The discovery and reporting of internal control deficiencies prior to SOX-mandated audits

ARTICLE IN PRESS

Journal of Accounting and Economics 44 (2007) 166–192 www.elsevier.com/locate/jae

The discovery and reporting of internal control deficiencies prior to SOX-mandated audits$ Hollis Ashbaugh-Skaifea, Daniel W. Collinsb,, William R. Kinney Jr.c a

School of Business, University of Wisconsin-Madison, Madison, WI 53707, USA b Tippie College of Business, University of Iowa, Iowa City, IA 52242, USA c McCombs School of Business, University of Texas at Austin, Austin, TX 78712, USA Received 1 March 2005; received in revised form 20 October 2006; accepted 26 October 2006 Available online 15 December 2006

Abstract We use internal control deficiency (ICD) disclosures prior to mandated internal control audits to investigate economic factors that expose firms to control failures and managements’ incentives to discover and report control problems. We find that, relative to non-disclosers, firms disclosing ICDs have more complex operations, recent organizational changes, greater accounting risk, more auditor resignations and have fewer resources available for internal control. Regarding incentives to discover and report internal control problems, ICD firms have more prior SEC enforcement actions and financial restatements, are more likely to use a dominant audit firm, and have more concentrated institutional ownership. r 2006 Elsevier B.V. All rights reserved. JEL classification: G34; G38; K22; M41; M49 Keywords: Internal control; Auditing; Regulation; SOX

$ We thank Andy Bailey, Dave Burgstahler, Ryan LaFond, Thomas Lys, Linda McDaniel, Pamela Murphy, Joel Horowitz, Robert Lipe, Gene Savin, Lynn Turner, Jerry Zimmerman, Editor, Andy Leone, the referee, and seminar participants at the University of Kentucky, Michigan State University, University of North Carolina at Chapel Hill, Ohio State University and the University of Wisconsin-Madison for helpful comments and suggestions. We also thank Guojin Gong, Neil Schreiber, Kwadwo Asare and John McInnis for their capable research assistance. Corresponding author. Tel.: +1 319 335 0912; fax: +1 319 335 1956. E-mail addresses: [email protected] (H. Ashbaugh-Skaife), [email protected] (D.W. Collins), [email protected] (W.R. Kinney Jr.).

0165-4101/$ - see front matter r 2006 Elsevier B.V. All rights reserved. doi:10.1016/j.jacceco.2006.10.001

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

167

1. Introduction This study investigates the economic factors that expose a firm to internal control risk and management’s incentives to discover and report an internal control deficiency (ICD). Section 404 of the Sarbanes–Oxley Act (US Congress, 2002), denoted SOX requires that public company financial statements filed on Form 10-K and Form 10-Q contain an assessment by management of the design and operating effectiveness of its internal control over financial reporting. Section 404 also requires that the external auditor, on an annual basis, provide an opinion on management’s assessment of internal control (Securities and Exchange Commission (SEC), 2003). Before the implementation of SOX Section 404, Section 302 of SOX required that management evaluate the effectiveness of disclosure controls and procedures, report results of their evaluation, and indicate any significant changes in internal control since the last Form 10-K or Form 10-Q filing (SEC, 2002). The SEC defines disclosure controls and procedures as ‘‘controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports filed or submitted by it under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the Commission’s rules and forms’’ (SEC, 2002). However, neither the SEC nor SOX Section 302 specify particular procedures to be applied by management in evaluating internal controls nor do they require independent audits of internal controls. Furthermore, while Section 302 requires management to report any discovered material weaknesses to their external auditor and the audit committee (SEC, 2003), whether such ICDs had to be disclosed to shareholders in public SEC filings is less clear. As an example of this ambiguity, the SEC staff addressed the ‘‘frequently asked’’ question: ‘‘Is a registrant required to disclose changes or improvements to controls made as a result of preparing for the registrant’s first management report on internal control over financial reporting?’’ (SEC, 2004, Question 9). The staff’s answer was that they ‘‘would welcome disclosure of all material changes to controls’’ whether before or after the Section 404 compliance date, but they ‘‘would not object’’ if a registrant did not disclose changes made in preparation for the registrant’s first management report under Section 404. The staff added to its response ‘‘However, if the registrant were to identify a material weakness, it should carefully consider whether that fact should be disclosed as well as changes made in response to the material weakness’’. Thus, under the provisions of Section 302, the review of internal control is subject to less scrutiny by both management and the auditor and the disclosure rules are less specific than subsequently exist under Section 404.1 This suggests that managers had more discretion in disclosing ICDs during the pre-Section 404 regime. We use ICD disclosures provided by firms after Section 302 became effective, but before the effective date for independent internal control audits mandated by Section 404 to study 1 Further evidence that management exercised some discretion in disclosing ICDs during the pre-Section 404 regime is provided by a Glass Lewis & Company report (Glass Lewis, 2005) that 87% of firms disclosing ICDs in the first 3 months of 2005 certified their controls as effective under SOX 302 in the previous quarter. Some of these occurrences were due to new GAAP guidance on application of lease accounting rules provided by the SEC in February 2005 that managers were unaware of when they certified that controls over financial reporting were effective in the prior quarter (SEC, 2005). However, a large percentage of the ICD disclosures made early in the SOX 404 regime related to more systemic control problems of long standing (e.g., inadequate recording of inventory or improper year-end roll-up procedures) suggesting that managers had either not yet detected ICDs or did not feel compelled to disclose these weaknesses during the SOX 302 regime.

