The Effect of SOX Internal Control Deficiencies on Firm Risk and Cost of Equity

The Sarbanes-Oxley Act (SOX) mandates management evaluation and independent audits of internal control effectiveness. The mandate is costly to firms but may yield benefits through lower information risk that translates into lower cost of equity. We use unaudited pre–SOX 404 disclosures and SOX 404 audit opinions to assess how changes in internal control quality affect firm risk and cost of equity. After controlling for other risk factors, we find that firms with internal control deficiencies have significantly higher idiosyncratic risk, systematic risk, and cost of equity. Our change analyses document that auditor-confirmed changes in internal control effectiveness (including remediation of previously disclosed internal control deficiencies) are followed by significant changes in the cost of equity that range from 50 to 150 basis points. Overall, our cross-sectional and intertemporal change test results are consistent with internal control reports affecting investors' risk assessments and firms' cost of equity.     

Do Control Effectiveness Disclosures Require SOX 404(b) Internal Control Audits? A Natural Experiment with Small U.S. Public Companies

We use incremental and joint implementation of multiple SOX‐based control effectiveness disclosure and audit mandates to assess relative performance of alternatives for small U.S. public companies. Using data from several low‐ and high‐effort management disclosure and audit regimes implemented from 2003 to 2008, we find substantial and statistically significant increases in material weakness disclosure rates for small firms undergoing initial SOX 404(b) internal control audits, but find quantitatively and statistically similar increases for initial management reports of small firms exempt from such audits. As to audit cost, fees more than double for initial 404(b) audits in 2004 and remain high, while 404(b)‐exempt firms’ fees grow about 10% annually. Our results support the view that, for small firms, management internal control reports and traditional financial audits may be a cost effective disclosure alternative to full application of SOX 404(b). Also, our results suggest that, even without management reports on internal control, analysis of the cause of known accounting mistakes may yield substantial material weakness disclosures.     

Internal control reporting and market liquidity

We investigate the impact of the Sarbanes-Oxley Act of 2002 (SOX) on information asymmetry by analyzing the relation between SOX Sections 302 and 404 control reports and market liquidity using bid-ask spreads. Lower market liquidity indicates higher levels of information asymmetry implying that market participants perceive financial statement misstatement risk is higher. If SOX disclosures contain relevant information, then one would expect firms reporting internal control material weaknesses to have lower market liquidity. Accordingly, we find that market liquidity is lower (i.e., bid-ask spreads are higher) for firms reporting ineffective control compared to firms reporting effective control using either annual SOX 404 internal control reports or quarterly SOX 302 disclosure control reports, which suggests that SOX 302 and 404 reports provide useful information for identifying firms with a higher risk of financial statement misstatement. However, we do not find consistent results using two alternative liquidity measures: trading volume and market quality indices. We then examine whether changes in control reports are associated with changes in market liquidity. We generally do not find that firms with improved (deteriorated) control reports experience a larger decrease (increase) in bid-ask spreads or larger increases (decreases) in trading volume and market quality indices compared to other firms, suggesting that market participants do not discern a change in information asymmetry when the effectiveness of internal controls over financial reporting changes.     

Internal control weaknesses and evidence of real activities manipulation

We examine whether US public firms that file internal control weakness (ICW) disclosure reports with the Securities and Exchange Commission, as part of the reporting requirements under Section 404 of the Sarbanes–Oxley (SOX) Act, exhibit higher levels of real activities manipulation (RM), compared to firms that do not file such reports. Using firm-level data for the post-SOX period, 2004–2010, we find a positive relationship between firms reporting internal control weaknesses and real activities manipulation. Further, those ICW-firms that use RM to beat earnings benchmarks have lower performance in the subsequent year. Our results also show that firms do not use discretionary accruals as a substitute for RM when they report internal control weaknesses. Overall, our findings suggest that ICW-firms are prone to using real activities manipulation as a form of earnings management. Our findings also have implications for audit quality as auditors need to gain a better understanding of how real activities manipulation influences the operations of the firm.     

