The Sarbanes-Oxley Act (SOX) of 2002 was enacted to help restore public trust in capital markets in the aftermath of several high-profile accounting scandals. One of the most controversial aspects of the Act has been the requirement of Section 404 (hereafter SOX 404) that both management and the independent auditor formally opine in the annual report on the effectiveness of a company's internal controls over financial reporting (ICFR).1 While various consequences of this requirement have received attention in the academic literature (e.g., Zhang , Gao, Wu, and Zimmerman ), our understanding of the effectiveness of SOX 404 reports in identifying existing control weaknesses has remained limited. In this paper, we study a sample of firms that correct misstatements in their financial reports in order to provide systematic evidence on two related questions. First, how effective are SOX 404 reports in providing advance warning of these impending accounting problems? Second, what are the determinants of the relative effectiveness of those reports?
From a public policy perspective, for SOX 404 to successfully assuage investor skepticism regarding the reliability of financial statements, it should be the case that those reports contain meaningful information (i.e., firms are not reporting that their internal controls are effective when they are ineffective).2 However, various commentators have cited instances of apparent failures to identify existing weaknesses in practice and questioned the overall reliability of ICFR reports (e.g., Glass Lewis , IMA , SEC [2009b]). Moreover, academic research on the causes and consequences of ineffective internal controls has typically taken firms’ public reporting on their internal controls at face value. Evidence on the reliability of those reports and the factors that influence it should be important considerations for future research studying ICFR.
Our research design centers on constructing a sample of firms where internal control weaknesses exist and then observing whether or not those weaknesses are reported as required by SOX 404. Thus, our focus is on the factors that influence the reporting of control weaknesses, rather than their existence.3
Under the reporting standards for SOX 404, ICFR are only to be deemed effective if no material weaknesses exist, where material weaknesses are defined as cases in which the likelihood of a material misstatement remaining undetected in the financial statements is at least reasonably possible (i.e., more than remote) (Auditing Standard No. 5 (AS5), paragraphs 2 and A7). Accordingly, we first identify firms that restate previously issued financial statements to correct misstatements in the original reports, as these firms are likely to have had control weaknesses at the time of the misstatements. We then refine the set of restating firms by examining the control-related disclosures issued in the aftermath of each restatement and retaining only those that are linked to an underlying control weakness. This process ensures that all of our sample firms have material weaknesses at the time of their misstatements, which allows us to focus directly on whether or not those weaknesses are originally reported as intended under SOX 404.
For a material weakness to exist but not be reported implies that either management and the auditor do not detect the weakness, or they detect it but opt not to disclose it (Ashbaugh-Skaife, Collins, and Kinney ).4 Accordingly, we study several factors expected to be associated with managers’ and auditors’ abilities to detect and incentives to disclose control weaknesses. These include the firm's external financing needs, size, financial health, recent managerial turnover, the occurrence of previous restatements and control weaknesses reported prior to SOX 404, and several factors related to the outside auditor, including the size of the audit firm, auditor effort, non-audit fees paid to the auditor, and recent auditor switches. Our primary analysis follows previous ICFR research in modeling detection and disclosure as a single, combined process that determines the ultimate reporting outcome. This leads to a standard probit specification with the reporting outcome as the dependent variable and the factors mentioned above as independent variables.
We also conduct analyses that provide evidence on the particular channel through which each of the factors affects the ultimate reporting outcome (i.e., through either detection or disclosure, or both), thus enabling sharper interpretations of each factor's role. To enhance robustness, we conduct two such analyses, each of which utilizes a different approach to dealing with the partial observability inherent in our setting (only the final reporting outcome is observable, not the underlying detection and disclosure processes). For the first analysis, we employ a bivariate probit model that explicitly accommodates partial observability. This approach, detailed in section 4.3, allows us to specify separate models of detection and disclosure and then estimate these models jointly based on the observable reporting outcome.
For the second additional analysis, we estimate the separate disclosure model on a subsample of firms for which detection is likely to have occurred. For firms where detection occurs, the reporting outcome reduces to a question of disclosure. This allows us to separately examine the disclosure process for this subsample and provides an alternative approach to overcoming the partial observability problem. We identify this subsample using the Hennes, Leone, and Miller  restatement classification scheme to isolate “irregularities,” which represent intentional misstatements, as opposed to unintentional errors. Managers making intentional misstatements are likely to be aware of the weaknesses in the controls being circumvented. Thus, we argue that detection has likely occurred for these firms.
Our results suggest that a large proportion of firms with material weaknesses fail to report those weaknesses in a timely manner. Only 32.4% of our sample firms report the existence of a material weakness during the misstatement period, as opposed to reporting it later, after the need for a restatement has been announced. Moreover, this proportion is decreasing over time, reaching a low of 13.6% in the most recent of the five years in our sample. Thus, despite being subject to outside audit, only a minority of these SOX 404 reports provide any advance warning of the possibility of impending accounting problems. Put differently, for the majority of restating firms, the internal control weaknesses that led to those restatements are reported only after the restatements themselves have already been disclosed. These results provide some support to criticisms that the reporting of internal control weaknesses has sometimes been ineffective in practice (e.g., Turner and Weirich ), and suggest that interpreting the recent decline in reported material weaknesses as prima facie evidence of improvements in underlying internal control practices is likely premature (e.g., SEC [2009b], Whitehouse [2009, 2010]).5
Regarding determinants of the reporting of existing weaknesses, we find evidence of several factors related to both the detection and disclosure of control weaknesses. Firms in need of raising external capital are less likely to report existing weaknesses, suggesting the existence of capital market–based incentives to avoid disclosure. This result is consistent with recent evidence that reported control problems lead to higher costs of capital (Ashbaugh-Skaife et al. , Costello and Wittenberg-Moerman ), such that managers who expect to raise outside capital have incentives to be less forthcoming about control weaknesses, much like similar considerations can lead to earnings management (e.g., Dechow, Sloan, and Sweeney ). Larger firms are also less likely to report existing weaknesses. To the extent that capital market pressures (e.g., Richardson, Tuna, and Wu ), auditor acquiescence (McKeown, Mutchler, and Hopwood ), and the complexity of the control environment are increasing in firm size, our results suggest that, on average, such factors outweigh any resource or scale advantages related to size.
