Does SOX 404 Have Teeth? Consequences of the Failure to Report Existing Internal Control Weaknesses

Transcription

1 Does SOX 404 Have Teeth? Consequences of the Failure to Report Existing Internal Control Weaknesses Sarah Rice Texas A&M University David P. Weber University of Connecticut Biyu Wu University of Connecticut Abstract We identify a sample of firms with restatements attributable to underlying control weaknesses, some which had previously reported these weaknesses as required by SOX 404 and some of which acknowledged them only after announcing the related restatement. We then examine whether various penalties that could serve as enforcement mechanisms for SOX 404 differ across these two groups. We find no evidence that penalties are more likely for firms, managers, or auditors that fail to report existing control weaknesses. Instead, class action lawsuits, SEC sanctions, and management and auditor turnover are all more likely in the wake of a restatement when control weaknesses had previously been reported. These results are consistent with public disclosures of control weaknesses making it difficult for management to plausibly claim later that they had been unaware of the underlying conditions that led to misstatements. These results also suggest that the enforcement mechanisms surrounding SOX 404 are unlikely to provide strong incentives for compliance and offer a potential explanation for why most restatements are issued by firms that have previously claimed to have effective internal controls. We also find that investors appear to be more surprised by restatements for firms that previously claimed to have effective internal controls, as evidenced by more negative abnormal returns and larger abnormal trading volume around restatement announcements. These results suggest that unreliable SOX 404 reports are costly to investors by distorting their investment decisions. Keywords: Sarbanes-Oxley Act; internal controls; enforcement; restatements We appreciate helpful comments and suggestions from Jean Bedard, Daniel Cohen, Asher Curtis, Reuven Lehavy, David Papandria, Troy Pollard, Srini Sankaraguruswamy, Mike Willenborg, Sunny Yang, and workshop participants at the 2012 AAA Annual Meeting, the 2012 AAA Northeast Regional Meeting, University of Tennessee, Texas A&M University, Tulane University, University of Utah, and University of Waterloo.

2 I. INTRODUCTION In this paper we examine several potential consequences of failing to report existing control weaknesses as required by Section 404 of the Sarbanes-Oxley Act of 2002 (hereafter SOX 404). Our investigation is motivated largely by recent concerns about the reliability of SOX 404 reports and related evidence of firms claiming to have effective internal controls over financial reporting when they instead have material weaknesses in those controls (e.g., Turner and Weirich 2006; Glass Lewis 2007; IMA 2008; SEC 2009; Plumlee and Yohn 2010; PCAOB 2012; Rice and Weber 2012). Understanding the consequences of such reporting failures is important because it bears on managers and auditors incentives to detect and disclose internal control weaknesses, and thus on the effectiveness of SOX 404 in achieving its intended goal of boosting investor confidence in the reliability of financial reports. Under SOX 404, firms and their auditors are required to provide formal opinions on the effectiveness of internal controls over financial reporting within the annual 10-K filing. 1 Internal controls are only to be deemed effective if there are no material weaknesses, which are defined as control deficiencies that result in the likelihood of a material misstatement being more than remote (PCAOB 2004). If material weaknesses exist, they are required to be reported along with a description of their nature. This requirement, which was promulgated in the aftermath of several high profile accounting scandals, is intended to enhance investor confidence in the reliability of financial reporting by providing an early warning of the possibility of impending accounting problems (PCAOB 2004; Cunningham 2004). 2 1 We use SOX 404 to refer collectively to the requirements under 404(a) (management s report) and 404(b) (the auditor s report); our empirical analyses also focus on firms with both management and auditor reports. Nonaccelerated filers (firms with public float less than $75 million) are exempt from 404(b) and are thus excluded. 2 The Securities and Exchange Commission (SEC) notes that a central purpose of the assessment of internal control over financial reporting is to identify material weaknesses that have, by their very definition, more than a remote likelihood of leading to a material misstatement in the financial statements (SEC 2005). 1

3 However, the effectiveness of SOX 404 in providing advance warning of potential accounting problems is unclear, and concerns have begun to emerge about the reliability of SOX 404 reports. For example, the SEC has suggested that the decrease in reported control weaknesses in recent years could be due to material weaknesses not being identified or reported, as opposed to improvements in the underlying controls (SEC 2009; see also Whitehouse 2009, 2010). Consistent with that concern, the Public Company Accounting Oversight Board (PCAOB) recently reported that 22% of the internal control audits it reviewed for 2011 were deficient, as were 15% for 2010 (PCAOB 2012; see also Rapoport 2012). Practitioners have also questioned the vigor of enforcement, noting that the SEC eliminated its accounting fraud task force in a recent reorganization (e.g., McKenna 2012). 3 Recent evidence from academic research highlights similar concerns. Rice and Weber (2012) study a sample of firms with restatements stemming from underlying control weaknesses and find that only about one third of these firms report their weaknesses prior to the related restatements. Thus, in many cases investors are not warned that the possibility of a material misstatement in the financial reports is more than remote until after the need to correct such a misstatement has been announced. In addition, Plumlee and Yohn (2010) document that restatements have generally outpaced reported internal control weaknesses in recent years and suggest that many weaknesses likely go unreported. We extend this previous research by examining whether there are substantive consequences associated with the failure to report existing internal control weaknesses as required. Understanding these consequences is important because the evidence from previous 3 For example, Jack Ciesielski, owner of research firm R.G. Associates and publisher of The Analyst s Accounting Observer, is quoted in McKenna (2012, 46) arguing, SEC enforcement of Sarbanes-Oxley has been minimal. Sarbanes-Oxley may have brought us some peace for our time, but without vigilance through long-term enforcement, it can t last. 2

