How Effective Is Internal Control Reporting under SOX 404? Determinants of the (Non-)Disclosure of Existing Material Weaknesses

Authors

  • SARAH C. RICE,

    1. University of Connecticut. We appreciate helpful comments from the editor, two anonymous reviewers, Brad Badertscher, Jean Bedard, Lisa Bryant-Kutcher, John Campbell, William Greene, Shane Heitzman, Linda Hughen, Bjorn Jorgensen, Reuven Lehavy, Andy Leone, Sarah McVay, Dave Papandria, Emma Peng, Bill Waller, Mike Willenborg, Teri Yohn, and workshop participants at the University of Arizona, Colorado State University, and the 2011 American Accounting Association Annual Meeting.
    Search for more papers by this author
  • DAVID P. WEBER

    1. University of Connecticut. We appreciate helpful comments from the editor, two anonymous reviewers, Brad Badertscher, Jean Bedard, Lisa Bryant-Kutcher, John Campbell, William Greene, Shane Heitzman, Linda Hughen, Bjorn Jorgensen, Reuven Lehavy, Andy Leone, Sarah McVay, Dave Papandria, Emma Peng, Bill Waller, Mike Willenborg, Teri Yohn, and workshop participants at the University of Arizona, Colorado State University, and the 2011 American Accounting Association Annual Meeting.
    Search for more papers by this author

ABSTRACT 

We study determinants of internal control reporting decisions under Section 404 of the Sarbanes-Oxley Act (SOX 404) using a sample of restating firms whose original misstatements are linked to underlying control weaknesses. We find that only a minority of these firms acknowledge their existing control weaknesses during their misstatement periods, and that this proportion has declined over time. Further, the probability of reporting existing weaknesses is negatively associated with external capital needs, firm size, non-audit fees, and the presence of a large audit firm; it is positively associated with financial distress, auditor effort, previously reported control weaknesses and restatements, and recent auditor and management changes. These results provide evidence that detection and disclosure incentives play a role in whether existing material weaknesses are reported, which has implications for the effectiveness of SOX 404 in providing investors with advance warning of potential accounting problems.

1. Introduction

The Sarbanes-Oxley Act (SOX) of 2002 was enacted to help restore public trust in capital markets in the aftermath of several high-profile accounting scandals. One of the most controversial aspects of the Act has been the requirement of Section 404 (hereafter SOX 404) that both management and the independent auditor formally opine in the annual report on the effectiveness of a company's internal controls over financial reporting (ICFR).1 While various consequences of this requirement have received attention in the academic literature (e.g., Zhang [2007], Gao, Wu, and Zimmerman [2009]), our understanding of the effectiveness of SOX 404 reports in identifying existing control weaknesses has remained limited. In this paper, we study a sample of firms that correct misstatements in their financial reports in order to provide systematic evidence on two related questions. First, how effective are SOX 404 reports in providing advance warning of these impending accounting problems? Second, what are the determinants of the relative effectiveness of those reports?

From a public policy perspective, for SOX 404 to successfully assuage investor skepticism regarding the reliability of financial statements, it should be the case that those reports contain meaningful information (i.e., firms are not reporting that their internal controls are effective when they are ineffective).2 However, various commentators have cited instances of apparent failures to identify existing weaknesses in practice and questioned the overall reliability of ICFR reports (e.g., Glass Lewis [2007], IMA [2008], SEC [2009b]). Moreover, academic research on the causes and consequences of ineffective internal controls has typically taken firms’ public reporting on their internal controls at face value. Evidence on the reliability of those reports and the factors that influence it should be important considerations for future research studying ICFR.

Our research design centers on constructing a sample of firms where internal control weaknesses exist and then observing whether or not those weaknesses are reported as required by SOX 404. Thus, our focus is on the factors that influence the reporting of control weaknesses, rather than their existence.3

Under the reporting standards for SOX 404, ICFR are only to be deemed effective if no material weaknesses exist, where material weaknesses are defined as cases in which the likelihood of a material misstatement remaining undetected in the financial statements is at least reasonably possible (i.e., more than remote) (Auditing Standard No. 5 (AS5), paragraphs 2 and A7). Accordingly, we first identify firms that restate previously issued financial statements to correct misstatements in the original reports, as these firms are likely to have had control weaknesses at the time of the misstatements. We then refine the set of restating firms by examining the control-related disclosures issued in the aftermath of each restatement and retaining only those that are linked to an underlying control weakness. This process ensures that all of our sample firms have material weaknesses at the time of their misstatements, which allows us to focus directly on whether or not those weaknesses are originally reported as intended under SOX 404.

For a material weakness to exist but not be reported implies that either management and the auditor do not detect the weakness, or they detect it but opt not to disclose it (Ashbaugh-Skaife, Collins, and Kinney [2007]).4 Accordingly, we study several factors expected to be associated with managers’ and auditors’ abilities to detect and incentives to disclose control weaknesses. These include the firm's external financing needs, size, financial health, recent managerial turnover, the occurrence of previous restatements and control weaknesses reported prior to SOX 404, and several factors related to the outside auditor, including the size of the audit firm, auditor effort, non-audit fees paid to the auditor, and recent auditor switches. Our primary analysis follows previous ICFR research in modeling detection and disclosure as a single, combined process that determines the ultimate reporting outcome. This leads to a standard probit specification with the reporting outcome as the dependent variable and the factors mentioned above as independent variables.

We also conduct analyses that provide evidence on the particular channel through which each of the factors affects the ultimate reporting outcome (i.e., through either detection or disclosure, or both), thus enabling sharper interpretations of each factor's role. To enhance robustness, we conduct two such analyses, each of which utilizes a different approach to dealing with the partial observability inherent in our setting (only the final reporting outcome is observable, not the underlying detection and disclosure processes). For the first analysis, we employ a bivariate probit model that explicitly accommodates partial observability. This approach, detailed in section 4.3, allows us to specify separate models of detection and disclosure and then estimate these models jointly based on the observable reporting outcome.

For the second additional analysis, we estimate the separate disclosure model on a subsample of firms for which detection is likely to have occurred. For firms where detection occurs, the reporting outcome reduces to a question of disclosure. This allows us to separately examine the disclosure process for this subsample and provides an alternative approach to overcoming the partial observability problem. We identify this subsample using the Hennes, Leone, and Miller [2008] restatement classification scheme to isolate “irregularities,” which represent intentional misstatements, as opposed to unintentional errors. Managers making intentional misstatements are likely to be aware of the weaknesses in the controls being circumvented. Thus, we argue that detection has likely occurred for these firms.

Our results suggest that a large proportion of firms with material weaknesses fail to report those weaknesses in a timely manner. Only 32.4% of our sample firms report the existence of a material weakness during the misstatement period, as opposed to reporting it later, after the need for a restatement has been announced. Moreover, this proportion is decreasing over time, reaching a low of 13.6% in the most recent of the five years in our sample. Thus, despite being subject to outside audit, only a minority of these SOX 404 reports provide any advance warning of the possibility of impending accounting problems. Put differently, for the majority of restating firms, the internal control weaknesses that led to those restatements are reported only after the restatements themselves have already been disclosed. These results provide some support to criticisms that the reporting of internal control weaknesses has sometimes been ineffective in practice (e.g., Turner and Weirich [2006]), and suggest that interpreting the recent decline in reported material weaknesses as prima facie evidence of improvements in underlying internal control practices is likely premature (e.g., SEC [2009b], Whitehouse [2009, 2010]).5

Regarding determinants of the reporting of existing weaknesses, we find evidence of several factors related to both the detection and disclosure of control weaknesses. Firms in need of raising external capital are less likely to report existing weaknesses, suggesting the existence of capital market–based incentives to avoid disclosure. This result is consistent with recent evidence that reported control problems lead to higher costs of capital (Ashbaugh-Skaife et al. [2009], Costello and Wittenberg-Moerman [2011]), such that managers who expect to raise outside capital have incentives to be less forthcoming about control weaknesses, much like similar considerations can lead to earnings management (e.g., Dechow, Sloan, and Sweeney [1996]). Larger firms are also less likely to report existing weaknesses. To the extent that capital market pressures (e.g., Richardson, Tuna, and Wu [2003]), auditor acquiescence (McKeown, Mutchler, and Hopwood [1991]), and the complexity of the control environment are increasing in firm size, our results suggest that, on average, such factors outweigh any resource or scale advantages related to size.