Firms with accounting losses, prior restatements, and control weaknesses previously reported prior to SOX 404 (i.e., under SOX 302, when control opinions were not yet subject to outside audit) are more likely to report existing weaknesses. These results are consistent with additional scrutiny being placed on firms in poor financial health or that have a history of accounting and control problems. Firms with recent auditor changes are also more likely to report their weaknesses, consistent with auditors having incentives to avoid sharing the blame for the existence of control issues (Hermanson, Krishnan, and Ye ) and being more likely to push for disclosure when the underlying control problems can be attributed to a previous auditor. Similar results also obtain for firms with recent managerial changes; firms with recent CFO or CEO turnover are more likely to report their existing control weaknesses.
Larger audit fees are also associated with a greater likelihood of reporting existing weaknesses, consistent with greater auditor effort being positively associated with the likelihood of detection. In contrast, non-audit fees paid to the outside auditor are negatively associated with the likelihood that existing weaknesses are disclosed, perhaps due to their effect on auditor objectivity.
We also find that clients of Big 4 auditors are less likely to report existing weaknesses. However, generalizing this result beyond our sample of restating firms should be done with care due to the direct role that auditors play in certifying the reliability of the associated financial statements. Given previous evidence that larger auditors tend to provide higher quality financial statement audits (see Francis  for a review), larger auditors may be better able to “audit around” control weaknesses and avoid the misstatements that would lead to inclusion in our sample.
More generally, the results of this study should be viewed in light of the sample we employ, which centers on restating firms as a way to identify the existence of control weaknesses. Given the nonrandom nature of such a sample, the generalizability of our results to other firms (i.e., those without restatements) is unclear. We note, however, that while our focus is on firms with financial statements that are later deemed to be unreliable, this is precisely the group that internal control reporting is intended to help investors identify. Thus, research design advantages aside, we believe this is an inherently important population to study.
The remainder of this paper is organized as follows. The next section reviews the regulatory setting and related literature. Section 3 develops our research design and details our sample selection. Section 4 reports our empirical results. Section 5 summarizes and concludes.
2. Background and Related Literature
2.1 regulatory background
SOX 404 became effective November 15, 2004, requiring that “accelerated” filers and their auditors provide an annual opinion as to the effectiveness of ICFR.6 Under SOX 404, any material weaknesses detected by management or the auditor are required to be disclosed in the annual report and ICFR are to be concluded ineffective. The reporting of material weaknesses is intended to provide advance warning to market participants that the possibility of material misstatements remaining undetected is more than remote.7
Prior to the effective date of SOX 404, firms began reporting on internal controls quarterly under SOX 302, which became effective August 29, 2002, and applied to all registrants. We focus our investigation on SOX 404, rather than SOX 302, for a number of reasons. First, the exact reporting requirements related to material weaknesses are somewhat ambiguous under SOX 302 (Doyle, Ge, and McVay [2007b]), while disclosure is clearly mandated under SOX 404. Second, SOX 404 reports are subject to additional documentation requirements as well as the scrutiny of the independent auditor, which should increase the probability of existing weaknesses being detected and disclosed. Third, much of the controversy surrounding SOX relates to the costs associated with having ICFR audited under SOX 404.
2.2 related literature
The closest antecedents to our paper are Doyle, Ge, and McVay [2007b] and Ashbaugh-Skaife, Collins, and Kinney . These studies examine firm characteristics associated with reported internal control deficiencies and find that organizational complexity, major organizational changes, and relative investments in controls are all significant factors. Doyle, Ge, and McVay [2007b] focus solely on the existence of underlying control risks and take ICFR opinions at face value, assuming that firms with no reported material weaknesses have effective internal controls.8 More recent evidence, however, suggests that this assumption is unlikely to be descriptive. For example, a recent PCAOB inspection of ICFR audits conducted by the eight largest public accounting firms noted several instances of auditors ignoring risk levels when selecting controls to be tested, failing to test system-generated data on which controls were dependent, and not gathering sufficient evidence to conclude whether controls were operating effectively (PCAOB ). More generally, the number of firms restating financial statements to correct material errors in recent years has outpaced the number of firms reporting material weaknesses in ICFR (Plumlee and Yohn ).9 In contrast to Doyle, Ge, and McVay [2007b], our focus is not on the existence of control weaknesses, but instead on the determinants of whether or not they are reported in cases where they do exist.
Ashbaugh-Skaife, Collins, and Kinney  include various incentives to report existing ICFR deficiencies in their model, but study the pre–SOX 404 time period when firms were reporting under SOX 302. As argued above (and as noted by Ashbaugh-Skaife, Collins, and Kinney ) the reporting requirements were more ambiguous prior to SOX 404 and, more importantly, reports were not subject to formal audit. As such, it is not clear that as much latitude exists over the reporting of weaknesses in the SOX 404 era. In addition, the reporting incentive results in Ashbaugh-Skaife, Collins, and Kinney  are difficult to interpret because their research design does not distinguish between firms with and without underlying control weaknesses (Leone ). Because our design isolates firms with existing weaknesses, we are able to focus directly on the determinants of reporting decisions.