ARTICLE IN PRESS 168

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

the firm characteristics that contribute to internal control risks and the incentives faced by managers to discover and disclose internal control problems. During this era, both accelerated and non-accelerated filers reported material weaknesses as well as lesser deficiencies that are not required to be disclosed under SOX 404 reporting.2 Thus, we document the determinants of ICDs for a broad cross-section of SEC registrants. Estimating determinants of ICDs across a broad cross-section of firms is important for developing investor expectations about internal control problems given non-accelerated filers are not yet required to comply with SOX 404.3 Three conditions must exist for a registrant to disclose an ICD under Section 302. First, an ICD must exist; second, the deficiency must be discovered by management or the independent auditor; and third, management, perhaps after consultation with its independent auditor, must conclude that the deficiency should be publicly disclosed.4 Our sample of ICD disclosers begins with 585 firms identified by Compliance Week from November 2003 to December 31, 2004 that disclosed ICDs in any SEC filing. To control for industry and time-specific factors, we collect parallel data on more than 4000 firms in the same industries over the same time period that did not report ICDs prior to December 31, 2004. We model pre-SOX 404 ICD disclosures as a function of internal control risk factors and incentives of managers and auditors to discover and disclose ICDs. Our internal control risk factors include the complexity and scope of firms’ operations, changes in firms’ organizational structure, accounting measurement application risk (e.g., exposure to accounting errors caused by difficulty or judgment in applying accounting procedures), lack of firm resources to devote to internal control and whether the auditor resigned in 2003. We use auditor dominance, sensitivity to regulatory intervention in financial reporting due to prior restatement or SEC enforcement actions, monitoring by institutional investors, and industry litigation risk to proxy for incentives to discover and disclose ICDs. As expected, ICD disclosers have more complex operations as proxied by the number of business segments and foreign sales, and more often engage in acquisitions and restructurings relative to non-ICD disclosure firms. The results also indicate that ICD disclosers face greater accounting procedure application risk as firms with greater sales growth and levels of inventory are more likely to report an ICD. We find that smaller firms, firms reporting a higher frequency of losses and firms in financial distress are more likely to disclose ICD weaknesses. A highly significant risk factor that explains the incidence of an ICD is the auditor resigning in the year prior to the ICD disclosure.

2 Non-accelerated filers are firms with total market capitalization less than $75 million. Non-accelerated filers are not required to comply with the SOX Section 404 reporting provisions until fiscal years ending on or after July 15, 2007. 3 Prior to SOX, public firms could voluntarily assess and report on the effectiveness of internal controls, but few firms did so. For example, McMullen et al. (1996) report that of 2221 firms listed on NAARS with December 31, 1993 fiscal year ends, only 55 contained a management statement that internal controls were ‘‘effective as of fiscal year end’’. Furthermore, McMullen et al. (1996) do not indicate whether any of the management reports were audited or reviewed by their external auditors even though auditing standards allowed such association (AICPA, 1988). 4 See Kinney and McDaniel (1989) for parallel arguments about disclosure of misstatements of quarterly earnings.

