The Effect of SOX Internal Control Deficiencies on Firm Risk and Cost of Equity
The Sarbanes-Oxley Act (SOX) mandates management evaluation and independent audits of internal control effectiveness. The mandate is costly to firms but may yield benefits through lower information risk that translates into lower cost of equity. We use unaudited pre–SOX 404 disclosures and SOX 404 audit opinions to assess how changes in internal control quality affect firm risk and cost of equity. After controlling for other risk factors, we find that firms with internal control deficiencies have significantly higher idiosyncratic risk, systematic risk, and cost of equity. Our change analyses document that auditor-confirmed changes in internal control effectiveness (including remediation of previously disclosed internal control deficiencies) are followed by significant changes in the cost of equity that range from 50 to 150 basis points. Overall, our cross-sectional and intertemporal change test results are consistent with internal control reports affecting investors' risk assessments and firms' cost of equity.
Prior research on the impact of the Sarbanes-Oxley Act (SOX) (U.S. Congress ) focuses primarily on the cost of its internal control reporting and audit requirements. In this study, we explore the relation between internal control quality and idiosyncratic and systematic risk, and the potential benefits of effective internal control in terms of cost of equity. Specifically, we investigate whether firms that disclose internal control deficiencies (ICDs) exhibit higher systematic risk, higher idiosyncratic risk, and higher cost of equity relative to firms with effective internal controls. Further, we investigate whether managements' initial disclosures of ICDs and remediation of previously reported ICDs are related to changes in firms' cost of equity.
Prior research posits that ineffective internal controls allow or introduce both intentional and unintentional misstatements into the financial reporting process that lead to lower quality accruals. Consistent with this conjecture, these studies find that firms reporting ICDs exhibit greater noise in accruals (Ashbaugh-Skaife et al. , Doyle, Ge, and McVay [2007a]) and larger abnormal accruals relative to firms not reporting ICDs (Ashbaugh-Skaife et al. ). In this study, we posit that ineffective internal control results in less reliable financial reporting, thus increasing the information risk faced by investors that manifests in a higher cost of equity.1
Recent theoretical work by Lambert, Leuz, and Verrecchia  models the direct and indirect effects of information quality on cost of equity capital in a single-period multisecurity capital asset pricing model (CAPM) setting. With respect to direct effects, they show that low quality information increases market participants' assessed variance of a firm's cash flows and the assessed covariances with other firms' cash flows, leading to a higher cost of equity capital. Moreover, they show that the quality of information systems, which includes the effectiveness of internal controls over information and assets within the firm, has an effect on firms' real decisions, including the assets appropriated by management. Management's appropriation of firm assets reduces the expected value of cash flows to investors, thus contributing to an indirect effect on firms' cost of equity.
Based on the theoretical work in Lambert, Leuz, and Verrecchia , we conduct both (1) cross-sectional tests to assess whether firms with ICDs present higher information risk to investors relative to firms having effective internal controls and (2) intertemporal tests to assess whether changes in the effectiveness of internal control yield changes in the cost of equity consistent with changes in information risk. As predicted, the results of our cross-sectional tests indicate that firms reporting ICDs exhibit significantly higher idiosyncratic risk, betas, and cost of equity relative to firms not reporting ICDs. These differences persist after controlling for other factors shown by prior research to be related to these risk measures. Our finding that differences in these risk measures predate the first disclosures of ICDs suggests that market participants' assessment of nondiversifiable market risk (beta), idiosyncratic risk, and cost of equity incorporates expectations about internal control risks based on observable firm characteristics prior to firms' initial revelation of control problems. This conjecture is consistent with Ashbaugh-Skaife, Collins, and Kinney  and Doyle, Ge, and McVay [2007b], who demonstrate that firms with more complex operations, recent changes in organization structure, greater accounting risk exposure, and less investment in internal control systems are more likely to disclose ICDs.
In an attempt to assess whether a causal relation may exist between internal control quality and firms' cost of equity, we construct four sets of intertemporal change analysis tests. The first intertemporal test examines the changes in implied cost of equity around the first disclosure of an ICD. Our results reveal that ICD firms experience a statistically significant increase in market-adjusted cost of equity, averaging about 93 basis points, around the first disclosure of an ICD. Moreover, we find that ICD firms with the lowest probability of reporting internal control problems (based on observable firm characteristics) exhibit a greater cost of equity change (125 basis points on average) relative to those ICD firms with the highest likelihood of reporting control problems (49 basis points on average). This result is consistent with the market incorporating incomplete adjustments for the likelihood of internal control problems into firms' cost of equity prior to the revelation of which firms have ICDs, and then updating these risk assessments after the control problems are revealed.
Our second change analysis examines cost of equity changes for firms that remediate previously disclosed ICDs as evidenced by an unqualified SOX 404 audit opinion. If revelation of ICDs contributes to an increase in firms' cost of equity, as our first set of change results suggest, then successful remediation of those problems should lead to a decrease in cost of equity. Consistent with this prediction, we find that ICD firms that subsequently receive an unqualified SOX 404 opinion exhibit an average decrease in market-adjusted cost of equity of 151 basis points around the disclosure of the opinion. In contrast, for our third change test we find that ICD firms that subsequently receive adverse SOX 404 audit opinions, which indicate that internal control problems persist, exhibit a modest but insignificant increase in cost of equity around the SOX 404 opinion release.
For our final intertemporal change analysis, we examine the change in cost of equity for non-ICD firms (i.e., no prior disclosure of internal control problems) that receive unqualified SOX 404 opinions. We find no significant cost of equity change for firms least likely to report an ICD, but a significant decrease in the average market-adjusted cost of equity of 116 basis points around the release of an unqualified SOX 404 opinion for firms most likely to report ICDs. These findings suggest that when firms deemed most likely to report internal control problems receive an unqualified SOX 404 audit opinion, the market responds favorably with a reduction in firms' cost of equity.
Collectively our cross-sectional and intertemporal tests present consistent evidence that information risk, as proxied by ineffective internal control, is an important determinant of both idiosyncratic risk and systematic market risk that affects the market's assessment of firms' cost of equity. We document that firms with effective internal control or firms that remediate previously reported ICDs are rewarded with a significantly lower cost of equity. Thus, our study is among the first to document potential benefits of a systematic reporting structure to communicate information about changes in the quality of internal control in terms of cost of equity consequences.
Our study contributes to the literature regarding the effects of information quality on investors' risk assessments and cost of equity in two ways. First, prior research examining the effect of information quality on the cost of equity uses measures of information quality that are dependent upon researcher estimates of information attributes or subjective metrics of voluntary disclosure (Botosan , Bhattacharya, Daouk, and Welker , Francis et al. ). We use the unique setting of SOX internal control reporting to identify firms that have ICDs, which is a less ambiguous indicator of firms' accounting information quality relative to information quality measures used in prior studies. Moreover, the independent auditors' SOX 404 opinions provide clear signals that confirm the remediation of ICDs that allow tests of changes in information quality on firms' cost of equity in ways that minimize competing explanations for our results.
A second contribution to the literature on information quality and cost of equity is that we predict and find that firms with low-quality financial information, as indicated by ICD disclosures, exhibit higher betas and higher idiosyncratic risk. Much of the prior accounting research that investigates the effect of information quality on cost of equity assesses this effect after controlling for systematic risk (Botosan , Botosan and Plumlee , Bhattacharya, Daouk, and Welker , Francis et al. ). We document linkages between information quality and systematic risk, as well as idiosyncratic risk, largely overlooked in prior empirical studies. More importantly, our results suggest that studies that investigate the effect of information quality on cost of equity after controlling for the effects of market risk (beta) are removing part of the information quality effects they seek to document.
Our study also contributes to the literature assessing the economic consequences of the SOX legislation, which is primarily focused on the costs of implementing SOX internal control auditing and reporting requirements (Li, Pincus, and Rego , Zhang , Berger, Li, and Wong , Solomon and Bryan-Low ). This paper, along with a concurrent study by Ogneva, Subramanyam, and Raghunandan , is among the first to investigate the potential benefits of SOX in terms of cost of equity effects. In contrast to the Ogneva, Subramanyam, and Raghunandan  study, which concludes there is no consistent association between ICDs and cost of equity, we find clear evidence that internal control risk matters to investors and that firms reporting effective internal controls or firms remediating previously disclosed ICDs benefit through lower cost of equity.2
The remainder of the paper is organized as follows. Section 2 summarizes the theoretical underpinnings of our analysis and sets forth our predictions about internal control weaknesses and remediation, market and idiosyncratic risk, and cost of equity. Section 3 provides institutional background and summarizes related work. Section 4 describes our samples and provides descriptive statistics. Section 5 presents our empirical findings along with a discussion of alternative cost of equity capital proxies. Conclusions are drawn in section 6.
2. Linkages between Internal Control Weaknesses, Firm Risk, and Cost of Equity
Lambert, Leuz, and Verrecchia  develop a model in a single-period multisecurity CAPM setting that links the quality of accounting disclosures and information systems to firm risk and cost of equity. In the Lambert, Leuz, and Verrecchia  framework, accounting information system quality is broadly defined to include not only the disclosures the firm makes to outsiders, but also the internal control systems that a firm has in place. A key insight from their analysis is that the quality of accounting information and the systems that produce that information influence a firm's cost of capital in two ways: (1) direct effects—where higher quality accounting information does not affect firm cash flows, per se, but does affect market participants' assessments of the variance of a firm's cash flows and the covariance of the firm's cash flows with aggregate market cash flows—and (2) indirect effects—where higher quality information and better internal controls affect real decisions within the firm, including the quality of operating decisions as well as the amount of firm resources that managers appropriate for themselves.