Firms with accounting losses, prior restatements, and control weaknesses previously reported prior to SOX 404 (i.e., under SOX 302, when control opinions were not yet subject to outside audit) are more likely to report existing weaknesses. These results are consistent with additional scrutiny being placed on firms in poor financial health or that have a history of accounting and control problems. Firms with recent auditor changes are also more likely to report their weaknesses, consistent with auditors having incentives to avoid sharing the blame for the existence of control issues (Hermanson, Krishnan, and Ye [2009]) and being more likely to push for disclosure when the underlying control problems can be attributed to a previous auditor. Similar results also obtain for firms with recent managerial changes; firms with recent CFO or CEO turnover are more likely to report their existing control weaknesses.

Larger audit fees are also associated with a greater likelihood of reporting existing weaknesses, consistent with greater auditor effort being positively associated with the likelihood of detection. In contrast, non-audit fees paid to the outside auditor are negatively associated with the likelihood that existing weaknesses are disclosed, perhaps due to their effect on auditor objectivity.

We also find that clients of Big 4 auditors are less likely to report existing weaknesses. However, generalizing this result beyond our sample of restating firms should be done with care due to the direct role that auditors play in certifying the reliability of the associated financial statements. Given previous evidence that larger auditors tend to provide higher quality financial statement audits (see Francis [2004] for a review), larger auditors may be better able to “audit around” control weaknesses and avoid the misstatements that would lead to inclusion in our sample.

More generally, the results of this study should be viewed in light of the sample we employ, which centers on restating firms as a way to identify the existence of control weaknesses. Given the nonrandom nature of such a sample, the generalizability of our results to other firms (i.e., those without restatements) is unclear. We note, however, that while our focus is on firms with financial statements that are later deemed to be unreliable, this is precisely the group that internal control reporting is intended to help investors identify. Thus, research design advantages aside, we believe this is an inherently important population to study.

The remainder of this paper is organized as follows. The next section reviews the regulatory setting and related literature. Section 3 develops our research design and details our sample selection. Section 4 reports our empirical results. Section 5 summarizes and concludes.

2. Background and Related Literature

2.1 regulatory background

SOX 404 became effective November 15, 2004, requiring that “accelerated” filers and their auditors provide an annual opinion as to the effectiveness of ICFR.6 Under SOX 404, any material weaknesses detected by management or the auditor are required to be disclosed in the annual report and ICFR are to be concluded ineffective. The reporting of material weaknesses is intended to provide advance warning to market participants that the possibility of material misstatements remaining undetected is more than remote.7

Prior to the effective date of SOX 404, firms began reporting on internal controls quarterly under SOX 302, which became effective August 29, 2002, and applied to all registrants. We focus our investigation on SOX 404, rather than SOX 302, for a number of reasons. First, the exact reporting requirements related to material weaknesses are somewhat ambiguous under SOX 302 (Doyle, Ge, and McVay [2007b]), while disclosure is clearly mandated under SOX 404. Second, SOX 404 reports are subject to additional documentation requirements as well as the scrutiny of the independent auditor, which should increase the probability of existing weaknesses being detected and disclosed. Third, much of the controversy surrounding SOX relates to the costs associated with having ICFR audited under SOX 404.

2.2 related literature

The closest antecedents to our paper are Doyle, Ge, and McVay [2007b] and Ashbaugh-Skaife, Collins, and Kinney [2007]. These studies examine firm characteristics associated with reported internal control deficiencies and find that organizational complexity, major organizational changes, and relative investments in controls are all significant factors. Doyle, Ge, and McVay [2007b] focus solely on the existence of underlying control risks and take ICFR opinions at face value, assuming that firms with no reported material weaknesses have effective internal controls.8 More recent evidence, however, suggests that this assumption is unlikely to be descriptive. For example, a recent PCAOB inspection of ICFR audits conducted by the eight largest public accounting firms noted several instances of auditors ignoring risk levels when selecting controls to be tested, failing to test system-generated data on which controls were dependent, and not gathering sufficient evidence to conclude whether controls were operating effectively (PCAOB [2009]). More generally, the number of firms restating financial statements to correct material errors in recent years has outpaced the number of firms reporting material weaknesses in ICFR (Plumlee and Yohn [2010]).9 In contrast to Doyle, Ge, and McVay [2007b], our focus is not on the existence of control weaknesses, but instead on the determinants of whether or not they are reported in cases where they do exist.

Ashbaugh-Skaife, Collins, and Kinney [2007] include various incentives to report existing ICFR deficiencies in their model, but study the pre–SOX 404 time period when firms were reporting under SOX 302. As argued above (and as noted by Ashbaugh-Skaife, Collins, and Kinney [2007]) the reporting requirements were more ambiguous prior to SOX 404 and, more importantly, reports were not subject to formal audit. As such, it is not clear that as much latitude exists over the reporting of weaknesses in the SOX 404 era. In addition, the reporting incentive results in Ashbaugh-Skaife, Collins, and Kinney [2007] are difficult to interpret because their research design does not distinguish between firms with and without underlying control weaknesses (Leone [2007]). Because our design isolates firms with existing weaknesses, we are able to focus directly on the determinants of reporting decisions.

Other recent research provides evidence on the consequences of underlying control risks. Several studies document that firms with reported weaknesses are more likely to have subsequent restatements, which is consistent with control weaknesses increasing the likelihood of misstatements (e.g., Li and Wang [2006], Hoitash, Hoitash, and Bedard [2008], Audit Analytics [2009], Nagy [2010], Feng and Li [2011]). Similarly, control weaknesses have also been shown to be negatively associated with accruals-based measures of earnings quality (Doyle, Ge, and McVay [2007a], Ashbaugh-Skaife et al. [2008], Bedard [2006]). Feng, Li, and McVay [2009] show a negative association between internal control quality and errors in managerial earnings forecasts, suggesting that poor controls also adversely affect the quality of internal firm information. Other work examines capital market–based consequences of internal control problems. Beneish, Billings, and Hodder [2008] and Hammersley, Myers, and Shakespeare [2008] report evidence of negative stock market returns surrounding the announcement of internal control weaknesses, and Ashbaugh-Skaife et al. [2009] and Costello and Wittenberg-Moerman [2011] provide evidence that firms reporting internal control problems face higher costs of equity and debt capital, respectively.10 Taken as a whole, these studies suggest that the effectiveness of internal controls is associated with the quality of financial reporting and leads to capital market consequences.

3. Research Design

3.1 identifying firms with material weaknesses

We begin with a set of firms that restate previously issued financial statements to correct misstatements in the original reports. The notion that misstatements are indicative of internal control problems has longstanding support in both the academic and practitioner literatures. In their study on the determinants of quarterly earnings restatements, Kinney and McDaniel [1989] argue that the need to correct a misstatement implies a breach of a firm's internal control system (see also DeFond and Jiambalvo [1991] and McMullen, Raghunandan, and Rama [1996]). Leone [2007, p. 234] makes a similar argument and points out that the PCAOB standards for auditing ICFR explicitly identify restatements as a “strong indicator that a material weakness in internal control over financial reporting exists.” This sentiment is also echoed by Turner and Weirich [2006], who conclude the following about restating firms:

If these companies’ internal controls really had no weaknesses, why did the companies have errors that required restatements? Recall that PCAOB AS 2 defined a material weakness as a deficiency in internal controls that creates a “more than remote likelihood” that a material misstatement in the financial statements will go undetected. If a company restated, then a material misstatement did in fact go undetected, indicating the company's internal controls must have had at least one weakness. (p. 17, emphasis in original)

Consistent with these arguments, we use restatements as a starting point to identify a sample of firms that likely have existing material control weakness during the restated period(s). The existence of a misstatement alone, however, does not strictly imply the existence of a material weakness. For example, firms may correct relatively minor errors that do not rise to a level that they view as justifying a material weakness. Likewise, the PCAOB allows for the possibility of “extenuating or unique circumstances” in which a misstatement does not necessitate the existence of a material weakness (PCAOB [2004], paragraph E97).11 Accordingly, we conduct an additional round of screening by manually examining firms’ control-related disclosures following their restatements and eliminating observations that are not clearly identified as the manifestation of control problems (described in detail below). Thus, our final sample of restatements includes only observations for which we could verify that control weaknesses do indeed exist. We then match this sample of restatements to the SOX 404 reports issued along with the original (misstated) financial statements to determine whether or not the underlying weaknesses were reported during the misstatement period.