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

169

Regarding variables that proxy for the incentives to discover and report internal control problems, our results indicate that firms that contract with the largest US audit suppliers, have had negative publicity about financial reporting as evidenced by prior restatements or sanctions from SEC Accounting and Auditing Enforcement Releases (AAERs), and that have concentrated institutional ownership are more likely to disclose an internal control problem. These results are robust to using alternative measures of internal control risk and incentives to report. Many have claimed that the passage of SOX imposed an extreme burden on SEC registrants by requiring them to document, evaluate, publicly report, and have audited the effectiveness of their internal controls. Contemporaneous and concurrent research examines different aspects of SOX in an attempt to evaluate the Act’s costs and benefits (e.g., see Ashbaugh-Skaife et al., 2006a; Beneish et al., 2006; De Franco et al., 2005; Doyle et al., 2006b; Hammersley et al., 2005; Hogan and Wilkins, 2006; Ogneva et al., 2005; Zhang, 2005). Our study contributes to this literature by investigating the causes of ICDs and managements’ incentives to report these deficiencies during a regulatory transition period in which there was mandated certification of disclosure controls and procedures, but no review procedures specified for management, no internal control audit requirement, limited guidance on classifications of severity of control deficiencies, and considerable disclosure discretion on the part of management. Our research is most closely related to a concurrent study by Doyle et al. (2006a) who examine the determinants of internal control deficiencies based on a sample of firms that disclosed ‘‘material weakness’’ control deficiencies during both the SOX 302 and 404 reporting regimes. As in our study, Doyle et al. (2006a) find ICDs are more likely for firms that are smaller, financially weaker, more complex, growing rapidly and undergoing restructuring. Our study differs from the Doyle et al. (2006a) study along several dimensions. First, Doyle et al. (2006a) restrict their analysis only to firms that report ‘‘material weakness’’ ICDs, while we consider all three levels of internal control deficiencies as set forth by the Public Company Accounting Oversight Board (PCAOB) in Auditing Standards (AS) No. 2—material weaknesses, significant deficiencies and control deficiencies (PCAOB, 2004).5 We include all levels of control deficiencies because regulatory guidance defining levels of severity of control deficiencies was not released until March of 2004, which is well after many firms provided their first disclosure of control problems. As a result, the inter-firm consistency of these self-reported classifications of control weaknesses is problematic.6 A second distinction between our study and Doyle et al. (2006a) is that our analysis is limited to ICDs disclosed during the SOX 302 regulatory regime. Because SOX 302 internal control disclosures are subject to less regulation and allows more management discretion than control disclosures made during the SOX 404 audit regime, our determinant model includes a number of variables designed to capture firms’ incentives to discover and report control deficiencies variables that capture, incentives to detect and 5

See discussion in Section 2 for distinction between these three levels of control deficiencies. For example, a deficiency that one firm considers to be a material weakness, another firm might classify as a significant deficiency, or vice versa. By considering all types of ICDs in our model, we avoid errors due to inconsistencies of self-classifications that are introduced when restricting the analysis to ICDs of one classification type. 6