The effect of external audits of internal control over financial reporting on financial reporting for clients of Big 4, Second-tier,and small audit firms

The external audit of internal control over financial reporting (ICFR) is a very expensive and contentious aspect of the Sarbanes–Oxley Act (SOX). Larger public firms were first required to file a management report on and have an external audit of ICFR in 2004. Smaller public firms were first required to file a management report on ICFR in 2007 but are exempt from the audit requirement. Whereas most related prior research investigates the combined effect of management and auditor reports on financial reporting, this study examines the distinct effect of auditor reports on reporting quality. For companies audited by small auditors, we find evidence that financial reporting quality improves with an auditor report on ICFR. We find no evidence that auditor ICFR reports improve reporting quality for clients of Big 4 or Second-tier audit firms. Our study adds to the debate on the applicability of SOX Section 404 to smaller firms.     

The use of management control systems to manage CSR strategy: A levers of control perspective

Little is known about the role of management control systems (MCS) in managing the strategic processes that underpin Corporate Social Responsibility (CSR). To enhance our understanding of this phenomenon, this study employs Simons’ (1995) levers of control framework to explore how organizations leverage MCS in different ways in order to drive strategic renewal and trigger organizational change while simultaneously supporting society's broader sustainability agenda. Drawing on data gathered from France's largest listed companies – members of the CAC 40 – we provide insights into the structures and processes that companies employ to design, implement and monitor their CSR strategy. In doing so, we provide evidence of the way that organizations seek to attain their CSR objectives, and of the relationship between the management of CSR and other business processes. Of particular interest is the role of the levers of control in enabling managers to identify and manage threats and opportunities associated with CSR strategy, thus forming risk management processes that support organizations in their attainment of strategic objectives. Furthermore, the study provides evidence suggesting the use of MCS has the potential to contribute to society's broader sustainability agenda through processes that enable innovation, communication, reporting, and the identification of threats and opportunities.     

Risk management and calculative cultures

Enterprise risk management (ERM) has recently emerged as a widespread practice in financial institutions. It has been increasingly codified and encrypted into regulatory, corporate governance and organizational management blueprints. A burgeoning literature of regulatory and practitioner texts is indicative of the apparent diversity of ambitions, objectives and techniques that constitute the ERM agenda. Making sense of these developments is a challenge. This paper presents field-based evidence from two large banking organizations suggesting that systematic variations in ERM practices exist in the financial services industry. The cases illustrate four risk management ideal types and show how they form the ‘risk management mix’ in a given organization. Further, drawing on the literature of the roles and uses of management control systems (MCS), the paper explores how ERM achieved organizational significance in the studied settings. The findings are indicative of the current co-existence of alternative models of ERM. In particular, two types of ERM models are postulated: one driven by a strong shareholder value imperative (ERM by the numbers), the other corresponding to the demands of the risk-based internal control imperative (holistic ERM). This paper explains the differences in the two risk management mixes pointing towards alternative logics of calculation [Power, M.K., 2007. Organized Uncertainty—Designing a World of Risk Management. Oxford University Press, Oxford], which I conceptualise and describe as different calculative cultures. The study suggests that calculative cultures, which in these cases shaped managerial predilections towards ERM practices, are relevant, albeit so far neglected, constituents of the fit between MCS and organizational contexts.     

How Effective Is Internal Control Reporting under SOX 404? Determinants of the (Non‐)Disclosure of Existing Material Weaknesses

We study determinants of internal control reporting decisions under Section 404 of the Sarbanes‐Oxley Act (SOX 404) using a sample of restating firms whose original misstatements are linked to underlying control weaknesses. We find that only a minority of these firms acknowledge their existing control weaknesses during their misstatement periods, and that this proportion has declined over time. Further, the probability of reporting existing weaknesses is negatively associated with external capital needs, firm size, non‐audit fees, and the presence of a large audit firm; it is positively associated with financial distress, auditor effort, previously reported control weaknesses and restatements, and recent auditor and management changes. These results provide evidence that detection and disclosure incentives play a role in whether existing material weaknesses are reported, which has implications for the effectiveness of SOX 404 in providing investors with advance warning of potential accounting problems.     

