICD changes causing significant revisions to investors' assessment of information risk, which is consistent with the theoretical arguments presented in Lambert, Leuz, and Verrecchia [2007]. Our findings that the cost of equity declines for (1) firms that remediate their ICDs and (2) firms that are expected to report an ICD but do not, suggest that the market values the reduction in information risk that results from effective internal control. Furthermore, our finding that the cost of equity does not change for nonremediating firms mitigates concerns that our results are driven by factors unrelated to information risk. Collectively, our results provide evidence consistent with ineffective internal controls causing investors to assess higher information risk and a higher cost of equity.

5.4 robustness tests

5.4.1. Accrual Quality versus ICD A primary objective of strong internal control over financial reporting is high-quality financial information. There is evidence to suggest that firms with ineffective internal controls have low-quality accruals relative to firms operating with effective internal controls (e.g., Doyle, Ge, and McVay [2007a], Ashbaugh-Skaife et al. [2008]). Prior research suggests that firms with low-quality accruals have a higher cost of equity (Francis et al. [2005]). To assess whether the presence of an ICD results in greater information risk beyond that of poor accruals quality, we re-estimate equation (5), equation (7), and equation (10) including two accruals quality variables: abnormal accruals and noise in working capital accruals. Abnormal accruals (AA) are defined as the absolute value of performance-adjusted abnormal accruals as estimated by the modified Jones model (see Ashbaugh, LaFond, and Mayhew [2003]). The noise in working capital accruals (ACCRUAL_NOISE) is defined as in Dechow and Dichev [2002].

In untabled results, we find, as expected, positive coefficients on AA and ACCRUAL_NOISE, indicating that poor accruals quality increases firms' idiosyncratic and systematic risk. However, we find no association between AA and ACCRUAL_NOISE in the cost of equity cross-sectional analysis. More importantly, after controlling for the quality of firms' accruals, we continue to find a significantly positive coefficient on ICD in all three analyses.

5.4.2. Consequences of Misspecification of ICD Model and Misclassification of ICD Firms In addition to our paper, Ogneva, Subramanyam, and Raghunandan (hereafter, OSR) [2007] also examine the implications of SOX 404 internal control reporting for cost of equity. They view ICDs as having two potential effects on the cost of equity. The first arises from information risk associated with ineffective internal control and the second arises from ICDs being inherently more likely for firms facing greater operating risk. OSR find that the cost of equity effect of ICDs disappears after controlling for beta and factors associated with an increased likelihood of reporting ICDs. Based on this finding, OSR conclude that ICDs do not have a direct effect on the cost of equity. However, as noted earlier, measuring the cost of equity effects after controlling for beta ignores the effects that ICDs may have on cost of equity through beta risk (Lambert, Leuz, and Verrecchia [2007]).

One potential explanation for the “no association” result in the OSR paper is due to their research design choice to “look ahead” to a future SOX 404 audit opinion to determine their coding of firms' internal control status. They partition firms into ICD and non-ICD samples based on their fiscal year 2004 SOX 404 audit opinions released in 2005. OSR's ICD sample is defined as firms receiving adverse SOX 404 opinions, whereas their non-ICD sample is comprised of all other firms receiving unqualified SOX 404 opinions and having the necessary data to estimate their model. They measure firms' cost of equity at June 2004 when the 2004 SOX 404 audit opinions are not known to the market. Because OSR's classification of ICD and non-ICD firms is based on firms' 2004 SOX 404 opinions that are issued from 6 to 18 months after the date used to compute implied cost of capital (June 2004), their partitioning of ICD and non-ICD samples imparts a “look-ahead” bias for firms that report ICDs under SOX 302 but subsequently receive an unqualified SOX 404 opinion. This look-ahead bias works in favor of finding no significant differences in cost of equity between their ICD and non-ICD samples.

