Antecedents, Characteristics and Consequences of Internal Control Weaknesses and the COSO (2013) Framework

Transcription

1 Antecedents, Characteristics and Consequences of Internal Control Weaknesses and the COSO (2013) Framework DINA F. EL-MAHDY * Earl G. Graves School of Business and Management Morgan State University McMechen Commerce Building 1700 E. Cold Spring Lane Baltimore, MD dina.elmahdy@morgan.edu SHEELA THIRUVADI Earl G. Graves School of Business and Management Morgan State University McMechen Commerce Building 1700 E. Cold Spring Lane Baltimore, MD sheela.thiruvadi@morgan.edu *Corresponding author TEL: ; FAX: ; dina.elmahdy@morgan.edu This paper is part of the first author s Ph.D. Dissertation. We thank Myung Seok Park, Carolyn Norman, Benson Wier, Manu Gupta, Jong Eun Lee, Jin Dong Park and participants of the 2012 American Accounting Association Mid-Atlantic Meeting. Electronic copy available at:

2 Antecedents, Characteristics and Consequences of Internal Control Weaknesses and the COSO (2013) Framework Updated: February 20, 2014 ABSTRACT The main thesis of our study is to provide a comprehensive review on the disclosure of Internal Control Weaknesses (ICWs) reported under the Sarbanes-Oxley Act of More specifically, we classify research on ICWs into three main streams: (1) antecedents, (2) characteristics and (3) consequences of ICWs. Throughout the review, we refer to the multifaceted aspects of the disclosure of ICWs on various important topics such as corporate governance, financial reporting quality, audit quality and information asymmetry. We also discuss the possible implications of the 2013 updated Committee of Sponsoring Organizations (COSO) internal control-integrated framework on accounting literature. Our review and framework help researchers as well as policy makers to better understand the mechanisms by which the existence, discovery and disclosure of ICWs affect the U.S. firms. Further, this study provides avenues for future research and helps regulators and policy makers in setting standards and provisions related to internal controls. 2 Electronic copy available at:

3 I. INTRODUCTION The Sarbanes-Oxley Act (SOX, hereafter) was enacted on July 30, 2002 involving various functions to protect the investing public. This Act came into effect in response to a number of major accounting scandals that rocked the financial markets in the U.S. These scandals resulted in significant corporate failures, including Enron, Tyco International, Global Crossing, WorldCom and others. Furthermore, these scandals resulted in a precipitous drop in companies share prices and shattered investors confidence in the reliability of the financial reporting. This was followed by several other compliance sections of the SOX, such as sections 302, 401, 404, 409, 802 and 906. The aim of these sections was to improve the informational infrastructure inside firms and reduce the agency costs created due to the principal-agent relationship. The main purpose of these provisions was to improve the quality of financial reporting and restore investors confidence in the reliability of public firms financial statements. SOX 302 and SOX received much attention from regulators as well as academicians. SOX 302 was issued in 2002 and focused on improving the corporate responsibility for financial reports. SOX 302 mandate that the Security and Exchange Commission (SEC) enacts rules that require the CEO or CFO of U.S. firms to report on the effectiveness of their internal controls each quarter (Munsif, Raghunandan and Rama 2013). Likewise, SOX was issued in 2004 and focused on the auditor s attestation on the management assessment of internal controls. SOX 302 and SOX 404 use definitions of effective internal control similar to that developed in 1992 by the COSO. Although the COSO framework broadly defines internal 1 We refer to SOX 2002-Section 302 and section 404 as SOX 302 and SOX 404 respectively throughout the paper. 2 There are two parts to Section 404 of SOX. Section 404(a) requires an assessment about the effectiveness of internal control over financial reporting by the management while Section 404(b) requires an opinion from the auditor for such controls, both of which became effective for accelerated filers for the first fiscal year on or after November, However, Section 404(a) became effective on or after December, for non-accelerated filers. The Dodd-Frank Act of 2010 provided exemption for non-accelerated filers from section 404(b). 3

4 control in terms of achieving (1) the effectiveness and efficiency of operations, (2) the reliability of financial reporting, and (3) compliance with applicable laws and regulations (Statements on Auditing Standards, SOX 319), SOX 302 and SOX 404 only pertain to internal control related to the reliability of financial Reporting. Due to various changes in business environment with regards to complexity, restructuring, failures, technology and operating environment, a 2013 updated COSO internal control-integrated framework was introduced to replace the original framework. The updated COSO internal control-integrated framework was introduced in May 2013 and is expected to be implemented by December 15, The updated COSO framework stresses on the importance of having a healthy internal control system not only for external reporting but also for internal reporting as well as non-financial reporting. It is argued that public firms in the U.S. do rely on COSO (1992) in complying with ICWs under SOX 2002-internal control related provisions. Although the differences between COSO (1992) and COSO (2013) are not fundamental, research on ICWs post COSO (2013) might be impacted due to the increased clarity of principles, applications, components, and scope of ICWs post COSO (2013). Further, COSO states that companies having external reporting should disclose whether they used the original framework or the updated framework (Cohn 2013). Given the increased level of clarity and details in COSO (2013), we would expect future research to be directed towards the study of ICWs in terms of its impact on business divisions. Further, we expect future research to integrate the non-financial aspects as well as the internal reporting needs into ICW research. These expected changes in the research directions call for a review study on concurrent ICWs research. The main purpose of this paper is to synthesize the direction of prior research on ICWs and discuss the possible implications of COSO (2013) framework on prior literature. 4