3.2 sample

Our restatement data are from Audit Analytics, which identifies the initial announcement date as well as the beginning and ending dates of the period being restated (i.e., the misstatement period). Table 1 details the sample selection process. We begin by extracting all restatements announced by the end of 2009 with misstatement periods that include annual reporting periods ending after the effective date of SOX 404, November 15, 2004. We then match these restatements to the corresponding internal control reports (also from Audit Analytics) issued during the misstatement periods, which results in 1,077 restatement observations with matching internal control reports. For individual firms that have multiple restatements during our sample period, we keep only the first instance for each firm and eliminate any subsequent restatements (193 observations). We also eliminate observations without all necessary information to construct the variables in our model (218 observations).

Table 1. 
Sample Selection and Composition
Panel A: Sample selection
  1. aFor each restatement, we obtain the beginning and ending dates of the misstatement period from Audit Analytics and use those dates to match the restatement to the corresponding SOX 404 report(s) issued by the firm during the misstatement period (i.e., the SOX 404 reports that accompanied the original financial statements that are later restated).

  2. bRepresentative examples are provided in appendix A.

Restatement observations with corresponding SOX 404  
 reports from Audit Analyticsa 1,077
Keep only first announced restatement for firms with  
 multiple restatements (193)
Missing information necessary to construct variables in  
 primary model (218)
Firms reporting that restatement was not attributable to  
 ineffective internal controlsb (39)
Firms not explicitly reporting on link between restatement  
 and internal controls (139)
Total 488
Panel B: Sample composition
Firms that report ineffective controls during the  
 misstatement period 158
Firms that acknowledge existence of material weaknesses  
 in aftermath of the restatementb263 
Firms that acknowledge material weaknesses related to the restatement did exist, but have been remediated by the  
 time of the next SOX 404 report after the restatementb67 
Firms that acknowledge ineffective controls only after  
 restatement is announced 330
Total 488

We then verify that each of the remaining restatements is attributable to an underlying material weakness in ICFR. For all firms that claimed to have effective ICFR during their misstatement periods, we read the control-related disclosures issued in the aftermath of their restatements to determine whether they subsequently acknowledge or deny the existence of a material weakness. For the firms that did report material weaknesses during their misstatement periods, we first attempt to link the particular type of misstatements being corrected with the type of control weaknesses that were originally reported (e.g., a revenue restatement and a reported weakness in controls over revenue). For those where a clear link is not obvious (e.g., the reported control weaknesses are firm-level in nature, rather than account-level), we follow the same process as for those firms that initially claimed their ICFR were effective and read the control-related disclosures issued following the restatement. As detailed in table 1, another 39 firms report that their restatements were unrelated to internal control issues and, accordingly, we remove them from the sample. The remaining 139 firms never explicitly acknowledge or deny a link between their restatement and internal controls. Because it is ambiguous as to whether or not their restatements are attributable to control weaknesses, we remove these firms as well.12 Thus, our final sample (488 observations) is comprised of only those restatements that are definitively linked to underlying control weaknesses. Representative examples of the various types of subsequent control disclosures are provided in appendix A.

Of the 488 firms in our sample, 158 report the existence of control weaknesses during their misstatement periods. Of the other 330 that report effective ICFR during their misstatement periods, 263 subsequently acknowledge the existence of control weaknesses in the aftermath of their restatements, and another 67 report that material weaknesses did exist during the misstatement period but have since been remediated. Thus, despite initially reporting effective controls, material weaknesses clearly existed for these 330 firms as well, and, accordingly, our final sample allows us to study the determinants of weakness reporting.

3.3 determinants of the reporting of existing material weaknesses

For our sample of firms with existing weaknesses, if a firm reports that ICFR are effective, it implies that either the weakness is not discovered by management and the auditor, or it is discovered but they opt not to disclose it. Accordingly, we model the reporting of existing weaknesses as a function of factors expected to affect detection and/or disclosure.

We first consider the impact of prior financial reporting problems and expect previous restatements to be a significant factor in detecting existing control weaknesses. Previous restatements imply that management and the auditor have recognized past accounting problems as well as, presumably, the conditions that led to those problems, increasing the likelihood of detection. Previous restatements might also affect disclosure, because the PCAOB's auditing guidance explicitly considers previous restatements as indicators of material weaknesses. Thus, market participants likely expect that weaknesses exist for firms with recent restatements, making it more difficult for such firms to justify avoiding the disclosure of a control weakness.13 We expect that firms with previous restatements are more likely to report existing control weaknesses, and capture this effect with PRIOR RESTATE, a binary variable that indicates whether or not a firm had any previous restatements between 2000 and the beginning of SOX 404 in 2004.14

We also consider firms’ previous internal control disclosures under SOX 302, prior to becoming subject to audit under SOX 404. Disclosing a weakness under SOX 302 demonstrates management's ability to detect and willingness to disclose control weaknesses in a more ambiguous regulatory environment. It also suggests that management is more likely to be aware of existing control problems. Moreover, firms that did not report material weaknesses under SOX 302 may face reputational costs associated with reversing that opinion once the controls are subject to the additional scrutiny of an outside auditor (e.g., Martinek [2005]). Thus, the previous disclosure of material weaknesses is expected to increase the likelihood of both detection and disclosure. We include MW302, an indicator variable set to one if the firm previously disclosed a material weakness under SOX 302 (prior to SOX 404), and zero otherwise, and expect it to be positively associated with the reporting of existing material weaknesses under SOX 404.

Larger firms may enjoy economies of scale and have superior resources to dedicate to internal control testing, thereby increasing the likelihood of detection. However, larger firms are also likely to have more complex organizational and reporting structures that may increase the difficulty of detecting control weaknesses; thus, the effect of firm size on detection is unclear. Firm size may also affect disclosure incentives if, for example, larger firms have higher public profiles and are subject to greater pressures from capital market participants (Richardson, Tuna, and Wu [2003]), or if auditors are more likely to acquiesce to larger clients (e.g., McKeown, Mutchler, and Hopwood [1991]). Thus, larger firms may have incentives to be less forthcoming about existing control weaknesses, suggesting a negative association between firm size and disclosure. We measure firm size as the natural log of market value of common equity at the end of the final year of the misstatement period (SIZE). Due to the conflicting effects described above, we do not predict an expected sign.

Firms in poor financial health may lack the necessary resources to conduct adequate tests of internal controls, making them less likely to detect existing weaknesses. In addition, some prior research argues that managers of firms in financial distress have greater incentives to mislead (e.g., Lys and Watts [1994]), suggesting firms in poor financial health may also be less likely to disclose their control weaknesses. However, there are likely greater litigation- and reputation-based concerns surrounding firms in poor financial health, particularly for the auditor, and thus the overall effect on incentives to detect and disclose is unclear. We proxy for poor financial health using LOSS, an indicator variable set to one if the firm reports a loss (negative income before extraordinary items), and zero otherwise, during the final year of the misstatement period.15 Because the net effect of poor financial health is theoretically ambiguous, we do not predict an expected sign for LOSS.

Capital market–based pressures are likely to be especially strong for firms that intend to access external capital in the near future, which could affect the disclosure of existing control weaknesses. Recent research provides evidence that reported internal control problems are associated with higher costs of both equity (Ashbaugh-Skaife et al. [2009]) and debt capital (Costello and Wittenberg-Moerman [2011]), which provides incentives for managers of firms in need of capital to be less forthcoming about existing control weaknesses. With no reason to expect an effect on detection abilities, we expect external financing needs to reduce the likelihood of disclosure and thus be negatively associated with the reporting of existing weaknesses. Because a manager's intent regarding future financing activities is not directly observable, we use an ex post measure of actual financing activity during the first year subsequent to the misstatement period to proxy for that intent. We follow Bradshaw, Richardson, and Sloan [2006] and use ΔXFIN to measure firms’ capital market activities as the net change in their external financing. Specifically, ΔXFIN is the sum of net cash received from equity (cash received from stock issuance less cash used in stock repurchases and dividend payments) and net cash received from debt (cash received from debt issuance less cash used in reduction of debt), scaled by average total assets.16

Due to the attestation requirement under SOX 404, we expect the outside auditor to play a role in the reporting of internal control weaknesses. In particular, higher quality audits should increase the likelihood that existing weaknesses are detected. Previous research provides evidence consistent with larger audit firms providing higher quality audits (e.g. Teoh and Wong [1993], Becker et al. [1998]) and, thus, we expect the presence of a large audit firm to be positively associated with the detection of existing control weaknesses (we have no expectations regarding disclosure). We set BIG4 equal to one if a SOX 404 opinion was supplied by any of the largest four audit firms (Deloitte, Ernst and Young, KPMG, PricewaterhouseCoopers) during the misstatement period, and zero otherwise, and expect it to be positively associated with the reporting of existing weaknesses.