Other recent research provides evidence on the consequences of underlying control risks. Several studies document that firms with reported weaknesses are more likely to have subsequent restatements, which is consistent with control weaknesses increasing the likelihood of misstatements (e.g., Li and Wang , Hoitash, Hoitash, and Bedard , Audit Analytics , Nagy , Feng and Li ). Similarly, control weaknesses have also been shown to be negatively associated with accruals-based measures of earnings quality (Doyle, Ge, and McVay [2007a], Ashbaugh-Skaife et al. , Bedard ). Feng, Li, and McVay  show a negative association between internal control quality and errors in managerial earnings forecasts, suggesting that poor controls also adversely affect the quality of internal firm information. Other work examines capital market–based consequences of internal control problems. Beneish, Billings, and Hodder  and Hammersley, Myers, and Shakespeare  report evidence of negative stock market returns surrounding the announcement of internal control weaknesses, and Ashbaugh-Skaife et al.  and Costello and Wittenberg-Moerman  provide evidence that firms reporting internal control problems face higher costs of equity and debt capital, respectively.10 Taken as a whole, these studies suggest that the effectiveness of internal controls is associated with the quality of financial reporting and leads to capital market consequences.
3. Research Design
3.1 identifying firms with material weaknesses
We begin with a set of firms that restate previously issued financial statements to correct misstatements in the original reports. The notion that misstatements are indicative of internal control problems has longstanding support in both the academic and practitioner literatures. In their study on the determinants of quarterly earnings restatements, Kinney and McDaniel  argue that the need to correct a misstatement implies a breach of a firm's internal control system (see also DeFond and Jiambalvo  and McMullen, Raghunandan, and Rama ). Leone [2007, p. 234] makes a similar argument and points out that the PCAOB standards for auditing ICFR explicitly identify restatements as a “strong indicator that a material weakness in internal control over financial reporting exists.” This sentiment is also echoed by Turner and Weirich , who conclude the following about restating firms:
If these companies’ internal controls really had no weaknesses, why did the companies have errors that required restatements? Recall that PCAOB AS 2 defined a material weakness as a deficiency in internal controls that creates a “more than remote likelihood” that a material misstatement in the financial statements will go undetected. If a company restated, then a material misstatement did in fact go undetected, indicating the company's internal controls must have had at least one weakness. (p. 17, emphasis in original)
Consistent with these arguments, we use restatements as a starting point to identify a sample of firms that likely have existing material control weakness during the restated period(s). The existence of a misstatement alone, however, does not strictly imply the existence of a material weakness. For example, firms may correct relatively minor errors that do not rise to a level that they view as justifying a material weakness. Likewise, the PCAOB allows for the possibility of “extenuating or unique circumstances” in which a misstatement does not necessitate the existence of a material weakness (PCAOB , paragraph E97).11 Accordingly, we conduct an additional round of screening by manually examining firms’ control-related disclosures following their restatements and eliminating observations that are not clearly identified as the manifestation of control problems (described in detail below). Thus, our final sample of restatements includes only observations for which we could verify that control weaknesses do indeed exist. We then match this sample of restatements to the SOX 404 reports issued along with the original (misstated) financial statements to determine whether or not the underlying weaknesses were reported during the misstatement period.
Our restatement data are from Audit Analytics, which identifies the initial announcement date as well as the beginning and ending dates of the period being restated (i.e., the misstatement period). Table 1 details the sample selection process. We begin by extracting all restatements announced by the end of 2009 with misstatement periods that include annual reporting periods ending after the effective date of SOX 404, November 15, 2004. We then match these restatements to the corresponding internal control reports (also from Audit Analytics) issued during the misstatement periods, which results in 1,077 restatement observations with matching internal control reports. For individual firms that have multiple restatements during our sample period, we keep only the first instance for each firm and eliminate any subsequent restatements (193 observations). We also eliminate observations without all necessary information to construct the variables in our model (218 observations).
Sample Selection and Composition
|Restatement observations with corresponding SOX 404|| || |
| reports from Audit Analyticsa|| ||1,077|
|Keep only first announced restatement for firms with|| || |
| multiple restatements|| ||(193)|
|Missing information necessary to construct variables in|| || |
| primary model|| ||(218)|
|Firms reporting that restatement was not attributable to|| || |
| ineffective internal controlsb|| ||(39)|
|Firms not explicitly reporting on link between restatement|| || |
| and internal controls|| ||(139)|
|Panel B: Sample composition|
|Firms that report ineffective controls during the|| || |
| misstatement period|| ||158|
|Firms that acknowledge existence of material weaknesses|| || |
| in aftermath of the restatementb||263|| |
|Firms that acknowledge material weaknesses related to the restatement did exist, but have been remediated by the|| || |
| time of the next SOX 404 report after the restatementb||67|| |
|Firms that acknowledge ineffective controls only after|| || |
| restatement is announced|| ||330|
We then verify that each of the remaining restatements is attributable to an underlying material weakness in ICFR. For all firms that claimed to have effective ICFR during their misstatement periods, we read the control-related disclosures issued in the aftermath of their restatements to determine whether they subsequently acknowledge or deny the existence of a material weakness. For the firms that did report material weaknesses during their misstatement periods, we first attempt to link the particular type of misstatements being corrected with the type of control weaknesses that were originally reported (e.g., a revenue restatement and a reported weakness in controls over revenue). For those where a clear link is not obvious (e.g., the reported control weaknesses are firm-level in nature, rather than account-level), we follow the same process as for those firms that initially claimed their ICFR were effective and read the control-related disclosures issued following the restatement. As detailed in table 1, another 39 firms report that their restatements were unrelated to internal control issues and, accordingly, we remove them from the sample. The remaining 139 firms never explicitly acknowledge or deny a link between their restatement and internal controls. Because it is ambiguous as to whether or not their restatements are attributable to control weaknesses, we remove these firms as well.12 Thus, our final sample (488 observations) is comprised of only those restatements that are definitively linked to underlying control weaknesses. Representative examples of the various types of subsequent control disclosures are provided in appendix A.