5 Literature on the disclosure of internal control over financial reporting in accordance with SOX contains two types of disclosure: (1) mandatory disclosure under SOX 404 and (2) voluntary disclosure under SOX 302. There is a significant difference in the way the market reacts to voluntary versus mandatory disclosure. For example, Lam and Du (2004) hypothesize that mandatory disclosure is expected to be associated with low cross-sectional estimation risk. Whereas, Ashbaugh-Skaife, Collins and Kinney (2007) hypothesize that firms that voluntarily disclosed ICWs under SOX 302 are experiencing complex operations, auditor resignation, organizational change and accounting risk and have fewer resources for internal control. Hence, the disclosure of ICWs under SOX 404 is perceived as credible and reliable. However, anecdotal evidence shows that SOX 404 has ended up with unintended consequences (e.g., higher audit fees and audit change) on U.S. firms. Our study is motivated by the importance of the implications of SOX-related internal control provisions on various dimensions (e.g., audit quality, financial reporting quality, corporate governance, cost of debt and equity, firm value and performance). Further, the possible implications of the updated COSO integrated framework of internal control on prior research related to the discovery, reporting and remediation of ICWs also serves as a strong motivation. To the best of our knowledge, there is no paper that discusses the combination of all these factors put together in a theoretical framework. To provide a comprehensive framework on ICWs research, we classify a sample of concurrent research into three main streams: antecedents, characteristics, and consequences of SOX-related internal control provisions. Antecedents can be defined as the economic factors that result in internal control failure. These economic factors may include: firms that were involved in merger and acquisition, investment in internal control, firm size and auditors, who 5

6 resigned from the client the year prior to the discovery and reporting of the ICWs (Ge and McVay 2005; Ashbaugh-Skaife et al. 2007; Doyle, Ge and McVay 2007a; Leone 2007; Tang and Xu 2010). Characteristics of ICWs may include firm-specific characteristics that contributed to the occurrence and persistence of the ICWs over time such as profitability, financial health, audit quality, and timeliness of financial reporting quality (Ge and McVay 2005; Bryan and Lilien 2005; Ettredge, Li and Sun 2006; Bédard 2006; Hammersley, Myers and Shakespeare 2008; Feng et al. 2009; Laux and Stocken 2012; Skaife, Veenman and Wangerin 2013). Consequences of ICWs include both intended and unintended subsequent events that relate to the discovery and reporting of ICWs (De Franco, Guan, and Lu 2005; Ogneva, Subramanyam and Raghunandan 2007; Beneish, Billings and Hodder 2008; Ashbaugh-Skaife, Collins, Kinney and LaFond 2009; Haron, Ibrahim, Jeyaraman and Chye 2010; Hoitash, Hoitash and Johnstone 2012). For example, consequences of ICWs might be positive leading to remediation of ICWs or resolving market uncertainty. Alternatively, consequences of ICWs may be negative, leading to accounting restatement, board of director s resignation and a series of unfavorable outcomes to the firm Motivated by lack of theory behind SOX 2002 (Carcello 2005), our review study is important to both researchers as well as policy makers in understanding the theoretical framework of ICWs and the updated COSO internal control-integrated framework. Therefore, our study differs from prior literature that reviews research on ICWs. Our study contributes to the literature in a number of ways. First, our study addresses the following questions on SOX related ICWs provisions: (1) whether the discovery, disclosure and remediation of ICWs under SOX 302 versus 404 increase the reliability of financial statements? And/or, (2) Does it impose costs and burden on both the SEC and the registrants? Put together, prior research did not provide conclusive direction for the above questions. For instance, Beneish et al. (2008); Hogan 6

7 and Wilkins (2008); and Hoitash, Hoitash, and Bédard (2009) argue that ICWs disclosed under SOX 404 increase the costs associated with auditing and reporting of ICWs. Alexander, Bauguess, Bernile, Lee and Marietta-Westberg (2013) findings show that the costs associated with the compliance of SOX 404 of internal controls more than outweighs the benefits using survey responses from corporate insiders. However, Lobo and Zhou (2006) studies support the notion that SOX 404 enhanced the management scrutiny of the financial statements leading to increased investor s confidence in the financial statements. Further, Cheng, Dhaliwal and Zhang (2013) find that shareholders and other stake-holders are increasingly monitoring the firms to improve the quality of financial reporting post SOX 404. Second, our study highlights the possible implications of COSO updated internal control-integrated framework on the disclosure and reporting of ICWs under SOX 404. Finally, our study is important to market-wide participants, managers, auditors, creditors and customers in understanding the cycle of discovery, disclosure and remediation of ICWs. The reminder of this paper is organized as follows. Section two provides institutional background about ICWs. Section three introduces the theoretical framework on the disclosure of the ICWs. Section four summarizes and concludes our review study. II. INSTITUTIONAL BACKGROUND History of ICWs Disclosure The COSO (1992) defines internal control as: a process, effected by an entity s board of directors, management and other personnel designed to provide reasonable assurance regarding the achievement of objectives in the following categories: effectiveness and efficiency of operations, reliability of financial information, and compliance with the applicable laws and regulations. The updated COSO framework (2013) still uses the same definition of internal 7