ARTICLE IN PRESS 170

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

report are omitted from the Doyle et al. (2006a) study because they focus on material weakness disclosures that they deem to be required disclosures in both the 302 and 404 reporting regimes. Moreover, by restricting their analysis to material weakness disclosures, Doyle et al. (2006a) ignore lesser control problems that arguably have a significant impact on the reliability of firms’ financial statements (Ashbaugh-Skaife et al., 2006b). Finally, because we study disclosures made during a reporting regime that predated SOX 404 internal control audits, our study identifies factors that contribute to internal control problems for a broad cross-section of publicly traded firms that includes both accelerated and non-accelerated filers. Thus, our ICD model facilitates the formation of expectations about the determinants of ICDs that is more representative of the underlying population of firms that face control problems because our sample cuts across firms of all sizes in contrast to the sample in the Doyle et al. (2006a) study that contains a higher proportion of accelerated filer (larger) firms. Later in our paper, we demonstrate how this difference in sample composition influences the results. The remainder of the paper proceeds as follows. Section 2 elaborates on the regulations of SOX pertinent to reporting ICDs and introduces our conceptual framework for ICD disclosures. Section 3 describes our sample and descriptive statistics. Section 4 presents the multivariate analysis of the determinants of ICDs, as well as marginal effects, and sensitivity analyses of alternative measures of explanatory variables. Section 5 presents our summary and conclusions and identifies several avenues for future research. 2. Regulatory and conceptual background The lack of guidance on distinguishing between levels of severity of internal control problems prior to AS No. 2 makes firms’ classification and users’ interpretation of ICD reporting under Section 302 somewhat difficult. AS No. 2 identifies three levels of internal control deficiencies based on the likelihood that a material misstatement of annual or interim financial statements might result (PCAOB, 2004). Specifically, AS No. 2 states: A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis (AS No. 2, paragraph 8). A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the company’s ability to initiate, authorize, record, process, or report external financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the company’s annual or interim financial statement that is more than inconsequential will not be prevented or detected (AS No. 2, paragraph 9). A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected (AS No. 2, paragraph 10). The three categories differ in the probability that a misstatement of a particular amount might not be prevented or detected by the company’s disclosure controls and procedures. Some firms used terminology about classification of the severity of the deficiency from

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

171

ICD risk exposures Complexity and scope of operations Organizational change Accounting application risk Internal control resources

ICD existence

+ ICD discover and disclose incentives Auditor technology and scrutiny Regulator intervention threats Investor intervention threats Litigation risk

ICD detection

= Pre-SOX 404 audit ICD Disclosure

Fig. 1. Conceptual model of pre-SOX mandated audit disclosure of internal control deficiencies (ICDs).

prior standards for internal control reporting,7 some used AS No. 2 terminology, and some used neither. Despite the ambiguities, Compliance Week and other researchers have attempted to retrofit ICD disclosures into the AS No. 2 framework for investigating Section 302 disclosures (e.g., Hammersley et al., 2005; Doyle et al., 2006a). Management’s incentive to provide an ICD disclosure prior to a SOX 404 audit involves trading off the expected benefits from the discovery and disclosure of an ICD and the costs of disclosing an ICD. One of the potential costs of providing an early ICD disclosure is that it may expose management to criticism for lax organization and mismanagement. An ICD disclosure might also cast doubt on the reliability of management’s prior financial reports including increased concern that financial restatements might result. An additional cost of an early ICD disclosure is the potential increase in the risk of private litigation by investors for not discovering and reporting the deficiencies earlier. On the positive side, however, early disclosure of an ICD may allow management to ‘‘get in front of the issues’’ (Karr, 2005), or perhaps signal that the firm does not have more serious problems such as a material weakness or heightened likelihood of future restatements (Martinek, 2005). Furthermore, because the SEC assesses no penalties for having a material weakness or significant deficiency in internal control, there is no risk of regulatory sanctions for internal control weaknesses per se. Rather, there is risk of sanctions for not disclosing known material weaknesses in internal control or changes in internal control status. A conceptual model of the existence, detection and reporting of internal control deficiencies before SOX 404 audits is presented in Fig. 1. We model the existence of internal control deficiencies as a function of a number of internal control risk factors and the detection and reporting as a function of audit quality and the incentives that management and its auditor have for early reporting of internal control problems. Although we classify the determinants of ICD disclosure into the two broad categories of 7

Many Section 302 certifications from 2003 and early 2004 refer to ‘‘reportable conditions,’’ a term from AICPA auditing and attest standards guidance that predates SOX (AICPA, 1988, 2001). AS No. 2 also specifies new uncertainty terminology such as ‘‘a remote likelihood’’ to characterize the likelihood of material misstatement required to make an ICD a material weakness whereas prior guidance used ‘‘a relatively low level [of] risk’’ (AICPA, 1988). The possible differences in management and auditor implementation due solely to the 2004 changes in guidance led us to combine all ICD disclosures.