We also expect greater audit effort to be positively associated with the detection of control weaknesses. Prior research suggests that greater audit effort can curb earnings management (Caramanis and Lennox [2008]), and we expect a similar effect for internal control reporting, as greater audit effort increases the probability that existing control weaknesses are detected and could also reflect an increase in substantive testing necessitated by the lack of effective controls. We proxy for audit effort using AUDIT FEES, measured as audit-related fees paid during the final year of the misstatement period scaled by the square root of total assets (e.g., Kinney, Palmrose, and Scholz [2004]). With no reason to expect an offsetting effect on disclosure incentives, we expect audit effort to increase the likelihood of detection and thus predict a positive association between AUDIT FEES and the reporting of existing weaknesses.

Non-audit services provided by the audit firm also have the potential to affect internal control reporting, either through knowledge spillover effects (suggesting a positive effect on the likelihood that existing weaknesses are detected) or by compromising auditor independence (suggesting a negative effect on the likelihood that detected weaknesses are disclosed). We capture these potential effects with NONAUDIT FEES, measured as non-audit-related fees paid to the audit firm during the final year of the misstatement period scaled by the square root of total assets. Prior research has examined the competing audit quality effects of non-audit services in other, general financial reporting settings. The extant evidence is largely mixed (e.g., Frankel, Johnson, and Nelson [2002], Ashbaugh, LaFond, and Mayhew [2003], Kinney, Palmrose, and Schloz [2004]), and, thus, we do not predict the sign for NONAUDIT FEES.

We expect that recent auditor switches might impact the disclosure of control weaknesses. Hermanson, Krishnan, and Ye [2009] examine the link between adverse SOX 404 opinions and shareholder dissatisfaction towards auditors and find that shareholders are less likely to vote for auditor ratification following an adverse SOX 404 opinion. The authors interpret these results as suggesting that shareholders view auditors as partly responsible for the existence of control problems. Consistent with this notion, Ettredge et al. [2011] find that auditors are more likely to be dismissed after issuing an adverse SOX 404 opinion. Thus, continuing auditors might have incentives not to push the disclosure of existing weaknesses. We expect, however, that any such incentives are weaker for newly engaged auditors, who can shift the blame for the existence of control weaknesses onto the previous auditor.17 Accordingly, we include AUDITOR CHANGE, an indicator variable for whether or not the firm switched auditors within the two-year window prior to the end of the misstatement period, and expect it to be positively associated with disclosure incentives, and thus with the reporting of existing weaknesses.18

For similar reasons, we also examine recent managerial turnover and expect that new managers are more likely to disclose existing weaknesses because they can more easily deflect blame for the underlying existence of the weaknesses to their predecessors. Similar to AUDITOR CHANGE, MGT CHANGE is an indicator variable based on whether or not changes in either CEO or CFO occurred during the two-year window prior to the end of the misstatement period.

In summary, we argue that the reporting of existing material weaknesses in ICFR under SOX 404 is a function of several determinants that influence managers’ and auditors’ abilities to detect and incentives to disclose those weaknesses. To provide empirical evidence, we estimate the following probit model:

image(1)

where REPORT ICW is an indicator variable for whether or not the material weakness was reported under SOX 404 during the misstatement period and the independent variables are as described above. We also include SOXYEAR, which represents the number of years since the inception of SOX 404, to control for any trends over time in control reporting.19 Precise variable definitions, including data sources, are provided in appendix B.

4. Empirical Results

4.1 descriptive statistics

Table 2 shows the percentage of sample firms that report material weaknesses during their misstatement period (i.e., the mean value of REPORT ICW). Despite being subject to outside audit under SOX 404, only 32.4% report their existing weaknesses. Looking across years, the percentage is highest in the initial year of SOX implementation and declines monotonically, reaching its lowest point in the final sample year. Interestingly, this decreasing trend does not appear to be consistent with firms and their auditors improving the effectiveness of internal control reporting over time. Instead it suggests that interpreting declining overall rates of ineffective internal control opinions as general evidence of improving internal control practices is likely premature (SEC [2009b]). Our evidence indicates that a large proportion of restatements linked to control problems are for firms originally reporting that their internal controls were effective at the time of the misstatements, and that this proportion has not diminished over time.20

Table 2. 
Proportions of Restating Firms That Report Internal Control Weaknesses at the Time of Original (Misstated) Financial Statements
All YearsSOX Year 1SOX Year 2SOX Year 3SOX Year 4SOX Year 5
  1. This table presents the percentages of restating firms that disclose internal control weaknesses along with the originally filed financial statements (i.e., the financial statements subsequently determined to contain misstatements). The number of observations for each cell is reported in parentheses. The individual years are based on the final year of each firm's misstatement period. Year 1 represents fiscal year-ends during the first year that SOX 404 was effective (November 2004–October 2005). Year 2 represents the second year of SOX 404 (November 2005–October 2006), and so on.

32.4%35.4%34.7%30.8%25.0%13.6%
(488)(189)(144)(81)(52)(22)

In table 3, panel A, we present distributional statistics for the regression variables. As expected for a group of accelerated filers, our sample firms tend to be relatively large, with a median value for SIZE of 6.407 (that translates to $606 million in market capitalization), and the majority (84%) employ one of the largest audit firms. About 31% of sample firms report an accounting loss, 12% have recent auditor changes, and 46% have management changes.

Table 3. 
Descriptive Statistics
Panel A: Distributional statistics
VariableRestatement sample
 Full sampleREPORT ICW= 1ExpectedREPORT ICW= 0Nonrestating accelerated filers
MeanStd. Dev.25th PctlMedian75th PctlMeanRelationMeanMean
PRIOR RESTATE0.4240.4950.0000.0001.0000.582>0.3490.199
MW3020.0760.2650.0000.0000.0000.165>0.0330.030
SIZE6.4821.5465.4176.4077.2726.048> <6.6846.885
LOSS0.3110.4640.0000.0001.0000.487> <0.2270.213
ΔXFIN0.0260.208−0.041−0.0010.0480.016<0.0310.021
BIG40.8360.3711.0001.0001.0000.746>0.8780.824
AUDIT FEES64.34258.27931.71550.49279.97687.967>53.03046.189
NONAUDIT FEES13.18222.4231.7416.17115.38213.374> <13.0909.612
AUDITOR CHANGE0.1150.3190.0000.0000.0000.196>0.0760.209
MGT CHANGE0.4550.4980.0000.0001.0000.576>0.3970.590
Observations488    158 3309,249
Panel B: Pearson correlations (n= 488)
 (2)(3)(4)(5)(6)(7)(8)(9)(10)
  1. Variables are as defined in appendix B. In panel A, italic font in the REPORT ICW= 0 column represents a statistically significant difference between the REPORT ICW= 1 and REPORT ICW= 0 groups at the 0.05 level. In panel B, italic font represents correlations significant at the 0.05 level.

(1) PRIOR RESTATE0.287−0.0970.1210.060−0.0680.2250.0610.0750.018
(2) MW302 −0.0430.1250.055−0.0400.3320.1050.0430.041
(3) SIZE  -0.333-0.1130.3370.0180.0660.1930.101
(4) LOSS   0.146−0.0850.2080.1180.0770.146
(5) ΔXFIN    0.1440.0290.1580.0910.019
(6) BIG4     0.0670.1400.2570.004
(7) AUDIT FEES      0.3780.0970.207
(8) NONAUDIT FEES       0.0800.114
(9) AUDITOR CHANGE        0.020
(10) MGT CHANGE         

We also compare the variables across groups based on whether or not firms report internal control weaknesses. Reported weaknesses are more likely for firms with prior restatements (PRIOR RESTATE), material weaknesses previously reported under SOX 302 (MW302), higher audit fees (AUDIT FEES), accounting losses (LOSS), auditor changes (AUDIT CHANGE), and management changes (MGT CHANGE), and less likely for larger firms (SIZE) and those with the largest auditors (BIG4). The differences across groups for changes in external financing (ΔXFIN) and non-audit fees (NONAUDIT FEES) are not statistically significant. Taken as a whole, these differences suggest that many of the potential factors we identify are associated with the reporting of existing control weaknesses. These simple univariate comparisons, however, do not control for the other associated factors. Accordingly, we base our formal inferences on the regression results in the next section.

