Journal of Accounting and Economics 44 (2007) 166–192 The discovery and reporting of internal control deficiencies prior to SOX-mandated audits $ Hollis Ashbaugh-Skaife a , Daniel W. Collins b, , William R. Kinney Jr. c a School of Business, University of Wisconsin-Madison, Madison, WI 53707, USA b Tippie College of Business, University of Iowa, Iowa City, IA 52242, USA c McCombs School of Business, University of Texas at Austin, Austin, TX 78712, USA Received 1 March 2005; received in revised form 20 October 2006; accepted 26 October 2006 Available online 15 December 2006 Abstract We use internal control deficiency (ICD) disclosures prior to mandated internal control audits to investigate economic factors that expose firms to control failures and managements’ incentives to discover and report control problems. We find that, relative to non-disclosers, firms disclosing ICDs have more complex operations, recent organizational changes, greater accounting risk, more auditor resignations and have fewer resources available for internal control. Regarding incentives to discover and report internal control problems, ICD firms have more prior SEC enforcement actions and financial restatements, are more likely to use a dominant audit firm, and have more concentrated institutional ownership. r 2006 Elsevier B.V. All rights reserved. JEL classification: G34; G38; K22; M41; M49 Keywords: Internal control; Auditing; Regulation; SOX ARTICLE IN PRESS www.elsevier.com/locate/jae 0165-4101/$ - see front matter r 2006 Elsevier B.V. All rights reserved. doi:10.1016/j.jacceco.2006.10.001 $ We thank Andy Bailey, Dave Burgstahler, Ryan LaFond, Thomas Lys, Linda McDaniel, Pamela Murphy, Joel Horowitz, Robert Lipe, Gene Savin, Lynn Turner, Jerry Zimmerman, Editor, Andy Leone, the referee, and seminar participants at the University of Kentucky, Michigan State University, University of North Carolina at Chapel Hill, Ohio State University and the University of Wisconsin-Madison for helpful comments and suggestions. We also thank Guojin Gong, Neil Schreiber, Kwadwo Asare and John McInnis for their capable research assistance. Corresponding author. Tel.: +1 319 335 0912; fax: +1 319 335 1956. E-mail addresses: [email protected] (H. Ashbaugh-Skaife), [email protected] (D.W. Collins), [email protected] (W.R. Kinney Jr.).
Transcript
ARTICLE IN PRESS
Journal of Accounting and Economics 44 (2007) 166–192
0165-4101/$ -
doi:10.1016/j
$We than
Joel Horowit
seminar parti
Chapel Hill,
suggestions.
research assis�CorrespoE-mail ad
william.kinne
www.elsevier.com/locate/jae
The discovery and reporting of internal controldeficiencies prior to SOX-mandated audits$
Hollis Ashbaugh-Skaifea, Daniel W. Collinsb,�,William R. Kinney Jr.c
aSchool of Business, University of Wisconsin-Madison, Madison, WI 53707, USAbTippie College of Business, University of Iowa, Iowa City, IA 52242, USA
cMcCombs School of Business, University of Texas at Austin, Austin, TX 78712, USA
Received 1 March 2005; received in revised form 20 October 2006; accepted 26 October 2006
Available online 15 December 2006
Abstract
We use internal control deficiency (ICD) disclosures prior to mandated internal control audits to
investigate economic factors that expose firms to control failures and managements’ incentives to
discover and report control problems. We find that, relative to non-disclosers, firms disclosing ICDs
have more complex operations, recent organizational changes, greater accounting risk, more auditor
resignations and have fewer resources available for internal control. Regarding incentives to discover
and report internal control problems, ICD firms have more prior SEC enforcement actions and
financial restatements, are more likely to use a dominant audit firm, and have more concentrated
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 167
1. Introduction
This study investigates the economic factors that expose a firm to internal control riskand management’s incentives to discover and report an internal control deficiency (ICD).Section 404 of the Sarbanes–Oxley Act (US Congress, 2002), denoted SOX requires thatpublic company financial statements filed on Form 10-K and Form 10-Q contain anassessment by management of the design and operating effectiveness of its internal controlover financial reporting. Section 404 also requires that the external auditor, on an annualbasis, provide an opinion on management’s assessment of internal control (Securities andExchange Commission (SEC), 2003).
Before the implementation of SOX Section 404, Section 302 of SOX required thatmanagement evaluate the effectiveness of disclosure controls and procedures, report resultsof their evaluation, and indicate any significant changes in internal control since the lastForm 10-K or Form 10-Q filing (SEC, 2002). The SEC defines disclosure controls andprocedures as ‘‘controls and other procedures of an issuer that are designed to ensure thatinformation required to be disclosed by the issuer in the reports filed or submitted by itunder the Exchange Act is recorded, processed, summarized and reported, within the timeperiods specified in the Commission’s rules and forms’’ (SEC, 2002). However, neither theSEC nor SOX Section 302 specify particular procedures to be applied by management inevaluating internal controls nor do they require independent audits of internal controls.
Furthermore, while Section 302 requires management to report any discovered materialweaknesses to their external auditor and the audit committee (SEC, 2003), whether suchICDs had to be disclosed to shareholders in public SEC filings is less clear. As an exampleof this ambiguity, the SEC staff addressed the ‘‘frequently asked’’ question: ‘‘Is a registrantrequired to disclose changes or improvements to controls made as a result of preparing forthe registrant’s first management report on internal control over financial reporting?’’(SEC, 2004, Question 9). The staff’s answer was that they ‘‘would welcome disclosure of allmaterial changes to controls’’ whether before or after the Section 404 compliance date, butthey ‘‘would not object’’ if a registrant did not disclose changes made in preparation forthe registrant’s first management report under Section 404. The staff added to its response‘‘However, if the registrant were to identify a material weakness, it should carefullyconsider whether that fact should be disclosed as well as changes made in response to thematerial weakness’’. Thus, under the provisions of Section 302, the review of internalcontrol is subject to less scrutiny by both management and the auditor and the disclosurerules are less specific than subsequently exist under Section 404.1 This suggests thatmanagers had more discretion in disclosing ICDs during the pre-Section 404 regime.
We use ICD disclosures provided by firms after Section 302 became effective, but before
the effective date for independent internal control audits mandated by Section 404 to study
1Further evidence that management exercised some discretion in disclosing ICDs during the pre-Section 404
regime is provided by a Glass Lewis & Company report (Glass Lewis, 2005) that 87% of firms disclosing ICDs in
the first 3 months of 2005 certified their controls as effective under SOX 302 in the previous quarter. Some of these
occurrences were due to new GAAP guidance on application of lease accounting rules provided by the SEC in
February 2005 that managers were unaware of when they certified that controls over financial reporting were
effective in the prior quarter (SEC, 2005). However, a large percentage of the ICD disclosures made early in the
SOX 404 regime related to more systemic control problems of long standing (e.g., inadequate recording of
inventory or improper year-end roll-up procedures) suggesting that managers had either not yet detected ICDs or
did not feel compelled to disclose these weaknesses during the SOX 302 regime.
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192168
the firm characteristics that contribute to internal control risks and the incentives faced bymanagers to discover and disclose internal control problems. During this era, bothaccelerated and non-accelerated filers reported material weaknesses as well as lesserdeficiencies that are not required to be disclosed under SOX 404 reporting.2 Thus, wedocument the determinants of ICDs for a broad cross-section of SEC registrants.Estimating determinants of ICDs across a broad cross-section of firms is important fordeveloping investor expectations about internal control problems given non-acceleratedfilers are not yet required to comply with SOX 404.3
Three conditions must exist for a registrant to disclose an ICD under Section 302. First,an ICD must exist; second, the deficiency must be discovered by management or theindependent auditor; and third, management, perhaps after consultation with itsindependent auditor, must conclude that the deficiency should be publicly disclosed.4
Our sample of ICD disclosers begins with 585 firms identified by Compliance Week
from November 2003 to December 31, 2004 that disclosed ICDs in any SEC filing. Tocontrol for industry and time-specific factors, we collect parallel data on more than 4000firms in the same industries over the same time period that did not report ICDs prior toDecember 31, 2004.We model pre-SOX 404 ICD disclosures as a function of internal control risk factors
and incentives of managers and auditors to discover and disclose ICDs. Our internalcontrol risk factors include the complexity and scope of firms’ operations, changes in firms’organizational structure, accounting measurement application risk (e.g., exposure toaccounting errors caused by difficulty or judgment in applying accounting procedures),lack of firm resources to devote to internal control and whether the auditor resigned in2003. We use auditor dominance, sensitivity to regulatory intervention in financialreporting due to prior restatement or SEC enforcement actions, monitoring byinstitutional investors, and industry litigation risk to proxy for incentives to discoverand disclose ICDs.As expected, ICD disclosers have more complex operations as proxied by the number of
business segments and foreign sales, and more often engage in acquisitions andrestructurings relative to non-ICD disclosure firms. The results also indicate that ICDdisclosers face greater accounting procedure application risk as firms with greater salesgrowth and levels of inventory are more likely to report an ICD. We find that smallerfirms, firms reporting a higher frequency of losses and firms in financial distress are morelikely to disclose ICD weaknesses. A highly significant risk factor that explains theincidence of an ICD is the auditor resigning in the year prior to the ICD disclosure.