Lambert, Leuz, and Verrecchia  analyze the direct effects of information system quality by introducing an accounting information signal, (e.g., earnings), that provides a noisy signal about the (future) end-of-period cash flows of the firm, . That is, where is the noise or measurement error in the information signal. Because the (future) end-of-period firm cash flows are unobservable, the market's assessment of the variance of firm j's cash flows and the covariance structure of firm j's future cash flows with all other firms in the market is conditioned by the quality or precision of firm j's accounting signal. Specifically,
As equation (1) shows, investors' assessment of the variance of firm j's cash flows and covariance of firm j's cash flows with the cash flows of all other firms in the market is proportional to or the noise in the information signal about firm j's future cash flows. Importantly, the effect of measurement error in the information signal does not diversify away as the number of securities grows large—the nonnegative effect is present for each and every covariance term with firm j.
Recognizing that is a noisy signal from a broader information set Φ that conditions investors' assessment of the end-of-period cash flows, the following expression can be derived from the Lambert, Leuz, and Verrecchia  formulation for expected return (cost of capital):
In equation (2a) and equation (2b), Rf is the risk-free rate, Φ is the information set available to investors to make their assessments regarding the distribution of future cash flows for firm j, and Nτ is the aggregate risk tolerance of the market. All other variables are defined above. As indicated in equation (2a) and equation (2b), as the noise in the firm's accounting signals increases (decreases) the firm's cost of capital is expected to be higher (lower).
Within the Lambert, Leuz, and Verrecchia  framework, the quality of a firm's information system, which includes its internal control, can also affect a firm's real decisions. The real decisions include, but are not limited to, the amount of firm cash flows that managers appropriate for themselves. Ceteris paribus, we conjecture that ineffective internal control increases the firm assets appropriated by management and, therefore, decreases the ratio of expected cash flows available to investors relative to the covariance of firm cash flows with the market as shown in equation (2b). This indirect real effect translates into a higher cost of equity.3
In sum, we posit that the quality of a firm's internal control over financial reporting affects investors' assessments of firm risk and cost of capital because if a firm has weak internal control, then the quality or precision of its accounting signals is impaired. Consistent with this conjecture, Ashbaugh-Skaife et al.  and Doyle, Ge, and McVay [2007a] find that firms reporting ICDs exhibit noisier accruals after controlling for other firm characteristics that affect accrual quality. Combining these empirical findings with the theory in Lambert, Leuz, and Verrecchia , we develop both cross-sectional and intertemporal predictions.
In the cross-section, we predict that firms with ICDs exhibit higher idiosyncratic risk, higher systematic (beta) risk, and higher cost of equity relative to firms with strong internal controls. Moreover, we expect firms' costs of equity to increase when the first public revelation of internal control problems is made under SOX 302 or 404 reporting provisions, and to decrease when external auditor SOX 404 opinions affirm that the firm's control problems are remediated. In developing testable implications of the Lambert, Leuz, and Verrecchia  model, there are several key points to keep in mind.
First, in the Lambert, Leuz, and Verrecchia  framework, the cost of capital effect of higher quality information is fully captured by an appropriately specified forward-looking beta, that is, the covariance of expected end-of-period cash flows. Thus, if one can properly measure forward-looking betas there is no role for an ICD indicator in explaining differences in cost of equity because all effects of internal control problems on cost of capital are subsumed by forward-looking beta. However, betas estimated using historical return data do not fully capture all information quality effects of internal control differences. Because historical beta estimates provide a noisy estimate of the forward-looking beta in the Lambert, Leuz, and Verrecchia  model, we posit that the indicator variables for ICDs and remediation of ICDs used in our empirical tests have incremental explanatory power beyond beta with respect to cost of capital.
Second, the direct effects of information quality differences on investors' assessed variances and covariances of a firm's cash flows in the Lambert, Leuz, and Verrecchia  framework are developed under the maintained hypothesis that the firm's real investment and operating decisions are held constant. Accordingly, our predictions of the direct effects of ICDs and remediation on cost of equity are developed under the maintained hypothesis that firms' investment/operating decisions are held constant. Given the relatively short time horizon from the initial disclosure of an ICD to its subsequent remediation as evidenced by an unqualified SOX 404 audit opinion (generally, within one year), we believe this maintained hypothesis is reasonable.
Finally, in formulating our intertemporal tests, we recognize that investors hold priors on the likelihood of ICDs based on observable firm characteristics (Ashbaugh-Skaife, Collins, and Kinney , Doyle, Ge, and McVay [2007b]). Thus, we predict that the effect of a negative or positive signal about a firm's internal control quality has a greater (smaller) effect on cost of capital the smaller (greater) the probability of the firm reporting an ICD.
3. Institutional Background and Reporting Environment
Prior to passage of SOX in July 2002, public companies in the United States are required to maintain financial records as well as internal controls that protect corporate assets and facilitate generally accepted accounting principles (GAAP)-based financial reporting (e.g., Foreign Corrupt Practices Act, U.S. Congress ). However, pre-SOX statutes do not require management evaluations of internal control or public assertions about control adequacy and the statutes do not require independent audits of internal control.4 SOX changes the public assertion, audit, and audit reporting landscape in two steps.
First, section 302 of SOX (effective August 29, 2002) mandates that a firm's CEO and CFO certify in periodic (interim and annual) Securities and Exchange Commission (SEC) filings that they have “evaluated … and have presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation” (SOX 302 (a) (4) (C) and (D)). Second, section 404(b) requires the financial statement auditor to express an opinion on management's evaluation of the effectiveness of internal control over financial reporting. Auditing Standard (AS) No. 2 (effective for larger firms for fiscal years ending on or after November 15, 2004) adds a requirement that the auditor express a separate opinion about the effectiveness of the firm's internal controls based on the auditor's own review (PCAOB ).
In the empirical work to follow, we use ICD disclosures made under SOX section 302 and section 404 as indicators of poor-quality accounting information. ICDs can affect firms' information quality in two principal ways. One way is through random, unintentional misstatements due to the lack of adequate policies, training, or diligence by company employees. Examples are: inventory counting and pricing errors that misreport inventory on hand and related cost of sales, omission of items such as failure to record credit purchases, variation in revenue recording due to employee discretion or lack of specific policies for revenue recognition, expensing amounts that should be capitalized and vice versa, inadequate basis for accounting estimates such as the allowance of inventory obsolescence, and unreliable procedures for “rolling up” amounts from segments and subsidiaries at fiscal year-end. These unintentional misstatements are likely to be random and can lead to increases or decreases in resulting earnings.
A second way that ICDs can adversely affect information quality is through intentional misrepresentations or omissions by employees or by management. These nonrandom misstatements typically overstate earnings for the current period, but “big bath” write-offs or “cookie jar” reserves result in opportunistic understatement of current earnings as well. For example, management's exercise of discretion in accounting choices allows financial misrepresentation through manipulation of accruals for recording important accounting estimates such as warranty liabilities, reserves for sales returns, and allowance for uncollectible receivables. Furthermore, employee fraud is made possible by inadequate segregation of internal control duties. Weak internal control in the form of inadequate segregation of duties can allow the misappropriation of assets and alteration of recorded amounts by employees that are not detected because the company has inadequate staff for monitoring or lack of action by top management because of a lax control environment. In addition, misstatements can be introduced into the financial reporting process through opportunistic “oversights” or omissions in accumulating segment and subsidiary information for consolidated reports, as well as through management emphasizing earnings targets in instructions to employees.
Determining the status of internal controls (i.e., whether effective or ineffective) and whether previously reported control problems are remediated are important aspects of our research design. In the empirical tests that follow, we rely on an independent third-party evaluation of the effectiveness of internal controls as reflected in the SOX 404 audit report. Firms that previously disclose ICDs under 302 or 404 and subsequently receive an unqualified SOX 404 audit opinion comprise our remediation subsample, while ICD firms that receive a qualified SOX 404 opinion comprise our nonremediation subsample. Control firms are firms that do not report ICDs under SOX 302 and receive unqualified SOX 404 opinions in the first SOX 404 reporting year, thus indicating that their internal controls are effective.
4. Sample and Descriptive Statistics
4.1 ICD sample details
Our initial sample of firms providing ICD disclosures is obtained from compilations of SEC filings reported in Compliance Week and by Glass, Lewis & Co., LLC from November 2003 to September 2005.5 In addition, we supplement these two databases with hand-collected ICD disclosures from SEC filings made after September 2005 for firms that delay their SEC filings but indicate they are expecting an adverse internal control opinion.6 These procedures result in an initial sample of 1,053 firms disclosing at least one ICD in either the SOX 302 or SOX 404 reporting regime.