4 research suggests a potential disconnect between the intended goals of SOX 404 and the enforcement mechanisms that surround its implementation. 4 In our analyses we consider various legal, regulatory, and labor market-based penalties that could serve as potential enforcement mechanisms for SOX 404: class action lawsuits filed by investors, Accounting and Auditing Enforcement Releases (AAERs) issued by the SEC, top management turnover, and auditor turnover. In doing so, we consider both public and private mechanisms as well as penalties against the firm, its managers, and its auditor. Our analyses focus on a sample of firms that are subject to SOX 404 and also have restatements that we verify as resulting from internal control weaknesses. This sample has two important features. First, although control weaknesses existed at each of our sample firms at the time of the misstatement, many firms acknowledged their weaknesses only after announcing the need for a restatement. Because restatements provide a mechanism to (ex post) identify unreported control weaknesses, our design allows us to compare the consequences for firms that reported the existence of their control weaknesses in a timely manner with those that did not. 5 Second, consequences are unlikely for firms that never experience restatements because their failure to report existing weaknesses may never come to light. 6 However, within our sample 4 For example, the PCAOB has argued, For the implementation of Section 404 of the Act to achieve its objectives, the public must have confidence that all material weaknesses that exist as of the company s year-end will be publicly reported (PCAOB 2004). The findings of Rice and Weber (2012) suggest that this condition is violated, as the majority of restating firms had previously claimed to have effective controls. One potential explanation for these reporting failures is a lack of substantive penalties. 5 As noted by Ashbaugh-Skaife et al. (2007), the failure to report an existing control weakness implies that management and the auditor either fail to detect the weakness, or they detect it but opt not to disclose it. Our primary analyses focus on the final observed reporting outcomes (not the underlying detection and disclosure processes), because only the final reporting outcome is directly observable to market participants. However, as described in Section V, we also analyze a subsample where detection is likely to have occurred. For these firms, failures to report existing weaknesses more likely represent intentional lack of disclosure. 6 For example, consider a firm that has an existing material weakness, but does not report it and instead reports that controls are effective. If that firm never experiences a restatement, then the only direct public signal of internal control effectiveness is the SOX 404 report itself. Thus, regulators and market participants will likely never discover the existence of the control weakness or the associated reporting failure. 3

5 unreported control weaknesses are revealed by the restatement; thus, to the extent that consequences exist, they are likely to be concentrated among firms with restatements. Our empirical strategy can be summarized as follows. We first identify a sample of restating firms, where the restatements can be linked to underlying control weaknesses. After controlling for restatement severity, we then examine whether various consequences of the restatements differ between those firms that reported control weaknesses prior to the restatement and those that did not. We focus on consequences that could serve as potential enforcement mechanisms for SOX 404 (i.e., penalties faced by firms, their managers, and their auditors for failing to detect and disclose existing control weaknesses). Because our main variable of interest (whether or not firms report their control weaknesses prior to the restatement) is potentially endogenous, we also use propensity score matching and bivariate probit estimation to capture observable and unobservable factors, respectively, that may affect firms ex ante propensities to report existing weaknesses. 7 The economics literature has long recognized the importance of enforcement for incentivizing compliance with laws, regulations, and other prescribed behavior (e.g., Becker 1968; Stigler 1970). This literature is generally based on the assumption that agents consider the expected costs and benefits in deciding whether or not to comply with laws. The strength of enforcement, then, affects the expected costs of noncompliance. The accounting literature has also recently begun to document the important role of enforcement in determining the usefulness of various reporting standards and in reducing misreporting. For example, Kedia and Rajgopal (2011) show that due to resource constraints the SEC is more likely to investigate firms located 7 As described in Section II, we use the model of Rice and Weber (2012) to conduct the propensity score matching and as the first stage model in the bivariate probit analysis. This model includes several firm-specific factors that can affect firms propensities to report existing control weaknesses, such as financial distress and external capital needs. 4