ARTICLE IN PRESS 172

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

IC risk exposures and ICD discovery and disclosure incentives, we recognize that several of the variables we use could proxy for both risk effects and incentive effects. We highlight this potential dual role for several explanatory variables below. The IC risk factors include the complexity and scope of firms’ operations, changes in organizational structure, accounting measurement application risk, and firm resources (or lack thereof) invested in internal controls. We posit that firms with greater complexity and scope of operations are more likely to encounter internal control problems. The complexity of firm operations, and consequently, the intricacy of its transactions increase as the firm operates in diverse industries or in international markets. The more complicated the firm’s transactions, the more difficult to structure adequate internal controls. In addition, multi-segment firms potentially face more internal control problems related to the preparation of consolidated reports (e.g., the proper elimination of intracompany transactions). Moreover, the more diverse and multifaceted a firm’s operations the greater the chance there will be breaches in the year-end closing and roll up procedures. We use SEGMENTS, defined as the number of reported business segments in 2003, and FOREIGN_SALES, coded one if a firm reports foreign sales in 2003 and zero otherwise, to proxy for the complexity and scope of operations. Both SEGMENTS and FOREIGN_SALES are identified using the Compustat Segment file. We conjecture that firms are more likely to have ICDs when they have recently changed organization structure either through mergers or acquisitions or through restructurings. Acquiring firms face significant internal control challenges when integrating their operations, systems, and cultures with those of acquired firms. Furthermore, failure to develop adequate controls over accounting for acquired assets can increase internal control risk for acquiring firms. Firms participating in down-sizing and restructurings are likely to face greater internal control risk due to personnel problems related to the segregation of duties, inadequate staffing and supervision problems. We use M&A and RESTRUCTURE to proxy for recent changes in organizational structure. M&A is coded one if the firm has been involved in a merger or acquisition from 2001 to 2003 (Compustat AFTNT1), and zero otherwise. RESTRUCTURE is coded one if a firm has been involved in a restructuring from 2001 to 2003 and zero otherwise, where non-zero values of Compustat data items 376, 377, 378 or 379 are used to identify sample firms engaged in restructurings. We expect a positive relation between firms’ ICD disclosures and M&A and RESTRUCTURE. We use GROWTH, defined as the average percentage change in sales (Compustat #12), and INVENTORY, defined as inventory (Compustat #3) as a percentage of total assets (Compustat #6), to capture firms’ operating characteristics that are likely to expose them to greater accounting measurement application risks (Kinney and McDaniel, 1989). Rapidly growing firms are more likely to have systems that fail to keep pace with increases in customer demand or entry into new markets. Furthermore, growing firms are more likely to encounter staffing issues as the scope and complexity of their operations expand. Firms with more inventory face increased internal control risks related to the proper measurement and recording of inventory, misreporting due to theft, and timely recognition of inventory obsolescence. Information and control systems have a large fixed cost component and are costly to install and maintain. Conditional on their resources, firms will make differential investments in information and control systems. We reason that smaller firms have less to invest in sophisticated information systems (e.g., enterprise resource planning systems