Of the 1,053 ICD firms, 587 have the necessary data to estimate our idiosyncratic risk and systematic risk models. Data needed to conduct cross-sectional market reaction and cost of equity tests are available for 787 and 221 firms, respectively. There are 162 firms that have the necessary data to examine the intertemporal change in cost of equity at the time of the first ICD disclosure. The remaining analyses examine the change in ICD firms' cost of equity based on the type of SOX 404 opinion received. We have data for 38 firms that report an ICD under 302 but receive an unqualified SOX 404 opinion. These 38 firms comprise our “remediation” sample. We have data for 50 firms identified as having persistent control problems because they disclose ICDs under SOX 302 and subsequently receive an adverse SOX 404 opinion. These firms comprise our “no-remediation” sample.7Table 1 displays the subsamples used to conduct our cross-sectional tests of risk differences, market reaction tests, and intertemporal cost of equity change analyses.
Internal Control Deficiency Samples
|Firms either disclosing an internal control deficiency (ICD) under SOX 302 or both disclosing an ICD under SOX 404 and concurrently receiving an adverse SOX 404 opinion in SEC filings from November 2003 through September 2005 per Compliance Week and Glass Lewis. Sample is supplemented by hand-collected data from SEC filings after September 2005 for firms previously indicating delays due to expected adverse SOX 404 audit opinions.|| |
| “ICD firms”||1,053|
|ICD firms having the necessary data to conduct the market reaction (returns) analyses|| 787|
|ICD firms having the necessary data to conduct the cross-sectional idiosyncratic risk and market risk analyses|| 587|
|ICD firms having the necessary data to conduct the cross-sectional cost of equity analysis|| 221|
|ICD firms having the necessary data to conduct the cost of equity change analysis surrounding the issuance of the first ICD disclosure|| 162|
|ICD firms remediating their ICD and having the necessary data to conduct a change in cost of equity analysis around the first SOX 404 opinion|| |
| “Remediation sample”|| 38|
|ICD firms not remediating their ICD and having the necessary data to conduct a change in cost of equity analysis around the first SOX 404 opinion|| |
| “No-remediation sample”|| 50|
4.2 descriptive statistics
Table 2 reports descriptive statistics for the 587 ICD firms and the 3,024 non-ICD firms, that is, control firms, having sufficient data to conduct our cross-sectional tests of the association between internal control problems and idiosyncratic risk and systematic risk. Idiosyncratic risk (I_RISK) is the standard deviation of the residuals from the following model:
where EXRET is the firm's monthly return minus the risk-free rate and RMRF is the excess return on the market. Systematic risk (BETA) is measured as the coefficient on RMRF.8Equation (3) is estimated using monthly returns requiring a minimum of 24 and maximum of 60 observations over 2004 and the prior four fiscal years.9 Consistent with Doyle, Ge, and McVay [2007a], we assume that ICDs that are first disclosed in 2004 existed for some time prior to disclosure. In addition, we assume that the market is able to form expectations about internal control quality based on observable firm characteristics, and that these expectations are incorporated in the risk measures noted above (see Ashbaugh-Skaife, Collins, and Kinney , Doyle, Ge, and McVay [2007b])
Descriptive Statistics on Variables Used in the Idiosyncratic Risk and Beta Analyses
|ICD|| || 0.09|| 0.08|| 0.00|| 0.00||−0.04|| 0.02||−0.07||−0.10||−0.07|| 0.03|| 0.08|
|I_RISK|| 0.11|| || 0.64|| 0.46||−0.14||−0.41||−0.18||−0.46||−0.55||−0.03|| 0.05|| 0.31|
|BETA|| 0.08|| 0.65|| || 0.28||−0.16||−0.27||−0.15||−0.11||−0.41||−0.13|| 0.01|| 0.51|
|STD_CFO|| 0.02|| 0.58|| 0.41|| ||−0.14||−0.39||−0.21||−0.29||−0.28||−0.06|| 0.21|| 0.12|
|LEV||−0.01||−0.24||−0.22||−0.30|| ||−0.02||−0.09|| 0.11|| 0.11|| 0.04||−0.08||−0.21|
|CFO||−0.09||−0.34||−0.26||−0.19||−0.03|| || 0.08|| 0.33|| 0.24|| 0.21|| 0.13||−0.03|
|BM|| 0.03||−0.18||−0.16||−0.23|| 0.03||−0.13|| ||−0.23|| 0.04||−0.18||−0.05||−0.03|
|SIZE||−0.07||−0.49||−0.12||−0.39|| 0.19|| 0.37||−0.19|| || 0.42|| 0.05||−0.03||−0.09|
|DIVPAYER||−0.10||−0.63||−0.44||−0.41|| 0.16|| 0.24|| 0.07|| 0.41|| || 0.04||−0.05||−0.27|
|RET||−0.08||−0.18||−0.21||−0.15|| 0.10|| 0.26||−0.16|| 0.16|| 0.14|| || 0.02||−0.11|
|COVCFO|| 0.03|| 0.04|| 0.01|| 0.08||−0.06|| 0.12||−0.06||−0.02||−0.04|| 0.03|| || 0.03|
|INDBETA|| 0.08|| 0.33|| 0.50|| 0.23||−0.22||−0.05||−0.02||−0.09||−0.26||−0.14|| 0.05|| |
The control variables included in our analysis of I_RISK and BETA are as follows:
- • Standard deviation of cash flow from operations (STD_CFO) defined as the five-year standard deviation of cash flow from operations (Compustat #308) divided by total assets (Compustat #6), requiring a minimum of three years of data;
- • Leverage (LEV), defined as total debt (Compustat #9 plus Compustat #34) divided by total assets (Compustat #6);
- • Cash flow from operations (CFO), defined as cash flow from operations divided by total assets;
- • Book-to-market (BM), defined as book value of equity (Compustat #60) divided by market value of equity (Compustat #199 times Compustat #25);
- • Firm size (SIZE), defined as the natural log of market value of equity (Compustat #199 times Compustat #25);
- • Dividend distribution (DIVPAYER), defined as one if the firm pays dividends (Compustat # 21), and zero otherwise;
- • Return (RET), defined as the buy-and-hold return over the firm's fiscal year (CRSP);
- • Covariance of the firm's cash flows with the market cash flows (COVCFO), measured as the quarterly cash flows from operations using 2004 and the prior four fiscal years, requiring a minimum of three years (12 quarters) of data, divided by total assets of the firm and market, respectively. This variable is multiplied by 1,000 to facilitate comparisons with other coefficients;
- • Industry beta (INDBETA), measured as the coefficient on RMRF in the following industry return regression: INDRET=β0+β1RMRF+ɛ. The model is estimated over the 60 months prior to the firm's 2004 fiscal year-end, requiring a minimum of 18 months. INDRET is the monthly value-weighted return on a portfolio of firms in the same industry (three-, two-, and one-digit Standard Industrial Classification (SIC) codes requiring at least 10 firms in the industry) minus the risk-free rate. RMRF is the excess return on the market, which is obtained from the Website http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html.
All control variables are measured as of a firm's 2004 fiscal year-end.
The descriptive statistics reported in Table 2 indicate that, on average, ICD firms have statistically higher I_RISK, larger BETAs, and lower cash flows from operations; are smaller; and are less likely to pay dividends relative to non-ICD firms. In addition, ICD firms have statistically lower returns, higher covariance of firm cash flows with market cash flows, and larger industry betas relative to non-ICD firms.
Panel B of Table 2 displays the correlations among the control variables and the ICD indicator variable, where ICD is coded as one if the firm reports an internal control problem, and zero otherwise. The upper righthand portion of the panel presents Pearson product-moment correlations, while the lower lefthand portion presents Spearman rank-order correlations. To facilitate discussion, we focus on the Pearson correlations, but note that the Spearman rank-order correlations are generally consistent with the Pearson correlations. The ICD indicator is positively correlated with both I_RISK (0.09) and BETA (0.08). In addition, the ICD indicator is negatively correlated with CFO (−0.04), SIZE (−0.07), DIVPAYER (−0.10), and RET (−0.07), and positively correlated with COVCFO (0.03) and INDBETA (0.08). As expected, I_RISK and BETA exhibit a relatively large positive correlation (0.64) as do INDBETA and BETA (0.51).
5.1 cross-sectional return results
In this section we investigate whether there is a negative market reaction to firms' initial reporting of an ICD. Anecdotal evidence presented in the financial press highlights immediate material declines in the stock prices of select firms that report ICDs. For example, Flowserve's stock price declines 12% on the day after the announcement of an internal control problem (Goldman Sachs ). In contrast, academic research is inconclusive as to whether there is a negative market reaction to ICD disclosures. Whisenant, Sankaraguruswamy, and Raghunandan  find no pre-SOX evidence that disclosures of internal control weaknesses, as reportable events via a change in auditor reported on Form 8-K, result in significant negative abnormal returns around the 8-K filing dates. Hammersley, Myers, and Shakespeare , however, find a significant negative market reaction to material weakness ICDs disclosed under SOX 302.
To provide further insights into the market's immediate reaction to firms' initial announcements of an internal control problem, we calculate market-adjusted returns (BHAR) measured over a three-day window starting one day before and including the day after the announcement that contains the ICD disclosure.10 Panel A of Table 3 reports a mean (median) drop in share price of −0.76% (−0.41%) over the three-day window, which is significant at p= 0.00 (0.01). The average market cap of our sample firms at the beginning of fiscal year 2004 is $2,860 million, so a −0.76% abnormal return translates into a $21.74 million decline in market value, on average. Below, we link this negative market reaction to increases in the cost of equity.