The effect of internal control deficiencies on the usefulness of earnings in executive compensation

Since SOX 404 disclosures are informative about earnings, and due to the widespread practice of using earnings-based measures in executive compensation, this study examines whether reports of internal control material weaknesses (ICMW) under SOX 404 influence firms' reliance on earnings in tying executive pay to performance. Using 391 (366) firm-year observations with reported ICMW and 3648 (3138) firm-year observations for CEOs (CFOs) reporting NOMW under SOX 404, we find a decreased strength in the association between earnings and executives' (CEO and CFO) compensation when the firm reports an ICMW, and as the number of reported ICMW increases. In addition, we find this decreased weight on earnings for the more severe Company-Level than Account- Specific material weaknesses. Our study suggests that the ICMW report under SOX 404 provides incremental information for executive compensation beyond that contained in reported earnings.     

The implications of ineffective internal control and SOX 404 reporting for financial analysts

The mandatory reporting of firms’ internal control effectiveness continues to be debated by equity market participants, U.S. regulatory agencies and oversight committees. We investigate the implications of material weaknesses in internal control and SOX 404 required reporting of such for financial analysts because analysts are important intermediaries in the U.S. capital market and it is not known whether analysts’ forecasts or coverage decisions are affected by firms’ internal control problems or reporting, respectively. Results of our empirical tests indicate that analysts provide less accurate forecasts and there is greater forecast dispersion for firms with ineffective internal control. We also find that firms that disclose internal control problems have less analyst coverage and that analyst following declines after the material weakness in internal control is disclosed. The results are robust to controlling for potential self-selection bias and management earnings guidance. Our study documents the consequences of ineffective internal control for an important class of financial statement users and suggests the required reporting on the effectiveness of internal control is beneficial to understanding the properties of analysts’ forecasts.     

IT internal control weaknesses and firm performance: An organizational liability lens

The information systems literature and the public press have called for organizations to more closely scrutinize their information technology (IT) controls; however, little more than anecdotal evidence exists on the business value of quality IT internal control, beyond regulatory compliance. In this paper, we (a) advance an organizational liability perspective to the question of IT internal control value; and (b) use the unique setting provided by the enactment of the Sarbanes–Oxley Act of 2002 (SOX) to investigate the relationship between IT internal control weaknesses (ICWs) and both accounting earnings (a contemporaneous measure of firm performance) and market value (a forward looking, risk-adjusted measure of firm performance). Using a data set that provides audited annual assessments of the effectiveness of both IT and non-IT internal controls for a cross-section of companies as mandated by SOX, we find that firms that report an IT ICW have lower accounting earnings compared to firms with strong IT internal controls. We also find that IT ICW moderates the association between accounting earnings and market valuation, with firms reporting weak IT internal controls having a lower earnings multiple. These results are sustained even after controlling for non-IT ICWs and firm-specific factors that are known determinants of ICWs, and are reinforced using an inter-temporal changes analysis in which we use each firm as its own control at a different point in time. Overall, our results provide empirical evidence which suggests that IT internal controls are a strategic necessity and that information systems risk is priced by the capital markets. The implications of these findings for theory and practice are discussed.     

How the enterprise risk management function influences decision-making in the organization – A field study of a large,global oil and gas company

Risk management has been a discipline for decades. However, organizations have only recently begun to introduce a separate enterprise risk management (ERM) function. The aim of this study is to examine the transformation of the ERM function's influence in a company over time. We use a historical case study informed by social theory on how to influence others to investigate this phenomenon. The findings show that the construction of risk technologies over time triggers a change in the ERM function's influence on decision-making. Two processes of influence are used by the ERM function: selling new ideas and managing knowledge across boundaries. In the first process, the ERM function attempts to vertically influence top management's decisions regarding acceptance of new risk management technologies. In the second process, the ERM function attempts to horizontally influence decision makers to use risk knowledge in decision processes. Theoretically, our findings contribute to our understanding of how the ERM function influences decision-making in organizations over time.     