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

173

such as SAP) that can enhance internal control, and they are less likely to have adequate personnel and expertise to maintain these systems. We use SIZE, as measured by the market value of equity (Compustat #199*Compustat #25), to proxy for firms’ investment in information systems and internal control, where smaller firms are expected to have weaker internal controls (DeFond and Jiambalvo, 1991). Following the work of Wright and Wright (1996) who find a negative association between firm size and accounting errors, we predict a negative relation between SIZE and ICD disclosures. We use two additional variables to capture the impact of low investment in information and control systems on the likelihood of ICDs. We posit that poorly performing firms and firms in financial distress are more likely to under invest in systems and controls and have staffing problems that lead to IC weaknesses. We use %LOSS, defined as the proportion of years from 2001 to 2003 that the firm reported negative earnings (Compustat #118), to proxy for poor performance. Firms with a greater frequency of losses are expected to exhibit a higher likelihood of an ICD due to lack of investment in internal controls (Krishnan, 2005). We use the Altman z-score, ZSCORE, to capture distress risk with higher z-scores indicating less distress risk (Altman, 1968).8 We predict a positive coefficient on %LOSS and a negative coefficient on ZSCORE. The resignation of the auditor in the year prior to an ICD disclosure is viewed as another ICD risk factor. An auditor will resign from an audit engagement when the expected costs of being associated with an audit client exceed anticipated revenues. This might occur when the auditor believes that a client’s internal controls are excessively weak and that adequate client resources are not available to remedy the problem.9 We use Audit Analytics to identify firms in both the ICD sample and the control sample that switched auditors during the 12-month period beginning in the fourth month after the close of fiscal year 2002 through the third month after the close of fiscal year 2003.10 We collect the 8-K filings for sample firms that changed auditors and code AUDITOR_RESIGN as one for firms that state their auditor resigned during this 12-month period, and zero otherwise. We predict a positive relation between ICD and AUDITOR_RESIGN as an auditor resignation may indicate unacceptable audit engagement risk due to weak operating performance and financial distress that reflects inadequate investment in internal control.11 8 Prior and concurrent research often times uses accounting-based performance metrics such as return-on-equity (ROE) or return-on-assets (ROA) as a proxy for the resources available to invest in internal control systems. While useful in assessing firm performance, we elect not to use ROE or ROA as a determinant in our ICD disclosure model because using these measures implicitly assumes a monotonically increasing investment in internal control as performance improves. As stated above, much of the investment in internal control is fixed, and as such, we argue %LOSS and ZSCORE are better indicators of lack of investment in IC. 9 An auditor’s decision to resign from an engagement is complex and may result from various causes (Shu, 2000). For example, auditor resignation may reflect the auditor’s belief that client management lacks integrity and may commit fraud by overriding internal controls. Alternatively, the auditor may believe that it can earn higher returns with other clients and therefore resigns from the audit. Auditor resignation due to the latter reason introduces noise in this explanatory variable. 10 We allow for a 3-month window after fiscal year-end because most auditor changes occur after the fiscal yearend closing date but before the annual shareholder meeting (typically held in the fourth month after fiscal yearend) at which time a proxy vote for appointment of the external auditor takes place. 11 Firms changing auditors have long been required to disclose any internal control problems identified by predecessor auditors (AICPA, 1988; SEC, 1988; Whisenant et al., 2003). In the sensitivity section of the paper, we report the results of our ICD determinant model after deleting the 12 ICD firms that disclosed an internal control deficiency in conjunction with reporting a change in their external auditor.

ARTICLE IN PRESS 174

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Fig. 1 also models the factors that contribute to the detection and reporting of an ICD. We use auditor dominance, regulatory oversight in financial reporting due to prior restatement or SEC enforcement actions, monitoring by institutional investors, and industry litigation risk to proxy for incentives to discover and disclose ICDs. The quality of the external auditor is one factor that contributes to the detection of an ICD even in the era prior to mandated audits of internal control under Section 404. This is because detection of an ICD by the auditor is a function of its strategy and scrutiny in conducting financial statement audits and the quality of any optional audit technology that might be used in evaluating internal control as part of the financial statement audit. We expect dominant audit suppliers to be more likely to uncover, as well as to require management disclosure of any known ICD for several reasons. First, dominant audit suppliers are likely to provide higher quality financial statement audits that include more systematic examination and review of internal controls relative to other audit suppliers because dominant audit suppliers face greater loss of reputation by conducting poor quality audits (DeAngelo, 1981; Shu, 2000). Second, dominant audit suppliers invest more in technology and training that facilitates the discovery of internal control problems. Third, based on Dye’s (1993) work that links audit quality to auditor wealth, dominant audit suppliers hold greater litigation risk and thus face greater incentives to require ICD disclosure in order to avoid costly lawsuits. We classify BDO Seidman, Deloitte and Touche, Ernst and Young, Grant Thornton, KPMG, and PricewaterhouseCoopers as the dominant audit suppliers. We include BDO Seidman and Grant Thornton in the dominant auditor classification because these two firms acquired a significant number of SEC reporting clients following the demise of Arthur Andersen, which results in these firms facing additional litigation risk related to ICD reporting.12 AUDITOR is coded one for firms that contract with a dominant audit supplier, and zero otherwise. We predict a positive relation between AUDITOR and ICD disclosures. Fig. 1 also links managers’ incentives to discover and report internal control problems with the likelihood of an ICD disclosure. In general, management faces greater incentives to discover and report internal control weaknesses when the firm is subject to greater monitoring by stakeholders and when those stakeholders have greater incentives to initiate litigation if the firm’s financial reporting process is deemed to be deficient. We use three variables to capture managers’ incentives to discover and report ICDs prior to SOX 404 audits—either prior restatements or an SEC AAER, concentrated institutional ownership, and industry litigation risk. RESTATEMENT is coded one if the firm restated its financial statements or was the object of an AAER from 2001 to 2003, and zero otherwise.13 We view RESTATEMENT 12