To investigate whether the look-ahead misclassification of firms affects the inferences drawn from the OSR analysis, we replicate their approach using our data. We estimate firms' cost of equity using the OSR measure, the PEG ratio (CC_PEG), and follow their procedure for partitioning firms based on the 2004 SOX 404 audit opinion. We use a new variable, labeled WEAK (coded one for firms with adverse 2004 SOX 404 opinions, and zero otherwise) to distinguish between OSR's classification of firms from our classification of firms with ineffective internal control (i.e., our ICD variable) and estimate the following OLS regression:

  • image(12)

where CC_PEG is the cost of capital measure using the PEG ratio (PEG ratio is equal to [(eps2eps1)/P0]1/2, P0 is the price at the end of June 2004, and eps is equal the median consensus forecast for one and two years ahead) (these inputs are identical to those of OSR).

The model 1 column of Table 12 reports the results of estimating equation (12). We identify 1,127 firms that have the necessary data to estimate CC_PEG. Of those 1,127 firms, 163 receive adverse 2004 SOX 404 opinions and the remainder receive unqualified SOX 404 opinions. The coefficient on WEAK is insignificantly different from zero, suggesting that there is no significant difference in the cost of equity (CC_PEG) for ICD and non-ICD firms using OSR's classification scheme.

Table 12.  Internal Control Deficiencies and Cost of Equity: Consequences of Misclassifying ICD Firmsinline image
VariablesbPredicted SignModel 1cModel 2d
Coefficient EstimateStandard ErrorCoefficient EstimateStandard Error
  1.  This table reports the parameter estimates and standard errors from the OLS estimation of the PEG ratio (CC_PEG) estimates of cost of equity on alternative dummy variables for indentifying firms with weak internal controls (WEAK or ICD dummies), other determinants of cost of equity, and control variables. WEAK in model 1 is a dummy variable for identifying firms with internal control weaknesses using the procedure in Ogneva, Subramanyam, and Raghunandan [2007], while ICD in model 2 uses the procedures described in the present paper for identifying firms with internal control weaknesses. Variable definitions and measurements appear below.

  2.  aCC_PEG= PEG ratio estimate of the cost of equity (see Easton [2004]). The cost of equity measure used in this analysis is expressed as a percentage, i.e., 10% is 10.00. Coefficient estimates differ from those reported in Ogneva, Subramanyam, and Raghunandan [2007] due to scaling, e.g., in Ogneva, Subramanyam, and Raghunandan a 10% cost of equity is 0.10.

  3.  bBETA= estimate of β1 from EXRET01RMRF using monthly returns over the 60 months prior to the firm's 2004 fiscal year-end, requiring a minimum of 18 months, where EXRET= the firm's monthly return minus the risk-free rate, RMRF= excess return on the market obtained from the Website http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html; SIZE= natural log of market value of equity (Compustat #25 multiplied by Compustat #199) at 2004 fiscal year-end; BM= book value of equity (Compustat #60) divided by market value of equity (Compustat #199 multiplied by Compustat #25) at the firm's 2004 fiscal year-end; I_RISK= standard deviation of residuals from estimating EXRET01RMRF using monthly returns from 2004 and the prior four years; SEGMENTS= number of reported business segments (Compustat Segment file); FOREIGN_SALES= 1 if the firm reports foreign sales, and 0 otherwise (Compustat Segment file); M&A= 1 if the firm has a merger or acquisition from 2001 to 2003, and 0 otherwise (Compustat AFNT #1); RESTRUCTURE= 1 if the firm restructures from 2001 to 2003 as indicated by a nonzero amount for any of the following Compustat data items: 376, 377, 378, or 379, and 0 otherwise; RGROWTH= decile rank of average growth rate in sales from 2001 to 2003 (the percent change in Compustat #12); INVENTORY= average inventory to total assets from 2001 to 2003 (Compustat #3 divided by Compustat #6); %LOSS= proportion of years from 2001 to 2003 that a firm reports negative earnings; RZSCORE= decile rank of Altman [1980]z-score measure of distress risk; AUDITOR_RESIGN= 1 if the auditor resigns from the client in 2003, and 0 otherwise (8-K filings); RESTATEMENT= 1 if the firm has a restatement or an SEC AAER from 2001 to 2003, and 0 otherwise; AUDITOR= 1 if the firm engages as its auditor, for 2003, PricewaterhouseCoopers, Deloitte & Touche, Ernst & Young, KPMG, Grant Thornton, or BDO Seidman, and 0 otherwise (Compustat #149); INST_CON= percentage of shares held by institutional investors divided by the number of institutions that own the stock (Thomson Financial Securities data) multiplied by 100; and LITIGATION= 1 if the firm is in a litigious industry (SIC codes 2833–2836, 3570–3577, 3600–3674, 5200–5961, and 7370), and 0 otherwise.