8 control but it further highlights the basic concepts and principles of internal control. The existence of an effective internal control system provides reasonable assurance to the firm s top management as well as the external users. Related, it can be perceived as a proactive method by which a firm can detect fraud, and intentional and unintentional errors. By definition, there is no other alternative method to prevent material errors and fraud other than maintaining an effective system of internal control. The inability to detect internal control weaknesses by both the management and/or external auditor may end up with misleading financial statements and further restatements. Evaluating the effectiveness of internal control systems has always been a part of the audit task. Auditors, according to the AICPA, are required to evaluate the reliability of internal control in order to determine the scope and nature of the audit processes. In the pre- SOX 2002 era, there were no specific objective guidelines for auditors to follow in evaluating the reliability of the internal control systems. Traditionally, while evaluating the effectiveness of internal control systems, auditors were making a trade-off between the sample size and precision limits using subjective and qualitative tools such as flowcharts (Yu and Neter 1973), and makes the process of evaluating internal control systems biased, inaccurate and lacking in uniformity and consistency (Corless 1972). The history of the regulations of Internal control shows that government regulations required companies to establish systems of internal control as early as 1977 (Byington and Christensen 2005; Ge and McVay 2005). However, statutory regulations that govern the disclosure of internal controls over financial reporting has not been clear for SEC registrants and in most cases were not cost effective in terms of the net benefit of these statutory regulations to U.S. firms. The Foreign Corrupt Practices Act (FCPA) of 1977 was the first law which required 8

9 internal control disclosure. The FCPA also required public firms to disclose ICWs when announcing a change in auditors (Irving, 2006). It also required firms to maintain cost effective systems of internal controls over financial reporting. However, the term cost effective was quite vague to registrants and hence, subject to interpretation. Research on SOX- related internal control provisions is numerous and extends from pre-sox 302 to post-sox 404 periods (Beneish et al. 2008). SOX 302: Voluntary Disclosure of ICWs Corporate governance failures by the onset of the 1990s re-invigorated the need for corporate reforms to address various corporate misbehaviors leading to fraud, which lead to huge economic losses to the public sector. Therefore, SOX 2002 was enacted on July 30, 2002 in response to major corporate scandals. One of the key elements to blame for corporate fraud is the ICWs that failed to detect these frauds. Therefore, SOX 302 was issued followed by SOX 404, AS2, 3 and AS5. 4 The main purpose of the SOX-related internal control provisions is to inform investors and various stakeholders about the weaknesses in the Internal control structure of the firm. Prior to SOX provisions related to Internal control disclosures (SOX 302 and SOX 404), firms were only required to report on the effectiveness of their Internal control when changing auditors (Haron et al. 2010). 3 The PCAOB issued the Auditing Standard No. 2: An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements. Auditing Standard No. 2 was issued following the issuance of SOX 2002 SOX 404 to assist auditors in issuing an opinion on the effectiveness of their public company clients internal control. Over 200 pages, Auditing Standard No. 2 provides new detailed responsibilities and extensive procedures on both auditors and their clients (public firms). It further differentiates between the external auditors and management s responsibilities regarding evaluating and reporting internal control material weaknesses. 4 In almost 118 pages and following the unintended cost and consequences of SOX 404 to the U.S. firm, the PCAOB released Auditing Standard No. 5: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, as well as an independence rule and conforming amendments to the Board's auditing standards to amend the previously issued Auditing Standard No. 2. Auditing Standard No. 5 is issued to provide additional clarity, direct the external auditors focus on the most important matters in auditing the internal control over financial reporting, and further eliminate unnecessary audit work previously stipulated by Auditing Standard No. 2. 9

10 SOX 302 requires the CEO and CFO to certify that the financial reports are free from material errors and weaknesses. It became effective on August 29, SOX-section 906 White-Collar Crime Penalty Enhancements further stipulates the criminal penalties against the firms financial officers who knowingly certify incorrect financial statements. SOX 302 requires voluntary disclosure of ICWs as well as management evaluation on the effectiveness of controls and procedures. However, SOX 302 was not clear to both management and auditors. Management could not find clear guidelines on how to evaluate the effectiveness of internal controls. Further, auditors were confused about reporting the assessment of internal control systems to shareholders and/or management. Also, under SOX 302, no independent audit evaluation of a firm s internal controls was required. Therefore, managers had more discretion to disclose internal control deficiency pre-sox 404. Business firms, again, faced the same confusion under FCPA 1977 with regard to the issuance and enactment of SOX 302. Under SOX 302, the Public Company Accounting Oversight Board (hereafter PCAOB) requires firms to report on the effectiveness of internal control over financial reporting. However, SOX 302 did not provide clear guidelines to either management or external auditors on what, how, and when to report the internal control material weaknesses. There is a significant difference between voluntary and mandatory disclosure. Managers might have been hesitant to report material weaknesses under SOX 302 due to the proprietary costs associated with the full disclosure. Additionally, voluntary disclosure might be seen as a general disclosure that could exceed the minimum required disclosure (Haron et al. 2010). However, mandatory disclosure can be seen as the minimum required disclosure. Therefore, SOX 302 is associated with discretionary managerial behavior, while SOX 404 is associated with intentional or unintentional errors caused by inherent internal control risk. 10