2Non-accelerated filers are firms with total market capitalization less than $75 million. Non-accelerated filers
are not required to comply with the SOX Section 404 reporting provisions until fiscal years ending on or after July
15, 2007.3Prior to SOX, public firms could voluntarily assess and report on the effectiveness of internal controls, but few
firms did so. For example, McMullen et al. (1996) report that of 2221 firms listed on NAARS with December 31,
1993 fiscal year ends, only 55 contained a management statement that internal controls were ‘‘effective as of fiscal
year end’’. Furthermore, McMullen et al. (1996) do not indicate whether any of the management reports were
audited or reviewed by their external auditors even though auditing standards allowed such association (AICPA,
1988).4See Kinney and McDaniel (1989) for parallel arguments about disclosure of misstatements of quarterly
earnings.
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 169
Regarding variables that proxy for the incentives to discover and report internal controlproblems, our results indicate that firms that contract with the largest US audit suppliers,have had negative publicity about financial reporting as evidenced by prior restatements orsanctions from SEC Accounting and Auditing Enforcement Releases (AAERs), and thathave concentrated institutional ownership are more likely to disclose an internal controlproblem. These results are robust to using alternative measures of internal control risk andincentives to report.
Many have claimed that the passage of SOX imposed an extreme burden on SECregistrants by requiring them to document, evaluate, publicly report, and have audited theeffectiveness of their internal controls. Contemporaneous and concurrent researchexamines different aspects of SOX in an attempt to evaluate the Act’s costs and benefits(e.g., see Ashbaugh-Skaife et al., 2006a; Beneish et al., 2006; De Franco et al., 2005; Doyleet al., 2006b; Hammersley et al., 2005; Hogan and Wilkins, 2006; Ogneva et al., 2005;Zhang, 2005). Our study contributes to this literature by investigating the causes of ICDsand managements’ incentives to report these deficiencies during a regulatory transitionperiod in which there was mandated certification of disclosure controls and procedures,but no review procedures specified for management, no internal control audit requirement,limited guidance on classifications of severity of control deficiencies, and considerabledisclosure discretion on the part of management.
Our research is most closely related to a concurrent study by Doyle et al. (2006a) whoexamine the determinants of internal control deficiencies based on a sample of firms thatdisclosed ‘‘material weakness’’ control deficiencies during both the SOX 302 and 404reporting regimes. As in our study, Doyle et al. (2006a) find ICDs are more likely for firmsthat are smaller, financially weaker, more complex, growing rapidly and undergoingrestructuring.
Our study differs from the Doyle et al. (2006a) study along several dimensions. First,Doyle et al. (2006a) restrict their analysis only to firms that report ‘‘material weakness’’ICDs, while we consider all three levels of internal control deficiencies as set forth by thePublic Company Accounting Oversight Board (PCAOB) in Auditing Standards (AS)No. 2—material weaknesses, significant deficiencies and control deficiencies (PCAOB,2004).5 We include all levels of control deficiencies because regulatory guidancedefining levels of severity of control deficiencies was not released until March of 2004,which is well after many firms provided their first disclosure of control problems. As aresult, the inter-firm consistency of these self-reported classifications of control weaknessesis problematic.6
A second distinction between our study and Doyle et al. (2006a) is that our analysis islimited to ICDs disclosed during the SOX 302 regulatory regime. Because SOX 302internal control disclosures are subject to less regulation and allows more managementdiscretion than control disclosures made during the SOX 404 audit regime, ourdeterminant model includes a number of variables designed to capture firms’ incentivesto discover and report control deficiencies variables that capture, incentives to detect and
5See discussion in Section 2 for distinction between these three levels of control deficiencies.6For example, a deficiency that one firm considers to be a material weakness, another firm might classify as a
significant deficiency, or vice versa. By considering all types of ICDs in our model, we avoid errors due to
inconsistencies of self-classifications that are introduced when restricting the analysis to ICDs of one classification
type.
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192170
report are omitted from the Doyle et al. (2006a) study because they focus onmaterial weakness disclosures that they deem to be required disclosures in both the 302and 404 reporting regimes. Moreover, by restricting their analysis to material weaknessdisclosures, Doyle et al. (2006a) ignore lesser control problems that arguably have asignificant impact on the reliability of firms’ financial statements (Ashbaugh-Skaife et al.,2006b).Finally, because we study disclosures made during a reporting regime that predated
SOX 404 internal control audits, our study identifies factors that contribute to internalcontrol problems for a broad cross-section of publicly traded firms that includes bothaccelerated and non-accelerated filers. Thus, our ICD model facilitates the formation ofexpectations about the determinants of ICDs that is more representative of the underlyingpopulation of firms that face control problems because our sample cuts across firms of allsizes in contrast to the sample in the Doyle et al. (2006a) study that contains a higherproportion of accelerated filer (larger) firms. Later in our paper, we demonstrate how thisdifference in sample composition influences the results.The remainder of the paper proceeds as follows. Section 2 elaborates on the regulations
of SOX pertinent to reporting ICDs and introduces our conceptual framework for ICDdisclosures. Section 3 describes our sample and descriptive statistics. Section 4 presents themultivariate analysis of the determinants of ICDs, as well as marginal effects, andsensitivity analyses of alternative measures of explanatory variables. Section 5 presents oursummary and conclusions and identifies several avenues for future research.
2. Regulatory and conceptual background
The lack of guidance on distinguishing between levels of severity of internal controlproblems prior to AS No. 2 makes firms’ classification and users’ interpretation of ICDreporting under Section 302 somewhat difficult. AS No. 2 identifies three levels of internalcontrol deficiencies based on the likelihood that a material misstatement of annual orinterim financial statements might result (PCAOB, 2004). Specifically, AS No. 2 states:
A control deficiency exists when the design or operation of a control does notallow management or employees, in the normal course of performing theirassigned functions, to prevent or detect misstatements on a timely basis (ASNo. 2, paragraph 8).A significant deficiency is a control deficiency, or combination of control deficiencies,that adversely affects the company’s ability to initiate, authorize, record, process, orreport external financial data reliably in accordance with generally acceptedaccounting principles such that there is more than a remote likelihood that amisstatement of the company’s annual or interim financial statement that is morethan inconsequential will not be prevented or detected (AS No. 2, paragraph 9).A material weakness is a significant deficiency, or combination of significantdeficiencies, that results in more than a remote likelihood that a materialmisstatement of the annual or interim financial statements will not be prevented ordetected (AS No. 2, paragraph 10).
The three categories differ in the probability that a misstatement of a particular amountmight not be prevented or detected by the company’s disclosure controls and procedures.Some firms used terminology about classification of the severity of the deficiency from
ARTICLE IN PRESS
ICD risk exposures Complexity and scope of operations
Organizational change
Accounting application risk
Internal control resources
ICD existence
ICD discover and disclose incentivesAuditor technology and scrutiny
Regulator intervention threats
Investor intervention threats
Litigation risk
ICD detection
+
=
Pre-SOX 404 audit
ICD Disclosure
Fig. 1. Conceptual model of pre-SOX mandated audit disclosure of internal control deficiencies (ICDs).
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 171
prior standards for internal control reporting,7 some used AS No. 2 terminology, and someused neither. Despite the ambiguities, Compliance Week and other researchers haveattempted to retrofit ICD disclosures into the AS No. 2 framework for investigatingSection 302 disclosures (e.g., Hammersley et al., 2005; Doyle et al., 2006a).
Management’s incentive to provide an ICD disclosure prior to a SOX 404 audit involvestrading off the expected benefits from the discovery and disclosure of an ICD and the costsof disclosing an ICD. One of the potential costs of providing an early ICD disclosure isthat it may expose management to criticism for lax organization and mismanagement. AnICD disclosure might also cast doubt on the reliability of management’s prior financialreports including increased concern that financial restatements might result. An additionalcost of an early ICD disclosure is the potential increase in the risk of private litigation byinvestors for not discovering and reporting the deficiencies earlier. On the positive side,however, early disclosure of an ICD may allow management to ‘‘get in front of the issues’’(Karr, 2005), or perhaps signal that the firm does not have more serious problems such as amaterial weakness or heightened likelihood of future restatements (Martinek, 2005).Furthermore, because the SEC assesses no penalties for having a material weakness orsignificant deficiency in internal control, there is no risk of regulatory sanctions for internalcontrol weaknesses per se. Rather, there is risk of sanctions for not disclosing knownmaterial weaknesses in internal control or changes in internal control status.