  4.  cModel 1: following Ogneva, Subramanyam, and Raghunandan [2007], WEAK= 1 if the firm receives an adverse SOX 404 opinion, and 0 otherwise. This scheme incorrectly classifies firms with ICDs reported under SOX 302 who later receive an unqualified SOX 404 opinion as non-ICD firms (i.e., as if they had effective internal control as of June 2004).

  5.  dModel 2: ICD= 1 if the firm receives an adverse SOX 404 opinion or makes an ICD disclosure under SOX 302, and 0 otherwise.

  6.  *, **, and *** indicate significant difference from 0 at the 10%, 5%, and 1% levels, respectively (two-tailed).

Intercept 12.969***(1.420)12.887***(1.420)
WEAK+0.331(0.294)  
ICD+  0.446**(0.253)
BETA+−0.023(0.152)−0.025(0.152)
SIZE−0.526***(0.108)−0.515***(0.108)
BM+2.306***(0.510)2.265***(0.511)
I_RISK+4.816**(2.287)4.816**(2.285)
SEGMENTS 0.108*(0.064)0.107*(0.063)
FOREIGN_SALES 0.303(0.270)0.295(0.270)
M&A 0.091(0.210)0.095(0.210)
RESTRUCTURE −0.342(0.229)−0.357(0.229)
RGROWTH −0.154***(0.052)−0.156***(0.052)
INVENTORY 3.874***(0.985)3.885***(0.985)
%LOSS 3.850***(0.407)3.849***(0.407)
RZSCORE −0.249***(0.055)−0.247***(0.055)
AUDITOR_RESIGN −1.154(1.525)−1.184(1.524)
RESTATEMENT 0.005(0.405)−0.034(0.405)
AUDITOR 0.519(0.882)0.500(0.881)
INST_CON 0.246(0.289)0.260(0.289)
LITIGATION −0.219(0.251)−0.228(0.251)
Adjusted R2 0.32 0.32 
ICD firms 163 239 
Non-ICD firms 964 888 
Total N 1,127 1,127 

The model 2 column of Table 12 displays the results after appropriately reclassifying 76 firms classified under the OSR criterion as non-ICD or “control” firms that receive unqualified SOX 404 audit opinions in 2005, but previously disclose ICDs under SOX 302 in 2004. The reclassification results in 239 ICD firms and 888 non-ICD firms. The results of estimating equation (12) using the correct classification of firms indicate a positive and significant coefficient on the ICD variable. Furthermore, the results indicate that ICD firms have a higher implied cost of equity of roughly 45 basis points relative to non-ICD firms when using the PEG ratio as the estimate of firms' cost of equity.

In summary, the OSR paper and our paper are similar in that both studies include cross-sectional analyses of the cost of equity effects of internal control quality. However, the studies are different in two ways. First, our cross-sectional research design does not have the misclassification look-ahead bias present in OSR. Second, our study goes beyond OSR by conducting intertemporal firm-specific change analyses around two events—the initial disclosure of an ICD and the receipt of a SOX 404 audit opinion—that provide stronger tests of the cost of equity consequences of internal control reporting.

6. Conclusions

  1. Top of page
  2. ABSTRACT
  3. 1. Introduction
  4. 2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
  5. 3. Institutional Background and Reporting Environment
  6. 4. Sample and Descriptive Statistics
  7. 5. Results
  8. 6. Conclusions
  9. Appendix
  10. REFERENCES

Effective internal controls over financial reporting are widely recognized as being fundamental to high-quality information systems and high-quality financial information. The recent theoretical work of Lambert, Leuz, and Verrecchia [2007] suggests that the quality of firms' information systems, which includes internal control over financial reporting, has both a direct and indirect effect on the cost of equity. We use the unique setting provided by SOX that requires firms to disclose ICDs and have independent audits of their internal control to empirically test whether the effectiveness of firms' internal control affects idiosyncratic risk, beta risk, and costs of equity.