In the sensitivity section of the paper we report the results when classifying Deloitte and Touche, Ernst and Young, KPMG, and PricewaterhouseCoopers as the dominant audit suppliers. 13 Restatements announced by public companies from January 1, 2001 to December 31, 2003 are identified from various sources using the procedure outlined in Kinney et al. (2004), and the population of AAERs released by the SEC during the same time period comprises the AAER component of RESTATEMENT. Specifically, restatements are identified from public sources by searching the Lexis-Nexis News and Form 8-K library files, the Securities Class Action Alert, and various business journals such as the Wall Street Journal, New York Times, Washington Post, and Los Angeles Times. The key word search used ‘‘restat,’’ ‘‘revis,’’ ‘‘adjust,’’ and ‘‘error,’’ and phrases such as ‘‘responding to guidance from the SEC.’’ Our AAER search identified specific issuers that were the subject of the release.

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

175

as a proxy for managers’ incentives to discover and report ICDs because we posit that firms are more likely to be forthcoming about control problems when the quality of their financial statements has been questioned by market regulators or auditors in the past.14 Prior research suggests that firms suffer, on average, a 25% decline in stock price when earnings restatements are announced (Richardson et al., 2003). Thus, the market imposes a heavy penalty on firms that restate earnings. We expect that management of firms that have incurred such penalties in the recent past will have strong incentives to avoid incurring these penalties in the near future and, therefore, will be particularly diligent about discovering and reporting ICDs to reduce the risk of another restatement or AAER. Accordingly, we predict a positive relation between RESTATEMENT and ICD disclosures.15 We also posit that managers of firms with more concentrated ownership face greater incentives to discover and disclose ICDs due to increased monitoring and greater litigation threats from concentrated owners. Prior research suggests that institutional owners that hold large blocks of shares have both the incentives to monitor management and they have the voting power to bring pressure to bear on management to effect change when control problems surface (Jensen, 1993; Shleifer and Vishny, 1997). We use INST_CON, measured as the percentage of shares held by institutions divided by the number of institutions that own a firm’s stock (Compact D), as our measure of concentrated institutional ownership. We predict a positive relation between INST_CON and ICD disclosures. The last variable used to proxy for managers’ incentives to discover and disclose ICDs is LITIGATION, which is coded one if a firm operates in a litigious industry and zero otherwise.16 Managers of firms facing greater risk of lawsuits have greater incentives to disclose the adverse news of an IC problem to minimize potential share price declines that can trigger shareholder litigation. The LITIGATION variable could also serve as a proxy for IC risk if industries are subject to litigation because there is significant reporting control risk. For either reason, we expect a positive relation between LITIGATION and ICD disclosures. In summary, we posit that the disclosure of an ICD prior to a SOX 404 audit is a joint function of firm-specific economic attributes that expose firms to internal control risks and the incentives of firms’ management and external auditors to discover and disclose internal 14 One might conjecture that restatements are primarily due to internal control problems. However, for our Section 302 ICD sample firms with restatements, only 12% mention internal control problems as the primary restatement cause, while 15%, 27%, and 12%, respectively, mention management fraud, judgment error, and GAAP interpretation different from the SEC’s, with 34% silent about cause. 15 RESTATEMENT might also be viewed as an internal control risk proxy. But the predicted relation between RESTATEMENT and ICD is ambiguous in this case. On the one hand, firms with prior restatements may exhibit lower incidence of ICDs in the future because they have improved their accounting processes in order to avoid the negative market consequences of reporting another restatement, making it less likely that ICDs will exist (and be reported) going forward. On the other hand, one could argue that firms with prior restatements are more likely to have additional internal control problems that will resurface in the future, leading to a predicted positive relation between RESTATEMENT and ICD. Thus, if RESTATEMENT serves as an internal control risk proxy, its predicted relation with an ICD disclosure is indeterminate. Based on extant guidance and analysis of stated reasons for prior restatements noted in footnote 15, we conclude that our sample’s restatements more likely proxy for incentives to report than internal control risk. However, we acknowledge that the significance of this variable may reflect both internal control risk effects and incentive to discovery and report effects. 16 Consistent with Francis et al. (1994) firms with primary SIC codes of 2833–2836 (biotechnology), 3570–3577 (computer equipment), 3600–3674 (electronics), 5200–5961 (retailing), and 7370–7374 (computer services) are coded one, and zero otherwise.