Market Reaction to First Disclosure of Internal Control Deficiencies
|ICD (N= 787)||−0.76%***||−0.41%**|
|Adjusted R2|| || 0.00 || |
|N|| ||787|| |
When ICD disclosures are partitioned by the severity of the internal control problem, we find no significant difference between the market's response to material weaknesses and the market's response to significant deficiencies or control deficiencies. Specifically, we regress BHAR on a binary variable (MATERIAL_WEAKNESS) coded one for material weakness ICD disclosures, and zero otherwise. The regression results reported in panel B of Table 3 indicate an insignificant coefficient on MATERIAL_WEAKNESS, which is contrary to the findings in Hammersley, Myers, and Shakespeare , who document a greater negative market reaction to material weakness ICDs compared to those that firms self-classify as being of lesser severity.11
Overall, our market reaction tests provide evidence that the market reacts negatively to signals that firms' internal controls are ineffective. However, it appears that the uncertainty about the differences between material weaknesses and significant deficiencies or control deficiencies (as discussed in Ashbaugh-Skaife, Collins, and Kinney ) results in the market not making a significant distinction between the severity of ICDs.12
5.2 cross-sectional risk results
We begin our empirical tests of the risk effects of weak internal controls by investigating whether firms that report ICDs exhibit higher idiosyncratic risk (I_RISK) relative to non-ICD firms using an ordinary least squares (OLS) regression that controls for other factors that prior research shows to be related to idiosyncratic risk (Rajgopal and Venkatachalam , Hanlon, Rajgopal, and Shevlin , Pastor and Veronesi , Wei and Zhang ). Specifically, we estimate the following model:
where all variables are as previously defined.
Based on the modeling in Lambert, Leuz, and Verrecchia , we predict a positive coefficient on ICD as firms with internal control problems generate noisier (lower quality) accounting signals, thereby increasing the information risk faced by investors. Equation (4) controls for a number of innate firm characteristics that are shown to be related to idiosyncratic risk. CFO and STD_CFO are used to capture operating performance and the volatility of operations, respectively. We expect firms with underperforming operations and more volatile operations to exhibit greater I_RISK. Thus, we predict a negative (positive) coefficient on CFO (STD_CFO). SIZE and DIVPAYER represent firm size and firm maturity, where large firms and more mature firms are expected to be less risky. Therefore, we predict a negative relation among SIZE, DIVPAYER, and I_RISK. Finally, we expect firms with higher leverage (LEV) to exhibit greater I_RISK. We make no prediction about the association between BM and I_RISK or between RET and I_RISK. BM can reflect financial distress, which leads to a positive association between BM and the risk measure, or can proxy for growth opportunities, which leads to a negative association between BM and the risk measure. Rajgopal and Venkatachalam  document a negative association between I_RISK and RET. However, Duffee  finds that the association between I_RISK and RET is sensitive to the sample of firms used in the analysis. Specifically, he finds that the association varies depending on the treatment of firms that experience events such as bankruptcies, takeovers, and delistings. Therefore, while we include RET in the model, we leave the prediction unsigned.
The model 1 column of Table 4 displays the results of estimating equation (4). As expected, we find that larger firms, firms that more often pay dividends, firms with better operating performance, and firms with lower volatility of cash flows from operations exhibit lower idiosyncratic risk. We find a significant negative coefficient on BM that is consistent with the findings of Rajgopal and Venkatachalam  and suggests that firms with greater growth opportunities have lower idiosyncratic risk. The results indicate a significant negative coefficient on LEV, contrary to expectations. However, when we eliminate from the sample firms that have little or no debt (i.e., LEV less than 0.10), we find, as expected, a positive coefficient on LEV, which indicates that firms with more financing risk exhibit higher idiosyncratic risk.13
Internal Control Deficiencies and Idiosyncratic Risk
Model 1 Model 2
|SEGMENTS|| || || ||−0.002**||(0.001)|
|FOREIGN_SALES|| || || ||−0.001||(0.003)|
|M&A|| || || ||0.005**||(0.002)|
|RESTRUCTURE|| || || ||0.008***||(0.002)|
|RGROWTH|| || || ||0.002***||(0.000)|
|INVENTORY|| || || ||−0.008||(0.009)|
|%LOSS|| || || ||0.055***||(0.004)|
|RZSCORE|| || || ||−0.004***||(0.001)|
|AUDITOR_RESIGN|| || || ||0.009||(0.011)|
|RESTATEMENT|| || || ||0.002||(0.004)|
|AUDITOR|| || || ||−0.003||(0.005)|
|INST_CON|| || || ||−0.014***||(0.002)|
|LITIGATION|| || || ||0.019***||(0.002)|
|Adjusted R2|| ||0.49|| ||0.57|| |
|N|| ||3,611|| ||2,735|| |
Turning to the variable of interest, we find a positive and significant coefficient on ICD. This result indicates that, after controlling for operating, financing, and other risk attributes, firms with ineffective internal controls exhibit greater idiosyncratic risk than firms that do not report internal control problems.
The results reported in the model 1 column of Table 4 serve to benchmark the relation between firms' information quality as a function of internal controls and I_RISK after controlling for firm fundamentals documented in prior research to be related to idiosyncratic risk. Ashbaugh-Skaife, Collins, and Kinney  report that firms are more likely to have ICDs when they have more segments, engage in foreign sales, participate in mergers and acquisitions, and engage in restructurings. These economic events also influence firms' operating performance and the volatility of operations. To ensure that our ICD variable is not proxying for some other inherent operating risk, we expand the I_RISK model with the ICD determinants documented in Ashbaugh-Skaife, Collins, and Kinney  and estimate the following OLS regression:
the number of reported business segments in 2003 (Compustat Segment file);
one if a firm reports foreign sales in 2003, and zero otherwise (Compustat Segment file);
one if a firm is involved in a merger or acquisition from 2001 to 2003, and zero otherwise (Compustat AFNT #1);
one if a firm is involved in a restructuring from 2001 to 2003, and zero otherwise (this variable is coded one if any of the following Compustat data items is nonzero: 376, 377, 378, or 379);
the decile rank of average growth rate in sales from 2001 to 2003 (the percent change in Compustat #12);
the average inventory to total assets from 2001 to 2003 (Compustat #3/Compustat #6);
the proportion of years from 2001 to 2003 that a firm reports negative earnings;
the decile rank of the Altman z-score measure of distress risk;
one if the auditor resigns from the client in 2003, and zero otherwise (8-K filings);
one if a firm has a restatement or an SEC Accounting and Auditing Enforcement Release (AAER) from 2001 to 2003, and zero otherwise;
one if the firm engages one of the largest six audit firms for 2003, and zero otherwise (Compustat #149), where the largest six audit firms include PricewaterhouseCoopers, Deloitte & Touche, Ernst & Young, KPMG, Grant Thornton, and BDO Seidman;
the percentage of shares held by institutional investors divided by the number of institutions that own the stock as of December 31, 2003 (Thomson Financial Securities data);
one if a firm is in a litigious industry—SIC codes 2833–2836, 3570–3577, 3600–3674, 5200–5961, and 7370—and zero otherwise;
and all other variables are as previously defined. All ICD determinants are measured as of the firm's 2003 fiscal year-end or the average of the 2001 to 2003 values since prior economic events affect the likelihood of internal control problems reported in fiscal 2004 and after (Ashbaugh-Skaife, Collins, and Kinney ). We do not make predictions on the sign of the ICD determinant coefficients because many of the ICD determinants proxy for similar constructs included in the basic I_RISK model (e.g., more risky operations).
The model 2 column of Table 4 displays the results of estimating equation (5). Eight of the 13 ICD determinants are significantly related to I_RISK and we continue to find significant coefficients on STD_CFO, LEV, BM, SIZE, and DIVPAYER. The CFO coefficient is no longer significant after including the ICD determinants, which also serve as measures of firm operating performance. One other finding that differs from the results reported in the model 1 column of Table 3 is that the coefficient on RET is now significantly positive. Most importantly, after including the additional control variables in the I_RISK model, we continue to find a positive and significant coefficient on ICD.14 This indicates that, after controlling for operating, financing, and internal control risk factors, firms with greater information risk due to internal control problems exhibit greater idiosyncratic risk.
Our next cross-sectional analysis examines the relation between ICDs and market risk (BETA). Similar to our I_RISK analysis, we estimate two models of BETA:
where all variables are as previously defined.
Equation (6) is the baseline model that includes the risk factors previously documented in the literature as being related to BETA (e.g., see Beaver, Kettler, and Scholes ). We predict a positive coefficient on STD_CFO and COVCFO because firms with more volatile cash flows from operations are considered to be more risky firms. We expect CFO, SIZE, and DIVPAYER to be negatively related to BETA because firms with better operating performance, large firms, and more mature firms are expected to be less risky. We expect a positive coefficient on LEV because firms with greater financial risk are expected to have greater market risk. In addition, we expect a positive coefficient on INDBETA because firms that operate in riskier industries are expected to have greater market risk. Similar to our I_RISK analysis, we make no prediction on the association between BM and BETA because BM can proxy for growth or for financial distress. Equation (7) is the expanded model that controls for the determinants of ICDs.