A conceptual model of the existence, detection and reporting of internal controldeficiencies before SOX 404 audits is presented in Fig. 1. We model the existence ofinternal control deficiencies as a function of a number of internal control risk factors andthe detection and reporting as a function of audit quality and the incentives thatmanagement and its auditor have for early reporting of internal control problems.Although we classify the determinants of ICD disclosure into the two broad categories of
7Many Section 302 certifications from 2003 and early 2004 refer to ‘‘reportable conditions,’’ a term from
AICPA auditing and attest standards guidance that predates SOX (AICPA, 1988, 2001). AS No. 2 also specifies
new uncertainty terminology such as ‘‘a remote likelihood’’ to characterize the likelihood of material misstatement
required to make an ICD a material weakness whereas prior guidance used ‘‘a relatively low level [of] risk’’
(AICPA, 1988). The possible differences in management and auditor implementation due solely to the 2004
changes in guidance led us to combine all ICD disclosures.
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192172
IC risk exposures and ICD discovery and disclosure incentives, we recognize that several ofthe variables we use could proxy for both risk effects and incentive effects. We highlightthis potential dual role for several explanatory variables below.The IC risk factors include the complexity and scope of firms’ operations, changes in
organizational structure, accounting measurement application risk, and firm resources(or lack thereof) invested in internal controls. We posit that firms with greater complexityand scope of operations are more likely to encounter internal control problems. Thecomplexity of firm operations, and consequently, the intricacy of its transactions increaseas the firm operates in diverse industries or in international markets. The morecomplicated the firm’s transactions, the more difficult to structure adequate internalcontrols. In addition, multi-segment firms potentially face more internal control problemsrelated to the preparation of consolidated reports (e.g., the proper elimination of intra-company transactions). Moreover, the more diverse and multifaceted a firm’s operationsthe greater the chance there will be breaches in the year-end closing and roll up procedures.We use SEGMENTS, defined as the number of reported business segments in 2003, andFOREIGN_SALES, coded one if a firm reports foreign sales in 2003 and zero otherwise,to proxy for the complexity and scope of operations. Both SEGMENTS andFOREIGN_SALES are identified using the Compustat Segment file.We conjecture that firms are more likely to have ICDs when they have recently changed
organization structure either through mergers or acquisitions or through restructurings.Acquiring firms face significant internal control challenges when integrating theiroperations, systems, and cultures with those of acquired firms. Furthermore, failure todevelop adequate controls over accounting for acquired assets can increase internal controlrisk for acquiring firms. Firms participating in down-sizing and restructurings are likely toface greater internal control risk due to personnel problems related to the segregation ofduties, inadequate staffing and supervision problems. We use M&A and RESTRUC-TURE to proxy for recent changes in organizational structure. M&A is coded one if thefirm has been involved in a merger or acquisition from 2001 to 2003 (CompustatAFTNT1), and zero otherwise. RESTRUCTURE is coded one if a firm has been involvedin a restructuring from 2001 to 2003 and zero otherwise, where non-zero values ofCompustat data items 376, 377, 378 or 379 are used to identify sample firms engaged inrestructurings. We expect a positive relation between firms’ ICD disclosures and M&A andRESTRUCTURE.We use GROWTH, defined as the average percentage change in sales (Compustat #12),
and INVENTORY, defined as inventory (Compustat #3) as a percentage of total assets(Compustat #6), to capture firms’ operating characteristics that are likely to expose themto greater accounting measurement application risks (Kinney and McDaniel, 1989).Rapidly growing firms are more likely to have systems that fail to keep pace with increasesin customer demand or entry into new markets. Furthermore, growing firms are morelikely to encounter staffing issues as the scope and complexity of their operations expand.Firms with more inventory face increased internal control risks related to the propermeasurement and recording of inventory, misreporting due to theft, and timely recognitionof inventory obsolescence.Information and control systems have a large fixed cost component and are costly to
install and maintain. Conditional on their resources, firms will make differentialinvestments in information and control systems. We reason that smaller firms have lessto invest in sophisticated information systems (e.g., enterprise resource planning systems
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 173
such as SAP) that can enhance internal control, and they are less likely to have adequatepersonnel and expertise to maintain these systems. We use SIZE, as measured by themarket value of equity (Compustat #199*Compustat #25), to proxy for firms’ investmentin information systems and internal control, where smaller firms are expected to haveweaker internal controls (DeFond and Jiambalvo, 1991). Following the work of Wrightand Wright (1996) who find a negative association between firm size and accounting errors,we predict a negative relation between SIZE and ICD disclosures.
We use two additional variables to capture the impact of low investment in informationand control systems on the likelihood of ICDs. We posit that poorly performing firms andfirms in financial distress are more likely to under invest in systems and controls and havestaffing problems that lead to IC weaknesses. We use %LOSS, defined as the proportion ofyears from 2001 to 2003 that the firm reported negative earnings (Compustat #118), toproxy for poor performance. Firms with a greater frequency of losses are expected toexhibit a higher likelihood of an ICD due to lack of investment in internal controls(Krishnan, 2005). We use the Altman z-score, ZSCORE, to capture distress risk withhigher z-scores indicating less distress risk (Altman, 1968).8 We predict a positivecoefficient on %LOSS and a negative coefficient on ZSCORE.
The resignation of the auditor in the year prior to an ICD disclosure is viewed as anotherICD risk factor. An auditor will resign from an audit engagement when the expected costsof being associated with an audit client exceed anticipated revenues. This might occurwhen the auditor believes that a client’s internal controls are excessively weak and thatadequate client resources are not available to remedy the problem.9 We use AuditAnalytics to identify firms in both the ICD sample and the control sample that switchedauditors during the 12-month period beginning in the fourth month after the close of fiscalyear 2002 through the third month after the close of fiscal year 2003.10 We collect the 8-Kfilings for sample firms that changed auditors and code AUDITOR_RESIGN as one forfirms that state their auditor resigned during this 12-month period, and zero otherwise. Wepredict a positive relation between ICD and AUDITOR_RESIGN as an auditorresignation may indicate unacceptable audit engagement risk due to weak operatingperformance and financial distress that reflects inadequate investment in internal control.11
8Prior and concurrent research often times uses accounting-based performance metrics such as return-on-equity
(ROE) or return-on-assets (ROA) as a proxy for the resources available to invest in internal control systems.
While useful in assessing firm performance, we elect not to use ROE or ROA as a determinant in our ICD
disclosure model because using these measures implicitly assumes a monotonically increasing investment in
internal control as performance improves. As stated above, much of the investment in internal control is fixed, and
as such, we argue %LOSS and ZSCORE are better indicators of lack of investment in IC.9An auditor’s decision to resign from an engagement is complex and may result from various causes (Shu,
2000). For example, auditor resignation may reflect the auditor’s belief that client management lacks integrity and
may commit fraud by overriding internal controls. Alternatively, the auditor may believe that it can earn higher
returns with other clients and therefore resigns from the audit. Auditor resignation due to the latter reason
introduces noise in this explanatory variable.10We allow for a 3-month window after fiscal year-end because most auditor changes occur after the fiscal year-
end closing date but before the annual shareholder meeting (typically held in the fourth month after fiscal year-
end) at which time a proxy vote for appointment of the external auditor takes place.11Firms changing auditors have long been required to disclose any internal control problems identified by
predecessor auditors (AICPA, 1988; SEC, 1988; Whisenant et al., 2003). In the sensitivity section of the paper, we
report the results of our ICD determinant model after deleting the 12 ICD firms that disclosed an internal control
deficiency in conjunction with reporting a change in their external auditor.