11 SOX 404: Mandatory Disclosure of Internal Control Material Weaknesses (ICMWs) Preliminary discussions about SOX 404 were initially raised by COSO in 1992 that recommended public firms to report on the effectiveness of internal control over financial reporting in their annual reports. SOX 404 became effective on or after November 15, 2004 for only accelerated filers and domestic firms with a market capitalization of $75 million or greater. Under SOX 404, auditors were required to opine on the management s assessment of internal control over financial reporting and further disclose the material weaknesses and issue an adverse opinion even if s/he finds material ICWs. SOX 404 required public firms to file forms 10-K 5 and 10-Q containing an evaluation by management of its internal control. SOX 404 differs from SOX 302 in terms of its consequences on U.S. firms. For example, SOX 404 forced public firms to go private in order to avoid the proprietary costs associated with disclosing internal control weaknesses (Engel, Hayes, and Wang 2007) and triggered the initiation of the PCAOB, which is responsible for issuing Auditing Standards that facilitate the smooth application of SOX 2002-internal control related provision in practice. SOX 404 was therefore named the section of the unintended consequences (Gupta and Nayar 2007). The actual financial burden of implementing SOX 404 during its first year was $1,241,000 ($8,510,000) for firms with market capitalization between $75 and $700 million (more than $700 million). Opponents of SOX 404 argue that it does not benefit smaller firms. Therefore, SEC made 5 An excerpt of KRISPY KREME DOUGHNUTS INC Annual Report on Form 10-K Filing discloses the status of the firm s Internal control weaknesses as follows: The Company believes that, because of the number and magnitude of the restatement adjustments identified to date, it is highly likely that it will conclude that there were one or more material weaknesses in the Company's internal control over financial reporting at January 30, If the Company's management concludes that one or more material weaknesses existed, it will be unable to conclude that the Company maintained effective internal control over financial reporting as of January 30, Also, if one or more material weaknesses existed, the Company's independent registered public accounting firm will issue an adverse opinion with respect to the effectiveness of the Company's internal control over financial reporting as of January 30, This excerpt is available at the company s web page: 11

12 recommendations to the PCAOB to exempt micro-cap firms (firms with market cap below $128 million) from SOX 404 and small-cap firms (firms with market cap between $128 and $787 million) from the external auditor attestation on the management s decision on the quality of internal control in 2006 (Ettredge et al. 2006). SOX 404 cost of compliance also includes the cost of gaining the attention of top management to make a decision regarding an internal operational activity such as internal control effectiveness (Bryan and Lilien 2005). SOX 404 constitutes as a challenge to external auditors. Byington and Christensen (2005) provide a framework of suggested checklists that include management considerations and auditing considerations in order to facilitate the compliance of SOX 404, in addition to considerations related to the use of spreadsheets, outsourcing and computer security. SOX 404 was one of the most controversial SOX provisions because it carries both costs and benefits. This has been further supported by research on the intended and unintended consequences of SOX 404. On one hand, Abbott, Parker, Peters and Rama (2007) argue that the audit committee functions post SOX ensures the independence of external auditing. On the other hand, Gupta and Nayar (2007) suggest that internal control weaknesses might trigger a debt ratings review and consequently increase the borrowing cost in the short run and also incur default risk. Table 1-4 summarize a sample of research on the disclosure of ICWs pre and post SOX [Insert tables 1-4 here] Operationalizing Internal Control Quality in Accounting Literature One of the difficulties of researching internal control is its broad definition due to the complexities of the internal control process (Kinney 2000). This makes operationalizing the quality of internal controls as a research construct difficult. Moreover, internal controls are 12