Of the 488 firms in our sample, 158 report the existence of control weaknesses during their misstatement periods. Of the other 330 that report effective ICFR during their misstatement periods, 263 subsequently acknowledge the existence of control weaknesses in the aftermath of their restatements, and another 67 report that material weaknesses did exist during the misstatement period but have since been remediated. Thus, despite initially reporting effective controls, material weaknesses clearly existed for these 330 firms as well, and, accordingly, our final sample allows us to study the determinants of weakness reporting.
3.3 determinants of the reporting of existing material weaknesses
For our sample of firms with existing weaknesses, if a firm reports that ICFR are effective, it implies that either the weakness is not discovered by management and the auditor, or it is discovered but they opt not to disclose it. Accordingly, we model the reporting of existing weaknesses as a function of factors expected to affect detection and/or disclosure.
We first consider the impact of prior financial reporting problems and expect previous restatements to be a significant factor in detecting existing control weaknesses. Previous restatements imply that management and the auditor have recognized past accounting problems as well as, presumably, the conditions that led to those problems, increasing the likelihood of detection. Previous restatements might also affect disclosure, because the PCAOB's auditing guidance explicitly considers previous restatements as indicators of material weaknesses. Thus, market participants likely expect that weaknesses exist for firms with recent restatements, making it more difficult for such firms to justify avoiding the disclosure of a control weakness.13 We expect that firms with previous restatements are more likely to report existing control weaknesses, and capture this effect with PRIOR RESTATE, a binary variable that indicates whether or not a firm had any previous restatements between 2000 and the beginning of SOX 404 in 2004.14
We also consider firms’ previous internal control disclosures under SOX 302, prior to becoming subject to audit under SOX 404. Disclosing a weakness under SOX 302 demonstrates management's ability to detect and willingness to disclose control weaknesses in a more ambiguous regulatory environment. It also suggests that management is more likely to be aware of existing control problems. Moreover, firms that did not report material weaknesses under SOX 302 may face reputational costs associated with reversing that opinion once the controls are subject to the additional scrutiny of an outside auditor (e.g., Martinek ). Thus, the previous disclosure of material weaknesses is expected to increase the likelihood of both detection and disclosure. We include MW302, an indicator variable set to one if the firm previously disclosed a material weakness under SOX 302 (prior to SOX 404), and zero otherwise, and expect it to be positively associated with the reporting of existing material weaknesses under SOX 404.
Larger firms may enjoy economies of scale and have superior resources to dedicate to internal control testing, thereby increasing the likelihood of detection. However, larger firms are also likely to have more complex organizational and reporting structures that may increase the difficulty of detecting control weaknesses; thus, the effect of firm size on detection is unclear. Firm size may also affect disclosure incentives if, for example, larger firms have higher public profiles and are subject to greater pressures from capital market participants (Richardson, Tuna, and Wu ), or if auditors are more likely to acquiesce to larger clients (e.g., McKeown, Mutchler, and Hopwood ). Thus, larger firms may have incentives to be less forthcoming about existing control weaknesses, suggesting a negative association between firm size and disclosure. We measure firm size as the natural log of market value of common equity at the end of the final year of the misstatement period (SIZE). Due to the conflicting effects described above, we do not predict an expected sign.
Firms in poor financial health may lack the necessary resources to conduct adequate tests of internal controls, making them less likely to detect existing weaknesses. In addition, some prior research argues that managers of firms in financial distress have greater incentives to mislead (e.g., Lys and Watts ), suggesting firms in poor financial health may also be less likely to disclose their control weaknesses. However, there are likely greater litigation- and reputation-based concerns surrounding firms in poor financial health, particularly for the auditor, and thus the overall effect on incentives to detect and disclose is unclear. We proxy for poor financial health using LOSS, an indicator variable set to one if the firm reports a loss (negative income before extraordinary items), and zero otherwise, during the final year of the misstatement period.15 Because the net effect of poor financial health is theoretically ambiguous, we do not predict an expected sign for LOSS.
Capital market–based pressures are likely to be especially strong for firms that intend to access external capital in the near future, which could affect the disclosure of existing control weaknesses. Recent research provides evidence that reported internal control problems are associated with higher costs of both equity (Ashbaugh-Skaife et al. ) and debt capital (Costello and Wittenberg-Moerman ), which provides incentives for managers of firms in need of capital to be less forthcoming about existing control weaknesses. With no reason to expect an effect on detection abilities, we expect external financing needs to reduce the likelihood of disclosure and thus be negatively associated with the reporting of existing weaknesses. Because a manager's intent regarding future financing activities is not directly observable, we use an ex post measure of actual financing activity during the first year subsequent to the misstatement period to proxy for that intent. We follow Bradshaw, Richardson, and Sloan  and use ΔXFIN to measure firms’ capital market activities as the net change in their external financing. Specifically, ΔXFIN is the sum of net cash received from equity (cash received from stock issuance less cash used in stock repurchases and dividend payments) and net cash received from debt (cash received from debt issuance less cash used in reduction of debt), scaled by average total assets.16
Due to the attestation requirement under SOX 404, we expect the outside auditor to play a role in the reporting of internal control weaknesses. In particular, higher quality audits should increase the likelihood that existing weaknesses are detected. Previous research provides evidence consistent with larger audit firms providing higher quality audits (e.g. Teoh and Wong , Becker et al. ) and, thus, we expect the presence of a large audit firm to be positively associated with the detection of existing control weaknesses (we have no expectations regarding disclosure). We set BIG4 equal to one if a SOX 404 opinion was supplied by any of the largest four audit firms (Deloitte, Ernst and Young, KPMG, PricewaterhouseCoopers) during the misstatement period, and zero otherwise, and expect it to be positively associated with the reporting of existing weaknesses.