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192174
Fig. 1 also models the factors that contribute to the detection and reporting of an ICD.We use auditor dominance, regulatory oversight in financial reporting due to priorrestatement or SEC enforcement actions, monitoring by institutional investors, andindustry litigation risk to proxy for incentives to discover and disclose ICDs.The quality of the external auditor is one factor that contributes to the detection of an
ICD even in the era prior to mandated audits of internal control under Section 404. This isbecause detection of an ICD by the auditor is a function of its strategy and scrutiny inconducting financial statement audits and the quality of any optional audit technology thatmight be used in evaluating internal control as part of the financial statement audit.We expect dominant audit suppliers to be more likely to uncover, as well as to require
management disclosure of any known ICD for several reasons. First, dominant auditsuppliers are likely to provide higher quality financial statement audits that include moresystematic examination and review of internal controls relative to other audit suppliersbecause dominant audit suppliers face greater loss of reputation by conducting poorquality audits (DeAngelo, 1981; Shu, 2000). Second, dominant audit suppliers invest morein technology and training that facilitates the discovery of internal control problems.Third, based on Dye’s (1993) work that links audit quality to auditor wealth, dominantaudit suppliers hold greater litigation risk and thus face greater incentives to require ICDdisclosure in order to avoid costly lawsuits.We classify BDO Seidman, Deloitte and Touche, Ernst and Young, Grant Thornton,
KPMG, and PricewaterhouseCoopers as the dominant audit suppliers. We include BDOSeidman and Grant Thornton in the dominant auditor classification because these twofirms acquired a significant number of SEC reporting clients following the demise ofArthur Andersen, which results in these firms facing additional litigation risk related toICD reporting.12 AUDITOR is coded one for firms that contract with a dominant auditsupplier, and zero otherwise. We predict a positive relation between AUDITOR and ICDdisclosures.Fig. 1 also links managers’ incentives to discover and report internal control problems
with the likelihood of an ICD disclosure. In general, management faces greater incentivesto discover and report internal control weaknesses when the firm is subject to greatermonitoring by stakeholders and when those stakeholders have greater incentives to initiatelitigation if the firm’s financial reporting process is deemed to be deficient. We use threevariables to capture managers’ incentives to discover and report ICDs prior to SOX 404audits—either prior restatements or an SEC AAER, concentrated institutional ownership,and industry litigation risk.RESTATEMENT is coded one if the firm restated its financial statements or was the
object of an AAER from 2001 to 2003, and zero otherwise.13 We view RESTATEMENT
12In the sensitivity section of the paper we report the results when classifying Deloitte and Touche, Ernst and
Young, KPMG, and PricewaterhouseCoopers as the dominant audit suppliers.13Restatements announced by public companies from January 1, 2001 to December 31, 2003 are identified from
various sources using the procedure outlined in Kinney et al. (2004), and the population of AAERs released by the
SEC during the same time period comprises the AAER component of RESTATEMENT. Specifically,
restatements are identified from public sources by searching the Lexis-Nexis News and Form 8-K library files,
the Securities Class Action Alert, and various business journals such as the Wall Street Journal, New York Times,
Washington Post, and Los Angeles Times. The key word search used ‘‘restat,’’ ‘‘revis,’’ ‘‘adjust,’’ and ‘‘error,’’ and
phrases such as ‘‘responding to guidance from the SEC.’’ Our AAER search identified specific issuers that were
the subject of the release.
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 175
as a proxy for managers’ incentives to discover and report ICDs because we posit thatfirms are more likely to be forthcoming about control problems when the quality of theirfinancial statements has been questioned by market regulators or auditors in the past.14
Prior research suggests that firms suffer, on average, a 25% decline in stock price whenearnings restatements are announced (Richardson et al., 2003). Thus, the market imposes aheavy penalty on firms that restate earnings. We expect that management of firms thathave incurred such penalties in the recent past will have strong incentives to avoidincurring these penalties in the near future and, therefore, will be particularly diligentabout discovering and reporting ICDs to reduce the risk of another restatement or AAER.Accordingly, we predict a positive relation between RESTATEMENT and ICDdisclosures.15
We also posit that managers of firms with more concentrated ownership face greaterincentives to discover and disclose ICDs due to increased monitoring and greater litigationthreats from concentrated owners. Prior research suggests that institutional owners thathold large blocks of shares have both the incentives to monitor management and they havethe voting power to bring pressure to bear on management to effect change when controlproblems surface (Jensen, 1993; Shleifer and Vishny, 1997). We use INST_CON, measuredas the percentage of shares held by institutions divided by the number of institutions thatown a firm’s stock (Compact D), as our measure of concentrated institutional ownership.We predict a positive relation between INST_CON and ICD disclosures.
The last variable used to proxy for managers’ incentives to discover and disclose ICDs isLITIGATION, which is coded one if a firm operates in a litigious industry and zerootherwise.16 Managers of firms facing greater risk of lawsuits have greater incentives todisclose the adverse news of an IC problem to minimize potential share price declines thatcan trigger shareholder litigation. The LITIGATION variable could also serve as a proxyfor IC risk if industries are subject to litigation because there is significant reportingcontrol risk. For either reason, we expect a positive relation between LITIGATION andICD disclosures.
In summary, we posit that the disclosure of an ICD prior to a SOX 404 audit is a jointfunction of firm-specific economic attributes that expose firms to internal control risks andthe incentives of firms’ management and external auditors to discover and disclose internal
14One might conjecture that restatements are primarily due to internal control problems. However, for our
Section 302 ICD sample firms with restatements, only 12% mention internal control problems as the primary
restatement cause, while 15%, 27%, and 12%, respectively, mention management fraud, judgment error, and
GAAP interpretation different from the SEC’s, with 34% silent about cause.15RESTATEMENT might also be viewed as an internal control risk proxy. But the predicted relation between
RESTATEMENT and ICD is ambiguous in this case. On the one hand, firms with prior restatements may exhibit
lower incidence of ICDs in the future because they have improved their accounting processes in order to avoid the
negative market consequences of reporting another restatement, making it less likely that ICDs will exist (and be
reported) going forward. On the other hand, one could argue that firms with prior restatements are more likely to
have additional internal control problems that will resurface in the future, leading to a predicted positive relation
between RESTATEMENT and ICD. Thus, if RESTATEMENT serves as an internal control risk proxy, its
predicted relation with an ICD disclosure is indeterminate. Based on extant guidance and analysis of stated
reasons for prior restatements noted in footnote 15, we conclude that our sample’s restatements more likely proxy
for incentives to report than internal control risk. However, we acknowledge that the significance of this variable
may reflect both internal control risk effects and incentive to discovery and report effects.16Consistent with Francis et al. (1994) firms with primary SIC codes of 2833–2836 (biotechnology), 3570–3577
(computer equipment), 3600–3674 (electronics), 5200–5961 (retailing), and 7370–7374 (computer services) are
coded one, and zero otherwise.
ARTICLE IN PRESS
Table 1
Variable definitions
Variables Predicted
sign
Definitions and data source
IC risk attributes
SEGMENTS + Number of reported business segments in 2003 (Compustat
Segment file).
FOREIGN_SALES + Coded one if a firm reports foreign sales in 2003, and zero
otherwise (Compustat Segment file).
M&A + Coded one if a firm is involved in a merger or acquisition from
2001 to 2003, and zero otherwise (Compustat AFNT #1).
RESTRUCTURE + Coded one if a firm was involved in a restructuring from 2001 to
2003, and zero otherwise. This variable is coded one if any of the
following Compustat data items are non-zero: 376, 377, 378 or
379.
GROWTH + Average growth rate in sales from 2001 to 2003 (Percent change
in Compustat #12).
INVENTORY + Average inventory to total assets from 2001 to 2003 (Compustat
#3/#6).
SIZE � Average market value of equity from 2001 to 2003 in $ billions
(Compustat #199 * #25).
%LOSS + Proportion of years from 2001 to 2003 that a firm reports
negative earnings.
RZSCORE � Decile rank of Altman (1980) z-score measure of distress risk.
AUDITOR_RESIGN + Coded 1 if auditor resigned from the client during the 12-month
period beginning in the fourth month after the close of fiscal year
2002 through the third month after the close of fiscal year 2003,
zero otherwise (Audit Analytics and 8-K filings).
Proxies for incentives to discover and disclose
AUDITOR + Coded one if a firm engaged one of the largest six audit firms for
2003, and zero otherwise (Compustat). Largest six audit firms
include PWC, Deloitte & Touche, Ernst and Young, KPMG,
Grant Thornton and BDO Seidman.
RESTATEMENT + Coded one if a firm had a restatement or an SEC AAER from
2001 to 2003 and zero otherwise.
INST_CON + Percentage of shares held by institutional investors divided by the
number of institutions that own the stock as of December 31,
2003 (Compact D).
LITIGATION + Coded one if a firm was in a litigious industry—SIC codes
2833–2836; 3570–3577; 3600–3674; 5200–5961; and 7370, and
zero otherwise.
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192176
control problems. The variables used to capture the determinants of pre-404 ICDdisclosures are summarized in Table 1.
3. Sample and descriptive statistics
3.1. Sample
Our initial sample of firms providing disclosure of ICDs is obtained from monthlycompilations of SEC filings reported in Compliance Week, a weekly electronic newsletter
ARTICLE IN PRESS
Table 2
Sample selection criteria
Number of firms disclosing internal control deficiencies 11-03 through 12-04a 585
Elimination of duplicate firms (47)
Elimination of firms from financial services and utilities industries (16)
Firms not covered by Compustat (73)
Firms with insufficient Compustat data (108)
Firms with insufficient return/price data (15)
Internal control deficiency (ICD) sample 326
Control sampleb 4484
aSource: Compliance week.bAll firms having the necessary data on Compustat and CRSP to estimate the ICD disclosure model.