13 processes that are dissimilar across firms, industries, regulatory regimes, cultures, and time. Additionally, the auditing process in terms of time, effort, and expertise affects the quality of internal control. The tone at the top or the management s philosophy towards internal controls might also exacerbate incidents of poor financial quality over internal control (Ogneva et al. 2007). All of these dynamic factors mediate internal control quality as an explanatory variable in a research construct. In general, the quality of internal control systems is operationalized in prior research using many proxies such as: internal audit quality, quality assurance and oversight (Haron et al. 2010), owners investments in internal control 6 (Pae and Yoo 2001), and disclosure of material weaknesses versus effective internal control as the most widely used measure on the effectiveness of internal control (Feng et al. 2009; Doyle, Ge, and McVay 2007a,b; Ashbaugh- Skaife, Collins, Kinney, and LaFond 2008, Skaife et al. 2013). Types of Internal Control Weaknesses A material weakness in internal control over financial reporting is defined by the PCAOB (2004) as: one or more deficiencies that results in more than a remote likelihood that a material misstatement 7 of the annual or interim financial statements will not be prevented or detected. The main purpose for the disclosure of material internal control weaknesses is to resolve financial reporting uncertainty about the firm (Beneish et al. 2008). Hence, such disclosure should help reduce asymmetric information in the market because uninformed investors receive additional information that would reduce their need to search for private information. However, 6 Owner s investment in internal controls is part of the agency costs incurred to align the interests of both management and shareholders. Failure to maintain an effective internal control system is thus an expropriation of the shareholders wealth in a firm. 7 Material restatements occur when: (1) an inherent risk leads to the occurrence of material errors/misstatements, GAAP violations or internal audit failure; (2) Unable to prevent or detect these material restatements before the release of audited financial statements; (3) Release of the audited financial statements and the auditor, by default, did not discover the presence of material misstatements; and (4) someone (e.g., internal auditor, external auditor, an employee, top management, board of directors) detects material misstatements. Therefore, corrected financial statements must be issued in response to the discovery of internal control material restatements (Eilifsen and Messier, 2000). 13

14 Beneish et al. (2008) argue that internal control disclosures might increase information asymmetry (uncertainty) because the disclosure of ICWs signals increased risk to the market. Beneish et al. (2008) find that SOX 302 might have a negative impact on stock returns especially with the presence of internal control material weaknesses. They also examined the market reaction to SOX 404. However, they did not find an association between the disclosure of ICMWs and stock returns. Ettredge, Johnstone, Stone and Wang (2011) find that internal control weakness is negatively associated with disclosure compliance under SOX 404 using comment letters of SEC staff objections to firm disclosures from the SEC website. Further, they also find a positive association between the quality of governance and firm compliance. They show that managers opportunistically omit disclosures that are perceived as bad news by investors based on prior research. There are three common types of ICWs in the accounting literature, namely, control deficiencies, significant deficiencies, and material weaknesses (Hammersley et al. 2008; Bryan and Lilien 2005). Significant deficiencies and material weaknesses are referred to as ICWs in prior literature (Leone 2007). Prior research focuses mainly on material weakness, because it has severe consequences on the firm and must be disclosed under SOX 2002 provisions. Hammersley et al. (2008) find that the market reacts to the disclosure of significant deficiencies and material weaknesses, but they do not detect a similar reaction to the disclosure of control deficiencies. Stated differently, firms with disclosed material weaknesses are characterized as high-risk firms, in which investors, mostly uninformed investors, ask for a high risk premium to compensate them for the high uncertainty surrounding the disclosure of ICWs. Firms with material weaknesses also send a signal to the market stating that the disclosing firm has poor financial reporting quality. Poor financial reporting quality can thus exacerbate information 14

15 asymmetry (Ogneva et al. 2007). However, some ICWs rather than reducing uncertainty will infuse uncertainty in the market and thereby increase information asymmetry (Beneish et al. 2008; Kim and Park 2009). Surprisingly, AS2 does not provide clear guidance on the types of internal control weaknesses that should be disclosed. In general, there are two main classifications of ICWs from prior literature: (1) Material weaknesses, significant deficiencies, and control deficiencies; (2) Company-level and account-specific weaknesses. The first classification of IC weakness was discussed in AS2. Underlying this classification, De Franco et al. (2005) stratify ICWs into three different categories in their order of severity: material weaknesses, significant deficiencies, and unspecified or control deficiencies. Unspecified or control deficiencies have been defined by AS2 as those deficiencies resulting from a lack of operational control that hinders management or employees from preventing or detecting misstatements in a timely manner. A significant deficiency is one or a combination of control deficiencies that negatively affects the firm s ability to accurately initiate, record, and process external financial data according to GAAP. A significant deficiency indicates that there is a remote likelihood that a more than inconsequential misstatement of the firm s financial statement will not be either detected or prevented. If there is more than a remote likelihood that a material misstatement will not be prevented or detected, then the significant deficiency is classified as a material weakness. Similarly, Hammersley et al. (2008) find that the market reacts to the disclosure of significant deficiencies and material weaknesses, but they do not detect the same reaction to the disclosure of control deficiencies. The second classification has been a main topic of discussion by both academicians and practitioners. Underlying this classification, Ettredge et al. (2006), PCAOB, AS2, and Moody s (2004) categorize internal control systems into company-level and specific-account internal 15