The model 1 column of Table 5 displays the results of estimating equation (6). Consistent with expectations, we find a significantly positive coefficient on STD_CFO and significantly negative coefficients on CFO and DIVPAYER, indicating that firms with more volatile operation, firms with weak operating performance, and less mature firms exhibit larger market risk. Similar to the results presented in Table 4, we find a significantly negative coefficient on LEV. However, when we eliminate firms with little or no debt in their capital structure, the coefficient on LEV becomes insignificant. Inconsistent with expectations, we find a positive coefficient on SIZE. As noted earlier, many of the firm fundamentals in our risk models are highly correlated. A reduced form estimate of equation (6) that excludes DIVPAYER yields a negative relation between SIZE and BETA as shown in prior research (Beaver, Kettler, and Scholes ).
Internal Control Deficiencies and Systematic Risk (Beta)
Model 1 Model 2
|SEGMENTS|| || || ||−0.057***||(0.010)|
|FOREIGN_SALES|| || || ||0.102***||(0.035)|
|M&A|| || || ||0.045||(0.032)|
|RESTRUCTURE|| || || ||0.156***||(0.032)|
|RGROWTH|| || || ||0.001||(0.006)|
|INVENTORY|| || || ||−0.292**||(0.126)|
|%LOSS|| || || ||0.795***||(0.051)|
|RZSCORE|| || || ||−0.033***||(0.008)|
|AUDITOR_RESIGN|| || || ||0.185||(0.146)|
|RESTATEMENT|| || || ||0.036||(0.057)|
|AUDITOR|| || || ||0.112*||(0.061)|
|INST_CON|| || || ||−0.172***||(0.022)|
|LITIGATION|| || || ||0.184***||(0.034)|
| || || || || || |
|Adjusted R2|| ||0.41|| ||0.51|| |
|N|| ||3,611|| ||2,735|| |
The key result reported in model 1 of Table 5 is the positive coefficient on ICD, which indicates that firms with ineffective internal control exhibit higher BETAs relative to firms with effective internal control after controlling for known sources of beta risk. Results of estimating equation (7), which controls for known risk factors and ICD determinants (model 2 column of Table 5), provide additional evidence that firms with ineffective internal control have greater market risk as the coefficient on ICD is positive and significant at conventional p-values.
Overall, the results reported in Table 4 and Table 5 suggest that firms with ineffective internal control present greater information risk to investors, as investors assess larger variances in cash flows (I_RISK) and covariances in cash flows (BETA) for firms with low-quality financial information (Lambert, Leuz, and Verrecchia ).
5.3 cost of capital analysis
5.3.1. Discussion and Validation of Alternative Implied Cost of Equity Measures Prior to presenting our cross-sectional tests of the effects of ICDs on cost of equity, we provide an overview of alternative cost of equity proxies and justification for our proxy. Conceptually, the cost of equity capital is the discount rate the market applies to a firm's future cash flows to determine its current stock price. We measure firms' implied cost of equity by taking the average of Value Line's high and low annualized expected return for a three- to five-year horizon.15 Value Line's expected return is the discount rate that equates their three- to five-year target price forecasts and dividend forecasts to a firm's current price. The target prices are provided quarterly, and Value Line updates the current prices and subsequently updates firms' expected returns between Value Line report dates. For our cross-sectional tests we measure firms' cost of equity capital, labeled CC, as the average expected return over the firm's fiscal year.16 Averages are comprised of a minimum of 4 and a maximum of 12 expected return measures.
The fact that the Value Line expected return proxy for firms' implied cost of equity is updated frequently is an important research design feature in our setting because the ICDs whose effects we seek to capture are potentially short lived in nature. After ICDs are discovered and publicly reported, management faces added incentives to develop and implement an action plan to remediate these deficiencies. For a significant number of our sample firms that disclose ICDs in fiscal 2004, the deficiency is remediated within a 6- to 18-month period. If the market anticipates that most ICDs are remediated within a relatively short time frame, then a higher discount rate should be assigned to the near-term cash flows and a lower discount rate should be applied to cash flows further into the future when the control deficiencies are expected to be resolved.17 Therefore, to better detect a cost of equity effect of internal control problems and their remediation it is important that the cost of equity estimates be updated in a timely fashion and that the estimates be based upon a technique that does not require that the same discount rate be applied to all future periods. If the method used to estimate cost of equity assumes the same discount rate for all periods, it may be harder to detect the short-term ICD effects hypothesized in this study because the estimated cost of equity is an average of a higher discount rate applied to shorter term cash flows and a lower, more normal, rate applied to cash flows further into the future. The Value Line expected return does not restrict the discount rates for periods beyond the target price horizon to be the same as the near term (three- to five-year) discount rates. In contrast, other popular implied cost of capital estimation techniques typically assume that the same discount rate applies before and after the terminal value year.18
A variety of implied cost of capital estimates have been proposed in the literature (see Botosan and Plumlee  for a detailed discussion of these alternative approaches). Theoretical and empirical research indicates that a “good” measure of implied cost of capital is positively related to beta and the book-to-market ratio and negatively related to size (Sharpe , Lintner , Black , Berk , Fama and French , Botosan and Plumlee ). Using these criteria, we find that the Value Line expected return measure is positively related to beta and the book-to-market ratio and negatively related to size.
Guay, Kothari, and Shu  develop an alternative technique for evaluating implied cost of equity measures. Their evaluation is based on the association between measures of expected return and future realized returns. Based on the premise that expected returns, on average, should equal realized returns if the market's expected returns reflect rational expectations, they posit that regressing future realized returns on an estimate of expected returns should yield a coefficient of one for good estimates of expected returns, or in the following equation, δ1 should equal one.
where RETt is the firms' realized returns in period t, and E(RETt) is a proxy for the firms' expected return at the beginning of period t. Thus, the appropriateness of an implied cost of equity measure is evaluated based on whether the estimated δ1 in equation (8) is not significantly different from one.
We validate our cost of equity measure using the methodology developed by Guay, Kothari, and Shu . Specifically, following the approach in Fama and MacBeth , we regress future monthly returns on estimated monthly expected returns, calculated as the Value Line expected return divided by 12.19 The average monthly δ1 coefficient is 0.66, which is significantly different from zero at p= 0.08 (two-tailed). As noted by Guay, Kothari, and Shu , if the expected return measure in equation (8) is a good proxy for the market's rational expectations of future returns, the δ1 coefficient is predicted to be one. The p-value associated with the test of whether 0.66 equals one is 0.47, two-tailed. Thus, we conclude that the Value Line expected return serves as a reasonably good proxy for firms' cost of equity.
To determine whether we should incorporate alternative cost of equity capital measures into our empirical tests, we investigate the reasonableness of the positive earnings growth (PEG) ratio (Easton ) as a cost of equity proxy. The results of Botosan and Plumlee  suggest that this measure performs well as a proxy for firms' cost of equity relative to other estimates used in prior literature.20 We use I/B/E/S consensus analysts' earnings forecast data to calculate PEG ratio estimates of firms' cost of equity. In untabled analyses, we find that the PEG ratio cost of capital estimates are positively related to beta and the book-to-market ratio and negatively related to size, as expected. However, when we estimate equation (8) using the PEG ratio, the δ1 coefficient is −0.02, insignificantly different from zero and significantly different from one.21 Thus, for our sample, the PEG ratio proxy for implied cost of equity fails the rational expectations test of Guay, Kothari, and Shu .
To summarize, the results indicate that our implied cost of equity measure, based on the Value Line expected return, serves as a better proxy for firms' cost of equity because it meets the criteria of reasonableness outlined above whereas the PEG ratio proxy fails to meet the Guay, Kothari, and Shu  rational expectations criteria. Moreover, in test results reported below, we demonstrate that changes in Value Line expected returns are sensitive to whether ICDs are remediated or are more persistent, which is consistent with this implied cost of equity measure being more appropriate for the setting that we investigate.
5.3.2. Cost of Capital Cross-sectional ResultsTable 6 displays the descriptive statistics for the Value Line cost of capital estimate (CC) and the risk measures that serve as control variables in our cost of capital tests: BETA, SIZE, BM, and I_RISK. The mean (median) CC value for ICD firms is 15.006% (13.750%), whereas the mean and median CC values for the non-ICD firms are significantly less (12.523% and 11.500%, respectively). The univariate tests also indicate that both the means and medians for BETA, BM, and I_RISK are larger for ICD firms. However, on average, ICD firms are smaller than non-IDC firms based on market value of equity.
Descriptive Statistics for Cost of Equity Subsamples
|BETA|| 1.367|| 1.108|| 0.556|| 1.999||1.057|
|SIZE|| 7.349|| 7.158|| 6.428|| 8.242||1.447|
|BM|| 0.495|| 0.460|| 0.285|| 0.632||0.278|
|I_RISK|| 0.140|| 0.129|| 0.095|| 0.175||0.064|
|Non-ICD firms (N= 1,183)|
|BETA|| 1.011|| 0.757||0.378|| 1.410||0.891|
|SIZE|| 8.025|| 7.896||6.961|| 8.995||1.478|
|BM|| 0.427|| 0.401||0.260|| 0.569||0.230|
|I_RISK|| 0.117|| 0.100||0.078|| 0.140||0.057|
As an initial test of our predictions regarding the effects of ICDs on the cost of equity, we use the following model:
where all variables are as previously defined. This simplified model that omits BETA and I_RISK allows us to measure the full effect of internal control problems on firms' cost of equity through the γ1 coefficient because the effects of ICDs on BETA and I_RISK are not removed, as is typically done in prior research.