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 177
published by Boston’s Financial Media Holdings Group. The sample period spans filingsmade from November 2003 to December 2004 and includes 585 separate disclosures madeby 538 firms.17 Additional data requirements to estimate the multivariate logit model(described more fully below) reduced the final sample to 326 firms as detailed in Table 2.Henceforth, we refer to this group of firms as the ICD sample. All remaining firms on theCompustat Annual Industrial Full Coverage and Research files not identified as providinga disclosure of ICD prior to December 31, 2004 and with the required data for estimatingour model of ICD reporting comprise our control sample of 4484 firms.18
3.2. Descriptive statistics and univariate results
Panel A of Table 3 presents descriptive statistics and the results of univariate tests thatstatistically assess the comparisons between the ICD and control samples. Summarystatistics for the continuous variables, which represent the average value calculated overthe 3 years prior to the filing of the ICD report (i.e., from 2001 to 2003), include the mean,standard deviation (std. dev.), first quartile, third quartile, and median. The mean valuesreported for the categorical variables show the proportion of treatment or control firmsthat possess the indicated characteristic.
With few exceptions, the descriptive statistics in Table 3 support our predictions aboutthe determinants of ICD disclosures. For the ICD risk attributes, we find that firmsreporting control deficiencies have more segments and are more likely to have foreignsales, be involved in mergers and acquisitions, and engage in restructurings. ForGROWTH and INVENTORY, the two variables that proxy for accounting measurementapplication risk, we find significantly higher median values for both variables for the ICDfirms relative to control firms as predicted. The univariate results on SIZE as a proxy for
17Through the end of 2004, Compliance Week identified ICD firms by filtering all SEC filings of all registrants
for the key words that would indicate an internal control deficiency. We read the ICD firms’ SEC filings over
2001–2004 to determine the date of the first public disclosure of an ICD. These filings include forms 10-K, 10-Q,
8-K, S-3, S-4 and proxy statements. We find that all firms identified by Compliance Week as having an internal
control problem did disclose an ICD in a SEC filing, but approximately 39% of the firms disclosed an ICD in an
earlier SEC filing than the one reported in Compliance Week. Beginning January 1, 2005, Compliance Week filters
only the SEC filings of firms comprising the Russell 3000, suggesting that samples drawn from Compliance Week
after December 31, 2004 are not representative of the US equity market.18Accelerated filers comprise 59.8% of our ICD sample and 52.9% of our control sample.
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192178
investment in internal controls are mixed; the average size of the ICD sample ($.885billion) is slightly smaller than the control sample ($1.164 billion), while the median size ofthe ICD firms ($.140 billion) is significantly larger than the control firms ($0.091 billion).Turning to the three other variables used to proxy for firms’ investment in internal controls(%LOSS, ZSCORE and AUDITOR_RESIGN), the descriptive statistics indicate thatICD firms have a higher incidence of losses and more often have their auditors resign fromthe engagement. The descriptive statistics on ZSCORE show that this variable is highlynegatively skewed. Accordingly, we focus on median tests that suggest there is nodifference in bankruptcy risk between ICD and control firms.The univariate tests also suggest significant differences between the ICD firms’ and
control firms’ ability to detect IC weaknesses and incentives to disclose ICDs. A higherproportion of firms in the ICD sample are audited by a dominant audit firm, are morelikely to have restated earnings or have SEC AAERs sometime during the period from2001 to 2003, and have a higher concentration of institutional shareholders. There is,however, no significant difference in the proportion of ICD firms versus control firms thatoperate in litigious industries.We present pair-wise correlations in Panel B of Table 3, where the upper right-hand
portion of the table presents Pearson product–moment correlations and the lower left-hand portion presents the Spearman rank–order correlations. We discuss the Pearsoncorrelations, but note that the patterns of the two correlations are quite similar. The largestcorrelations are a significant positive correlation of 0.372 between ZSCORE andAUDITOR, followed by a significant positive correlation of 0.307 between RESTRUC-TURE and AUDITOR. The vast majority of other correlations fall between 70.20, whichsuggests that the variables included in our determinant model capture distinct features offirms’ internal control risks and incentives to report.Overall, the descriptive statistics suggest that firms disclosing ICDs prior to SOX 404
audits face greater operating and reporting risks relative to non-ICD firms. In the nextsection we conduct more formal tests of our hypotheses using multivariate logisticregression.
4. Multivariate analysis of ICD disclosure
We use the following logistic regression model to assess the extent to which internalcontrol risk attributes and incentives to discover and early report internal control problemsare associated with firms’ ICD disclosures:
ICD_DISCLOSURE
¼ b0 þ b1 SEGMENTSþ b2 FOREIGN_SALES
þ b3 M&Aþ b4 RESTRUCTUREþ b5RGROWTH
þ b6 INVENTORYþ b7 SIZEþ b8 %LOSSþ b9RZSCORE
þ b10AUDITOR_RESIGNþ b11 AUDITOR
þ b12 RESTATEMENTþ b13 INST_CON
þ b14 LITIGATIONþ e, ð1Þ
where ICD_DISCLOSURE is coded one for ICD firms and zero for control firms. Wetransform GROWTH to be the decile rank of the average sales growth from 2001 to 2003
ARTIC
LEIN
PRES
STable 3
Descriptive statistics on the determinants of internal control deficiency disclosures
Mean Std. dev. Q1 Median Q3
Panel A: Distributional properties of independent variables
***, **, *Indicates significance at the 0.01, 0.05, and 0.10 level or better, respectively, based on t-statistic for difference in means or based on Z-statistic for difference
in medians. There are 326 firms in the ICD sample and 4484 firms in the Control sample. All continuous variables have been winsorized at the 1 and 99 percentile
values. See Table 1 for variable definitions.1In Table 6, we report the results of a sensitivity analysis where we set auditor equal to one if the firm uses one of the Big Four audit firms (PWC, Deloitte and
Touche, Ernst and Young and KPMG) and zero otherwise. The proportion of ICD (Control) firms that use Big Four auditors is 0.724 (0.683) whereas 12.2% of the
ICD sample firms use BDO Seidman or Grant Thortnon and 7.6% of the control firms use these two auditors (these proportions are different at the 0.05 level).2The upper right-hand portion of the table presents Pearson product–moment correlations and the lower left-hand portion presents the Spearman rank-order
correlations. Bold text indicates significance at the 0.01 level or better. n ¼ 4810. See Table 1 for variable definitions.
H.
Ash
ba
ug
h-S
ka
ifeet
al.
/J
ou
rna
lo
fA
ccou
ntin
ga
nd
Eco
no
mics
44
(2
00
7)
16
6–
19
2180
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 181
(RGROWTH) because we expect the relation between growth and ICDs to be ordinalrather than cardinal.19 We also convert ZSCORE to decile ranks (RZSCORE) because ofthe documented skewness in the distribution of ZSCORE (see Panel A of Table 3).
Model 1 of Table 4 displays the results of estimating Eq. (1) using only the variablesclassified as IC risk attributes, which serves as a benchmark for assessing the incrementaleffect of reporting incentives on the likelihood of firms disclosing ICDs. All of theestimated coefficients on the internal control risk attributes have the expected sign and aresignificant at conventional levels with the exception of RZSCORE, which has the predictedsign but is insignificant. We find that firms with more complex operations as reflected in thenumber of business segments and being engaged in foreign operations, as captured byFOREIGN_SALES, hold greater internal control risk than firms that only operate indomestic markets. The results document that firms engaged in organizational change viaparticipation in a M&A or restructuring face greater internal control risk and are morelikely to report an ICD. In addition, we find that firms with higher sales growth and firmswith relatively larger inventory holdings are more likely to have problems with theirinternal controls and are thus more likely to report ICDs. After controlling for the scopeand complexity of operations, we find that smaller firms and firms with a higher incidenceof losses are more likely to report ICDs consistent with our conjecture that smaller, lessprofitable firms make fewer investments in sophisticated information and operatingsystems. We also find that the resignation of the auditor is positively related to an ICDdisclosure supporting the notion that an auditor resignation may indicate unacceptableaudit engagement risk due to weak operating performance and financial distress thatreflects inadequate investment in internal control. The benchmark model yields aLikelihood ratio w2 of 98.31, which is significant at the 0.01 level or better.
Model 2 of Table 4 displays the logit results incorporating the variables that we use toproxy for the incentives to discover and disclose an ICD. The coefficients on the internalcontrol risk attribute variables are significant with the predicted signs, includingRZSCORE, after the addition of the variables that proxy for reporting incentives. Aftercontrolling for internal control risk attributes, we document that firms that contract with adominant auditor supplier are more likely to make an ICD disclosure. This findingsuggests that the quality of the external audit has an impact on the detection and reportingof a firm’s internal control problems. We also find that firms that face more reporting riskbecause they have previously disappointed the market with low quality financialinformation, as proxied by having to restate their financial statements or being involvedin a SEC AAER action during the 2001–2003 period, are more likely to disclose an ICD.Consistent with our prediction, we find that firms with greater concentrated institutionalownership are more likely to voluntarily report ICDs during the SOX 302 reportingregime. Finally, contrary to expectations, we fail to find that firms operating in litigiousindustries are more likely to report ICDs.