16 control issues. Company-level internal control issues are those weaknesses in internal control that impacts a wide range of general control issues such as: the audit committee, risk assessment, revenue recognition, and the internal audit function. Specific control issues are those that affect a narrow activity inside the internal control system such as account-specific balances (e.g., inventory, accounts payable, accounts receivable). Moody s Investor Services stated in October 2004 that they are less concerned about material weaknesses that relate to specific accounts or transaction-level processes. Moody s Investor Services also stated that they will not consider such weaknesses in their rating evaluations. However, material weaknesses that relate to company-level controls may trigger rating actions by Moody s. Another classification of ICWs, not common in accounting literature, is based on the COSO (1992) framework. There are eight types of ICWs according to the COSO (1992) classification: personnel, processes and procedures, documentation, segregation of duties, information systems processes, risk assessment/control design, closing processes, and the control environment. Little research has examined the consequences of material weaknesses under the COSO classification due to lack of supporting theory (Ettredge et al. 2006). Feng et al. (2009) argue that not all material weaknesses result in uncertainties. They further claim that material weaknesses related to segment disclosure, balance sheet classification, or cash flow classification do not negatively affect the input quality for financial reporting. We encourage future research as well as practitioners to utilize the COSO classification post the implementation of COSO 2013 because it provides more depth and knowledge into the types and severity of ICWs than the traditional classifications in prior literature. The COSO classifications also might help management in identifying the appropriate course of actions to remediate ICWs. 16

17 Remediation of Internal Control Weaknesses Ashbaugh-Skaife et al. (2008) measure the change in ICWs by tracing its disclosure under SOX 302 and their subsequent remediation. Internal control remediation can also be measured by SOX 404 audit opinions, where an unqualified opinion compared to the previous year s adverse opinion indicates remediation, and a persistent adverse opinion indicates pervasive internal control weaknesses. Prior research suggests a positive impact of the remediation of ICWs on U.S. firms. For example, Gupta and Nayar (2007) examine whether the voluntary disclosure of material weakness (post-sox 2002 and prior to SOX 404) by SEC registrants convey value-relevant information to the U.S. equity market. They find that the voluntary disclosure of material weakness is associated with a negative stock price reaction. Further, they show that this reaction is mitigated when the disclosing firms also report remediation action to resolve the disclosed material weaknesses. Surprisingly, they find that the voluntary disclosure of material weaknesses indeed convey value relevant information. In a related study, Ashbaugh-Skaife et al. (2008) find that firms that remediate internal control, by going from adverse to unqualified SOX 404 opinions, show a significant increase in accrual and financial reporting quality. III. THEORETICAL FRAMEWORK OF INTERNAL CONTROL WEAKNESSES Antecedents of Internal control Weaknesses In their influential work, Ashbaugh-Skaife et al. (2007) studied the determinants of ICWs prior to SOX 404 and developed expectations of internal control problems. They introduced a theoretical model of economic factors that contribute to internal control deficiencies such as: internal control risk factors and management s incentives to disclose and report ICWs, prior to SOX 404 and after SOX 302. This internal control risk is operationalized in the model by the 17

18 following factors: the complexity and scope of the firm s operations, the major change in the firm s organizational structure, accounting measurement application risk, lack of firm resources devoted to internal control, and auditor resignation in Factors that affect management s incentives to report and disclose internal control deficiency include: auditor dominance, prior accounting restatement, the dominance of institutional investors, and litigation risk. In related research, Doyle et al. (2007a) examine the severity of internal control material weakness, in the pre-sox 302 and post-sox 404 periods. They use a sample of accelerated filers and examine whether the severity of material weaknesses vary based on the reason for their weakness. They find that there are two types of severity of material weakness, viz. accountspecific material weaknesses (less severe in terms of affecting the reliability of financial statements) and, company-level material weaknesses (more severe). They identify that the determinants of internal control weaknesses are related to staffing, complexity, or general factors. Leone (2007) refutes the findings of Ashbaugh-Skaife et al. (2007) by showing evidence of a positive association between the big-4 audit firms and management incentives to disclose internal control deficiency. They argue that Ashbaugh-Skaife et al. (2007) results are driven by small firms. The argument that smaller firms are more likely to report material weaknesses under SOX 404 suggests that the cost of compliance with SOX 404 for big firms is high. Ge and McVay (2005) find that disclosing material weaknesses is negatively associated with firm size (market capitalization). Furthermore, Ge and McVay (2005) suggest that insufficient resources in internal controls lead to deficiencies in those controls such as: revenue recognition, segregation of duties, the closing process, and accounting reconciliation. Tang and Xu (2010) find a positive association between total institutional ownership and the presence of ICMW. They also find that 18

19 firms have less resource to invest in internal control system when they have pervasive ICMWs than those firms having contained ICMWs. Similarly, Rice and Weber (2012) find that firms are less likely to disclose weakness when they are in need of external capital. This shows an existence of a capital market based incentive to avoid disclosure of ICWs. Overall, prior research suggests that the antecedents of the existence, discovery and reporting of ICWs is associated with failed business infrastructure. This is due to fewer resources invested in internal control systems by such firms. Also, severe types of ICWs are linked to such firms, indicating the persistence of the ICWs and the inability to remediate these deficiencies in the short term. Future research might focus on the implications of unscalability of SOX 2002 on the economic determinants of the ICWs. While the Dodd-Frank Wall Street Reform and Consumer Protection Act (Public Law No: ) was enacted on July 1, 2010 to permanently exempt non-accelerated filers (small firms with 75 million market capitalization) from SOX 404(b); still small firms are required to comply with SOX 404(a). Also, mid- size firms are lacking the resources to automate their internal control systems and hence work on improving their ICWs. Characteristics of Internal control weaknesses Following the enactment of SOX-related internal control provisions, a stream of research (Ge and McVay 2005; Bryan and Lilien 2005; Ettredge et al. 2006; Bédard 2006; Hammersley et al. 2008; Feng et al. 2009; Laux and Stocken 2012; Skaie et al. 2013) emerge to characterize firms with effective versus ineffective internal control systems. Ge and McVay (2005) maintain that firms disclosing material weaknesses under SOX 302 find that material weakness are positively associated with business complexity (e.g., number of reported operating segments and foreign currency translation), and being audited by large firms and negatively associated with 19

