5.1 crosssectional return results
In this section we investigate whether there is a negative market reaction to firms' initial reporting of an ICD. Anecdotal evidence presented in the financial press highlights immediate material declines in the stock prices of select firms that report ICDs. For example, Flowserve's stock price declines 12% on the day after the announcement of an internal control problem (Goldman Sachs [2005]). In contrast, academic research is inconclusive as to whether there is a negative market reaction to ICD disclosures. Whisenant, Sankaraguruswamy, and Raghunandan [2003] find no preSOX evidence that disclosures of internal control weaknesses, as reportable events via a change in auditor reported on Form 8K, result in significant negative abnormal returns around the 8K filing dates. Hammersley, Myers, and Shakespeare [2008], however, find a significant negative market reaction to material weakness ICDs disclosed under SOX 302.
To provide further insights into the market's immediate reaction to firms' initial announcements of an internal control problem, we calculate marketadjusted returns (BHAR) measured over a threeday window starting one day before and including the day after the announcement that contains the ICD disclosure.^{10} Panel A of Table 3 reports a mean (median) drop in share price of −0.76% (−0.41%) over the threeday window, which is significant at p= 0.00 (0.01). The average market cap of our sample firms at the beginning of fiscal year 2004 is $2,860 million, so a −0.76% abnormal return translates into a $21.74 million decline in market value, on average. Below, we link this negative market reaction to increases in the cost of equity.
Table 3. Market Reaction to First Disclosure of Internal Control DeficienciesPanel A: Market reaction to first internal control deficiency disclosure 



Variables  Mean ThreeDay BHAR^{a}  Median ThreeDay BHAR 

ICD (N= 787)  −0.76%***  −0.41%** 
Panel B: OLS regression testing for differences in market reactions between types of ICDs 





Variables  Predicted Sign  Coefficient Estimate  Standard Error 


Intercept   −0.001  (0.006) 
MATERIAL_WEAKNESS^{b}  −  −0.008  (0.007) 
Adjusted R^{2}   0.00  
N   787  
When ICD disclosures are partitioned by the severity of the internal control problem, we find no significant difference between the market's response to material weaknesses and the market's response to significant deficiencies or control deficiencies. Specifically, we regress BHAR on a binary variable (MATERIAL_WEAKNESS) coded one for material weakness ICD disclosures, and zero otherwise. The regression results reported in panel B of Table 3 indicate an insignificant coefficient on MATERIAL_WEAKNESS, which is contrary to the findings in Hammersley, Myers, and Shakespeare [2008], who document a greater negative market reaction to material weakness ICDs compared to those that firms selfclassify as being of lesser severity.^{11}
Overall, our market reaction tests provide evidence that the market reacts negatively to signals that firms' internal controls are ineffective. However, it appears that the uncertainty about the differences between material weaknesses and significant deficiencies or control deficiencies (as discussed in AshbaughSkaife, Collins, and Kinney [2007]) results in the market not making a significant distinction between the severity of ICDs.^{12}
5.2 crosssectional risk results
Based on the modeling in Lambert, Leuz, and Verrecchia [2007], we predict a positive coefficient on ICD as firms with internal control problems generate noisier (lower quality) accounting signals, thereby increasing the information risk faced by investors. Equation (4) controls for a number of innate firm characteristics that are shown to be related to idiosyncratic risk. CFO and STD_CFO are used to capture operating performance and the volatility of operations, respectively. We expect firms with underperforming operations and more volatile operations to exhibit greater I_RISK. Thus, we predict a negative (positive) coefficient on CFO (STD_CFO). SIZE and DIVPAYER represent firm size and firm maturity, where large firms and more mature firms are expected to be less risky. Therefore, we predict a negative relation among SIZE, DIVPAYER, and I_RISK. Finally, we expect firms with higher leverage (LEV) to exhibit greater I_RISK. We make no prediction about the association between BM and I_RISK or between RET and I_RISK. BM can reflect financial distress, which leads to a positive association between BM and the risk measure, or can proxy for growth opportunities, which leads to a negative association between BM and the risk measure. Rajgopal and Venkatachalam [2005] document a negative association between I_RISK and RET. However, Duffee [1995] finds that the association between I_RISK and RET is sensitive to the sample of firms used in the analysis. Specifically, he finds that the association varies depending on the treatment of firms that experience events such as bankruptcies, takeovers, and delistings. Therefore, while we include RET in the model, we leave the prediction unsigned.
The model 1 column of Table 4 displays the results of estimating equation (4). As expected, we find that larger firms, firms that more often pay dividends, firms with better operating performance, and firms with lower volatility of cash flows from operations exhibit lower idiosyncratic risk. We find a significant negative coefficient on BM that is consistent with the findings of Rajgopal and Venkatachalam [2005] and suggests that firms with greater growth opportunities have lower idiosyncratic risk. The results indicate a significant negative coefficient on LEV, contrary to expectations. However, when we eliminate from the sample firms that have little or no debt (i.e., LEV less than 0.10), we find, as expected, a positive coefficient on LEV, which indicates that firms with more financing risk exhibit higher idiosyncratic risk.^{13}
Table 4. Internal Control Deficiencies and Idiosyncratic Risk Model 1 Model 2 Variables^{b}  Predicted Sign  Model 1  Model 2 