6 closer to its offices, and that these firms are, in turn, less likely to adopt aggressive accounting practices (see Leuz and Wysocki 2009 for a survey on reporting regulation and enforcement). Failure to report existing control weaknesses suggests a violation of SOX 404. Therefore, if enforcement is stringent we would expect penalties surrounding restatements to be more likely for firms that had previously claimed to have effective controls. However, there are also reasons to expect that penalties might instead be more likely for firms that had previously disclosed their control weaknesses in compliance with SOX 404. First, the public disclosure of material weaknesses in internal controls likely brings firms to the attention of regulators and class action law firms as potential targets of investigations and litigation, particularly because the disclosure is effectively a tacit admission that the firm is in violation of the internal control provisions of the Foreign Corrupt Practices Act (FCPA). 8 Second, the disclosure of control weaknesses serves to acknowledge managements and auditors awareness of the existence of those weaknesses, which makes it more difficult for them to plausibly claim later that they were unaware of the conditions that led to the need for a restatement. Thus, whether the enforcement of SOX 404 is stringent enough to overcome these opposing forces is ultimately an empirical question. In our empirical tests, we find no evidence that the failure to report existing control weaknesses increases the likelihood of penalties following restatements. Most of our results instead indicate the opposite. After controlling for restatement severity and other relevant factors, we find firms that report internal control weaknesses prior to their restatement are 4 to 9 percent more likely to face class action lawsuits. This is true even when we remove lawsuits that are later dismissed, which is consistent with control weaknesses that are reported prior to a restatement lowering plaintiffs burden of proof in showing that management was aware (or should have 8 The Foreign Corrupt Practices Act of 1977 requires public firms to devise and maintain a system of internal accounting controls sufficient to provide reasonable assurance that transactions are recorded in accordance with generally accepted accounting principles (15 U.S.C. 78m(b)(2)(B)). 5

7 been aware) of the likelihood of misstatements. Similarly, AAERs are 3 to 5 percent more likely when weaknesses are reported prior to a restatement, but these results are weaker statistically. We also find that top management turnover is 12 to 17 percent more likely at firms that report control weaknesses prior to their restatements, which is consistent with firms seeking to improve the credibility of their financial reporting by replacing managers that were clearly aware of existing problems with controls over financial reporting, yet did not prevent them from manifesting in misstatements. This result holds for both CEOs and CFOs. Likewise, auditor turnover is about 7 percent more likely at firms that report control weaknesses prior to their restatements. This result, however, appears to be driven primarily by auditor resignations (rather than dismissals), which is consistent with auditors opting to resign from riskier clients in the event of a restatement (e.g., Huang and Scholz 2012). Auditors likely view such clients as having higher audit risk because, despite being aware of the existing control weaknesses, the auditors remained unable to successfully prevent material misstatements from appearing in these clients financial statements. As a supplementary analysis, we also examine stock market reactions to restatement announcements, which we use to infer whether unreliable SOX 404 reports affect the market s ability to anticipate the likelihood of restatements. In particular, we test whether investor responses (abnormal returns and abnormal trading volume) to restatement announcements differ between firms that have, and have not, previously reported their control weaknesses. SOX 404 reports are designed to alert investors of an increased likelihood of material misstatements, and several prior studies document that firms with reported control weaknesses are indeed more likely to subsequently have restatements (e.g., Hoitash et al. 2008; Audit Analytics 2009; Nagy 2010; Feng and Li 2011). Therefore we expect restatements to be more of 6

8 a surprise (i.e., generate more negative abnormal returns and larger abnormal volume at announcement) for firms that previously claimed to have effective internal controls. This expectation is tempered, however, by the possibility that market participants are able to see through unreliable SOX 404 reports. For example, prior research documents several observable factors associated with the likelihood of internal control weaknesses (Doyle et al. 2007; Ashbaugh-Skaife et al. 2007). To the extent that such signals can be used to infer the likelihood that control problems exist, investors may anticipate the presence of weaknesses even for firms that claim to have effective controls. Therefore, whether, and to what degree, investors are misled by unreliable SOX 404 reports are ultimately empirical questions. Our results indicate that restatement announcement-window stock returns are more negative for firms that previously claimed to have effective internal controls. Based on a clean sample of restatement announcements that do not coincide with earnings releases, announcement returns are -2.1 percent for firms that previously reported their control weaknesses and -3.7 percent for those that previously claimed to have effective controls. Similarly, we find that abnormal trading volume around restatement announcements is also roughly twice as large for firms that had not yet acknowledged the weaknesses in their controls. Both of these results hold after controlling for restatement severity. Thus, the failure to report existing control weaknesses appears to hinder price discovery as investors are less able to anticipate the increased likelihood of impending accounting problems and subsequent restatements are more of a surprise. This study makes three primary contributions to the accounting literature. First, our evidence that restatement-related penalties are no more likely for firms that previously claimed to have effective internal controls (and in many cases are less likely) suggests that the enforcement mechanisms surrounding SOX 404 are unlikely to provide strong incentives to 7

9 detect and disclose existing weaknesses. Thus, our results offer a potential explanation for why the majority of restatements occur at firms that previously claimed to have effective controls. 9 Second, our market reaction results suggest that when SOX 404 reports are unreliable, they hinder price discovery, as evidenced by larger market reactions when subsequent restatements are announced. Thus, when control weaknesses exist but are not disclosed, it does not appear that investors can fully glean this information from other signals. Finally, our results also contribute to the literature that investigates various consequences surrounding restatements (e.g., Palmrose and Scholz 2004; Palmrose et al. 2004; Desai et al. 2006; Plumlee and Yohn 2008; Kravet and Shevlin 2010). Our results demonstrate that firms prior disclosure of the control weaknesses that lead to their restatements can be an important determinant of the associated consequences, and thus should be considered by future research. The remainder of the paper is structured as follows. Sections II and III provide relevant background and develop our research design; Section IV describes our sample; Sections V and VI present our empirical results; Section VII concludes. II. ENFORCEMENT MECHANISMS Class Action Lawsuits The first enforcement mechanism we consider is class action lawsuits filed by investors against restating firms. These lawsuits generally allege that the defendants violated Section 10(b) of the Securities Exchange Act of 1934 (15 U.S.C. 78j) and related SEC Rule 10b-5 (17 C.F.R b-5). In such claims, the plaintiffs plead that the defendant made a material misstatement or omission and that the plaintiffs reliance on that misstatement or omission led to 9 We do not mean to imply that all SOX 404 misreporting is intentional. It can also result from unintentional failures to detect existing weaknesses. However, enforcement can also affect the incidence of unintentional reporting failures, if, for example, it influences the level of effort and resources that management and auditors dedicate to the detection of control weaknesses. 8