20 firm size and profitability. Similarly, Bryan and Lilien (2005) characterize firms with disclosed material weaknesses under SOX 404 as generally smaller, poor performers, financially weaker, and with higher market risks. They also find that the market reacts negatively to the announcement of material weaknesses, but the documented negative stock returns are statistically insignificant. Similarly, Bédard (2006) further explains the improvements in earnings quality reported under SOX 404 as a result of the formal internal control process performed under SOX, either by the internal control system or the external auditor. Ettredge et al. (2006) find that the compliance with SOX 404 is associated with auditor delay. It is worthwhile to note that the audit delay documented in Ettredge et al. (2006) is attributable to SOX 404 and not SOX 2002 itself. The audit delays associated with SOX 404 can be explained by the insufficiency of internal control procedures in firms with ICMWs and the inadequacy and/or ambiguity associated with extended internal control auditing (inquiries, observations, inspections, and evaluation of internal control) as was initially required under AS2 and then amended by AS5 by the PCAOB. Bédard (2006) investigates whether the requirements of SOX 302 and SOX 404 have increased the quality of earnings. She finds that management, either voluntarily or based on a request from the external auditor, reversed the accrual they made in prior years to the disclosure of internal control material weaknesses. However, the magnitude of earnings manipulations reported under SOX 302 was more than that reported under SOX 404, implying that there are significant differences in the consequences of implementing SOX 302 versus SOX 404. Hammersley et al. (2008) investigate the reaction of the market to the disclosure of internal control weakness and the characteristics of this disclosure under Sec 302 of the Sarbanes Oxley Act of They find that certain characteristics of weakness such as their severity, their 20

21 auditability, vagueness of their disclosure and management s decision on the effectiveness of the controls are informative. They also find that the disclosure of the information content of internal control weakness depends on the severity of the weakness. Feng et al. (2009) test the relationship between internal control quality and the accuracy of management guidance. They find that relying on an ineffective internal control system, results in less accurate management guidance. Accurate management guidance decreases information asymmetry by enhancing the transparency and credibility of their financial reporting. Moreover, the negative impact of an ineffective internal control is higher when the weaknesses in internal control are related to revenues and cost of goods sold. They argue that the quality of internal control has a significant effect on management decisions. Dobre (2011) used the model developed by Bollen, Smith and Whaley (2004) for a sample of compliant firms to divide the cost elements of the bid-ask spread during the period of SOX 404 implementation. Findings showed a reduction in the bid-ask spread surrounding the passage of SOX. Singer and You (2011) study the effects of SOX 404 on earnings quality of all complying firms. Results show an increase in the quality of earnings in the post-404 period that was supported by a reduction in the absolute value of discretionary accruals. Laux and Stocken (2012) investigate how the effectiveness of internal control environment affects the relationship between litigation and reporting behavior under SOX. Surprisingly, they find that the quality of a firm s financial reporting may become weak when the penalties are increased for violating the securities law in a weak internal control environment. Thus, management behavior cannot be controlled by governance systems and legal penalties. Cheng et al. (2013) find a causal relation between the quality of financial reporting and investment efficiency by investigating the investment behavior of a sample of firms that 21

22 disclosed internal control weakness under SOX. Findings show that these firms under-invest (over-invest) when they are under financial constrain before ICW disclosure. However, these firms become efficient in investment after ICW disclosure under SOX 404. To sum up, firms with ICWs are characterized as firms having poor performance, financial weaknesses, negative stock market response, issues on disclosure compliance, low audit quality and less accurate audit guidance. If ICWs exist in such failed systems, would regulators work on enforcing firms to disclose such deficiencies or simply focus on remediating such weaknesses? If firms with good internal control systems are financially healthier than firms with ICWs, it would be very economically wise to fix the problem rather than expose it. Giving firms incentives by the SEC (e.g., waiving the proprietary costs associated with the disclosure of ICWs) might also help these firms recover their internal control systems. Consequences of Internal control weaknesses Research on the consequences of the disclosure of internal control weaknesses was triggered by the Ashbaugh-Skaife et al. (2007) and Doyle et al. (2007a), who identified the determinants of disclosing ICWs. However, the consequences of ICWs to U.S. firms are still not clear. Stated differently, research on the consequences of IC weaknesses has shown mixed results. For example, Ashbaugh-Skaife et al. (2009) find a positive association between the cost of capital and the disclosure of material weaknesses under SOX 302 and SOX 404. However, Ogneva et al. (2007) do not find the same relation under SOX 404. Beneish et al. (2008) analyze whether the disclosure of material ICWs under SOX 302 and SOX 404 is related to investor belief revision. 8 They find that the unaudited disclosure of ICMWs under SOX 302 causes an abnormal increase in the equity cost of capital and negative abnormal returns. 8 Belief revision can be defined as the act of continuously changing beliefs due to the arrival of new information to the market. 22