In cross-sectional tests, we find that firms with ICDs exhibit significantly higher betas, idiosyncratic risk, and cost of equity capital relative to firms not reporting ICDs. These differences persist after controlling for other factors that prior research shows to be related to these risk measures. We also structure intertemporal change analysis tests designed to investigate whether initial disclosure, repeated disclosure, or remediation of internal control problems cause predictable changes in firms' cost of equity capital.

Our findings indicate that firms that initially disclose ineffective internal control experience a significant increase in market-adjusted cost of equity, and firms that subsequently improve their internal control (as evidenced by an unqualified SOX 404 audit opinion) exhibit a decrease in market-adjusted cost of equity. Thus, this study provides evidence suggesting that firms with internal control problems present greater information risk to investors and firms reporting effective internal control and firms that remediate known internal control problems benefit from lower costs of equity beyond that predicted by other risk factors.

Appendix

  1. Top of page
  2. ABSTRACT
  3. 1. Introduction
  4. 2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
  5. 3. Institutional Background and Reporting Environment
  6. 4. Sample and Descriptive Statistics
  7. 5. Results
  8. 6. Conclusions
  9. Appendix
  10. REFERENCES
Table 13. Logit Model for Existence and Disclosure of Internal Control Deficienciesinline image
VariablesbPredicted SignCoefficient ValuecStandard Error
  1.  This table presents parameter estimates from a logit model to predict the existence and reporting of internal control deficiencies (ICDs) based on work by Ashbaugh-Skaife, Collins, and Kinney [2007]. There are 4,073 firms that have ICD values of 0, and 737 firms that have ICD values of 1. The predicted probability of reporting an ICD is used to classify firms that are most likely (top three deciles) and least likely (bottom three deciles) to report ICDs in the cost of capital change analysis tests reported in Tables 8 and 11.

  2.  aICD= 1 if the firm reports an internal control problem, and 0 otherwise.

  3.  bSEGMENTS= number of reported business segments (Compustat Segment file); FOREIGN_SALES= 1 if firm reports foreign sales (Compustat Segment file), and 0 otherwise; M&A= 1 if firm has a merger or acquisition from 2002 to 2004 (Compustat AFNT #1), and 0 otherwise; RESTRUCTURE= 1 if the firm restructures as indicated by a nonzero amount in any of Compustat data items #376, 377, 378, or 379 from 2002 to 2004, and 0 otherwise; RGROWTH= decile rank of average sales growth rate from 2002 to 2004 (Compustat #12); INVENTORY= average of inventory to total assets from 2001 to 2003 (Compustat #3 divided by Compustat #6); SIZE is the average market value of equity from 2001 to 2003 in $ billions (Compustat #199 ×#25); %LOSS= proportion of years from 2001 to 2003 that the firm reports negative earnings; RZSCORE= decile rank of Altman [1980]z-score; AUDITOR_RESIGN= 1 if auditor resigned in 2003, and 0 otherwise (8-K filings); AUDITOR= 1 if the firm's auditor for 2003 (Compustat #149) is PricewaterhouseCoopers, Deloitte & Touche, Ernst & Young, KPMG, Grant Thornton, or BDO Seidman, and 0 otherwise; RESTATEMENT= 1 if the firm has a restatement or an SEC AAER from 2002 to 2004, and 0 otherwise; INST_CON= percentage of shares held by institutional investors divided by the number of institutions owning its stock (Thomson Financial Securities data) multiplied by 100; and LITIGATION= 1 if the firm is in a litigious industry (SIC codes 2833–2836, 3570–3577, 3600–3674, 5200–5961, and 7370), and 0 otherwise.

  4.  *, **, and *** indicate significantly different from 0 at the 10%, 5%, and 1% levels, respectively.