10 injury in connection with the purchase or sale of securities. These conditions are typically evidenced by the restatement of prior financial statements and related stock price drop. However, in order to survive motions to dismiss, the plaintiffs must also show that the defendants acted with intent or reckless disregard (scienter). Establishing scienter is generally the most significant hurdle facing plaintiffs in accounting-related class actions (e.g., Pritchard and Sale 2005; Johnson et al. 2006; Donelson et al. 2012). If the plaintiffs can establish scienter and survive the motion to dismiss, these cases are almost always settled rather than go to trial. A priori, whether timely control weakness reporting decreases or increases the likelihood of a class action lawsuit following a related restatement is unclear. On one hand, failure to report an existing material weakness violates SOX 404 and could potentially be used by plaintiffs as evidence of further misleading reporting (in addition to the misstated financial statements). Thus, timely reporting of control weaknesses may be viewed as a signal of management acting in good faith and help insulate the firm from claims that management knowingly misled investors. Likewise, reporting an existing control weakness could indirectly mitigate the risk of a related lawsuit by decreasing the amount of time the stock trades at inflated prices, thereby lessening the severity of a single large price drop at the restatement announcement. These arguments suggest that firms are less likely to face class action lawsuits following a restatement if they have previously reported their internal control weaknesses. Alternatively, there are at least two reasons to expect that reporting the existence of control weaknesses could expose firms to a greater likelihood of litigation. First, the previous disclosure of material weaknesses in controls could increase the likelihood of scienter being established by lowering plaintiffs burden of proof in showing that management was aware (or should have been aware) of the likelihood of misstatements. By having previously acknowledged 9

11 material weaknesses in internal controls, it becomes more difficult for management to reasonably claim they were unaware of associated misstatements in the financial reports. 10 Second, reported control weaknesses can bring the firm to the attention of class action litigators as a potential target. For example, Files et al. (2009) argue that class action law firms typically have staff specifically assigned to searching for news stories and other disclosures to identify firms with lawsuit potential, and thus prominent disclosure of restatement information increases the likelihood of restating firms becoming targets. Consistent with this argument, they show that, all else equal, firms that disclose restatements prominently in press releases are more likely to be sued than those with stealth restatements. In our setting, given the link between control weaknesses and potential accounting problems, adverse SOX 404 opinions could also serve to draw the attention of law firms, thereby increasing the likelihood of litigation in the event of a subsequent restatement. Given the opposing arguments outlined above, the effect of timely control weakness reporting on the likelihood of class action lawsuits is an empirical question. To provide evidence on this question, we collect litigation data from the Stanford Securities Class Action Clearing House. Our tests focus on two indicator variables for litigation events: LITIGATION is coded 1 if a class action lawsuit related to the restatement is filed against the firm, 0 otherwise; LIT EXCL DISMISS is coded 1 only for those lawsuits that are not dismissed, 0 otherwise (variable definitions are provided in Appendix A). 10 For example, following a restatement in 2007, Shuffle Master, Inc., which had reported material weaknesses in its internal controls prior to the restatement, was sued in a class action. As part of the scienter allegations, the plaintiffs argued, The Defendants knew or with deliberate and extreme recklessness disregarded the fact that the Company had not corrected the previously disclosed deficiencies in its internal controls and that the Company s internal controls therefore continued to suffer from systemic weaknesses which rendered the Company s financial accounting and reporting less reliable; thus, the Defendants knew of or deliberately disregarded the risk that accounting would be improper in order to meet the numbers. The court agreed that management s knowledge of the control weaknesses (as evidenced by their SOX 404 reports), and failure to prevent those weaknesses from manifesting in misstatements, created a strong inference of scienter and denied Shuffle Master s motion to dismiss. 10