23 In the same vein, De Franco et al. (2005) discuss the wealth change and the redistribution effect of SOX internal control disclosure. They argue that the benefits of SOX 404 are obscure or non-existent. They observed a significant change of wealth in the three days surrounding the disclosure of ICWs, suggesting that the disclosure of an internal control deficiency is new information to the market and that investors incorporate this news into their investment decision. They find cumulative average abnormal returns of -1.8% during the three days surrounding the disclosure of ICWs. They also argue that the net selling of small investors explain these negative returns. This result implies that SOX 404 causes redistribution of wealth from large (sophisticated) investors to small investors because large investors react indifferently to the disclosure of significant deficiencies while small investors sell their stock in response to the disclosure of those deficiencies. In other words, small investors benefit more from material ICWs or significant deficiencies disclosures. Overall, their findings support the conjecture that investors factor the disclosure of ICWs (a piece of information that is assumed to be unknown by investors until it is disclosed) into their decision making. Disclosure of ICWs should compensate traders for the uncertainty surrounding the reporting quality by causing belief revisions regarding the firm s internal control risk. Therefore, uninformed investors are more likely to benefit from this weakness disclosure and less likely to face an adverse selection problem (Beneish et al. 2008). Moreover, uninformed traders, small investors or unsophisticated investors are more likely to alter their trading behavior or leave the market (Frankel and Li 2004; De Franco et al. 2005). Irving (2006) finds that the disclosure of material weakness has information content as measured by stock return volatility and trading volume. Moreover, he provides empirical evidence on the incremental information content of SOX 404 over SOX 302. Likewise, Haron et al. (2010) investigate the relationship between IC 23

24 disclosure and firm performance. They used proxies to measure IC disclosure such as: internal audit quality, quality assurance and oversight. Firm performance is measured by return on asset (ROA) and return on equity (ROE). Overall, their findings suggest that well-performing companies voluntarily disclose internal control effectiveness in their financial reports. Cheh, Lee and Kim (2010) constructed a highly predictive data mining model by investigating a number of independent variables from three published studies. The prediction rate of MW was 98.47% for this model. Li, Sun and Etterdge (2010) studies shows that companies having CFOs with weak qualification (accounting knowledge and experience) receive an initial adverse SOX 404 opinion and have more CFO turnover. Those companies undergoing CFO turnover with adverse opinions hire new CFOs with qualifications. Munsif, Raghunandan, Rama and Singhvi (2011) show that firms enjoy low audit fees when they remediate material weakness in internal controls, with regard to firms that don t remediate. Johnstone, Li and Rupley (2011) find that firms disclosing ICMWs is followed by a turnover of members of the boards of directors, audit committees, and top management, including both CEOs and CFOs. Xu and Tang (2012) examine the effect of internal control material weakness (ICMW) on sell side analysts. Results show that firms reporting ICMW has less accurate earnings forecasts than non-reporting firms. Hoitash et al. (2012) find that firms having strong governance oversight have a negative association between ICMW disclosures and a change in the CFO bonus compensation compared to those firms with weaker oversight. This is more noticeable in firms wherein the cost of misreporting is high. Gordon and Wilford (2012) re-examine the association between material weaknesses in internal control and cost of equity, with particular importance of non-remediation and remediation of MW effect on a firm s cost of equity under SOX 404. Results show that cost 24

25 of equity is negatively impacted by material weaknesses in internal control. Further, results show that there is an increase in the market penalty of a firm s cost of equity in the absence of any remediation of material weaknesses in internal control relative to the number of years a firm reports MW continuously. Li, Peters, Richardson and Watson (2012) study the link between the strength of information technology controls over management information systems and the forecasting ability of the information caused by those systems. They find that management forecasts are not very detailed for firms with IT material weaknesses in their financial reporting system than for firms that do not have material weaknesses. Overall, firms with ICWs are more subject to major restructuring (e.g., merger and acquisition), have low investment in IT, infrastructure, and inadequate accounting resources (Ge and McVay 2005), are likely to be exposed to SEC enforcement actions (Ashbaugh-Skaife et al. 2007), have lower accrual quality (Doyle et al. 2007b), associated with abnormal negative stock price reaction (Hammersley et al. 2008; Beneish et al. 2008), higher restatement (Krishnan and Visvanathan 2007), trigger a debt rating (Gupta and Nayar 2007), and an increased audit fees (Beneish et al. 2008) Possible Implications of COSO-SOX (2013) Internal Control-Integrated Framework on Internal Control Literature Due to the various changes that can affect a business and its operating activities since the inception of the original framework, the 2013 framework is expected to help companies implement internal controls addressing those changes. The updated COSO clarifies that internal control is an on-going and an adaptable process geared towards achieving the firm s objectives on the operation, reporting and compliance levels. The possible implications of COSO (2013) on accounting literature related to ICWs might be vivid. For example, while prior research has been 25