We also expect greater audit effort to be positively associated with the detection of control weaknesses. Prior research suggests that greater audit effort can curb earnings management (Caramanis and Lennox ), and we expect a similar effect for internal control reporting, as greater audit effort increases the probability that existing control weaknesses are detected and could also reflect an increase in substantive testing necessitated by the lack of effective controls. We proxy for audit effort using AUDIT FEES, measured as audit-related fees paid during the final year of the misstatement period scaled by the square root of total assets (e.g., Kinney, Palmrose, and Scholz ). With no reason to expect an offsetting effect on disclosure incentives, we expect audit effort to increase the likelihood of detection and thus predict a positive association between AUDIT FEES and the reporting of existing weaknesses.
Non-audit services provided by the audit firm also have the potential to affect internal control reporting, either through knowledge spillover effects (suggesting a positive effect on the likelihood that existing weaknesses are detected) or by compromising auditor independence (suggesting a negative effect on the likelihood that detected weaknesses are disclosed). We capture these potential effects with NONAUDIT FEES, measured as non-audit-related fees paid to the audit firm during the final year of the misstatement period scaled by the square root of total assets. Prior research has examined the competing audit quality effects of non-audit services in other, general financial reporting settings. The extant evidence is largely mixed (e.g., Frankel, Johnson, and Nelson , Ashbaugh, LaFond, and Mayhew , Kinney, Palmrose, and Schloz ), and, thus, we do not predict the sign for NONAUDIT FEES.
We expect that recent auditor switches might impact the disclosure of control weaknesses. Hermanson, Krishnan, and Ye  examine the link between adverse SOX 404 opinions and shareholder dissatisfaction towards auditors and find that shareholders are less likely to vote for auditor ratification following an adverse SOX 404 opinion. The authors interpret these results as suggesting that shareholders view auditors as partly responsible for the existence of control problems. Consistent with this notion, Ettredge et al.  find that auditors are more likely to be dismissed after issuing an adverse SOX 404 opinion. Thus, continuing auditors might have incentives not to push the disclosure of existing weaknesses. We expect, however, that any such incentives are weaker for newly engaged auditors, who can shift the blame for the existence of control weaknesses onto the previous auditor.17 Accordingly, we include AUDITOR CHANGE, an indicator variable for whether or not the firm switched auditors within the two-year window prior to the end of the misstatement period, and expect it to be positively associated with disclosure incentives, and thus with the reporting of existing weaknesses.18
For similar reasons, we also examine recent managerial turnover and expect that new managers are more likely to disclose existing weaknesses because they can more easily deflect blame for the underlying existence of the weaknesses to their predecessors. Similar to AUDITOR CHANGE, MGT CHANGE is an indicator variable based on whether or not changes in either CEO or CFO occurred during the two-year window prior to the end of the misstatement period.
In summary, we argue that the reporting of existing material weaknesses in ICFR under SOX 404 is a function of several determinants that influence managers’ and auditors’ abilities to detect and incentives to disclose those weaknesses. To provide empirical evidence, we estimate the following probit model:
where REPORT ICW is an indicator variable for whether or not the material weakness was reported under SOX 404 during the misstatement period and the independent variables are as described above. We also include SOXYEAR, which represents the number of years since the inception of SOX 404, to control for any trends over time in control reporting.19 Precise variable definitions, including data sources, are provided in appendix B.
4. Empirical Results
4.1 descriptive statistics
Table 2 shows the percentage of sample firms that report material weaknesses during their misstatement period (i.e., the mean value of REPORT ICW). Despite being subject to outside audit under SOX 404, only 32.4% report their existing weaknesses. Looking across years, the percentage is highest in the initial year of SOX implementation and declines monotonically, reaching its lowest point in the final sample year. Interestingly, this decreasing trend does not appear to be consistent with firms and their auditors improving the effectiveness of internal control reporting over time. Instead it suggests that interpreting declining overall rates of ineffective internal control opinions as general evidence of improving internal control practices is likely premature (SEC [2009b]). Our evidence indicates that a large proportion of restatements linked to control problems are for firms originally reporting that their internal controls were effective at the time of the misstatements, and that this proportion has not diminished over time.20
Proportions of Restating Firms That Report Internal Control Weaknesses at the Time of Original (Misstated) Financial Statements
In table 3, panel A, we present distributional statistics for the regression variables. As expected for a group of accelerated filers, our sample firms tend to be relatively large, with a median value for SIZE of 6.407 (that translates to $606 million in market capitalization), and the majority (84%) employ one of the largest audit firms. About 31% of sample firms report an accounting loss, 12% have recent auditor changes, and 46% have management changes.
|NONAUDIT FEES||13.182||22.423||1.741||6.171||15.382||13.374||> <||13.090||9.612|
|Observations||488|| || || || ||158|| ||330||9,249|
|(1) PRIOR RESTATE||0.287||−0.097||0.121||0.060||−0.068||0.225||0.061||0.075||0.018|
|(2) MW302|| ||−0.043||0.125||0.055||−0.040||0.332||0.105||0.043||0.041|
|(3) SIZE|| || ||-0.333||-0.113||0.337||0.018||0.066||−0.193||−0.101|
|(4) LOSS|| || || ||0.146||−0.085||0.208||0.118||0.077||0.146|
|(5) ΔXFIN|| || || || ||−0.144||0.029||0.158||0.091||0.019|
|(6) BIG4|| || || || || ||0.067||0.140||−0.257||0.004|
|(7) AUDIT FEES|| || || || || || ||0.378||0.097||0.207|
|(8) NONAUDIT FEES|| || || || || || || ||0.080||0.114|
|(9) AUDITOR CHANGE|| || || || || || || || ||0.020|
|(10) MGT CHANGE|| || || || || || || || || |
We also compare the variables across groups based on whether or not firms report internal control weaknesses. Reported weaknesses are more likely for firms with prior restatements (PRIOR RESTATE), material weaknesses previously reported under SOX 302 (MW302), higher audit fees (AUDIT FEES), accounting losses (LOSS), auditor changes (AUDIT CHANGE), and management changes (MGT CHANGE), and less likely for larger firms (SIZE) and those with the largest auditors (BIG4). The differences across groups for changes in external financing (ΔXFIN) and non-audit fees (NONAUDIT FEES) are not statistically significant. Taken as a whole, these differences suggest that many of the potential factors we identify are associated with the reporting of existing control weaknesses. These simple univariate comparisons, however, do not control for the other associated factors. Accordingly, we base our formal inferences on the regression results in the next section.