12 Using LITIGATION and LIT EXCL DISMISS as response variables, we conduct regression analyses that control for other factors associated with the likelihood of litigation. Our main independent variable of interest is REPORT ICW, which is an indicator for whether or not firms reported their control weaknesses prior to their restatement (coded 1 for those that did, 0 for those that did not). Our first set of controls relate to the severity of the restatement. We expect that, all else equal, more severe restatements increase the likelihood of litigation. Our controls for restatement severity include the change in reported income (REST MAGNITUDE), the number of distinct accounts being restated (REST COUNT), the number of years being restated (REST YEARS), and an indicator for whether or not reported revenue was restated (REST REVENUE). Following Hennes et al. (2008), we also control for whether restatements are attributable to unintentional errors or intentional irregularities. We include the indicator variable IRREGULARITY, which is coded 1 for restatements related to fraud or where SEC or board-instigated independent investigations occur, and 0 otherwise. We also control for several factors that prior research suggests are related to the likelihood of litigation more generally (e.g., Kim and Skinner 2012; Rogers and Stocken 2005). Because larger firms are more likely to be targets of litigation, we control for firm size (SIZE), measured as the natural log of the market value of common equity at the end of the final year of the misstatement period. We control for investor losses leading up to and at the time of the restatement with PREVIOUS RETURN, which is calculated as the buy-and-hold abnormal return using the CRSP equally-weighted market portfolio return measured over the window (-252,-2) relative to the restatement announcement, and with CAR, the abnormal return at announcement. We control for the standard deviation and skewness of stock returns preceding the restatement, 11

13 expecting that the likelihood of litigation is positively associated with standard deviation and negatively associated with skewness (Kim and Skinner 2012). Similar to PREVIOUS RETURN, we measure RETURN STD DEV and RETURN SKEWNESS over the window (-252, -2) relative to the restatement announcement. We control for how actively a firm s shares are traded using SHARE TURNOVER, measured as [1 - t (1-shares traded t /total shares t )] over the one-year period ending on the second day prior to the restatement announcement date (Field et al. 2005; Files et al. 2009). We expect litigation to be more likely for firms with greater share turnover. Finally, we include an indicator variable, LIT INDUSTRY, for firms in industries identified by Francis et al. (1994) as having higher litigation risk and expect it to be positively associated with the likelihood of litigation. Using probit estimation, we estimate the following model: LITIGATION or LIT EXCL DISMISS = α + β 1 REPORT ICW + β 2 REST MAGNITUDE + β 3 IRREGULARITY + β 4 REST REVENUE + β 5 REST COUNT + β 6 REST YEARS + β 7 CAR + β 8 LIT INDUSTRY + β 9 PREVIOUS RETURN + β 10 RETURN STD DEV + β 11 RETURN SKEWNESS + β 12 SHARE TURNOVER + β 13 SIZE +ε (1) Accounting and Auditing Enforcement Releases (AAERs) We next consider AAERs, which are sanctions from the SEC for accounting-related infractions. These sanctions typically involve SEC allegations that the firm violated the books and records provision and/or the internal controls provision of the FCPA (15 U.S.C. 78m(b)(2)(A) and (B), respectively). 11 Similar to class action lawsuits, the expectation for whether AAERs are more or less likely for firms that report their control weaknesses prior to their restatements is also ambiguous. First, restatements could be viewed as symptomatic of 11 Despite its name, the Foreign Corrupt Practices Act applies to all U.S. issuers of securities. Thus, firms need not have foreign operations for these provisions to apply. 12

14 deeper reporting problems for firms that also violated SOX 404 by failing to report their control weaknesses. This suggests a negative association between AAERs and previously reported control weaknesses. Alternatively, the disclosure of control weaknesses could serve as a red flag that increases the likelihood of an SEC investigation. The SEC regularly reviews financial statements and other public disclosures and pursues investigations in those cases where the probability of success is highest (e.g., Feroz et al. 1991; Files 2012). Because the disclosure of material weakness in internal controls effectively acknowledges that the firm is in violation of the control provisions of the FCPA, and because control weaknesses often signal potential accounting problems, we might expect that they increase the likelihood of a SEC investigation and resulting AAER. 12 Also, as with litigation, previously reported control weaknesses can undermine plausible deniability by making it more difficult for management to claim later that they were unaware of the underlying problems that resulted in misstatements. We collect AAER information from the SEC s website ( and create the variable AAER, which we code as 1 for firms that were the subject of an enforcement action related to their restatement and 0 otherwise. We then test whether AAER is associated with REPORT ICW after including our controls for restatement severity, investor losses, share turnover, and firm size. Using probit estimation, we estimate the following model: AAER = α + β 1 REPORT ICW + β 2 REST MAGNITUDE + β 3 REST REVENUE + β 4 REST COUNT + β 5 REST YEARS + β 6 CAR + β 7 PREVIOUS RETURN + β 8 SHARE TURNOVER + β 9 SIZE +ε (2) 12 We note that of the 35 firms in our sample that received AAERs, 33 were cited for violating the internal control provisions of the FCPA. 13