Firm Characteristics and Stock Price

This study examines the stock price reaction to the internal control reporting required under Section 404 of the Sarbanes‐Oxley Act of 2002 for three distinct groups of firms. After controlling for general stock price movements, we find that stock returns are most negative for firms that delay filing of their internal control reports, continue to be negative for firms with ineffective internal controls, and are positive for firms with effective internal controls. The decrease in stock prices of the first two groups is more pronounced for those with a lower return on assets, higher growth rate in sales, and no prior disclosure of their internal controls weaknesses. Our results indicate that market participants value the reliability of financial information ensuing from Section 404 compliance, irrespective of firm size and debt proportion. Thus, regulators and policymakers worldwide should consider mandating comparable SOX 404 compliance for all publicly held companies to improve the accuracy and reliability of financial reports.     

A comprehensive and quantitative internal control index: construction,validation, and impact

We use a new method to better measure internal control quality. Specifically, we construct an internal control index for all public firms in China, because the lack of internal control regulations during our sample period presents an interesting setting, in which the diversity of internal control quality is preserved. Two distinctive features set our index apart from the information currently available under SOX 404 in the U.S. First, it comprehensively evaluates a firm’s internal control, based on the COSO framework. Second, it quantitatively measures a firm’s internal control, using the analytic hierarchy process designed for analyzing complex decisions. We proceed to validate our index by confirming the known relation between internal control quality and earnings management. Further, we theorize that our internal control index has a positive impact on the earnings response coefficient, and find that better internal control indeed makes financial reporting more credible to investors.     

Strategies of resistance to internal control regulation

This paper applies the institutional concepts of resource dependence, power, resistance, and dramaturgical exchange to the legislative history of the Foreign Corrupt Practices Act (FCPA) of 1977, internal control proposals and regulations from the late 1970s to the late 1990s, and the internal control requirements under the Sarbanes–Oxley Act (SOX) of 2002. The analysis documents that from 1976 to 2001 powerful organizations and individuals employed active strategies of avoidance, defiance, and manipulation to successfully defeat proposals that would have required all public companies to assess and publicly report on their internal controls over financial reporting. During this same period, the US Securities and Exchange Commission (SEC) vacillated between actively advocating mandatory internal control reporting and passively acquiescing to industry and White House demands for voluntary internal control reporting. The resulting dramaturgical exchange between the SEC and its regulatees made it appear as if the voluntary initiatives were reasonably effective, but subsequent accounting and financial scandals challenged this view and eventually precipitated mandatory internal control assessment and reporting. The paper also considers how the ongoing dramaturgical exchange between regulators and regulatees could significantly weaken the internal control requirements of SOX (2002) [Sarbanes–Oxley Act of 2002 (2002). Public Law 107–204, 116 Stat. 745], and discusses implications for future research and recent critiques of neoinstitutional theory.     

Public mandates, market monitoring, and nonprofit financial disclosures

Public officials have recently sought increased regulation of financial disclosures from not-for-profit organizations as a means of improving accountability with the public. One objective of this study is to examine whether not-for-profit entities already subject to audit requirements submit financial reports in compliance with GAAP. Further, since the majority of not-for-profit organizations are not subject to public audit mandates, this study also ascertains whether other market actors such as donors monitor and demand accrual-based financial information. The empirical analyses indicate that not-for-profit organizations subject to public audit mandates are largely in compliance with GAAP, although a significant minority of organizations subject to state requirements is not; further analyses suggest that external oversight significantly influence the use of accrual reporting. Models are also tested on a subsample of not-for-profits that switched from cash to accrual reporting, with the results suggesting that increasing public and market oversight have a significant effect on the decision to switch methods. The overall results suggest that public and market actors demand accrual-based financial reporting from not-for-profit organizations.     