Intercept −3.752*(0.225)
SEGMENTS+0.078***(0.029)
FOREIGN_SALES+0.466***(0.099)
M&A+0.177**(0.090)
RESTRUCTURE+0.296***(0.091)
RGROWTH+0.064***(0.016)
INVENTORY+0.785***(0.323)
SIZE−0.048***(0.014)
%LOSS+0.192*(0.129)
RZSCORE−0.016(0.020)
AUDITOR_RESIGN+1.506***(0.299)
AUDITOR+0.965***(0.140)
RESTATEMENT+0.470***(0.140)
INST_CON+0.085**(0.042)
LITIGATION+0.263***(0.092)
Likelihood ratio χ2 233.53*** 
Percent concordant 66.3 
Percent discordant 33 
N 4810 
Footnotes
  • 1

    Unlike inferences about information quality that are based on estimates (e.g., large abnormal accruals), the disclosure of an ICD is a process quality indicator that the reliability of the financial information is threatened and, thus, likely of low quality.

  • 2

    Later in the paper, we discuss sample, design choices, and cost of equity proxy differences between our study and the Ogneva, Subramanyam, and Raghunandan [2007] study that contribute to the differences in results.

  • 3

    It is important to note that the Lambert, Leuz, and Verrecchia [2007] model of information quality effects on firms' cost of capital is developed in a single-period setting. However, in a multiperiod world the cost of capital effects of additional cash flows that result from reduced financing costs or from reduced manager appropriation of firm resources when internal controls are strengthened is more difficult to predict. How the additional cash flows are invested can change the ratio of the expected cash flows to the covariances of the firm's cash flows with the market (see equation (2b)). If the additional cash flows are invested in high-risk projects, then the ratio of expected cash flows to the covariance of those cash flows could increase.

  • 4

    The Foreign Corrupt Practices Act does require external auditors to report to the board of directors any material weaknesses in the firm's internal control over financial reporting noted during conduct of the financial statement audit.

  • 5

    Compliance Week is a weekly electronic newsletter published by Boston's Financial Media Holdings Group and Glass, Lewis & Co., LLC is an investment research and proxy advisory firm.

  • 6

    For these firms we confirm the SOX 404 opinion and filing dates.

  • 7

    For the sake of completeness, it is important to note that there are 527 firms that disclose an ICD under SOX 302 but do not have a SOX 404 opinion. These firms do not have a SOX 404 opinion because they are either nonaccelerated filers (i.e., are not required to file a SOX 404 opinion because they have less than $75 million in float) or they do not file a 10-K that contains a SOX 404 report by the sample cutoff date of September 2005.

  • 8
  • 9

    We use monthly returns to estimate equation (3) to reduce the bias in BETA due to infrequent trading (Dimson [1979]).

  • 10

    The announcement day is the date of the SEC filing that first mentions a control weakness. We identify firms that report ICDs using compilations prepared by Compliance Week and Glass Lewis. We then back-trace all SEC filings of firms identified by these two sources. For over 30% of the sample, we find that the first mention of control problems occurs in an SEC filing that precedes the filing noted as the initial disclosure in Compliance Week or Glass Lewis. Thus, studies relying on the dates provided by these two sources may incorrectly identify the event date for the first ICD disclosure.

  • 11

    One potential explanation for the differences in results is the difficulty of classifying the nature of internal control problems prior to the enactment of AS No. 2 (see the next footnote for details).

  • 12

    AS No. 2, which provides guidance for the classification of ICDs, is issued after many firms provide their initial ICD disclosures. Thus, many firms that voluntarily report lesser internal control problems in the SOX 302 era are likely to have had more severe problems.

  • 13

    The tabled result that LEV is negatively associated with I_RISK is consistent with Duffee [1995], who finds that the positive relation between leverage and risk measures documented in prior work is due to the samples used in the empirical analysis. When Duffee [1995] requires firms to have debt, he finds a positive relation between leverage and risk. Relaxing this requirement results in either insignificant results or, in some instances, the opposite result. Following Duffee [1995], we delete firms with LEV values less than 0.10 and find a positive association between LEV and I_RISK.

  • 14

    Although the coefficient on the ICD dummy is significant, the adjusted R2 values of model 1 and model 2 are only marginally lower when the ICD dummy is deleted. Thus, as is the case for most cross-sectional regression models with a continuous dependent variable, the inclusion of a binary independent variable does not add significant incremental explanatory power.