Coefficient Estimate  Standard Error  Coefficient Estimate  Standard Error 


Intercept   0.266***  (0.005)  0.290***  (0.009) 
ICD  +  0.010***  (0.003)  0.005**  (0.003) 
STD_CFO  +  0.161***  (0.013)  0.106***  (0.014) 
LEV  +  −0.029***  (0.005)  −0.037***  (0.006) 
CFO  −  −0.073***  (0.006)  −0.003  (0.007) 
BM  ±  −0.046***  (0.003)  −0.033***  (0.004) 
SIZE  −  −0.011***  (0.001)  −0.015***  (0.001) 
DIVPAYER  −  −0.060***  (0.002)  −0.034***  (0.003) 
RET  ±  0.002  (0.002)  0.006***  (0.002) 
SEGMENTS     −0.002**  (0.001) 
FOREIGN_SALES     −0.001  (0.003) 
M&A     0.005**  (0.002) 
RESTRUCTURE     0.008***  (0.002) 
RGROWTH     0.002***  (0.000) 
INVENTORY     −0.008  (0.009) 
%LOSS     0.055***  (0.004) 
RZSCORE     −0.004***  (0.001) 
AUDITOR_RESIGN     0.009  (0.011) 
RESTATEMENT     0.002  (0.004) 
AUDITOR     −0.003  (0.005) 
INST_CON     −0.014***  (0.002) 
LITIGATION     0.019***  (0.002) 
Adjusted R^{2}   0.49   0.57  
N   3,611   2,735  
Turning to the variable of interest, we find a positive and significant coefficient on ICD. This result indicates that, after controlling for operating, financing, and other risk attributes, firms with ineffective internal controls exhibit greater idiosyncratic risk than firms that do not report internal control problems.
The results reported in the model 1 column of Table 4 serve to benchmark the relation between firms' information quality as a function of internal controls and I_RISK after controlling for firm fundamentals documented in prior research to be related to idiosyncratic risk. AshbaughSkaife, Collins, and Kinney [2007] report that firms are more likely to have ICDs when they have more segments, engage in foreign sales, participate in mergers and acquisitions, and engage in restructurings. These economic events also influence firms' operating performance and the volatility of operations. To ensure that our ICD variable is not proxying for some other inherent operating risk, we expand the I_RISK model with the ICD determinants documented in AshbaughSkaife, Collins, and Kinney [2007] and estimate the following OLS regression:
 (5)
where:
 SEGMENTS
the number of reported business segments in 2003 (Compustat Segment file);
 FOREIGN_SALES
one if a firm reports foreign sales in 2003, and zero otherwise (Compustat Segment file);
 M&A
one if a firm is involved in a merger or acquisition from 2001 to 2003, and zero otherwise (Compustat AFNT #1);
 RESTRUCTURE
one if a firm is involved in a restructuring from 2001 to 2003, and zero otherwise (this variable is coded one if any of the following Compustat data items is nonzero: 376, 377, 378, or 379);
 RGROWTH
the decile rank of average growth rate in sales from 2001 to 2003 (the percent change in Compustat #12);
 INVENTORY
the average inventory to total assets from 2001 to 2003 (Compustat #3/Compustat #6);
 %LOSS
the proportion of years from 2001 to 2003 that a firm reports negative earnings;
 RZSCORE
the decile rank of the Altman [1968]zscore measure of distress risk;
 AUDITOR_RESIGN
one if the auditor resigns from the client in 2003, and zero otherwise (8K filings);
 RESTATEMENT
one if a firm has a restatement or an SEC Accounting and Auditing Enforcement Release (AAER) from 2001 to 2003, and zero otherwise;
 AUDITOR
one if the firm engages one of the largest six audit firms for 2003, and zero otherwise (Compustat #149), where the largest six audit firms include PricewaterhouseCoopers, Deloitte & Touche, Ernst & Young, KPMG, Grant Thornton, and BDO Seidman;
 INST_CON
the percentage of shares held by institutional investors divided by the number of institutions that own the stock as of December 31, 2003 (Thomson Financial Securities data);
 LITIGATION
one if a firm is in a litigious industry—SIC codes 2833–2836, 3570–3577, 3600–3674, 5200–5961, and 7370—and zero otherwise;
and all other variables are as previously defined. All ICD determinants are measured as of the firm's 2003 fiscal yearend or the average of the 2001 to 2003 values since prior economic events affect the likelihood of internal control problems reported in fiscal 2004 and after (AshbaughSkaife, Collins, and Kinney [2007]). We do not make predictions on the sign of the ICD determinant coefficients because many of the ICD determinants proxy for similar constructs included in the basic I_RISK model (e.g., more risky operations).
The model 2 column of Table 4 displays the results of estimating equation (5). Eight of the 13 ICD determinants are significantly related to I_RISK and we continue to find significant coefficients on STD_CFO, LEV, BM, SIZE, and DIVPAYER. The CFO coefficient is no longer significant after including the ICD determinants, which also serve as measures of firm operating performance. One other finding that differs from the results reported in the model 1 column of Table 3 is that the coefficient on RET is now significantly positive. Most importantly, after including the additional control variables in the I_RISK model, we continue to find a positive and significant coefficient on ICD.^{14} This indicates that, after controlling for operating, financing, and internal control risk factors, firms with greater information risk due to internal control problems exhibit greater idiosyncratic risk.
Our next crosssectional analysis examines the relation between ICDs and market risk (BETA). Similar to our I_RISK analysis, we estimate two models of BETA:
 (6)
 (7)
where all variables are as previously defined.
Equation (6) is the baseline model that includes the risk factors previously documented in the literature as being related to BETA (e.g., see Beaver, Kettler, and Scholes [1970]). We predict a positive coefficient on STD_CFO and COVCFO because firms with more volatile cash flows from operations are considered to be more risky firms. We expect CFO, SIZE, and DIVPAYER to be negatively related to BETA because firms with better operating performance, large firms, and more mature firms are expected to be less risky. We expect a positive coefficient on LEV because firms with greater financial risk are expected to have greater market risk. In addition, we expect a positive coefficient on INDBETA because firms that operate in riskier industries are expected to have greater market risk. Similar to our I_RISK analysis, we make no prediction on the association between BM and BETA because BM can proxy for growth or for financial distress. Equation (7) is the expanded model that controls for the determinants of ICDs.
The model 1 column of Table 5 displays the results of estimating equation (6). Consistent with expectations, we find a significantly positive coefficient on STD_CFO and significantly negative coefficients on CFO and DIVPAYER, indicating that firms with more volatile operation, firms with weak operating performance, and less mature firms exhibit larger market risk. Similar to the results presented in Table 4, we find a significantly negative coefficient on LEV. However, when we eliminate firms with little or no debt in their capital structure, the coefficient on LEV becomes insignificant. Inconsistent with expectations, we find a positive coefficient on SIZE. As noted earlier, many of the firm fundamentals in our risk models are highly correlated. A reduced form estimate of equation (6) that excludes DIVPAYER yields a negative relation between SIZE and BETA as shown in prior research (Beaver, Kettler, and Scholes [1970]).
Table 5. Internal Control Deficiencies and Systematic Risk (Beta) Model 1 Model 2 Variables^{b}  Predicted Sign  Model 1  Model 2 