The expanded model is highly significant with a Likelihood ratio w2 of 137.69. The Waldw2 of 41.96 (significant at 0.01) indicates that the addition of the incentives to discover anddisclose variables, as a group, add significant incremental explanatory power to the modelbased only on internal control risk attributes. Overall, the results of the logistic regressionsupport the hypothesis that the early disclosure of ICDs is a joint function of firm-specific
19In the sensitivity analysis section of the paper, we present results when coding GROWTH as a continuous
variable.
ARTICLE IN PRESS
Table 4
Logistic regression of the determinants of internal control deficiency disclosures
þ b12 RESTATEMENTþ b13 INST_CONþ b14 LITIGATIONþ e,
Predicted sign Estimated coefficients
Model 1 Model 2
Intercept 7 �3.996 �4.379
(199.26)*** (202.55)***
IC risk attributes
SEGMENTS + 0.087 0.074
(4.606)** (3.243)**
FOREIGN_SALES + 0.361 0.278
(6.757)*** (3.968)**
M&A + 0.402 0.416
(10.314)*** (10.78)***
RESTRUCTURE + 0.417 0.249
(10.910)*** (3.579)**
RGROWTH + 0.059 0.060
(7.581)*** (7.262)***
INVENTORY + 1.163 1.346
(6.943)*** (8.774)***
SIZE � �0.036 �0.032
(3.081)** (2.425)*
%LOSS + 0.475 0.502
(6.702)*** (7.229)***
RZSCORE � �0.015 �0.037
(0.304) (1.701)*
AUDITOR_RESIGN + 2.008 2.024
(45.912)*** (43.619)***
Proxies for incentives to discover and disclose
AUDITOR + 0.565
(9.681)***
RESTATEMENT + 0.839
(23.964)***
INST_CON + 10.260
(3.176)**
LITIGATION + �0.136
(0.996)
Likelihood ratio, w2 98.31*** 137.69***
Wald, w2 103.95*** 41.96***
Sample size 4810 4810
ICD_DISCLOSURE is coded one for firms that file an internal control deficiency report (n ¼ 326) and zero
otherwise (n ¼ 4484). RGROWTH is the decile rank of GROWTH, where GROWTH and other variables are
defined in Table 1. Wald w2 values in parentheses. ***Indicates significance at the 0.01 level or better, **Indicates
significance at the 0.05 level or better, *Indicates significance at 0.10 level or better.
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192182
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 183
economic attributes that expose firms to internal control risks and the incentives of firms’management and external auditors to provide early warning of internal control problems.
4.1. Marginal analysis
In order to provide some insight into what factors are most important in determining thelikelihood that a firm will disclose an ICD, we calculate the change in probability of a firmdisclosing an ICD as a result of changing the levels of various explanatory variables inEq. (1). The change in probability is calculated using the following steps. First, wecalculate the probability of a firm disclosing an ICD from our logitistic regression modelusing the following expression:
pðX Þ ¼ eb0X=ð1þ eb
0X Þ, (2)
where b is the vector of coefficients from Model 2 in Table 4 and X is the vector ofindependent variables set equal to their mean values across the sample of all firms.Conditional on the mean values of the independent variables, the likelihood of reportingan ICD is 4.9%. Next, we calculate the marginal changes in the probability of a firmreporting an ICD for a one standardized unit increase in each explanatory variable whileholding the other independent variables at their mean values.20 Each marginal effect ismeasured by qpðX Þ=qxi ¼ bipðX Þ½1� pðX Þ� calculated at the mean value of the regressors.
These marginal effects are reported in column 3 of Table 5. Among the IC risk factors,the variables with the greatest marginal effects are AUDITOR_RESIGN (0.227), and%LOSS (0.210) and M&A (0.193). For incentives to discover and report, AUDITOR(0.268) and RESTATEMENT (0.201) have the greatest marginal impact.
An alternative way of assessing the effect of various IC risk factors and incentives todiscover and report an ICD is to calculate the values of the logit function, p(X), at selectedxi values such as their lower and upper quartiles (Agresti, 2002, p. 167). This entailssubstituting the quartile values for each xi explanatory variable into Eq. (1) while holdingthe other variables constant at their means. The linear approximation to changes in p(X)is obtained by multiplying the interquartile range of xi values (see Table 3 for theinterquartile ranges) by the marginal effects based on the unstandardized value ofthe variables (Agresti, 2002, Chapter 5). These values are reported in the last column ofTable 5.
We first calculate the probability of disclosing an ICD for a hypothetical firm that takeson the lower (upper) quartile values of determinants of an ICD disclosure for variablesthat are positively (negatively) related to ICDs.21 This yields a probability of disclosing anICD of about 1.2%. We next repeat this process but now use upper (lower) quartile valuesof explanatory variables that are positively (negatively) related to the incidence of an ICD.This yields a probability of an ICD of 77.9% with AUDIT_RESIGN accounting fornearly 35%. Leaving AUDIT_RESIGN out of the model lowers the probability of an ICDto 31.7%. Thus, the probability of reporting an ICD is dramatically higher when a firm
20We use standardized values because the various explanatory variables are measured in different units.
Without standardization the marginal probabilities are difficult to compare and interpret (Agresti, 2002, Chapter
5).21For attributes measured as a binary variable, the benchmark probability is determined with the zero (one)
value when the attribute is positively (negatively) related to reporting an ICD.
ARTICLE IN PRESS
Table 5
Assessment of changes in probabilities of firm disclosing an ICD for selected changes in independent variables
Variables Predicted sign Marginal effect Change in probability
Standardized variables Q1 vs. Q3 values
IC risk attributes
SEGMENTS + 0.108 0.025
FOREIGN_SALES + 0.131 0.048
M&A + 0.193 0.072
RESTRUCTURE + 0.117 0.043
RGROWTH + 0.169 0.010
INVENTORY + 0.180 0.042
SIZE � �0.113 �0.003
%LOSS + 0.210 0.087
RZSCORE � �0.120 �0.032
AUDITOR_RESIGN + 0.227 0.349
Proxies for incentives to discover and disclose
AUDITOR + 0.268 0.097
RESTATEMENT + 0.201 0.145
INST_CON + 0.087 0.313
LITIGATION + �0.066 �0.023
The Marginal Effects column shows the change in probability of a firm disclosing an ICD due to a one unit
change in the variable of interest after standardizing the independent variables. Marginal effects are computed as:
pðX Þ ¼ eb0X=ð1þ eb
0X ÞÞ where b0X is evaluated at the mean values of X. Tabled values in the Change in
Probability column show the change in the probability of a firm disclosing an ICD as a result of moving from the
first to the third quartile value of the variable of interest, holding all other variables constant at their mean values.
RGROWTH is the decile rank of GROWTH and LOGSIZE is the natural log of SIZE, where GROWTH and
SIZE, as well as other variables are defined in Table 1.
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192184
takes on upper quartile values of the IC risk attributes and factors that are associated withthe incentives to discover and report ICDs.22
4.2. Sensitivity analysis
The validity of the inferences drawn from our model of ICD disclosure is conditional onthe quality of the variables that we use to proxy for IC risk attributes and incentives todiscover and disclose ICDs. In this sub-section, we assess the robustness of our results toalternative measures of IC risk and other proxies for incentives to discover and discloseICDs.The first sensitivity test that we conduct relates to our proxy for audit quality,
AUDITOR. As stated earlier, we consider BDO Seidman and Grant Thornton to bedominant audit suppliers in the US audit market during our analysis period because thesetwo firms gained more SEC reporting clients and held a larger US audit market share after
22We hasten to note that this illustration does not reflect the typical firm in our sample because any given firm
will likely not start from a position of having low IC risk factors or incentives to report (1Q or zero value for
dummy variables) along all of the multiple dimensions we consider. Nor is it likely that any given firm would be
able to move to a position of having high IC risk factors and incentives to report along all dimensions (3Q or one
for dummy variables).