The model 1 column of Table 7 reports results of estimating equation (9). The signs of the coefficients on the risk factors are as expected in that we find that CC is positively related to BM and negatively related to SIZE. We also find a significantly positive γ1 coefficient on ICD of 1.938. The model 2 column of Table 7 reports results of estimating equation (9) after expanding the CC model to include BETA and I_RISK.22 Although the coefficient on the ICD variable is considerably smaller (1.141), it is still highly significant, indicating that control weaknesses have an effect on firms' cost of equity beyond the effects captured through historical BETA and I_RISK estimates.23 This result supports our general hypothesis that firms that have ICDs exhibit higher costs of equity than firms that do not.
Internal Control Deficiencies and Cost of Equity
|BETA||+|| || ||1.355***||(0.204)||0.879***||(0.268)|
|I_RISK||+|| || ||27.992***||(3.493)||15.446***||(4.440)|
|SEGMENTS|| || || || || ||−0.056||(0.097)|
|FOREIGN_SALES|| || || || || ||−0.854*||(0.488)|
|M&A|| || || || || ||−0.455*||(0.335)|
|RESTRUCTURE|| || || || || ||−0.053||(0.366)|
|RGROWTH|| || || || || ||0.215***||(0.086)|
|INVENTORY|| || || || || ||2.361||(1.539)|
|%LOSS|| || || || || ||3.270***||(0.671)|
|RZSCORE|| || || || || ||−0.257***||(0.096)|
|AUDITOR_RESIGN|| || || || || ||0.924||(2.550)|
|RESTATEMENT|| || || || || ||−0.230||(0.653)|
|AUDITOR|| || || || || ||−0.034||(2.258)|
|INST_CON|| || || || || ||−0.991*||(0.767)|
|LITIGATION|| || || || || ||0.988***||(0.392)|
|Adjusted R2|| ||0.06|| ||0.25|| ||0.28|| |
|N|| ||1,404|| ||1,404|| ||1,027|| |
To provide further evidence on the effect of ICDs on the cost of equity, we expand our CC model with the ICD determinants of the Ashbaugh-Skaife, Collins, and Kinney  model:
where all variables are as previously defined.
The model 3 column of Table 7 presents results of the cross-sectional CC model after including the additional control variables (equation (10)). While the magnitude of the coefficient on the ICD variable reported in the last column of Table 7 is reduced relative to the results in the model 1 and model 2 columns, we continue to find a positive and significant association between the cost of equity and ICD after controlling for ICD determinants that capture differences in firms' operating risks.
Collectively, the findings reported in Table 7 provide support for the notion that information risk due to ineffective internal control is associated with a higher cost of equity.
5.3.3. Change in Cost of Equity Analysis The cross-sectional results reported above suggest that ineffective internal control is associated with a higher cost of equity, but these results provide little basis for inferring causality. To help assess whether a causal relation may exist between ICDs and cost of equity, we conduct four intertemporal change tests. The first analysis tests whether there is a change in the cost of equity when firms first report an ICD under SOX. Furthermore, because the market holds expectations for the quality of firms' internal controls based on observable events (see Ashbaugh-Skaife, Collins, and Kinney , Doyle, Ge, and McVay [2007b]), we examine whether the magnitude of the change in cost of equity is inversely related to the market's assessed likelihood that a firm reports an ICD.
We start by identifying the first ICD report date for 162 sample firms for which we have Value Line CC estimates both before and after the ICD report date and data necessary to estimate the ICD determinant model in the appendix that is used to calculate the firm-specific probability of reporting an ICD (see Ashbaugh-Skaife, Collins, and Kinney  for a complete discussion of the variables used in the ICD determinant model). We then compare the CC estimate predisclosure to the CC estimate postdisclosure.24 In addition, we divide the 162 firms into deciles based on the likelihood of reporting an ICD to assess whether there are differences in the magnitude of changes in cost of equity conditional on the likelihood of a firm reporting an ICD.
Panel A of Table 8 reports the mean and median cost of equity estimates for the 162 firms. We report both raw and market-adjusted CC estimates, where the market-adjusted cost of equity is the difference between the firm's cost of equity and the average cost of equity for all firms on Value Line not reporting an ICD over the same time interval. The descriptive statistics indicate that both the raw and market-adjusted cost of equity increase after firms' first disclosure of an ICD.
Change in Cost of Equity: Pre- versus Post–First ICD Disclosure
|Pre–first ICD CCa||15.878||14.750||11.000||18.250||7.391|
|Post–first ICD CC||16.990||15.000||11.750||19.750||8.289|
|Pre–first ICD market-adjusted CC|| 4.042|| 2.917||−0.500|| 6.500||7.420|
|Post–first ICD market-adjusted CC|| 4.969|| 2.979||0.000|| 7.750||8.272|
|ΔCCc full sample (N= 162)||0.927**||1.042**|
|ΔCC for least likely firms to report ICDs (N= 48)d||1.254*||1.375|
|ΔCC for most likely firms to report ICDs (N= 48)||0.490||0.750|
|Adjusted R2|| ||0.03|| |
|N|| ||162|| |
Panel B of Table 8 reports that the mean (median) firm-specific change in cost of equity for the 162 firms is 0.927% (1.042%),25 which is significantly different from zero at p= 0.02.26 In addition, panel B of Table 8 reports the firm-specific change in cost of equity for subsamples of the 162 firms, where subsamples are partitioned by the likelihood of disclosing an ICD (where firms in the lower three deciles are deemed less likely and firms in the upper three deciles are deemed more likely). As expected, we find that the cost of equity increase following the ICD report is greater for firms deemed least likely to report an ICD (1.254% and significant at p= 0.06) relative to firms deemed most likely to report ICDs (0.490% and not significant at conventional p-values).27
As a further validation of the cost of equity change results, we investigate the relation between the three-day market-adjusted buy-and-hold return (BHAR) associated with the initial ICD disclosures reported in Table 3 and the change in cost of equity (ΔCC) and change in forecasted earnings growth (ΔEG) following the approach outlined in Hail and Leuz . This approach attempts to decompose the price reaction to the first ICD announcement into a portion that is due to changes in risk assessment and a portion due to changes in expected future cash flows (proxied by ΔEG). We estimate the following OLS regression for the 162 firms for which we have the necessary data and expect a negative (positive) relation between BHAR and ΔCC (ΔEG).
where ΔCC is equal to the CC estimate after the first ICD disclosure minus the CC estimate before the first ICD disclosure, ΔEG is the Value Line forecasted three- to five-year earnings growth rate immediately following the first ICD disclosure minus this forecast just prior to the first ICD disclosure.
The results reported in panel C of Table 8 indicate a negative and significant coefficient on ΔCC and a positive, but insignificant, coefficient on ΔEG. Thus, in the cross-section, firms with a larger negative market reaction on the initial disclosure of an ICD exhibit a larger increase in cost of equity. This finding provides additional evidence that changes in firms' cost of equity are the result of firms' disclosure of ICDs to the market. Based on the results reported in Table 8, we conclude that the initial revelation of an ICD results in investors assigning a higher cost of equity to firms and that this revision in cost of equity is greater for firms that are least likely to report an ICD based on observable firm characteristics.
As a second test to link ICD disclosures to changes in firms' cost of equity, we investigate whether there is a change in the cost of equity when investors learn that firms remediated their ICDs. Specifically, we examine the change in the cost of equity surrounding the release of an unqualified SOX 404 opinion for the sample of firms that previously disclosed an ICD under SOX 302. In conducting this analysis, we require firms to have at least two months between the release of the SOX 302 ICD and the unqualified SOX 404 audit opinion to ensure that investors have sufficient time to revise their cost of equity estimates.
Panel A of Table 9 reports descriptive statistics on the cost of equity for the 38 “remediation” firms with sufficient Value Line data to conduct our change analysis. We posit that when investors receive confirmation from a firm's independent auditor that prior ICDs are resolved, the information risk they face goes down, leading to a reduction in the firm's cost of equity. Consistent with this prediction, we find that the mean (median) cost of equity (both raw and market-adjusted) decreases from the 180 days prior to the 180 days after the filing of the unqualified SOX 404 opinion. In addition, the results reported in panel B of Table 9 indicate that there is a significant reduction in the remediation firms' market-adjusted cost of equity following release of the unqualified SOX 404 opinion (mean change =−1.513%, median change =−1.313%). Collectively, the findings reported in Table 9 are consistent with the market responding to the reduction in information risk due to improved internal control by reducing firms' cost of equity.
Change in Cost of Equity: Remediation of Internal Control Deficiencies
|Pre–404 market-adjusted CC||4.096||2.125||−1.625||7.292||8.501|
|Post–404 market-adjusted CC||2.583||0.792||−2.750||4.333||8.592|
|ΔCCd for firms that remediated their ICDs (n= 38)||−1.513**||−1.313**|
In contrast to the remediating firms, our third change test investigates whether the cost of equity changes around the release of an adverse SOX 404 audit opinion for the 50 ICD firms with necessary Value Line data that fail to remediate their ICDs. For these firms, one might expect no increase in cost of equity at the release of an adverse SOX 404 opinion because the market has already increased its cost of equity assessments to reflect the initial ICD disclosure (Table 8). Alternatively, there may be a modest increase in cost of equity because the adverse SOX 404 audit opinion may indicate that the firm is unwilling or unable to remediate its internal control problems or perhaps new ICDs have surfaced upon closer scrutiny by the auditor. In panel A of Table 10, we report descriptive statistics on raw and market-adjusted CC for the 50 firms that failed to remediate their control problems prior to the SOX 404 audit. Panel B of Table 10 reports the mean and median market-adjusted ΔCC around the SOX 404 audit opinion. We find a modest, but insignificant, increase in cost of equity around the adverse opinion release (mean = 0.671%, median = 0.146%).