For comparative purposes, in the final column in panel A of table 3 we also provide descriptive statistics for a sample of nonrestating firms. Ideally, this comparison group would consist of all nonrestating firms that have existing control weaknesses. However, among nonrestating firms we are unable to observe whether such weaknesses exist without appealing to their SOX 404 reports (i.e., we cannot identify unreported weaknesses). Thus, the comparison group is comprised of all accelerated filers without any restatements during the SOX 404 era, and includes all such firm-years with the necessary information to construct our variables. Relative to our sample, the nonrestating firms tend to be somewhat larger and have lower audit and non-audit fees. These firms are also less likely to report a loss, or to have had a restatement or control weakness reported prior to the SOX 404 era.21 While it is unclear what proportion of the comparison group actually has existing control weaknesses, these differences nevertheless suggest that caution should be used in generalizing our results to other, nonrestating firms.

We provide Pearson correlations between the regressors in table 3, panel B. These correlations are largely consistent with intuition. For example, larger firms tend to employ larger auditors and be more financially stable; SIZE is positively correlated with BIG4 and negatively correlated with LOSS. Firms with previous restatements are also more likely to have reported a material weakness under SOX 302; PRIOR RESTATE is positively correlated with MW302. Audit fees tend to be higher for firms with previous restatements and material weaknesses under SOX 302; AUDIT FEES is positively correlated with PRIOR RESTATE and MW302.

4.2 regression results

In table 4 we present our primary regression results. Along with coefficient estimates and standard errors, we also provide estimated marginal effects for each variable. The reported marginal effects are averages of the individual marginal effects evaluated at every observation in the sample (Bartus [2005], Greene [2003]).22

Table 4. 
Determinants of the Reporting of Existing Internal Control Weaknesses under SOX 404
ParameterPredicted SignEstimated CoefficientStandard ErrorMarginal Effect
  1. This table presents probit regression results with REPORT ICW as the dependent variable. Variables are as defined in appendix B and the sample is as described in table 1. Marginal effects are evaluated at every observation in the estimation sample and then averaged over those individual effects. ***, **, and * denote statistical significance at the 0.01, 0.05, and 0.10 levels, respectively, based on two-tailed tests.

INTERCEPT±0.16070.3888 
PRIOR RESTATE+0.30110.1360**0.0877
MW302+0.49890.2611*0.1545
SIZE±−0.09310.0489*−0.0263
LOSS±0.53040.1482***0.1624
ΔXFIN−1.04560.4318**−0.2953
BIG4+−0.55130.1911***−0.1687
AUDIT FEES+0.00640.0015***0.0018
NONAUDIT FEES±−0.00900.0038**−0.0025
AUDITOR CHANGE+0.35140.2124*0.1057
MGT CHANGE+0.34610.1357**0.1003
SOXYEAR±−0.20010.0607***−0.0564
Likelihood ratio, chi-square 124.41***  
Pseudo-R2 0.202  
Observations 488  

As expected, the estimated coefficients on PRIOR RESTATE and MW302 are both positive, and the corresponding marginal effects indicate that firms with prior restatements and firms that previously reported material weaknesses under SOX 302 are about 8.8 and 15.5% more likely to report existing material weaknesses under SOX 404, respectively. These results are consistent with those of Ashbaugh-Skaife et al. [2007], who also find prior restatements are positively associated with the reporting of internal control weaknesses.

The estimated coefficient on SIZE is negative (marginal effect =−0.0263), indicating that larger firms are less likely to report their existing control weaknesses. Doyle, Ge, and McVay [2007b] and Ashbaugh-Skaife, Collins, and Kinney [2007] also report that firm size is negatively associated with reported control deficiencies; however, because neither of those studies distinguishes between the existence and the disclosure of control problems, they both view size as a proxy for investment in internal controls and interpret their results as evidence that underlying control problems are less likely to exist in larger firms. Our results, by contrast, indicate that, when control weaknesses do exist, larger firms are less likely to report those weaknesses. To the extent that capital market pressures (e.g., Richardson, Tuna, and Wu [2003]), auditor acquiescence (McKeown, Mutchler, and Hopwood [1991]), and the complexity of the control environment are increasing in firm size, our results suggest that, on average, such factors outweigh any resource or scale advantages related to size.23

The estimated coefficient on LOSS is positive (marginal effect = 0.1624), suggesting that the incentives for additional scrutiny that surround firms in poor financial health outweigh any corresponding reduction in resources available for internal control testing. This variable also provides an interpretation that contrasts with Doyle, Ge, and McVay [2007b] and Ashbaugh-Skaife, Collins, and Kinney [2007]. Both of those papers interpret the association between financial health and reported control deficiencies as evidence that firms in poor financial health are more likely to have underlying control problems. In contrast, because all firms in our sample have known control problems, we interpret our results to imply that firms in poor financial health are more likely to report the weaknesses that do exist.

Capital market pressures stemming from firms’ impending external financing needs also appear to be associated with the likelihood that existing control weaknesses are reported. The estimated coefficient on ΔXFIN is negative, consistent with firms being less forthcoming about disclosing control problems that could lead to increases in the cost of the capital they intend to access. As a gauge of economic significance, moving ΔXFIN from its first quartile value to its third quartile value, while holding all other variables constant at their means, implies a 3.3% decrease in the likelihood of existing weaknesses being reported.24

Contrary to our expectations, the estimated coefficient for BIG4 is negative, indicating that clients of the largest audit firms are less likely to report material weaknesses. While this result could be viewed as consistent with the largest audit firms providing lower quality internal controls audits, we are cautious about drawing this inference due to the conditional nature of our sample. In particular, given previous evidence that larger audit firms tend to provide higher quality financial statement audits (e.g., Teoh and Wong [1993], Becker et al. [1998]), it is possible that larger auditors are better able to “audit around” existing weaknesses and avoid misstatements in the financial reports that would lead to restatements and inclusion in our sample. As such, care should be used in generalizing this result to firms without restatements.

The estimated coefficient on AUDIT FEES is positive, which is consistent with greater audit effort leading to an increased likelihood of detecting existing control weaknesses. Moving AUDIT FEES from its first quartile value to its third quartile value, while holding all other variables constant at their means implies a 10.4% increase in the likelihood of existing weaknesses being reported. In contrast, the estimated coefficient on NONAUDIT FEES is negative, which is consistent with decreased auditor objectivity outweighing, on average, any benefits from knowledge spillovers in this particular setting. The likelihood of existing weaknesses being reported decreases by 4.3% as NONAUDIT FEES moves from its first quartile value to its third quartile value, holding all other variables constant at their means.

As expected, recent auditor and management changes are both positively associated with the likelihood of existing material weaknesses being reported. The estimated marginal effects for AUDITOR CHANGE and MGT CHANGE are 10.6% and 10.0%, respectively, consistent with an increased likelihood of control weakness disclosure when it is easier for auditors and management to deflect blame for the existence of those weaknesses on their predecessors.

The estimated coefficient on SOXYEAR is negative and significant, indicating that the trend of decreased reporting of existing control weaknesses shown in table 2 continues to hold after controlling for the other factors in our model.

Taken as a whole, the results reported in table 4 are largely consistent with our initial predictions and provide evidence that the reporting of existing weaknesses in ICFR is affected by various factors related to detection and disclose incentives.

4.3 additional analyses

Our primary analysis in the preceding section follows previous literature (Ashbaugh-Skaife, Collins, and Kinney [2007]) in modeling the detection and disclosure of control weaknesses as a single underlying process. Detection and disclosure, however, may also be viewed as separate and sequential processes: the firm first undertakes the detection process and then, conditional on detecting the material weakness, undertakes the disclosure decision process. This view suggests the importance of discriminating between the detection and the disclosure processes, as they are different inputs to the reporting outcome. Formally,

image(2)

where DETECT ICW and DISCLOSE ICW are indicators for whether the weakness is detected and disclosed, respectively.

Modeling detection and disclosure as separate processes is complicated by the fact that the intermediate outcomes are only partially observable to the researcher. That is, REPORT ICW=DETECT ICW x DISCLOSE ICW, but only the final outcome, REPORT ICW, is observed. Thus, when a firm fails to report an existing weakness, we cannot observe whether it is due to a failure to detect or a failure to disclose.