Incorporating Strategic Risk into Enterprise Risk Management: A Survey of Current Corporate Practice

Since ERM is a relatively recent activity and has yet to be fully implemented in most companies, there has been little academic research about its accomplishments and about the obstacles to further progress. In particular, very little has been published about corporate attempts to identify and manage corporate strategic risks while integrating them into a corporate‐ wide ERM framework. This article uses responses collected from a survey of 271 risk and financial executives in North American and European companies to address the following questions: What forces are behind this push for a more organized and integrated management of significant risks? What challenges are companies encountering as they implement implement ERM? Once fully in place, how does ERM affect the company's ability to implement its strategy? The primary drivers of ERM are said to be corporate governance requirements and other regulatory pressures, and management and investor demand for greater understanding of strategic and operating risks. The benefits of full ERM implementation are increased management accountability and better governance practices, greater managerial understanding of and consensus about corporate strategy, and, in some cases, higher credit ratings and hence a lower cost of capital. The tools and techniques to measure the impact of strategic risks appear to vary, depending on the stage of ERM implementation. For advanced ERM companies, the most frequently used tools and techniques are key risk indicators, self‐assessments, and scenario analysis.     

Sustainability,institutionalization and the duality of structure: Contradiction and unintended consequences in the political context of an Australian water business

This paper presents the results of a longitudinal case study of an Australian public sector water business in order to examine how, and to what extent, did the institutionalization and deinstitutionalization of internal sustainable and environmental management routines, practices and procedures occur over the period 2001 to the start of 2011. It adopts the Dillard et al. framework of institutionalization which incorporates institutional theory, Weber's axes of tension and structuration theory. In 2001, the criteria for costing and financial reporting practices and the criteria for environmental regulation and management practices were competing at the economic and political economic level, the organizational field level and the organizational level. An unintended consequence of this was no accounting for environmental costs. Environmental management criteria and practices were characterized by compliance with EPA regulatory requirements whilst financial management and costing criteria and practices were characterized by New Public Management criteria. Subsequent to 2001, an unintended consequence of the establishment of separate legislative and regulatory bodies has been the institutionalization of competing legitimating criteria with regard to water conservation, externalities, environmental regulation and financial reporting and costing. Within this context, the organizational field and the organizational level of the individual water business has been characterized by the development of new organizational practices and routines with regard to water conservation as well as unintended consequences and decoupling. At all three levels, the ontological security of agents has been evident in the development of new criteria and practices for sustainable development, whilst the routine procedures of the respective management systems were a source of ontological security to the relevant agents.     

The effect of internal control and risk management regulation on earnings quality: Evidence from Germany

We investigate the impact of mandatory internal control and risk management (ICRM) reform on earnings-based attributes of accounting quality in Germany. Although prior studies examine changes in accounting quality under SOX Sections 302 and 404, there is scant evidence of the accounting quality effects of ICRM reform in foreign jurisdictions. Such evidence is warranted given the ongoing global policy debate of ICRM reform in the post-SOX era. We extend existing research by examining changes in earnings quality following the 1998 German legislation on control and transparency (KTG). The KTG regime provides a unique setting in which the regulatory scope extends beyond internal control over financial reporting (ICFR) to include broad business and enterprise risk control. Using both a differences and difference-in-differences research design, we find that German firms experience an increase in timely loss recognition and a decrease in earnings smoothing after KTG. We also find some evidence of a decrease in loss avoidance behavior. Additional analyses show that the sensitivity of capital investment efficiency to earnings quality increases in the German market after KTG, suggesting that earnings quality effects of mandatory ICRM reform has positive consequences for capital resource allocation. Together, our results are consistent with the achievement of one of the intended outcomes of ICRM regulation—increased accounting quality through effective ICRM systems.     

Independent Movement or Government Subcontractor? – Strategic Responses of Voluntary Organizations to Institutional Processes

The purpose of this paper is to identify factors that can explain differing responses of voluntary organizations to the pressure of homogenization that follows from interaction with public authorities. The paper is theoretically based on institutional organization theory and resource dependence theory, and empirically on research on voluntary organizations in the social sector. It is asserted that the following factors may explain voluntary organizations' ability to maintain autonomous in relation to public organizations: the characteristics of the organizational field, the focal organization's relations to the dominating organization in the field, organization characteristics and intra–organizational processes and strategies.