Change in Cost of Equity: No Remediation of Internal Control Deficiencies
|Pre-404 market-adjusted CC|| 4.921|| 3.708|| 0.042|| 5.458||8.000|
|Post-404 market-adjusted CC|| 5.591|| 3.542|| 0.333|| 8.450||8.615|
|ΔCCd for ICD firms not remediating the ICD (N= 50)||0.671||0.146|
Our last set of intertemporal change tests uses the “control sample” of firms that did not disclose ICDs under SOX 302 or 404 and received unqualified SOX 404 opinions, that is, firms that never reported internal control problems and the effectiveness of internal controls was confirmed by an independent review by the outside auditor. Following the work in Ashbaugh-Skaife, Collins, and Kinney  and Doyle, Ge, and McVay [2007b], we posit that the market sets expectations for the quality of firms' internal controls based on observable economic events or firm characteristics prior to receiving a SOX 404 audit opinion. Our final change analysis investigates whether there are changes in cost of equity around the release of an unqualified SOX 404 opinion for firms that investors expect (do not expect) to report an ICD.
Panel A of Table 11 displays descriptive statistics for the cost of equity pre- and postissuance of the unqualified SOX 404 opinion for the 685 non-ICD firms with available expected returns from Value Line. In panel B of Table 11, we partition the sample based on the likelihood of a firm reporting an ICD. We find that the subsample of firms most likely to report an ICD (top three deciles) exhibits a significant reduction in the cost of equity following the release of an unqualified SOX 404 opinion. Specifically, the mean change in the market-adjusted cost of equity is −1.159% (significant at p= 0.01) and the median change is −0.583% (significant at p= 0.05). In contrast, we find no significant change in cost of equity for the firms least likely to report an ICD (bottom three deciles).28 Thus, the market appears to reward firms expected to have ineffective controls after the SOX 404 opinion confirms internal control effectiveness. This finding provides evidence that the reporting requirements of SOX 404 provide a cost of equity benefit to firms with effective internal controls.
Change in Cost of Equity: No Internal Control Deficiencies (Control Firms)
|Pre-404 CCb||13.612||12.000|| 9.000||16.250||6.628|
|Post-404 CC||13.816||12.500|| 9.000||17.500||7.512|
|Preperiod market-adjusted CC|| 1.612|| 0.167||−2.833|| 4.417||6.633|
|Postperiod market-adjusted CC|| 1.622|| 0.333||−3.333|| 5.250||7.514|
|ΔCCd for firms that do not report ICDs (N= 685)|| 0.010|| 0.250|
|ΔCC for least likely firms to report ICDs that do not (N= 205)d|| 0.141|| 0.250|
|ΔCC for most likely firms to report ICDs that do not (N= 205)||−1.159***||−0.583**|
In summary, the results presented in Table 8 through Table 11 provide evidence consistent with the revelation of information about ICD changes causing significant revisions to investors' assessment of information risk, which is consistent with the theoretical arguments presented in Lambert, Leuz, and Verrecchia . Our findings that the cost of equity declines for (1) firms that remediate their ICDs and (2) firms that are expected to report an ICD but do not, suggest that the market values the reduction in information risk that results from effective internal control. Furthermore, our finding that the cost of equity does not change for nonremediating firms mitigates concerns that our results are driven by factors unrelated to information risk. Collectively, our results provide evidence consistent with ineffective internal controls causing investors to assess higher information risk and a higher cost of equity.
5.4 robustness tests
5.4.1. Accrual Quality versus ICD A primary objective of strong internal control over financial reporting is high-quality financial information. There is evidence to suggest that firms with ineffective internal controls have low-quality accruals relative to firms operating with effective internal controls (e.g., Doyle, Ge, and McVay [2007a], Ashbaugh-Skaife et al. ). Prior research suggests that firms with low-quality accruals have a higher cost of equity (Francis et al. ). To assess whether the presence of an ICD results in greater information risk beyond that of poor accruals quality, we re-estimate equation (5), equation (7), and equation (10) including two accruals quality variables: abnormal accruals and noise in working capital accruals. Abnormal accruals (AA) are defined as the absolute value of performance-adjusted abnormal accruals as estimated by the modified Jones model (see Ashbaugh, LaFond, and Mayhew ). The noise in working capital accruals (ACCRUAL_NOISE) is defined as in Dechow and Dichev .
In untabled results, we find, as expected, positive coefficients on AA and ACCRUAL_NOISE, indicating that poor accruals quality increases firms' idiosyncratic and systematic risk. However, we find no association between AA and ACCRUAL_NOISE in the cost of equity cross-sectional analysis. More importantly, after controlling for the quality of firms' accruals, we continue to find a significantly positive coefficient on ICD in all three analyses.
5.4.2. Consequences of Misspecification of ICD Model and Misclassification of ICD Firms In addition to our paper, Ogneva, Subramanyam, and Raghunandan (hereafter, OSR)  also examine the implications of SOX 404 internal control reporting for cost of equity. They view ICDs as having two potential effects on the cost of equity. The first arises from information risk associated with ineffective internal control and the second arises from ICDs being inherently more likely for firms facing greater operating risk. OSR find that the cost of equity effect of ICDs disappears after controlling for beta and factors associated with an increased likelihood of reporting ICDs. Based on this finding, OSR conclude that ICDs do not have a direct effect on the cost of equity. However, as noted earlier, measuring the cost of equity effects after controlling for beta ignores the effects that ICDs may have on cost of equity through beta risk (Lambert, Leuz, and Verrecchia ).
One potential explanation for the “no association” result in the OSR paper is due to their research design choice to “look ahead” to a future SOX 404 audit opinion to determine their coding of firms' internal control status. They partition firms into ICD and non-ICD samples based on their fiscal year 2004 SOX 404 audit opinions released in 2005. OSR's ICD sample is defined as firms receiving adverse SOX 404 opinions, whereas their non-ICD sample is comprised of all other firms receiving unqualified SOX 404 opinions and having the necessary data to estimate their model. They measure firms' cost of equity at June 2004 when the 2004 SOX 404 audit opinions are not known to the market. Because OSR's classification of ICD and non-ICD firms is based on firms' 2004 SOX 404 opinions that are issued from 6 to 18 months after the date used to compute implied cost of capital (June 2004), their partitioning of ICD and non-ICD samples imparts a “look-ahead” bias for firms that report ICDs under SOX 302 but subsequently receive an unqualified SOX 404 opinion. This look-ahead bias works in favor of finding no significant differences in cost of equity between their ICD and non-ICD samples.
To investigate whether the look-ahead misclassification of firms affects the inferences drawn from the OSR analysis, we replicate their approach using our data. We estimate firms' cost of equity using the OSR measure, the PEG ratio (CC_PEG), and follow their procedure for partitioning firms based on the 2004 SOX 404 audit opinion. We use a new variable, labeled WEAK (coded one for firms with adverse 2004 SOX 404 opinions, and zero otherwise) to distinguish between OSR's classification of firms from our classification of firms with ineffective internal control (i.e., our ICD variable) and estimate the following OLS regression:
where CC_PEG is the cost of capital measure using the PEG ratio (PEG ratio is equal to [(eps2−eps1)/P0]1/2, P0 is the price at the end of June 2004, and eps is equal the median consensus forecast for one and two years ahead) (these inputs are identical to those of OSR).
The model 1 column of Table 12 reports the results of estimating equation (12). We identify 1,127 firms that have the necessary data to estimate CC_PEG. Of those 1,127 firms, 163 receive adverse 2004 SOX 404 opinions and the remainder receive unqualified SOX 404 opinions. The coefficient on WEAK is insignificantly different from zero, suggesting that there is no significant difference in the cost of equity (CC_PEG) for ICD and non-ICD firms using OSR's classification scheme.
Internal Control Deficiencies and Cost of Equity: Consequences of Misclassifying ICD Firms
|WEAK||+||0.331||(0.294)|| || |
|ICD||+|| || ||0.446**||(0.253)|
|Adjusted R2|| ||0.32|| ||0.32|| |
|ICD firms|| ||163|| ||239|| |
|Non-ICD firms|| ||964|| ||888|| |
|Total N|| ||1,127|| ||1,127|| |
The model 2 column of Table 12 displays the results after appropriately reclassifying 76 firms classified under the OSR criterion as non-ICD or “control” firms that receive unqualified SOX 404 audit opinions in 2005, but previously disclose ICDs under SOX 302 in 2004. The reclassification results in 239 ICD firms and 888 non-ICD firms. The results of estimating equation (12) using the correct classification of firms indicate a positive and significant coefficient on the ICD variable. Furthermore, the results indicate that ICD firms have a higher implied cost of equity of roughly 45 basis points relative to non-ICD firms when using the PEG ratio as the estimate of firms' cost of equity.
In summary, the OSR paper and our paper are similar in that both studies include cross-sectional analyses of the cost of equity effects of internal control quality. However, the studies are different in two ways. First, our cross-sectional research design does not have the misclassification look-ahead bias present in OSR. Second, our study goes beyond OSR by conducting intertemporal firm-specific change analyses around two events—the initial disclosure of an ICD and the receipt of a SOX 404 audit opinion—that provide stronger tests of the cost of equity consequences of internal control reporting.