For comparative purposes, in the final column in panel A of table 3 we also provide descriptive statistics for a sample of nonrestating firms. Ideally, this comparison group would consist of all nonrestating firms that have existing control weaknesses. However, among nonrestating firms we are unable to observe whether such weaknesses exist without appealing to their SOX 404 reports (i.e., we cannot identify unreported weaknesses). Thus, the comparison group is comprised of all accelerated filers without any restatements during the SOX 404 era, and includes all such firm-years with the necessary information to construct our variables. Relative to our sample, the nonrestating firms tend to be somewhat larger and have lower audit and non-audit fees. These firms are also less likely to report a loss, or to have had a restatement or control weakness reported prior to the SOX 404 era.21 While it is unclear what proportion of the comparison group actually has existing control weaknesses, these differences nevertheless suggest that caution should be used in generalizing our results to other, nonrestating firms.
We provide Pearson correlations between the regressors in table 3, panel B. These correlations are largely consistent with intuition. For example, larger firms tend to employ larger auditors and be more financially stable; SIZE is positively correlated with BIG4 and negatively correlated with LOSS. Firms with previous restatements are also more likely to have reported a material weakness under SOX 302; PRIOR RESTATE is positively correlated with MW302. Audit fees tend to be higher for firms with previous restatements and material weaknesses under SOX 302; AUDIT FEES is positively correlated with PRIOR RESTATE and MW302.
4.2 regression results
In table 4 we present our primary regression results. Along with coefficient estimates and standard errors, we also provide estimated marginal effects for each variable. The reported marginal effects are averages of the individual marginal effects evaluated at every observation in the sample (Bartus , Greene ).22
Determinants of the Reporting of Existing Internal Control Weaknesses under SOX 404
|Likelihood ratio, chi-square|| ||124.41***|| || |
|Pseudo-R2|| ||0.202|| || |
|Observations|| ||488|| || |
As expected, the estimated coefficients on PRIOR RESTATE and MW302 are both positive, and the corresponding marginal effects indicate that firms with prior restatements and firms that previously reported material weaknesses under SOX 302 are about 8.8 and 15.5% more likely to report existing material weaknesses under SOX 404, respectively. These results are consistent with those of Ashbaugh-Skaife et al. , who also find prior restatements are positively associated with the reporting of internal control weaknesses.
The estimated coefficient on SIZE is negative (marginal effect =−0.0263), indicating that larger firms are less likely to report their existing control weaknesses. Doyle, Ge, and McVay [2007b] and Ashbaugh-Skaife, Collins, and Kinney  also report that firm size is negatively associated with reported control deficiencies; however, because neither of those studies distinguishes between the existence and the disclosure of control problems, they both view size as a proxy for investment in internal controls and interpret their results as evidence that underlying control problems are less likely to exist in larger firms. Our results, by contrast, indicate that, when control weaknesses do exist, larger firms are less likely to report those weaknesses. To the extent that capital market pressures (e.g., Richardson, Tuna, and Wu ), auditor acquiescence (McKeown, Mutchler, and Hopwood ), and the complexity of the control environment are increasing in firm size, our results suggest that, on average, such factors outweigh any resource or scale advantages related to size.23
The estimated coefficient on LOSS is positive (marginal effect = 0.1624), suggesting that the incentives for additional scrutiny that surround firms in poor financial health outweigh any corresponding reduction in resources available for internal control testing. This variable also provides an interpretation that contrasts with Doyle, Ge, and McVay [2007b] and Ashbaugh-Skaife, Collins, and Kinney . Both of those papers interpret the association between financial health and reported control deficiencies as evidence that firms in poor financial health are more likely to have underlying control problems. In contrast, because all firms in our sample have known control problems, we interpret our results to imply that firms in poor financial health are more likely to report the weaknesses that do exist.
Capital market pressures stemming from firms’ impending external financing needs also appear to be associated with the likelihood that existing control weaknesses are reported. The estimated coefficient on ΔXFIN is negative, consistent with firms being less forthcoming about disclosing control problems that could lead to increases in the cost of the capital they intend to access. As a gauge of economic significance, moving ΔXFIN from its first quartile value to its third quartile value, while holding all other variables constant at their means, implies a 3.3% decrease in the likelihood of existing weaknesses being reported.24
Contrary to our expectations, the estimated coefficient for BIG4 is negative, indicating that clients of the largest audit firms are less likely to report material weaknesses. While this result could be viewed as consistent with the largest audit firms providing lower quality internal controls audits, we are cautious about drawing this inference due to the conditional nature of our sample. In particular, given previous evidence that larger audit firms tend to provide higher quality financial statement audits (e.g., Teoh and Wong , Becker et al. ), it is possible that larger auditors are better able to “audit around” existing weaknesses and avoid misstatements in the financial reports that would lead to restatements and inclusion in our sample. As such, care should be used in generalizing this result to firms without restatements.