  • 15

    Our measure of the implied cost of equity is similar to those of Brav, Lehavy, and Michealy [2005], Botosan and Plumlee [2002, 2005], and Francis et al. [2004], who use Value Line's forecasted target prices and forecasted dividends to derive a measure of firms' expected return.

  • 16

    Our results are robust to setting the cost of equity to the median expected return over the firm's fiscal year and robust to using only the first (or last) expected return for a given Value Line report period. The correlations across various measures of expected return based on different requirements of price updating exceed 0.95.

  • 17

    We thank the anonymous referee for suggesting this point to us.

  • 18

    In contrast to implied cost of equity approaches such as the Value Line target price method and the PEG ratio method (Easton [2004]), an alternative is to estimate expected return (cost of equity) using a factor model approach (Francis et al. [2005], Core, Guay, and Verdi [2008]). However, factor models require a long time series (usually three to five years of historical monthly data) to estimate reliable factor loadings. To the extent that forces posited to affect risk assessments are temporary (as many of the ICDs may be after they are discovered and disclosed), factor model estimates of cost of equity are not precise enough to capture changes in cost of equity when initial ICD disclosures are made or corrective actions are announced. Therefore, we do not consider factor model approaches to estimating firms' cost of equity to be viable in our setting.

  • 19

    The Value Line expected return represents an annual cost of equity estimate. We divide the annual measure by 12 to convert the annual expected return to a monthly expected return. Our analysis period runs from April 1997 to December 2003, due to the requirement of future returns and allowing for three months following the fiscal year-end for data to become known to the market. Specifically, realized returns for fiscal year t+ 1 are regressed on expected returns from fiscal year t, which is the expected return for fiscal t+ 1. For example, the monthly realized return over fiscal 1997 is regressed on the estimate of expected return made in fiscal 1996 for fiscal 1997.

  • 20

    Following Easton [2004], rpeg=[(eps2eps1)/P0]1/2, where eps is the one- (two)-year-ahead forecasted earnings per share, and P0 is equal to the current price. The number of observations for which rpeg can be calculated is further reduced by the requirements that both epsand eps2 be positive, and epsmust be greater than eps1.

  • 21

    We draw similar conclusions when estimating the PEG ratio cost of capital using Value Line forecasts.

  • 22

    Note that in this specification BETA and I_RISK are significantly positively related to cost of equity as expected, but SIZE is no longer significant. This result is due to SIZE being highly negatively correlated with I_RISK.

  • 23

    As noted in section 2, one reason that the ICD dummy can exhibit an association with firms' cost of equity when BETA and I_RISK are in the model is because idiosyncratic risk and beta risk estimates are based on historical time-series data that measure the information risk effects of ICDs with error (i.e., they are not based on forward-looking data as specified in the Lambert, Leuz, and Verrecchia [2007] framework). An alternative explanation for why ICD loads in model 2 of Table 7 is that ICD proxies for risk factors in other asset-pricing models that have been shown to be related to firms' expected returns.

  • 24

    In Tables 8 through 11 we report the results using market-adjusted cost of equity measures, where market adjustments are made using all firms not reporting an ICD over the same time period. We also examine the change in the cost of equity using unadjusted and industry-adjusted cost of capital measures and find similar results.

  • 25

    We note that this estimated change in cost of equity of roughly 100 basis points is comparable to the estimated change in cost of equity associated with restatements documented by Hribar and Jenkins [2004], who report cost of equity changes of 100–150 basis points. Restatements are often a direct result of ineffective internal control.

  • 26

    We also find that the mean (median) cost of equity increase is greater for firms disclosing relatively lesser ICDs, i.e., significant deficiency/control deficiency, relative to firms that report material weaknesses in internal control (1.632% versus 0.733%, respectively), but the difference is not statistically significant.

  • 27

    A direct test of the differences in mean (median) changes in cost of equity for these two groups of firms is significant at only the 0.25 (0.23) level (one-sided). However, the lack of significance in these differences is due primarily to low power because of the small sample size in each group. When all 162 observations are included in a regression with change in cost of equity as the dependent variable and the predicted probability of reporting an ICD as the independent variable, the coefficient on the predicted probability is negative and significantly different from zero at the 0.07 level.