We conduct two analyses to help discriminate between detection and disclosure, and thus provide evidence on the specific channel(s) through which each variable from our main model affects the ultimate reporting outcome. The key idea behind both analyses is that, because the disclosure process is conditional on detection (see equation (2)), overcoming the partial observability problem requires some method of identifying detection. The difference between the two analyses is in the approach to achieving that identification. The first approach uses a statistical method that involves modeling the factors that are expected to affect detection. The second approach isolates a subsample for which detection can reasonably be assumed to have occurred. Because each approach has its own merits, we conduct both analyses to help gauge the robustness of the results.

For the first of these analyses, we model detection and disclosure as separate underlying processes and then estimate those models jointly using a bivariate probit approach that accommodates partial observability.25 To develop the partial observability model for our setting, let X1 be a vector of factors that affect detection and X2 be a vector of factors that affect disclosure. Then let

image(3a)
image(3b)

be the processes that determine the likelihood of detection and disclosure, respectively, such that

image(4a)
image(4b)

Thus26, equation (2) becomes

image(5)

From (5), it follows that the log-likelihood function is

image(6)

and maximum likelihood can be used to estimate the parameter vectors β1 and β2.

Each variable from our primary analysis is assigned to either X1 or X2 (or both) according to the channel through which it is expected to affect control reporting (i.e., detection or disclosure). We base these assignments on the theory underlying the original motivation for each variable, as developed in detail in section 3.3 and summarized here:

image
image

Identification of the partial observability model requires that at least one variable differ between X1 and X2 (Maddala [1983]). In our case, ΔXFIN, AUDITOR CHANGE, and MGT CHANGE appear only in the disclosure model, and BIG4 and AUDIT FEES appear only in the detection model.27 The choice to omit each of these variables from either the detection or disclosure stage of the estimation is based on a lack of theoretical support for inclusion. For example, as discussed in section 3.3, we have no theoretical reason to expect that firms seeking external financing would be more or less likely to detect control weaknesses, nor is there sufficient theory for why auditor or managerial turnover would impact the likelihood of detection. Similarly, while there is clear theoretical support for including BIG4 and AUDIT FEES in the detection model, we do not find sufficient justification for including these factors in the disclosure model.28

For the second analysis, rather than relying on a statistical identification of detection, we instead estimate the disclosure model on a subset of the sample for which detection is likely to have occurred. This approach is based on the observation that, when detection occurs (i.e., when DETECT ICW= 1), equation (2) collapses to Pr(REPORT ICW= 1) = Pr(DISCLOSE ICW= 1). In such cases, DISCLOSE ICW and REPORT ICW become equivalents and the separate disclosure model can be estimated using the observable outcome, REPORT ICW.

To identify a subset where detection is likely to have occurred, we follow Hennes, Leone, and Miller [2008] and classify restatements as due to either irregularities or to errors. Because irregularities represent “intentional misreporting” (Hennes, Leone, and Miller [2008, p. 1488]), it is likely that in such cases management is aware of the weaknesses in the controls being circumvented (recall that material weaknesses are defined as those that result in a “more than remote” possibility of material misstatement).29 Therefore, we assume that detection is likely to have occurred for those firms with restatements classified as irregularities and estimate the disclosure model on this subsample. This approach provides an opportunity to triangulate the partial observability approach, but is subject to the caveat that the sample is conditional on having an irregularity restatement and thus may not generalize to other firms.30

The results from the partial observability approach (both detection and disclosure models) as well as the irregularity subsample approach (disclosure model only) are reported in table 5. Beginning with the detection model, PRIOR RESTATE, MW302, and AUDIT FEES are all positively associated with detection, as expected. LOSS is also positively associated with detection, suggesting that increased incentives to detect problems for firms in poor financial health outweigh resource considerations. As in our primary results, the coefficient on BIG4 is negative. SIZE, NONAUDIT FEES, and SOXYEAR are insignificant in the detection model.

Table 5. 
Determinants of Detection and Disclosure of Existing Internal Control Weaknesses
ParameterBivariate Probit with Partial ObservabilityUnivariate Probit (Irregularities Only)
Detection ModelDisclosure ModelDisclosure Model
Estimated CoefficientStandard ErrorEstimated CoefficientStandard ErrorEstimated CoefficientStandard Error
  1. This table presents the results of estimating probit regressions with REPORT ICW as the dependent variable. Variables are as defined in appendix B. ***, **, and * denote statistical significance at the 0.01, 0.05, and 0.10 levels, respectively, based on two-tailed tests.

INTERCEPT−0.58440.53215.59392.0437***−0.34150.4164
PRIOR RESTATE0.65940.1992***−1.46500.7497*0.46330.1472***
MW3020.74670.4010*0.09190.66380.76330.2748***
SIZE−0.04040.0707−0.23750.1888−0.08430.0517
LOSS0.34550.1952*1.21070.5889**0.66980.1599***
ΔXFIN  −3.69201.8819**−1.22680.5458**
BIG4-0.82800.2425***    
AUDIT FEES0.01070.0022***    
NONAUDIT FEES0.00440.0073−0.03270.0148**−0.00640.0036*
AUDITOR CHANGE  2.54872.08720.54560.2186**
MGT CHANGE  0.77340.4445*0.43410.1450***
SOXYEAR0.08010.1047−1.03010.3151***−0.13800.0651**
Likelihood ratio, chi-square 145.91*** 85.24***
Pseudo-R2  0.237 0.169
Observations 488 409

Turning to the disclosure model, we discuss the results from the two estimation approaches together and note differences where applicable. Under both approaches, LOSS and MGT CHANGE are positively associated with disclosure, and ΔXFIN and NONAUDIT FEES are negatively associated with disclosure, all consistent with expectations. MW302 and AUDITOR CHANGE have positive coefficients, as expected, for the irregularities sample, but both variables are insignificant in the disclosure stage of the partial observability model. The estimated coefficient for PRIOR RESTATE is positive for the irregularities sample, but is negative in the disclosure stage of the partial observability model. Thus, the positive association between PRIOR RESTATE and REPORT ICW documented in table 4 appears to be attributable, at least in part, to the effect of previous restatements on detection, while the evidence regarding their effect on disclosure is mixed. SOXYEAR is significantly negative in both estimations of the disclosure model, suggesting that the time trend observed in table 4 stems from a decline in the likelihood of disclosing weaknesses as we move further away from the initial promulgation of SOX. SIZE is insignificant in both estimations of the disclosure model.

Overall, the results of these additional analyses are generally consistent with our main results in table 4. More importantly, by discriminating between detection and disclosure, these analyses help to sharpen the interpretation of the main results by providing evidence on the specific channels through which each of the factors we study affects the ultimate reporting of control weaknesses.

5. Summary and Conclusion

In this paper, we examine the effectiveness of SOX 404 internal control reports in identifying existing material control weaknesses, as well as the determinants of the relative effectiveness of those reports across firms. While SOX 404 has received significant attention, largely due to the perceived burden of the associated compliance costs, how reliably the resulting reports identify weaknesses has remained largely overlooked in the academic literature. We address this void by studying a sample of firms that restate previously issued financial statements to correct misstatements and that can be identified as having had existing control weaknesses during the time of their misstatements. We examine the internal control reports that accompanied the original (misstated) financial statements to determine whether firms reported their control weaknesses as required. Thus, our paper differs from previous research such as Doyle, Ge, and McVay [2007b] and Ashbaugh-Skaife, Collins, and Kinney [2007] in that we are able to separate the reporting of internal control weaknesses from their underlying existence. Because weaknesses exist for all of our sample firms, we are able to focus on the reporting of those weaknesses and thus provide evidence on the factors that affect detection and disclosure. We sharpen the interpretation of our evidence by also conducting analyses that distinguish between factors that affect detection versus those that affect disclosure.

Our results indicate that the majority of sample firms and their auditors fail to report existing control weaknesses and instead report that controls are effective. Only 32.4% report the existence of a material weakness in their SOX 404 reports during the misstatement period, and this proportion has declined over time. The usefulness of internal control reports in providing advance warning on the likelihood of misstatements in the financial reports is reduced if control weaknesses are not disclosed until after the misstatements themselves are later revealed. As such, it is important to understand the conditions that lead to the (non)disclosure of existing control weaknesses.

Despite the mandatory nature of material weakness reporting under SOX 404, our empirical evidence suggests that managers’ and auditors’ incentives to detect and disclose internal control problems play an important role in whether or not existing weaknesses are ultimately reported. In particular, we find that firms in need of external capital, larger firms, and firms that pay larger amounts of non-audit fees to their auditors are less likely to report their existing control weaknesses, consistent with these factors affecting managers’ and auditors’ incentives to disclose control problems. We also find that clients of the largest audit firms are less likely to report weaknesses, while poor financial health, previous financial reporting and control problems, greater auditor effort, and recent auditor and management changes are all positively associated with the reporting of existing control weaknesses under SOX 404.