Coefficient Estimate  Standard Error  Coefficient Estimate  Standard Error 


Intercept   0.446***  (0.073)  0.599***  (0.123) 
ICD  +  0.068**  (0.037)  0.048*  (0.037) 
STD_CFO  +  1.214***  (0.173)  0.803***  (0.194) 
LEV  +  −0.225***  (0.065)  −0.447***  (0.079) 
CFO  −  −1.010***  (0.082)  −0.200**  (0.095) 
BM  ±  −0.205***  (0.045)  −0.042  (0.051) 
SIZE  −  0.064***  (0.008)  0.029**  (0.012) 
DIVPAYER  −  −0.585***  (0.033)  −0.355***  (0.040) 
COVCFO  +  −0.364  (0.258)  −0.149  (0.271) 
INDBETA  +  0.654***  (0.021)  0.481***  (0.024) 
SEGMENTS     −0.057***  (0.010) 
FOREIGN_SALES     0.102***  (0.035) 
M&A     0.045  (0.032) 
RESTRUCTURE     0.156***  (0.032) 
RGROWTH     0.001  (0.006) 
INVENTORY     −0.292**  (0.126) 
%LOSS     0.795***  (0.051) 
RZSCORE     −0.033***  (0.008) 
AUDITOR_RESIGN     0.185  (0.146) 
RESTATEMENT     0.036  (0.057) 
AUDITOR     0.112*  (0.061) 
INST_CON     −0.172***  (0.022) 
LITIGATION     0.184***  (0.034) 
     
Adjusted R^{2}   0.41   0.51  
N   3,611   2,735  
The key result reported in model 1 of Table 5 is the positive coefficient on ICD, which indicates that firms with ineffective internal control exhibit higher BETAs relative to firms with effective internal control after controlling for known sources of beta risk. Results of estimating equation (7), which controls for known risk factors and ICD determinants (model 2 column of Table 5), provide additional evidence that firms with ineffective internal control have greater market risk as the coefficient on ICD is positive and significant at conventional pvalues.
Overall, the results reported in Table 4 and Table 5 suggest that firms with ineffective internal control present greater information risk to investors, as investors assess larger variances in cash flows (I_RISK) and covariances in cash flows (BETA) for firms with lowquality financial information (Lambert, Leuz, and Verrecchia [2007]).