Effective internal controls over financial reporting are widely recognized as being fundamental to high-quality information systems and high-quality financial information. The recent theoretical work of Lambert, Leuz, and Verrecchia  suggests that the quality of firms' information systems, which includes internal control over financial reporting, has both a direct and indirect effect on the cost of equity. We use the unique setting provided by SOX that requires firms to disclose ICDs and have independent audits of their internal control to empirically test whether the effectiveness of firms' internal control affects idiosyncratic risk, beta risk, and costs of equity.
In cross-sectional tests, we find that firms with ICDs exhibit significantly higher betas, idiosyncratic risk, and cost of equity capital relative to firms not reporting ICDs. These differences persist after controlling for other factors that prior research shows to be related to these risk measures. We also structure intertemporal change analysis tests designed to investigate whether initial disclosure, repeated disclosure, or remediation of internal control problems cause predictable changes in firms' cost of equity capital.
Our findings indicate that firms that initially disclose ineffective internal control experience a significant increase in market-adjusted cost of equity, and firms that subsequently improve their internal control (as evidenced by an unqualified SOX 404 audit opinion) exhibit a decrease in market-adjusted cost of equity. Thus, this study provides evidence suggesting that firms with internal control problems present greater information risk to investors and firms reporting effective internal control and firms that remediate known internal control problems benefit from lower costs of equity beyond that predicted by other risk factors.
Table 13. Logit Model for Existence and Disclosure of Internal Control Deficiencies
|Likelihood ratio χ2|| ||233.53***|| |
|Percent concordant|| ||66.3|| |
|Percent discordant|| ||33|| |
|N|| ||4810|| |
Unlike inferences about information quality that are based on estimates (e.g., large abnormal accruals), the disclosure of an ICD is a process quality indicator that the reliability of the financial information is threatened and, thus, likely of low quality.
Later in the paper, we discuss sample, design choices, and cost of equity proxy differences between our study and the Ogneva, Subramanyam, and Raghunandan  study that contribute to the differences in results.
It is important to note that the Lambert, Leuz, and Verrecchia  model of information quality effects on firms' cost of capital is developed in a single-period setting. However, in a multiperiod world the cost of capital effects of additional cash flows that result from reduced financing costs or from reduced manager appropriation of firm resources when internal controls are strengthened is more difficult to predict. How the additional cash flows are invested can change the ratio of the expected cash flows to the covariances of the firm's cash flows with the market (see equation (2b)). If the additional cash flows are invested in high-risk projects, then the ratio of expected cash flows to the covariance of those cash flows could increase.
The Foreign Corrupt Practices Act does require external auditors to report to the board of directors any material weaknesses in the firm's internal control over financial reporting noted during conduct of the financial statement audit.
Compliance Week is a weekly electronic newsletter published by Boston's Financial Media Holdings Group and Glass, Lewis & Co., LLC is an investment research and proxy advisory firm.
For these firms we confirm the SOX 404 opinion and filing dates.
For the sake of completeness, it is important to note that there are 527 firms that disclose an ICD under SOX 302 but do not have a SOX 404 opinion. These firms do not have a SOX 404 opinion because they are either nonaccelerated filers (i.e., are not required to file a SOX 404 opinion because they have less than $75 million in float) or they do not file a 10-K that contains a SOX 404 report by the sample cutoff date of September 2005.
The data source for equation (3) is the website http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html.
We use monthly returns to estimate equation (3) to reduce the bias in BETA due to infrequent trading (Dimson ).
The announcement day is the date of the SEC filing that first mentions a control weakness. We identify firms that report ICDs using compilations prepared by Compliance Week and Glass Lewis. We then back-trace all SEC filings of firms identified by these two sources. For over 30% of the sample, we find that the first mention of control problems occurs in an SEC filing that precedes the filing noted as the initial disclosure in Compliance Week or Glass Lewis. Thus, studies relying on the dates provided by these two sources may incorrectly identify the event date for the first ICD disclosure.
One potential explanation for the differences in results is the difficulty of classifying the nature of internal control problems prior to the enactment of AS No. 2 (see the next footnote for details).
AS No. 2, which provides guidance for the classification of ICDs, is issued after many firms provide their initial ICD disclosures. Thus, many firms that voluntarily report lesser internal control problems in the SOX 302 era are likely to have had more severe problems.
The tabled result that LEV is negatively associated with I_RISK is consistent with Duffee , who finds that the positive relation between leverage and risk measures documented in prior work is due to the samples used in the empirical analysis. When Duffee  requires firms to have debt, he finds a positive relation between leverage and risk. Relaxing this requirement results in either insignificant results or, in some instances, the opposite result. Following Duffee , we delete firms with LEV values less than 0.10 and find a positive association between LEV and I_RISK.
Although the coefficient on the ICD dummy is significant, the adjusted R2 values of model 1 and model 2 are only marginally lower when the ICD dummy is deleted. Thus, as is the case for most cross-sectional regression models with a continuous dependent variable, the inclusion of a binary independent variable does not add significant incremental explanatory power.
Our measure of the implied cost of equity is similar to those of Brav, Lehavy, and Michealy , Botosan and Plumlee [2002, 2005], and Francis et al. , who use Value Line's forecasted target prices and forecasted dividends to derive a measure of firms' expected return.
Our results are robust to setting the cost of equity to the median expected return over the firm's fiscal year and robust to using only the first (or last) expected return for a given Value Line report period. The correlations across various measures of expected return based on different requirements of price updating exceed 0.95.
We thank the anonymous referee for suggesting this point to us.
In contrast to implied cost of equity approaches such as the Value Line target price method and the PEG ratio method (Easton ), an alternative is to estimate expected return (cost of equity) using a factor model approach (Francis et al. , Core, Guay, and Verdi ). However, factor models require a long time series (usually three to five years of historical monthly data) to estimate reliable factor loadings. To the extent that forces posited to affect risk assessments are temporary (as many of the ICDs may be after they are discovered and disclosed), factor model estimates of cost of equity are not precise enough to capture changes in cost of equity when initial ICD disclosures are made or corrective actions are announced. Therefore, we do not consider factor model approaches to estimating firms' cost of equity to be viable in our setting.
The Value Line expected return represents an annual cost of equity estimate. We divide the annual measure by 12 to convert the annual expected return to a monthly expected return. Our analysis period runs from April 1997 to December 2003, due to the requirement of future returns and allowing for three months following the fiscal year-end for data to become known to the market. Specifically, realized returns for fiscal year t+ 1 are regressed on expected returns from fiscal year t, which is the expected return for fiscal t+ 1. For example, the monthly realized return over fiscal 1997 is regressed on the estimate of expected return made in fiscal 1996 for fiscal 1997.
Following Easton , rpeg=[(eps2−eps1)/P0]1/2, where eps is the one- (two)-year-ahead forecasted earnings per share, and P0 is equal to the current price. The number of observations for which rpeg can be calculated is further reduced by the requirements that both eps1 and eps2 be positive, and eps2 must be greater than eps1.
We draw similar conclusions when estimating the PEG ratio cost of capital using Value Line forecasts.
Note that in this specification BETA and I_RISK are significantly positively related to cost of equity as expected, but SIZE is no longer significant. This result is due to SIZE being highly negatively correlated with I_RISK.
As noted in section 2, one reason that the ICD dummy can exhibit an association with firms' cost of equity when BETA and I_RISK are in the model is because idiosyncratic risk and beta risk estimates are based on historical time-series data that measure the information risk effects of ICDs with error (i.e., they are not based on forward-looking data as specified in the Lambert, Leuz, and Verrecchia  framework). An alternative explanation for why ICD loads in model 2 of Table 7 is that ICD proxies for risk factors in other asset-pricing models that have been shown to be related to firms' expected returns.
In Tables 8 through 11 we report the results using market-adjusted cost of equity measures, where market adjustments are made using all firms not reporting an ICD over the same time period. We also examine the change in the cost of equity using unadjusted and industry-adjusted cost of capital measures and find similar results.
We note that this estimated change in cost of equity of roughly 100 basis points is comparable to the estimated change in cost of equity associated with restatements documented by Hribar and Jenkins , who report cost of equity changes of 100–150 basis points. Restatements are often a direct result of ineffective internal control.
We also find that the mean (median) cost of equity increase is greater for firms disclosing relatively lesser ICDs, i.e., significant deficiency/control deficiency, relative to firms that report material weaknesses in internal control (1.632% versus 0.733%, respectively), but the difference is not statistically significant.
A direct test of the differences in mean (median) changes in cost of equity for these two groups of firms is significant at only the 0.25 (0.23) level (one-sided). However, the lack of significance in these differences is due primarily to low power because of the small sample size in each group. When all 162 observations are included in a regression with change in cost of equity as the dependent variable and the predicted probability of reporting an ICD as the independent variable, the coefficient on the predicted probability is negative and significantly different from zero at the 0.07 level.
A direct test of the differences in mean (median) changes in cost of equity for these two groups of firms is significant at the 0.01 (0.03) level (one-sided). When all 685 observations are included in a regression with the change in cost of equity as the dependent variable and the predicted probability of reporting an ICD as the independent variable, the coefficient on the predicted probability is negative and significantly different from zero at the 0.01 level.