The results of this study make several contributions to the literature. By documenting that SOX 404 reports are not always effective in identifying existing control weaknesses and, further, that the effectiveness has not improved over time, our results lend some support to criticisms of internal control reporting in practice (Turner and Weinrich [2006]) and suggest that recent declines in reported material weaknesses may not be reflective of improvements in underlying control practices, consistent with concerns voiced by the SEC (SEC [2009b]). These results also inform recent debates over the value of requiring control reports to be audited (SEC [2007], SEC [2009a], Kinney and Shepardson [2011], Bedard and Graham [2011]). Despite the audit requirement of SOX 404, our evidence indicates that the majority of restating firms provided no advance warning of the control problems that led to their misstatements. Finally, our results also have implications for future academic research. We document considerable variation in whether existing weaknesses are actually reported, and our evidence on the determinants of that reporting should be considered by future research using public disclosures to study internal control practices.

We close by noting that this study is subject to limitations. In particular, our focus on restating firms provides research design advantages but also presents a potential tradeoff in that the generalizability of our results to firms with control weaknesses that do not lead to restatements is unclear. This is particularly true of our results for Big 4 vs. non–Big 4 auditors because of the direct role that auditors play in certifying the reliability of financial statements (and thus in the likelihood of restatement). While restating firms are important to understand, future research could develop additional ways to identify (unreported) internal control weaknesses and extend this line of inquiry to other groups of firms.

Appendices

appendix a

Examples of Control-Related Disclosures Following Restatements

Reporting ineffective controls after the restatement (retained in sample):

The New York Times Company (Form 10-K for year ended 12/31/06, filed 3/1/07)

As discussed elsewhere in this Annual Report on Form 10-K, we are restating certain of our previously issued financial statements. In light of the need for this restatement, our Chief Executive Officer and Chief Financial Officer have identified a material weakness in our internal control over financial reporting with respect to accounting for pension and postretirement liabilities arising under collectively bargained pension and benefit plans, further described below under “Management's Report on Internal Control Over Financial Reporting.” As of December 31, 2006, Janet L. Robinson, our Chief Executive Officer, and James M. Follo, our Chief Financial Officer, have evaluated the effectiveness of our disclosure controls and procedures. Based upon, and as of the date of their evaluation, the Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were not effective solely because of this material weakness.

Acknowledging that material weaknesses did exist during the misstatement period, but have subsequently been remediated by the time of the next SOX 404 report (retained in sample):

8×8, Inc. (Form 10-K for year ended 3/31/07, filed 6/29/07)

As discussed in Note 2 to the consolidated financial statements contained in Item 8 of this Annual Report on Form 10-K, the Company has restated its 2006 and 2005 annual consolidated financial statements to correct an error related to the Company's accounting for certain warrants. As a result of this error, the Company has also restated its interim consolidated financial statements for the first three quarters of 2007 and all quarters for 2006. In connection with this restatement, the following material weakness was identified that existed during fiscal 2006 and prior periods. A material weakness is a control deficiency, or combination of control deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected. The Company did not maintain effective controls over the accounting for warrants. Specifically, the Company's controls did not ensure the appropriate classification of warrants as a liability in accordance with generally accepted accounting principles. This control deficiency resulted in the misstatement of stockholders’ equity, liabilities, and net loss that resulted in the need to restate the Company's previously issued financial statements as discussed above.

Reporting that the restatement was not related to ineffective controls (removed from sample):

Renaissance Learning Inc. (Form 10-K/A for year ended 12/31/06, filed 8/9/07)

As a result of the restatement discussed in Note 19 to the Notes to the Consolidated Financial Statements, the Company has re-evaluated, under the supervision and with the participation of management, including the Company's Chief Executive Officer and Chief Financial Officer, the effectiveness of the design and operation of the Company's disclosure controls and procedures as of December 31, 2006. Based upon that evaluation, the Chief Executive Officer and the Chief Financial Officer concluded that the Company's original conclusions with respect to the effectiveness of disclosure controls and procedures remain appropriate and that the disclosure controls and procedures were effective at a reasonable assurance level as of December 31, 2006. In arriving at this conclusion, management considered the facts and circumstances that resulted in the reclassification related to auction rate securities including considerations with respect to its internal control over financial reporting. Management determined that the reclassification was not the result of material weakness within internal control over financial reporting.

appendix b

Variable Definitions

VariableDefinition and Data Source
Dependent variable:
REPORT ICWCoded one if the firm disclosed the existence of a material weakness in internal control over financial reporting in any SOX 404 report during their misstatement period, zero otherwise (Audit Analytics).
Independent variables:
PRIOR RESTATECoded one if the firm had any previous restatements between 2000 and the beginning of SOX 404 in 2004, zero otherwise (Audit Analytics).
MW302Coded one if the firm disclosed a material weakness in any SOX 302 report prior to SOX 404, zero otherwise (Audit Analytics).
SIZENatural log of the total market value of common equity at the end of the misstatement period (Compustat; CSHO × PRCC_F).
LOSSCoded one if the firm reports a loss (negative income before extraordinary items) in the final year of the misstatement period, zero otherwise (Compustat data item IB < 0).
ΔXFINSum of cash received from the sale of stock and issuance of long-term debt, minus cash used in repurchase of stock, payment of dividends, and reduction of debt (Compustat; SSTK + DLTIS − PRSTKC − DV − DLTR + DLCCH), measured over the first fiscal year after the misstatement period and scaled by average total assets (Compustat AT).
BIG4Coded one if the firm received a SOX 404 audit opinion from any of the largest four audit providers during the misstatement period, zero otherwise (Audit Analytics). The largest four audit providers are Deloitte, Ernst and Young, KPMG, and PricewaterhouseCoopers.
AUDIT FEESAudit fees (Audit Analytics), scaled by the square root of total assets, for the final year of the misstatement period.
NONAUDIT FEESTotal non-audit fees paid to the outside audit firm (Audit Analytics), scaled by the square root of total assets, for the final year of the misstatement period.
AUDIT CHANGECoded one if the firm experienced an auditor change within the two-year window prior to the end of the misstatement period, zero otherwise (Audit Analytics).
MGT CHANGECoded one if the firm experienced a CEO or CFO change within the two-year window prior to the end of the misstatement period, zero otherwise (Audit Analytics).
SOXYEARBased on the final year of each firm's misstatement period, coded one for fiscal year-ends during the first year that SOX 404 was effect (November 2004–October 2005); coded two for years ending during the second year of SOX 404 (November 2005–October 2006); and so on.

Footnotes

  • 1

    Internal controls are those processes intended to provide “reasonable assurance about the reliability of a company's financial reporting” (PCAOB [2004], p. 4). Except where otherwise noted, our use of “SOX 404” refers to the internal control reporting requirements of both sections 404(a) (the management reporting requirement) and 404(b) (the audit requirement) collectively.

  • 2

    In this spirit, the Public Company Accounting Oversight Board (PCAOB) has argued, “For the implementation of Section 404 of the Act to achieve its objectives, the public must have confidence that all material weaknesses that exist as of the company's year-end will be publicly reported” (PCAOB [2004], paragraph E94).

  • 3

    Ashbaugh-Skaife, Collins, and Kinney [2007] also consider firms’ incentives regarding internal control reporting, but they study a time period prior to SOX 404, when internal control reporting practices were not as standardized or subject to audit, and they do not distinguish between the existence and the reporting of control problems (our primary interest). These and other important differences between our study and previous research are reviewed more thoroughly in section 2.

  • 4

    Because SOX 404 requires both managers and auditors to provide an opinion, it is possible that they could disagree (e.g., management reports that ICFR are effective and the audit firm reports that ICFR are not effective). However, disagreements appear to be rare in practice (e.g., Costello and Wittenberg-Moerman [2011]), and we do not find any such instances for our sample firms. It is also theoretically possible for weaknesses to be reported when none exist, but we are unaware of any reason to expect this happens in practice.

  • 5

    For example, noting the declining trend in reported material weaknesses in a speech to the American Institute of Certified Public Accountants (AICPA), SEC Professional Accounting Fellow Doug Besch remarked that, “This decline could be due to registrants, on average, having addressed previously reported material weaknesses while also having controlled all of the unique financial reporting risks introduced by the recent economic conditions,” or alternatively that “this trend could also be due to material weaknesses not being identified or reported” (SEC [2009b]).