  • 28

    A direct test of the differences in mean (median) changes in cost of equity for these two groups of firms is significant at the 0.01 (0.03) level (one-sided). When all 685 observations are included in a regression with the change in cost of equity as the dependent variable and the predicted probability of reporting an ICD as the independent variable, the coefficient on the predicted probability is negative and significantly different from zero at the 0.01 level.

REFERENCES

  1. Top of page
  2. ABSTRACT
  3. 1. Introduction
  4. 2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
  5. 3. Institutional Background and Reporting Environment
  6. 4. Sample and Descriptive Statistics
  7. 5. Results
  8. 6. Conclusions
  9. Appendix
  10. REFERENCES
  • Altman, E. Financial Ratios, Discriminant Analysis, and the Prediction of Corporate Bankruptcy. Journal of Finance 23 (1968): 589609.
  • Ashbaugh, H.; R. LaFond; and B. Mayhew. Do Nonaudit Services Compromise Auditor Independence? Further Evidence. The Accounting Review 78 (2003): 61140.
  • Ashbaugh-Skaife, H.; D. Collins; and W. Kinney. The Discovery and Reporting of Internal Control Deficiencies Prior to SOX-Mandated Audits. Journal of Accounting & Economics 44 (2007): 16692.
  • Ashbaugh-Skaife, H.; D. Collins; W. Kinney; and R. LaFond. The Effect of SOX Internal Control Deficiencies and Their Remediation on Accrual Quality. The Accounting Review 83 (2008): 21750.
  • Beaver, W.; P. Kettler; and M. Scholes. The Association Between Market Determined and Accounting Determined Risk Measures. The Accounting Review 45 (1970): 65482.
  • Berger, P.; F. Li; and F. Wong. The Impact of Sarbanes-Oxley on Cross-Listed Companies.” Working paper, University of Chicago, 2005.
  • Berk, J. A Critique of Size-Related Anomalies. Review of Financial Studies 8 (1995): 27586.
  • Bhattacharya, U.; H. Daouk; and M. Welker. The World Price of Earnings Opacity. The Accounting Review 78 (2003): 64178.
  • Black, F. Capital Market Equilibrium with Restricted Borrowing. Journal of Business 45 (1972): 44455.
  • Botoson, C. Disclosure Level and the Cost of Equity Capital. The Accounting Review 72 (1997): 32349.
  • Botoson, C., and M. Plumlee. A Re-examination of Disclosure Level and Expected Cost of Equity Capital. The Accounting Review 40 (2002): 2140.
  • Botosan, C., and M. Plumlee. Assessing Alternative Proxies for Expected Risk Premium. The Accounting Review 80 (2005): 2153.
  • Brav, A.; R. Lehavy; and R. Michaely. Using Expectations to Test Asset Pricing Models. Financial Management 34 (2005): 3164.
  • Core, J.; W. Guay; and R. Verdi. Is Accruals Quality a Priced Risk Factor? Journal of Accounting & Economics 46 (2008): 222.
  • Dechow, P., and I. Dichev. The Quality of Accruals and Earnings: The Role of Accrual Estimation Errors. The Accounting Review 77 (2002): 3559.
  • Dimson, E. Risk Measurement When Shares Are Subject to Infrequent Trading. Journal of Financial Economics 7 (1979): 197226.
  • Doyle, J.; W. Ge; and S. McVay. Accruals Quality and Internal Control over Financial Reporting. The Accounting Review 82 (2007a): 114170.
  • Doyle, J.; W. Ge; and S. McVay. Determinants of Weaknesses in Internal Control over Financial Reporting. Journal of Accounting & Economics 44 (2007b): 193223.
  • Duffee, G. Stock Returns and Volatility: A Firm-Level Analysis. Journal of Financial Economics 37 (1995): 399420.
  • Easton, P. PE Ratios, PEG Ratios, and Estimating the Implied Expected Rate of Return on Equity Capital. The Accounting Review 79 (2004): 7396.
  • Fama, E., and K. French. Profitability, Investment, and Average Returns. Journal of Financial Economics 82 (2006): 491532.