15 We omit IRREGULARITY from (2) because it is mechanically related to the dependent variable in this particular model. 13 Management Turnover We also consider employment-related consequences for managers. In particular, we examine whether the likelihood that a restatement leads to management turnover is affected by whether internal control weaknesses are reported in advance of the restatement. If the failure to report existing weaknesses is perceived as a sign of managerial incompetence or intent to deceive, we might expect management turnover to be more likely for firms that claimed to have effective controls prior to their restatement. Alternatively, Li et al. (2010) show that, in general, management turnover is more likely for firms with internal control weaknesses as boards seek to improve the perceived credibility of their financial reporting. While control weaknesses exist for all of our sample firms, at those firms whose weaknesses were reported prior to their restatement, management was clearly aware of the control problems yet was unable to prevent them from manifesting in misstatements. As a result, we might expect management turnover to be more likely at firms with reported control weaknesses. Given the conflicting arguments, we do not predict the sign of the association between management turnover and the reporting of existing control weaknesses. For our empirical tests, we code MGT TURN as 1 if there is a change in either CEO or CFO during the one-year period following the restatement announcement and as 0 otherwise. 14 Using probit estimation, we then estimate the likelihood of management turnover as a function of our proxies for restatement severity, stock returns at the time of and preceding the restatement announcement, firm size, and whether control weaknesses had previously been reported: 13 Recall that part of the Hennes et al. (2008) irregularity classification is based on whether there is an SEC investigation, which is a precursor to an AAER. 14 As described in Section V, we also consider CEO and CFO turnover separately. 14

16 MGT TURN = α + β 1 REPORT ICW + β 2 REST MAGNITUDE + β 3 IRREGULARITY + β 4 REST REVENUE + β 5 REST COUNT + β 6 REST YEARS + β 7 CAR + β 8 PREVIOUS RETURN + β 9 SIZE +ε (3) When estimating (3), we remove observations with management changes in the year prior to the restatement. This eliminates cases where a restatement was potentially prompted by a new manager who disagrees with the firm s previous accounting practices, and also ensures that the managers in question had signed off on at least one set of previous, misstated financial statements (and associated SOX 404 reports). Auditor Turnover Finally, we also consider consequences for auditors. In particular, we examine whether the likelihood of auditor turnover following a restatement is affected by the previous disclosure of control weaknesses. Opining that a firm has effective internal controls when in fact material weaknesses exist suggests a failure on the part of the audit firm, and thus we might expect auditor turnover to be higher at firms that previously received clean SOX 404 opinions. Alternatively, previous research suggests that reported control weaknesses increase the likelihood of auditor turnover as firms dismiss auditors to enhance the credibility of their financial reporting, and as auditors resign from their riskier clients (Ettredge et al. 2011; Huang and Scholz 2012). We might expect both of these effects (dismissals and resignations) to be stronger in cases where auditors were aware of control weaknesses (as evidenced by their prior adverse SOX 404 opinions) yet were unable to prevent misstatements from occurring in the financial statements. Therefore, we make no prediction regarding the association between auditor turnover and the reporting of existing control weaknesses. 15

17 Similar to management turnover, we code AUD TURN as 1 if there is an auditor change during the one-year period following the restatement announcement, and 0 otherwise. 15 We then estimate the likelihood of auditor turnover as a function of whether control weaknesses had previously been reported, controlling for restatement severity, stock returns at the time of and preceding the restatement announcement, and firm size. Because previous research documents that turnover is less likely for the largest audit firms (e.g., Hennes et al. 2012), we also control for the size of the audit firm by including BIG4, an indicator set to 1 for the largest four audit firms (Deloitte, PricewaterhouseCoopers, Ernst & Young, and KPMG), and 0 otherwise. Using probit estimation, we estimate the following: AUD TURN = α + β 1 REPORT ICW + β 2 REST MAGNITUDE + β 3 IRREGULARITY + β 4 REST REVENUE + β 5 REST COUNT + β 6 REST YEARS + β 7 CAR + β 8 PREVIOUS RETURN + β 9 SIZE + β 10 BIG4 +ε (4) Following Hennes et al. (2012), and similar to our approach with management turnover, we remove observations with auditor changes in the year prior to the restatement when estimating (4). This eliminates cases where a restatement was prompted by an auditor switch (rather than vice versa) and ensures that the auditors in question have signed off on at least one set of previous, misstated financial statements (and the associated SOX 404 reports). Controlling for Self-Selection The treatment in our research design (i.e., REPORT ICW) is not randomly assigned, and therefore we also acknowledge the possibility that the reporting of existing control weaknesses could be endogenous. If there are factors that affect the reporting of existing weaknesses that are also correlated with the various penalties on which we focus our tests, then the coefficient 15 In Section V, we also consider auditor dismissals and resignations separately. 16

18 estimates from our probit models could be biased. To address this possibility, we use propensity score matching to create an alternative sample where firms are matched on factors that affect the likelihood of reporting existing control weaknesses (Rosenbaum and Rubin 1983). We estimate propensities using the model of Rice and Weber (2012), which models the probability of reporting existing weaknesses as a function of financial distress, external capital needs, firm size, recent manager and auditor turnover, audit firm size, audit fees, non-audit fees paid to the audit firm, and previously reported control deficiencies and restatements. See their Table 4 (p. 829) for more details. We limit matches to be within a caliper of 0.03 and perform the matching with replacement (Morgan and Harding 2006; Roberts and Whited 2011). By first modeling firms propensities to report their existing weaknesses and then matching firms based on those propensities, we control for the known determinants of REPORT ICW. This provides reasonable assurance that our results are not attributable to observable differences between firms that report existing weaknesses and those that do not. 16 III. MARKET REACTIONS TO RESTATEMENT ANNOUNCEMENTS As a supplementary analysis, we also investigate whether market reactions to restatements are mitigated by the previous disclosure of an internal control weakness. Several prior papers document that restatement announcements tend to trigger negative abnormal stock returns and positive abnormal trading volume as investors revise their beliefs about firms expected future earnings and risk (e.g., Palmrose et al. 2004; Hribar and Jenkins 2004; Plumlee and Yohn 2008). Other research shows that firms with internal control weaknesses are more likely to subsequently have restatements (e.g., Hoitash et al. 2008; Audit Analytics 2009; Nagy 2010; Feng and Li 2011). Thus, if control weaknesses are a signal of increased restatement 16 In Section V, we also describe a bivariate probit approach that considers endogeneity due to other, unobservable factors. 17