  • 6

    “Accelerated” filers are defined as those firms that: (1) have a common equity public float of $75 million or more as of the firm's most recently completed second fiscal quarter, (2) have been subject to the Securities Exchange Act of 1934 reporting requirements for at least 12 calendar months, (3) have previously filed a 10-K, (4) are not a “small business” as defined in Rule 12b-2 of the 1934 Act.

  • 7

    Material weaknesses are the most severe category of ICFR deficiencies, based on the likelihood and materiality of associated misstatements (the lesser two categories are termed “control deficiencies” and “significant deficiencies”). Under the PCAOB's initial auditing standards (AS2), a material weakness is defined as “a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected.” In 2007, AS2 was superseded by the current standard, AS5, which replaces “more than remote” with “reasonably possible” in the definition of a material weakness to be more consistent with the language of GAAP. As noted by the PCAOB (see appendix 4 of AS5), “more than remote” and “reasonably possible” are definitional equivalents.

  • 8

    Doyle, Ge, and McVay [2007b, p. 204] acknowledge that “the use of the proxy of a disclosure of a material weakness versus the true underlying existence of a weakness is a limitation of our study.”

  • 9

    While Plumlee and Yohn [2010] also explore the link between restatements and internal control reporting, our work is distinct in that we focus on ICFR reporting during the misstatement period (i.e., a weakness disclosure is not an effective warning mechanism if it is only announced after the restatement), and we also study the determinants of weakness disclosures.

  • 10

    Ogneva, Subramanyam, and Raghunandan [2007] also explore the link between internal control quality and cost of capital, but do not find evidence of a significant association.

  • 11

    For example, the PCAOB notes that a restatement may not imply a control weakness if it “reflected the SECs subsequent view of an accounting matter, when the auditor concluded that management had reasonable support for its original position” (PCAOB [2004], paragraph E99).

  • 12

    Consistent with not rising to a level that justifies a material weakness, these restatements tend to be much less severe than those retained in our sample (based on untabulated comparisons of changes in reported income, number of years restated, number of accounts restated, and percentage of cases with no effect on reported income). Thus, it seems prudent to omit these observations from the analysis. We note, however, that our results are quite similar if we retain them.

  • 13

    To the extent that reputational effects of previous restatements also serve to make management more forthcoming about control problems (Ashbaugh-Skaife, Collins, and Kinney [2007]), this would reinforce our expectation that prior restatements are positively associated with the disclosure of existing control weaknesses.

  • 14

    We use this window because the Audit Analytics data begins in 2000. As a sensitivity check, we also vary the beginning of the window to either 1999 or 2001 (to expand into 1999 we searched the 2002 GAO report on restatements for each of our individual sample firms). All results are very similar to those reported in the paper.

  • 15

    We obtain similar inferences with alternative proxies for poor financial health, including the proportion of loss years over the prior three years, the decile rank of the Altman Z-score, and an indicator for aggregate losses over the two prior years (e.g., Ashbaugh-Skaife, Collins, and Kinney [2007], Doyle, Ge, and McVay [2007b]).

  • 16

    Our inferences are not sensitive to instead using an ex ante measure of external financing needs based on free cash flow (Dechow, Sloan, and Sweeney [1996]).

  • 17

    Recent theoretical research also suggests that a “slippery slope” effect can exist that increases in auditor tenure and dampens the auditor's incentives to expose managerial misreporting because doing so would also reveal the auditor's failures to stem the misreporting in previous periods (Corona and Randhawa [2010]).

  • 18

    We do not posit an association between recent auditor changes and detection. Prior literature investigating the audit quality effects of auditor tenure has yielded only mixed results (see Davis, Soo, and Trompeter [2009] for a recent discussion). Moreover, the primary motivation underlying that literature involves auditor independence (i.e., a disclosure issue).

  • 19

    We obtain similar results if we estimate the model with time period fixed effects rather than SOXYEAR. Results are also robust to the inclusion of industry fixed effects. To ensure that our results are not somehow driven by differences in restatement severity, in untabulated analysis we also include controls for the change in reported income due to the restatement, the number of account types restated, and the number of years restated. Each of these additional variables is insignificant in the presence of the other variables in our model, and none of our inferences are affected. We also include various commonly used measures of litigation risk, including those based on Francis, Philbrick, and Schipper [1994], Rogers and Stocken [2005], and Kim and Skinner [2011]. These variables are insignificant in every case and do not affect our other inferences.

  • 20

    We undertake two analyses to ensure that this time trend is not simply a mechanical manifestation of later sample years having less postevent time available for reporting problems to come to light. First, note that such truncation would only create the trend if it disproportionately affects REPORT ICW= 1 firms. This could happen if REPORT ICW= 1 firms tend to take longer to announce their restatements after the misstatements occur. We find, however, the opposite to be true: the mean (median) number of days is 225 (221) for REPORT ICW= 1 firms and 277 (297) for REPORT ICW= 0 firms. Thus, if anything, the trend we document may be understated. Second, we restrict the sample to restatements announced within one year of the misstatement period to ensure we have a “level playing field” across time periods; we find a similar declining trend.

  • 21

    The reported values of AUDITOR CHANGE and MGT CHANGE for the nonrestating firms are not directly comparable to our sample firms, because the two-year measurement window can lead to the same auditor or management change being counted for two consecutive firm-years. For a more meaningful comparison, we restrict the measurement window for these variables to only one previous year (for both samples) and find that previous auditor and management changes continue to be less common for our sample of restatement firms.

  • 22

    We obtain similar results if we winsorize or delete extreme values, or use Cook's D to identify and eliminate influential observations. Thus, outliers do not appear to be a concern. We also note that the standard errors of the marginal effects imply identical inferences to those from the associated coefficient estimates. For the sake of brevity we omit them from the table.

  • 23

    A potential alternative explanation is that larger firms could be more likely to be forced into restatements, perhaps due to heightened SEC scrutiny. However, this explanation does not appear to be supported by table 2, which indicates that our sample firms are, on average, smaller than other accelerated filers without restatements.

  • 24

    In untabulated analysis, we separate ΔXFIN into its debt and equity components and find that both are significantly negative. We also replace these separate debt and equity components with only the portions attributable to raising new capital (recall that ΔXFIN is a measure of net financing activities), that is, cash received from new long-term debt and stock sales, respectively. Both components are again negative, but only the equity portion is significant. Thus, overall, there is evidence consistent with both debt and equity needs influencing control reporting, but the evidence is strongest for equity.

  • 25

    The approach we adopt was originally developed in the labor economics literature by Abowd and Farber [1982]. Maddala [1983] and Greene [2007] also provide developments of the general model. Examples of its use in the accounting literature include Krishnan and Krishnan [1996], Fargher and Jiang [2008], and Heitzman, Wasley, and Zimmerman [2010].

  • 26

    Because of the assumed sequential nature of detection and disclosure, disc is only defined for the subset of observations where det > 0, and ɛ1 and ɛ2 are assumed to be independent with standard normal distributions (Maddala [1983]).

  • 27

    Table 5 indicates that four of these five variables are statistically significant, suggesting the identification is effective. We also conduct (untabulated) tests of the joint significance of BIG4 and AUDIT FEES in the detection model and ΔXFIN, AUDITOR CHANGE, and MGT CHANGE in the disclosure model, as well as a joint test on all five variables; in each case, the variables in question are jointly significant at p < 0.05.

  • 28

    It could be argued that the auditor-related variables (BIG4, AUDIT FEES, AUDITOR TURN CHANGE) have the potential to affect both detection and disclosure and thus should be included in both models. We include each of these variables in only one of the models for the reasons outlined in the text. As a practical matter, however, untabulated tests reveal that these variables are insignificant in the models from which they are currently omitted and adding them has little effect on the other variables in the model.

  • 29

    Consistent with management likely being aware of these misstatements, Hennes, Leone, and Miller [2008] document that irregularities restatements are associated with significantly greater likelihood of management turnover, market reactions that are more negative, and higher incidence of lawsuits.

  • 30

    As in Badertscher, Hribar, and Jenkins [2011], we identify irregularities using Audit Analytics (Hennes, Leone, and Miller [2008] use text searches in their original study, as much of their sample period predates Audit Analytics). Badertscher, Hribar, and Jenkins [2011] report a correlation of 0.94 between the two codings during the period in which they overlap.

Ancillary