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 185
the demise of Arthur Andersen. An additional partitioning of audit firm dominance basedon historical market share considers Deloitte, Ernst and Young, KPMG, andPricewaterhouseCoopers to be the dominant audit suppliers as these four firms, alongwith Arthur Andersen, audited the vast majority of SEC reporting firms since 1995. Model1 of Table 6 reports the results of our ICD disclosure determinant model adding anadditional indicator variable, AUDITOR(BIGFOUR), that is set equal to one if the firmcontracts with Deloitte, Ernst and Young, KPMG, and PricewaterhouseCoopers and zerootherwise. With AUDITOR(BIGFOUR) in the model, the coefficient on AUDITOR picksup the marginal likelihood of a client of BDO Seidman or Grant Thornton reporting anICD. Interestingly, the coefficient on AUDITOR(BIGFOUR) is negative and significantat a ¼ 0:10, while the coefficient on AUDITOR is positive and highly significant.23 Oneinterpretation of these results is that BDO Seidman and Grant Thornton audit clients withgreater internal control risk. Alternatively, the results suggest that BDO Seidman andGrant Thornton, in building their reputation with SEC clients, exercise more diligence inidentifying internal control problems. The signs and significance of the coefficients on theremaining variables are similar to those of Model 2 reported in Table 4 with the exceptionthat the coefficient on RZSCORE, which becomes insignificant.
Our second set of sensitivity tests uses alternative measures of firm growth and litigationrisk. Model 2 column of Table 6 displays the results of estimating Eq. (1) using acontinuous measure of growth (SALESGRWTH), where SALESGRWTH is defined asthe 3-year average sales growth over 2001–2003. The coefficient on SALESGRWTH ismarginally significant as compared to the highly significant coefficient on the rank growthmeasure (RGROWTH) in Table 4. Using this measure of growth does not changeinferences drawn about other variables in the model.
In Model 3 of Table 6, we replace LITIGATION, a categorical variable capturing highlitigation risk industries, with SHU_LIT, which is based on the work of Shu (2000).24 Aftercontrolling for other factors that provide incentives for managers to discover and reportICDs, we do not find that firms with high litigation risk as measured by Shu (2000) are anymore likely to provide an ICD disclosure than other firms. Thus, this result affirms ourearlier finding reported in Table 4 that ICD disclosure is not related to litigation risk.
There were 12 ICD firms that concurrently reported an auditor resignation and an ICDin 2003 and early 2004 on an 8-K filing. Because there is a one-to-one mapping of ICDdisclosure and the independent variable of AUDITOR_RESIGN, it is important to see ifour findings are robust to deleting these observations. In the Model 4 column of Table 6,we report the results of estimating our logistic model after deleting these 12 firms. The mostimportant point is that the deletion of these observations does not adversely affect thesignificance of the coefficient on AUDITOR_RESIGN. Moreover, except for RZSCORE,the signs and significance of the other coefficients remain unchanged from those reportedin Table 4. Thus, we conclude that the inferences drawn from the primary analysis arerobust to the deletion of these 12 firms.
23Obviously, there is a high correlation between AUDITOR and AUDITOR(BIGFOUR), r ¼ 0.82. If we
exclude AUDITOR from the model, the coefficient on AUDITOR(BIGFOUR) is positive and significant.24Shu (2000) models litigation risk as a function of firm size, inventory holdings, receivables, return-on-assets,
***Indicates significance at the 0.01 level or better, **indicates significance at the 0.05 level or better, *Indicates significance at 0.10 level or better. See Table 1 for
variable definitions.
Model 1—Base model with BIGFOUR auditor, where BIGFOUR is coded one if the firm contracts with Deloitte & Touche, Ernst & Young, KPMG, or
PricewaterhouseCoopers, else zero. As shown in footnote 1 to Table 3, 72.4% (68.3%) of the ICD firms (control firms) use BIGFOUR audit firms.
Model 2—Base model with continuous sales growth, where SALESGRWTH is defined as the average percentage change in sales from 2001 to 2003.
Model 3—Base model with the Shu litigation measure, where SHU_LIT is calculated as the parameter estimates from Table 3 of Shu (2000) applied to the accounting
and market measures of the sample firms that have the necessary data to calculate the measures.
Model 4—Base model estimated with concurrent auditor change and ICD disclosures observations (n ¼ 12) deleted.
Model 5—Base model with AUDITOR_DISMISS as an additional incentive to discover and disclose measure. AUDITOR_DISMISS ¼ 1 if the client dismissed its
auditor during the twelve month period beginning in the fourth month after the close of fiscal year 2002 through the third month after the close of fiscal year 2003,
zero otherwise (auditor dismissals were determined from Audit Analytics and 8-K filings).
Model 6—Base model estimated deleting observations of ICD firms that are non-accelerated filers. Estimated coefficients in italics represent estimates that result in
different inferences drawn from those of our primary analysis.
See Table 1 for all other variable definitions.
H.
Ash
ba
ug
h-S
ka
ifeet
al.
/J
ou
rna
lo
fA
ccou
ntin
ga
nd
Eco
no
mics
44
(2
00
7)
16
6–
19
2187
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192188
Our fifth sensitivity test explores whether the termination of a firm’s auditor signalsproblems with internal control. One potential reason why a firm terminates its contractwith the incumbent auditor is for unsatisfactory performance after management discoversinternal control problems in preparation for a SOX 404 audit that the incumbent auditorhad not discovered in a prior audit.25 If the auditor is dismissed, managers have incentivesto make an ICD disclosure in conjunction with ‘‘pointing the finger’’ at the terminatedauditor for poor internal control oversight. AUDITOR_DISMISS is coded one for firmsthat disclose in an 8-K filing the dismissal of their auditor in 2003 (and zero otherwise).The results when adding AUDITOR_DISMISS to the ICD disclosure determinant modelare displayed in the Model 5 column of Table 6. The coefficient on AUDITOR_DISMISSis positive and highly significant and the signs and significance of the coefficients on theother independent variables are similar to those of Model 2 reported in Table 4. Thesignificantly positive coefficient on AUDITOR_DISMISS is consistent with the notionthat firms that dismissed their auditors in 2003 are more likely to report ICDs as managerstake steps to improve internal control scrutiny.Our last sensitivity test is motivated by the fact that our sample includes both
accelerated and non-accelerated filers because our study focuses on the Section 302reporting era. In contrast, the Doyle et al. (2006a) study uses a sample that includesdisclosures made in both the SOX 302 and 404 reporting regimes, with observations fromthe later period being heavily weighted towards accelerated filers. To investigate how thedifferences in samples affect the inferences drawn on internal control risk, we re-estimateour ICD reporting model deleting ICD firms that are non-accelerated filers.26 The Model 6column of Table 6 displays the results. We continue to include our variables that proxy forthe incentives to detect and report ICDs because we posit that even though acceleratedfilers are required to report material weaknesses in internal control under SOX 404, thesefirms still faced differential incentives to detect and report internal control problems duringthe SOX 302 regime. We find the signs and significance on several of the internal controlrisk and reporting variables to be different from those of our benchmark results reported inthe Model 2 column of Table 4. Specifically, we find restructurings to increase inimportance in explaining ICDs and the effect of inventory levels, frequency of losses, andlikelihood of financial distress on the likelihood of ICDs disclosures to be less significant.More importantly, the results indicate a significant negative relation between INST_CONand ICD reporting, whereas we found a positive relation in our Table 4 results when non-accelerated filers were included in the ICD sample.27
25This point highlights the fact that AUDITOR can be considered an endogenous choice. Prior research
examining firms’ auditor choices models auditor choice as a function of operating risk, financial risk and the
demand for external monitoring (see e.g., Chow, 1982). Our empirical model of ICD disclosure includes many of
the same variables used in prior audit choice research to proxy for these risks, and as such, our research design
inherently controls for selection effects. Furthermore, the majority of sample firms made their auditor choices
across different years much earlier than our year of analysis (i.e., the average auditor tenure for our sample of
firms is over 6 years) and as such we think it reasonable to consider AUDITOR as an exogenous variable for this
sensitivity test.26It is important to note that in order to draw strong inferences regarding the determinants of ICD reporting in
the SOX 404 regime, non-accelerated filers also should be deleted from the control sample. We do not take this
step to allow more direct comparisons to the Doyle et al. (2006a) study.27To be more similar to the ICD risk model of Doyle et al. (2006a), we extend this sensitivity analysis by adding
firm AGE, defined as the natural log of the number of years on CRSP, to the model. Unlike Doyle et al. (2006a),
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 189
Based on the sensitivity analysis reported above, it appears that it is important to controlfor firms’ incentives to detect internal control problems when evaluating the likelihood ofICD reporting. We also find that including firms of all sizes (both accelerated and non-accelerated filers) affects the significance of several of the variables in our ICD determinantmodel.
4.3. Factors deterring managers from disclosing ICDs
We model ICD disclosures as a function of factors that proxy for managers’ incentivesto discover and disclose an ICD, but we do not include any explicit factors thatdeter managers from providing early ICD disclosures. One potential factor that may determanagers from making an early ICD disclosure is management reputation. Managersmay forego disclosing an ICD to avoid criticism in the market for lax organizationor mismanagement of operations ultimately reducing their employment options. Ifreputation is an incentive factor, we would expect new managers to be more likely todisclose ICDs because they can place the blame of internal control problems on priormanagement. Therefore, we expect firms that have management with longer tenure to beless likely to disclose ICDs. To investigate this issue we collect CEO tenure for all samplefirms covered by the Board Analyst database and add CEO tenure to our ICD determinant model. We code CEO tenure both as a continuous variable as well as a binaryvariable that is set equal to one if the CEO tenure is less than 2 years, and zero otherwise.In untabulated results, we do not find a statistically significant difference between the CEOtenure of ICD firms and control firms after controlling for other ICD risk and reportingdeterminants.