19 likelihood, then investors should be less surprised by restatements for firms that previously reported their weaknesses. We expect that, all else equal, announcement-window stock returns will be less negative for firms that previously reported related internal control weaknesses. Similarly, we expect that abnormal trading volume around restatement announcements will be lower for firms that previously reported their control weaknesses. It is possible, however, that market participants are able to see through unreliable SOX 404 reports. In particular, previous research documents several factors that are associated with the likelihood of internal control weaknesses, such as organizational complexity, major organizational changes, and relative investments in internal controls (Doyle et al. 2007; Ashbaugh-Skaife et al. 2007). To the extent that these and other signals can be used to infer the likelihood that control weaknesses exist, investors may anticipate the presence of weaknesses even for firms that issue clean SOX 404 reports, such that market reactions may not differ across our two REPORT ICW groups. We measure abnormal returns (CAR) using cumulative returns on days (0, +1) relative to the restatement announcement, adjusted for the CRSP equally-weighted market portfolio return. We measure abnormal trading volume (ABVOL) as the average of abnormal turnover for the same window (i.e., days 0, +1). Turnover for a given day is the ratio of shares traded to total shares outstanding on that day. Abnormal turnover is turnover for a given day less the firm s average turnover for the period (-250, -31) relative to the announcement. Our arguments above suggest that abnormal returns will be higher (less negative) and abnormal volume will be lower (less positive) for firms that disclosed their weaknesses prior to announcing their restatements. Thus, we predict that CAR will be positively associated with REPORT ICW, and that ABVOL will be negatively associated with REPORT ICW. We also 18

20 control for restatement severity in our regressions, and expect that more severe restatements will be associated with lower (more negative) abnormal returns and higher abnormal trading volume. Our baseline market reaction model is as follows: CAR or ABVOL = α + β 1 REPORT ICW + β 2 REST MAGNITUDE + β 3 IRREGULARITY + β 4 REST REVENUE + β 5 REST COUNT + β 6 REST YEARS +ε (5) Restatements are often announced concurrently with earnings releases, which make it difficult to separate the effects of the restatement from the effects of other news released at the same time (e.g., Palmrose et al. 2004; Files et al. 2009). Therefore, we estimate (5) using a clean sample that excludes any restatements announced concurrently with an earnings release. As a second approach, we also augment (5) with variables to control for concurrent earnings news and estimate the augmented model using the full sample. The augmented model includes an indicator for whether the firm announced earnings at the same time as the restatement (CONCURRENT) and a proxy for the amount of unexpected earnings (UNEXP EARN). As in Palmrose et al. (2004) and Files et al. (2009), UNEXP EARN is earnings for the current quarter less earnings from the same quarter in the previous year. For firms without concurrent earnings announcements, UNEXP EARN is set to 0. IV. SAMPLE Sample Selection Our selection procedure is designed to generate a sample of firms with restatements attributable to internal control weaknesses, some of which reported those weaknesses in advance of their restatements and some of which did not. This process involves two primary steps. First, restatements are matched with the SOX 404 reports issued by the restating firms during their misstatement periods. This enables us to determine whether or not control weaknesses were 19

21 reported prior to the restatements. Second, the sample is refined to eliminate restatements that cannot be clearly attributed to underlying control weaknesses. This second step ensures that control weaknesses existed at all sample firms at the time of their misstatements, which allows us to then focus on whether or not those weaknesses were reported in a timely manner. 17 Restatements and SOX 404 reports are both drawn from Audit Analytics. We begin by extracting all restatements announced by the end of 2010 that include annual reporting periods ending after the effective date of SOX 404 (November 14, 2004). For firms with multiple restatements announced during this period, we keep only the first instance. We then match the restatements with the SOX 404 reports issued during each firm s misstatement period (i.e., the period in which control weaknesses led to misreporting). 18 This results in an initial sample of 1,007 restatement observations with matching SOX 404 reports. Of these 1,007 restating firms, 259 reported an internal control weakness during their misstatement period and 748 did not. We then eliminate restatements that are not clearly associated with underlying control weaknesses. For the 259 firms that reported control weaknesses in advance of their restatements, we first attempt to link the particular type of misstatements being corrected with the type of control weaknesses that were originally reported (e.g., a revenue restatement and a reported weakness in controls over revenue). For those where a link is not obvious (e.g., the reported control weaknesses are firm-level in nature, rather than account-level), we then read the controlrelated disclosures issued in the aftermath of the restatement and eliminate the 26 cases where 17 On its own, the occurrence of a restatement does not necessarily imply the existence of a control weakness if, for example, it reflected the SEC s subsequent view of an accounting matter, when the auditor concluded that management had reasonable support for its original position (PCAOB 2004, paragraph E99). Likewise, some restatements merely reflect the correction of minor clerical errors, which would not rise to the level of a material weakness in internal controls. Thus, our selection process is designed to eliminate these types of restatements. 18 We require the SOX 404 reports to be audited, a regulation that only applies to Accelerated Filers. Thus, all our sample firms are Accelerated Filers (public float in excess of $75 million). 20