The estimated coefficient on AUDIT FEES is positive, which is consistent with greater audit effort leading to an increased likelihood of detecting existing control weaknesses. Moving AUDIT FEES from its first quartile value to its third quartile value, while holding all other variables constant at their means implies a 10.4% increase in the likelihood of existing weaknesses being reported. In contrast, the estimated coefficient on NONAUDIT FEES is negative, which is consistent with decreased auditor objectivity outweighing, on average, any benefits from knowledge spillovers in this particular setting. The likelihood of existing weaknesses being reported decreases by 4.3% as NONAUDIT FEES moves from its first quartile value to its third quartile value, holding all other variables constant at their means.
As expected, recent auditor and management changes are both positively associated with the likelihood of existing material weaknesses being reported. The estimated marginal effects for AUDITOR CHANGE and MGT CHANGE are 10.6% and 10.0%, respectively, consistent with an increased likelihood of control weakness disclosure when it is easier for auditors and management to deflect blame for the existence of those weaknesses on their predecessors.
The estimated coefficient on SOXYEAR is negative and significant, indicating that the trend of decreased reporting of existing control weaknesses shown in table 2 continues to hold after controlling for the other factors in our model.
Taken as a whole, the results reported in table 4 are largely consistent with our initial predictions and provide evidence that the reporting of existing weaknesses in ICFR is affected by various factors related to detection and disclose incentives.
4.3 additional analyses
Our primary analysis in the preceding section follows previous literature (Ashbaugh-Skaife, Collins, and Kinney ) in modeling the detection and disclosure of control weaknesses as a single underlying process. Detection and disclosure, however, may also be viewed as separate and sequential processes: the firm first undertakes the detection process and then, conditional on detecting the material weakness, undertakes the disclosure decision process. This view suggests the importance of discriminating between the detection and the disclosure processes, as they are different inputs to the reporting outcome. Formally,
where DETECT ICW and DISCLOSE ICW are indicators for whether the weakness is detected and disclosed, respectively.
Modeling detection and disclosure as separate processes is complicated by the fact that the intermediate outcomes are only partially observable to the researcher. That is, REPORT ICW=DETECT ICW x DISCLOSE ICW, but only the final outcome, REPORT ICW, is observed. Thus, when a firm fails to report an existing weakness, we cannot observe whether it is due to a failure to detect or a failure to disclose.
We conduct two analyses to help discriminate between detection and disclosure, and thus provide evidence on the specific channel(s) through which each variable from our main model affects the ultimate reporting outcome. The key idea behind both analyses is that, because the disclosure process is conditional on detection (see equation (2)), overcoming the partial observability problem requires some method of identifying detection. The difference between the two analyses is in the approach to achieving that identification. The first approach uses a statistical method that involves modeling the factors that are expected to affect detection. The second approach isolates a subsample for which detection can reasonably be assumed to have occurred. Because each approach has its own merits, we conduct both analyses to help gauge the robustness of the results.
For the first of these analyses, we model detection and disclosure as separate underlying processes and then estimate those models jointly using a bivariate probit approach that accommodates partial observability.25 To develop the partial observability model for our setting, let X1 be a vector of factors that affect detection and X2 be a vector of factors that affect disclosure. Then let
be the processes that determine the likelihood of detection and disclosure, respectively, such that
Thus26, equation (2) becomes
From (5), it follows that the log-likelihood function is
and maximum likelihood can be used to estimate the parameter vectors β1 and β2.
Each variable from our primary analysis is assigned to either X1 or X2 (or both) according to the channel through which it is expected to affect control reporting (i.e., detection or disclosure). We base these assignments on the theory underlying the original motivation for each variable, as developed in detail in section 3.3 and summarized here:
Identification of the partial observability model requires that at least one variable differ between X1 and X2 (Maddala ). In our case, ΔXFIN, AUDITOR CHANGE, and MGT CHANGE appear only in the disclosure model, and BIG4 and AUDIT FEES appear only in the detection model.27 The choice to omit each of these variables from either the detection or disclosure stage of the estimation is based on a lack of theoretical support for inclusion. For example, as discussed in section 3.3, we have no theoretical reason to expect that firms seeking external financing would be more or less likely to detect control weaknesses, nor is there sufficient theory for why auditor or managerial turnover would impact the likelihood of detection. Similarly, while there is clear theoretical support for including BIG4 and AUDIT FEES in the detection model, we do not find sufficient justification for including these factors in the disclosure model.28
For the second analysis, rather than relying on a statistical identification of detection, we instead estimate the disclosure model on a subset of the sample for which detection is likely to have occurred. This approach is based on the observation that, when detection occurs (i.e., when DETECT ICW= 1), equation (2) collapses to Pr(REPORT ICW= 1) = Pr(DISCLOSE ICW= 1). In such cases, DISCLOSE ICW and REPORT ICW become equivalents and the separate disclosure model can be estimated using the observable outcome, REPORT ICW.
To identify a subset where detection is likely to have occurred, we follow Hennes, Leone, and Miller  and classify restatements as due to either irregularities or to errors. Because irregularities represent “intentional misreporting” (Hennes, Leone, and Miller [2008, p. 1488]), it is likely that in such cases management is aware of the weaknesses in the controls being circumvented (recall that material weaknesses are defined as those that result in a “more than remote” possibility of material misstatement).29 Therefore, we assume that detection is likely to have occurred for those firms with restatements classified as irregularities and estimate the disclosure model on this subsample. This approach provides an opportunity to triangulate the partial observability approach, but is subject to the caveat that the sample is conditional on having an irregularity restatement and thus may not generalize to other firms.30
The results from the partial observability approach (both detection and disclosure models) as well as the irregularity subsample approach (disclosure model only) are reported in table 5. Beginning with the detection model, PRIOR RESTATE, MW302, and AUDIT FEES are all positively associated with detection, as expected. LOSS is also positively associated with detection, suggesting that increased incentives to detect problems for firms in poor financial health outweigh resource considerations. As in our primary results, the coefficient on BIG4 is negative. SIZE, NONAUDIT FEES, and SOXYEAR are insignificant in the detection model.