  • Fama, E., and J. Macbeth. Risk, Return, and Equilibrium: Empirical Test. Journal of Political Economy 81 (1973): 60736.
  • Francis, J.; R. LaFond; P. Olsson; and K. Schipper. Costs of Equity and Earnings Attributes. The Accounting Review 79 (2004): 9671010.
  • Francis, J.; R. LaFond; P. Olsson; and K. Schipper. The Market Pricing of Accruals Quality. Journal of Accounting & Economics 39 (2005): 295328.
  • Goldman Sachs Inc. “Sarbanes-Oxley Section 404—Analyzing Stock Market Reaction to Negative Disclosures,” Unpublished paper, Goldman Sachs Inc., February 2005.
  • Guay, W.; S. Kothari; and S. Shu. Properties of Implied Cost of Capital Using Analysts' Forecasts.” Working paper, Massachusetts Institute of Technology, 2005.
  • Hail, L., and C. Leuz. Cost of Capital Effects and Changes in Growth Expectations Around U.S. Cross Listings.” Working paper, University of Chicago, 2008.
  • Hammersley, J.; L. Myers; and C. Shakespeare. Market Reactions to the Disclosure of Internal Control Weaknesses and to the Characteristics of Those Weaknesses Under Section 302 of the Sarbanes Oxley Act of 2002. Review of Accounting Studies 13 (2008): 14165.
  • Hanlon, M.; S. Rajgopal; and T. Shevlin. Large Sample Evidence on the Relation Between Stock Options and Risk Taking.” Working paper, University of Michigan and University of Washington, 2006.
  • Hribar, P., and N. Jenkins. The Effect of Accounting Restatements on Earnings Revisions and the Estimated Cost of Capital. Review of Accounting Studies 9 (2004): 33758.
  • Lambert, R.; C. Leuz; and R. Verrecchia. Accounting Information, Disclosure, and Cost of Capital. Journal of Accounting Research 45 (2007): 385420.
  • Li, H.; M. Pincus; and S. Rego. Market Reaction to Events Surrounding the Sarbanes-Oxley Act of 2002 and Earnings Management. Journal of Law and Economics 51 (2008): 11134.
  • Lintner, J. The Valuation of Risky Assets and the Selection of Risky Investments in Stock Portfolios and Capital Budgets. The Review of Economics and Statistics 47 (1965): 1337.
  • Pastor, L., and P. Veronesi. Stock Valuation and Learning About Profitability. Journal of Finance 58 (2003): 174989.
  • Public Company Accounting Oversight Board (PCAOB). An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements. Auditing Standard No. 2. Washington , DC : PCAOB, 2004.
  • Ogneva, M.; K. Subramanyam; and K. Raghunandan. Internal Control Weakness and Cost of Equity: Evidence from SOX Section 404 Certifications. The Accounting Review 82 (2007): 125597.
  • Rajgopal, S., and M. Venkatachalam. Information Risk and Idiosyncratic Return Volatility over the Last Four Decades.” Working paper, Duke University, 2005.
  • Sharpe, W. Capital Asset Price: A Theory of Market Equilibrium Under Conditions of Risk. Journal of Finance 19 (1964): 42542.
  • Solomon, D., and C. Bryan-Low. Companies Complain About Cost of Corporate Governance Rules. The Wall Street Journal (February 10, 2004): A1.
  • U.S. Congress. The Foreign Corrupt Practices Act of 1977 (FCPA). Public Law No. 95-213. Washington , DC : Government Printing Office, 1977.
  • U.S. Congress. The Sarbanes-Oxley Act of 2002 (SOX). Public Law No. 107-204. Washington , DC : Government Printing Office, 2002.
  • Wei, S., and C. Zhang. Why Did Individual Stocks Become More Volatile? Journal of Business 79 (2006): 25992.
  • Whisenant, S.; S. Sankaraguruswamy; and K. Raghunandan. Market Reactions to Disclosure of Reportable Events. Auditing: A Journal of Practice & Theory 22 (2003): 18194.
  • Zhang, I. Economic Consequences of the Sarbanes-Oxley Act of 2002. Journal of Accounting & Economics 44 (2007): 74115.