22 management either denies that the restatement is linked to a control weakness or does not mention such a link. For the 748 firms that claimed to have effective internal controls during their misstatement periods (i.e., did not report any material weaknesses), we also examine the controlrelated disclosures issued following the restatements. Of these 748 firms, 355 acknowledge the existence of material weaknesses in the aftermath of the restatement. Another 80 firms report that material weaknesses did exist during the misstatement period but have since been remediated. Thus, despite initially reporting that their internal controls were effective, these 435 ( ) firms subsequently acknowledge that material weaknesses did indeed exist and we therefore retain them in our sample. We eliminate the other 313 firms that either do not mention or explicitly deny the existence of control weaknesses after their restatement because it is not possible to definitively conclude that material weaknesses existed at these firms. Following these screens, we are left with 668 (1, ) restatements linked to underlying control weaknesses. From this sample, we eliminate 36 observations for which the restatement announcement date precedes the end of the misstatement period in Audit Analytics. 19 Finally, we eliminate observations that are missing data necessary to construct the variables in our models (136 observations) and those with extreme values of CAR or ABVOL in the highest or lowest percentile of their respective distributions (14 observations), leaving a base sample of 482 observations. Descriptive Statistics 19 These appear to be largely situations where firms first announce that they have initiated an internal investigation of some accounting issue that has the potential to ultimately result in a restatement. Audit Analytics marks this initial announcement as the restatement disclosure date. In some cases, however, the investigations are protracted and details of the restatement become available only with some considerable delay. Thus, we eliminate these observations. 21

23 In Table 1 we provide descriptive statistics for our regression variables. Our sample firms are relatively large with a median value for SIZE of (which translates to $606 million in market capitalization), and the majority (84.6 percent) are audited by one of the four largest audit firms. The mean value of REPORT ICW is 0.317, indicating that roughly a third of sample firms report their control weaknesses prior to announcing their need for a restatement. Approximately 15 percent of sample firms face litigation as a result of their restatement, though the mean value of LIT EXCL DISMISS (0.074) indicates that about half of these cases are ultimately dismissed. About 7 percent of the sample is sanctioned by the SEC with an AAER related to their restatement, while the management and auditor turnover percentages are approximately 28 and 16 percent, respectively. Consistent with expectations, our sample firms experience negative abnormal returns and positive abnormal volume, on average, around their restatement announcements: the mean values of CAR and ABVOL are and 0.007, respectively. Table 1 also includes the mean values of our variables conditional on REPORT ICW. Turnover rates are higher for both managers and auditors of firms that previously reported their control weaknesses, but the difference is only statistically significant for auditors. Litigation and AAER rates are similar across groups. Thus, taken together, there is no evidence from these univariate comparisons to suggest a higher likelihood of restatement-related penalties for firms that failed to report their internal control weaknesses until after the restatement. These simple comparisons, however, do not control for other relevant factors and, accordingly, we base our inferences on the regression results in the next section. Restatement severity appears to be reasonably similar across REPORT ICW groups, with insignificant differences for most of our proxies (IRREGULARITY, which is significant at p < 0.10, is the only exception). The REPORT ICW = 0 firms in our sample tend to be larger and 22

24 more likely to have a Big 4 auditor. As expected, the average values of CAR are lower (more negative) and the average values of ABVOL are higher (more positive) for REPORT ICW = 0 firms, which is consistent with restatements being more of a surprise to investors in cases where the related control weaknesses were not disclosed until after the restatement. V. RESULTS ENFORCEMENT MECHANISMS Class Action Lawsuits The results of our litigation regressions are shown in Table 2. Along with coefficient estimates and standard errors, we also include estimated marginal effects for each variable. These reported marginal effects are averages of the individual marginal effects evaluated at every observation in the sample (Bartus 2005; Greene 2003). We provide results for the full sample as well as the propensity score-matched sample, for both LITIGATION and LIT EXCL DISMISS as dependent variables. The estimated coefficient on REPORT ICW is positive across all four models, indicating that firms reporting control weaknesses prior to their restatements are more likely to face class action lawsuits. This result is statistically significant in all cases except for the full sample when LITIGATION is the dependent variable. The estimated marginal effects suggest that REPORT ICW = 1 firms are between 4 and 9 percent more likely to face litigation. Results for the control variables are generally consistent with expectations. Litigation is more likely following more severe restatements, for larger and more heavily traded firms, for firms in litigious industries, and when previous and announcement returns are more negative. We omit IRREGULARITY from the propensity score models, because in these smaller samples it happens to be perfectly predictive (every observation with LITIGATION = 1 also has 23