Determinants of Detection and Disclosure of Existing Internal Control Weaknesses
|ΔXFIN|| || ||−3.6920||1.8819**||−1.2268||0.5458**|
|BIG4||-0.8280||0.2425***|| || || || |
|AUDIT FEES||0.0107||0.0022***|| || || || |
|AUDITOR CHANGE|| || ||2.5487||2.0872||0.5456||0.2186**|
|MGT CHANGE|| || ||0.7734||0.4445*||0.4341||0.1450***|
|Likelihood ratio, chi-square|| ||145.91***|| ||85.24***|
|Pseudo-R2|| || 0.237|| ||0.169|
|Observations|| ||488|| ||409|
Turning to the disclosure model, we discuss the results from the two estimation approaches together and note differences where applicable. Under both approaches, LOSS and MGT CHANGE are positively associated with disclosure, and ΔXFIN and NONAUDIT FEES are negatively associated with disclosure, all consistent with expectations. MW302 and AUDITOR CHANGE have positive coefficients, as expected, for the irregularities sample, but both variables are insignificant in the disclosure stage of the partial observability model. The estimated coefficient for PRIOR RESTATE is positive for the irregularities sample, but is negative in the disclosure stage of the partial observability model. Thus, the positive association between PRIOR RESTATE and REPORT ICW documented in table 4 appears to be attributable, at least in part, to the effect of previous restatements on detection, while the evidence regarding their effect on disclosure is mixed. SOXYEAR is significantly negative in both estimations of the disclosure model, suggesting that the time trend observed in table 4 stems from a decline in the likelihood of disclosing weaknesses as we move further away from the initial promulgation of SOX. SIZE is insignificant in both estimations of the disclosure model.
Overall, the results of these additional analyses are generally consistent with our main results in table 4. More importantly, by discriminating between detection and disclosure, these analyses help to sharpen the interpretation of the main results by providing evidence on the specific channels through which each of the factors we study affects the ultimate reporting of control weaknesses.
5. Summary and Conclusion
In this paper, we examine the effectiveness of SOX 404 internal control reports in identifying existing material control weaknesses, as well as the determinants of the relative effectiveness of those reports across firms. While SOX 404 has received significant attention, largely due to the perceived burden of the associated compliance costs, how reliably the resulting reports identify weaknesses has remained largely overlooked in the academic literature. We address this void by studying a sample of firms that restate previously issued financial statements to correct misstatements and that can be identified as having had existing control weaknesses during the time of their misstatements. We examine the internal control reports that accompanied the original (misstated) financial statements to determine whether firms reported their control weaknesses as required. Thus, our paper differs from previous research such as Doyle, Ge, and McVay [2007b] and Ashbaugh-Skaife, Collins, and Kinney  in that we are able to separate the reporting of internal control weaknesses from their underlying existence. Because weaknesses exist for all of our sample firms, we are able to focus on the reporting of those weaknesses and thus provide evidence on the factors that affect detection and disclosure. We sharpen the interpretation of our evidence by also conducting analyses that distinguish between factors that affect detection versus those that affect disclosure.
Our results indicate that the majority of sample firms and their auditors fail to report existing control weaknesses and instead report that controls are effective. Only 32.4% report the existence of a material weakness in their SOX 404 reports during the misstatement period, and this proportion has declined over time. The usefulness of internal control reports in providing advance warning on the likelihood of misstatements in the financial reports is reduced if control weaknesses are not disclosed until after the misstatements themselves are later revealed. As such, it is important to understand the conditions that lead to the (non)disclosure of existing control weaknesses.
Despite the mandatory nature of material weakness reporting under SOX 404, our empirical evidence suggests that managers’ and auditors’ incentives to detect and disclose internal control problems play an important role in whether or not existing weaknesses are ultimately reported. In particular, we find that firms in need of external capital, larger firms, and firms that pay larger amounts of non-audit fees to their auditors are less likely to report their existing control weaknesses, consistent with these factors affecting managers’ and auditors’ incentives to disclose control problems. We also find that clients of the largest audit firms are less likely to report weaknesses, while poor financial health, previous financial reporting and control problems, greater auditor effort, and recent auditor and management changes are all positively associated with the reporting of existing control weaknesses under SOX 404.
The results of this study make several contributions to the literature. By documenting that SOX 404 reports are not always effective in identifying existing control weaknesses and, further, that the effectiveness has not improved over time, our results lend some support to criticisms of internal control reporting in practice (Turner and Weinrich ) and suggest that recent declines in reported material weaknesses may not be reflective of improvements in underlying control practices, consistent with concerns voiced by the SEC (SEC [2009b]). These results also inform recent debates over the value of requiring control reports to be audited (SEC , SEC [2009a], Kinney and Shepardson , Bedard and Graham ). Despite the audit requirement of SOX 404, our evidence indicates that the majority of restating firms provided no advance warning of the control problems that led to their misstatements. Finally, our results also have implications for future academic research. We document considerable variation in whether existing weaknesses are actually reported, and our evidence on the determinants of that reporting should be considered by future research using public disclosures to study internal control practices.
We close by noting that this study is subject to limitations. In particular, our focus on restating firms provides research design advantages but also presents a potential tradeoff in that the generalizability of our results to firms with control weaknesses that do not lead to restatements is unclear. This is particularly true of our results for Big 4 vs. non–Big 4 auditors because of the direct role that auditors play in certifying the reliability of financial statements (and thus in the likelihood of restatement). While restating firms are important to understand, future research could develop additional ways to identify (unreported) internal control weaknesses and extend this line of inquiry to other groups of firms.