Another potential factor deterring managers from making an early ICD disclosure ismanagement compensation. An ICD disclosure might cast doubt on the reliability ofmanagement’s financial reporting, which impacts the uncertainty of information qualitythereby increasing the firm’s cost of capital (Easley and O’Hara, 2004) and decreasing itsmarket value. A CEO that has a large number of stock options (or stock option awards)might not want to disclose an ICD. On the other hand, a CEO that has stock grants as partof his compensation package may actually have incentives to disclose ICDs prior toreceiving grants in the hopes that such disclosure would lower the strike price on theoptions granted during the year, thus raising the value of his options. Given the predictionabout the effects of stock-based compensation on managements’ incentives to discloseICDs is not clear-cut and requires collecting detailed information on the timing of therelease of stock option grants relative to disclosure of the ICD, we leave this question tofuture research.
5. Summary and future research
Many have claimed that the passage of the Sarbanes–Oxley Act of 2002 imposed anextreme burden on SEC registrants by requiring them to document, evaluate, publiclyreport, and have audited the effectiveness of their internal controls. This paper investigates
(footnote continued)
we do not find a significant coefficient on AGE after controlling for the other ICD risk and reporting
determinants.
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192190
the economic events, strategic operating decisions, and investments in internal controlsthat expose firms to internal control risks. Because our study uses data prior to auditsmandated by Section 404 of the Sarbanes–Oxley Act, we are also able to investigate theincentives to discover and report internal control deficiencies (ICDs) in the absence of welldefined ICD discovery and reporting criteria and no mandated internal control audit.More importantly, because we restrict our sample to pre-404 disclosures made byaccelerated and non-accelerated filers, our study provides insights into the determinants ofICDs for a broad cross-section of SEC registrants, which is important for developingexpectations of internal control problems given that non-accelerated filers are not requiredto comply with SOX 404 until 2007.We find that firms that report ICDs have more complex operations as proxied by the
number of business segments and foreign sales, more often engage in mergers andacquisitions and restructurings, hold more inventory and are faster growing relative tofirms that do not disclose internal control weaknesses. In addition, the results indicate thatfirms with fewer resources to invest in internal control, as proxied by the frequency oflosses and greater financial distress, more often disclose problems with their internalcontrols. Moreover, the higher incidence of auditor resignations prior to ICD disclosuressuggests auditors have greater concerns about ICD firms’ accounting application risk andstatus as going concerns.With respect to incentives to discover and report internal control problems, we find that
firms that provide early (pre-SOX 404) warnings of ICDs are more likely to be audited bydominant auditors, have a higher incidence of restatements of financial statements andSEC AAERs in prior years, and are more likely to have concentrated institutional owners.Collectively, these results support our conjecture that firms that face greater internalcontrol risk and have greater reporting incentives are more likely to disclose internalcontrol deficiencies prior to the SOX-mandated internal control audit reportingrequirements.The vast majority of firms that reported control deficiencies in the first 3 months of 2005
as a result of SOX 404 audits previously certified their controls as effective under SOX 302(Glass Lewis, 2005). Future research can investigate whether there are significantdifferences in internal control risk profiles and incentives to report for firms that disclosedinternal control deficiencies prior to SOX-mandated audits versus firms that reportdeficiencies under Section 404 of the Sarbanes–Oxley Act. Exploring the relation betweeninternal control weaknesses and the quality of externally reported numbers is anothernatural extension of the present analysis (Ashbaugh-Skaife et al., 2006b; Doyle et al.,2006b). Finally, another avenue of fruitful research is to investigate whether internalcontrol deficiencies result in higher information risk that increases firms’ cost of equitycapital (Ashbaugh-Skaife et al., 2006a; Ogneva et al., 2005).
References
Agresti, A., 2002. Categorical Data Analysis. Wiley, New York.
Altman, E., 1968. Financial ratios, discriminant analysis, and the prediction of corporate bankrupcy. Journal of
Finance 23, 589–609.
American Institute of Certified Public Accountants (AICPA), 1988. Statement on Auditing Standards
No. 60: Communication of Internal Control Structure Related Matters Noted in an Audit, AICPA,
New York.
ARTICLE IN PRESSH. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 191
American Institute of Certified Public Accountants (AICPA), 2001. Statement on Standards for Attestation
Engagements No. 10: Reporting on an Entity’s Internal Control Over Financial Reporting, AICPA,
New York.
Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006a. The Effect of Internal Control Deficiencies on
Firm Risk and Cost of Equity Capital, Working paper, University of Iowa.
Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006b. Internal Control Deficiencies, Remediation
and Accrual Quality, Working paper, University of Iowa.
Beneish, M., Billings, M., Hodder, L., 2006. Internal Control Weaknesses and Information Uncertainty, Working
paper, Indiana University.
Chow, C., 1982. The demand for external auditing: Size, debt, and ownership influences. The Accounting Review
57, 272–291.
DeAngelo, L., 1981. Auditor size and audit quality. Journal of Accounting and Economics 3, 183–200.
DeFond, M., Jiambalvo, J., 1991. Incidence and circumstances of accounting errors. The Accounting Review 66,
643–655.
De Franco, G., Guan, Y., Lu, H., 2005. The Wealth Change and Redistribution Effects of Sarbanes–Oxley
Internal Control Disclosures. Working paper, University of Toronto.
Doyle, J., Ge, W., McVay, S., 2006a. Determinants of Weaknesses in Internal Control over Financial Reporting,
Working paper, New York University.
Doyle, J., Ge, W., McVay, S., 2006b. Accruals Quality and Internal Control over Financial Reporting, Working
paper, New York University.
Dye, R., 1993. Auditing standards, legal liabilities, and auditor wealth. Journal of Political Economy 101,
887–914.
Easley, D., O’Hara, M., 2004. Information and the Cost of Capital, Working paper, Cornell University.
Francis, J., Philbrick, D., Schipper, K., 1994. Shareholder litigation and corporate disclosures. Journal of
Accounting Research 32, 137–164.
Glass Lewis & Company, 2005. Interim Control Deficiency Disclosures-Interim Alert, Yellow Card Interim Alert,
Glass-Lewis and Company, LLC, April 12, p. 3.
Hammersley, J., Myers, L., Shakespeare, C., 2005. Market Reactions to Internal Control Disclosures, Working
paper, University of Michigan.
Hogan, C., Wilkins, M., 2006. Evidence on the Audit Risk Model: Do Auditors Increase Audit Effort in the
Presence of Internal Control Weaknesses? Working paper, Southern Methodist University.
Jensen, M., 1993. The modern industrial revolution, exit, and the failure of internal control systems. Journal of
Finance 48, 831–880.
Karr, S., 2005. 404 Disclosure: Experts Say Get in Front of the Issue, Compliance Week, February 15.
Kinney, W., McDaniel, L., 1989. Characteristics of firms correcting previously reported quarterly earnings.
Journal of Accounting and Economics 11, 71–93.
Kinney, W., Palmrose, Z., Scholz, S., 2004. Auditor independence, non-audit services, and restatements: Was the
US government right? Journal of Accounting Research 42, 561–588.
Krishnan, J., 2005. Audit committee quality and internal control: An empirical analysis. The Accounting Review
80, 649–675.
Martinek, P., 2005. SOX ‘Catch 22: Certifying Controls Later Found Weak, Compliance Week, February 22.
McMullen, D., Raghunandan, A., Rama, K., 1996. Internal control reports and financial reporting problems.
Accounting Horizons 10, 67–75.
Ogneva, M., Raghunandan, K., Subramanyam, K.R., 2005. Internal Control Weakness and Cost of
Equity: Evidence from SOX Section 404 Certifications, Working paper, University of Southern
California.
Public Company Accounting Oversight Board, 2004. Auditing Standard No. 2, An Audit of Internal
Control Over Financial Reporting Performed in Conjunction with An Audit of Financial Statements,
PCAOB, March 9.
Richardson, S., Tuna, I., Wu, M., 2003. Predicting Earnings Management: The Case of Earnings Restatements,
Working paper, University of Pennsylvania, Wharton School.
Securities and Exchange Commission (SEC), 1988. Disclosure Amendments to Regulation S-K, Form 8-K and
Schedule 14A Regarding Changes in Accountants and Potential Opinion Shopping Situations. Financial
Reporting Release No. 31, SEC, Washington, DC.
Securities and Exchange Commission (SEC), 2002. Certification of Disclosure in Companies’ Quarterly and