ARTICLE IN PRESS 176

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Table 1 Variable definitions Variables

Predicted sign

IC risk attributes SEGMENTS

+

FOREIGN_SALES

+

M&A

+

RESTRUCTURE

+

GROWTH

+

INVENTORY

+

SIZE



%LOSS

+

RZSCORE AUDITOR_RESIGN

 +

Proxies for incentives to discover and disclose AUDITOR +

RESTATEMENT

+

INST_CON

+

LITIGATION

+

Definitions and data source

Number of reported business segments in 2003 (Compustat Segment file). Coded one if a firm reports foreign sales in 2003, and zero otherwise (Compustat Segment file). Coded one if a firm is involved in a merger or acquisition from 2001 to 2003, and zero otherwise (Compustat AFNT #1). Coded one if a firm was involved in a restructuring from 2001 to 2003, and zero otherwise. This variable is coded one if any of the following Compustat data items are non-zero: 376, 377, 378 or 379. Average growth rate in sales from 2001 to 2003 (Percent change in Compustat #12). Average inventory to total assets from 2001 to 2003 (Compustat #3/#6). Average market value of equity from 2001 to 2003 in $ billions (Compustat #199 * #25). Proportion of years from 2001 to 2003 that a firm reports negative earnings. Decile rank of Altman (1980) z-score measure of distress risk. Coded 1 if auditor resigned from the client during the 12-month period beginning in the fourth month after the close of fiscal year 2002 through the third month after the close of fiscal year 2003, zero otherwise (Audit Analytics and 8-K filings). Coded one if a firm engaged one of the largest six audit firms for 2003, and zero otherwise (Compustat). Largest six audit firms include PWC, Deloitte & Touche, Ernst and Young, KPMG, Grant Thornton and BDO Seidman. Coded one if a firm had a restatement or an SEC AAER from 2001 to 2003 and zero otherwise. Percentage of shares held by institutional investors divided by the number of institutions that own the stock as of December 31, 2003 (Compact D). Coded one if a firm was in a litigious industry—SIC codes 2833–2836; 3570–3577; 3600–3674; 5200–5961; and 7370, and zero otherwise.

control problems. The variables used to capture the determinants of pre-404 ICD disclosures are summarized in Table 1. 3. Sample and descriptive statistics 3.1. Sample Our initial sample of firms providing disclosure of ICDs is obtained from monthly compilations of SEC filings reported in Compliance Week, a weekly electronic newsletter

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

177

Table 2 Sample selection criteria Number of firms disclosing internal control deficiencies 11-03 through 12-04a Elimination of duplicate firms Elimination of firms from financial services and utilities industries Firms not covered by Compustat Firms with insufficient Compustat data Firms with insufficient return/price data Internal control deficiency (ICD) sample Control sampleb a

585 (47) (16) (73) (108) (15) 326 4484

Source: Compliance week. All firms having the necessary data on Compustat and CRSP to estimate the ICD disclosure model.

b

published by Boston’s Financial Media Holdings Group. The sample period spans filings made from November 2003 to December 2004 and includes 585 separate disclosures made by 538 firms.17 Additional data requirements to estimate the multivariate logit model (described more fully below) reduced the final sample to 326 firms as detailed in Table 2. Henceforth, we refer to this group of firms as the ICD sample. All remaining firms on the Compustat Annual Industrial Full Coverage and Research files not identified as providing a disclosure of ICD prior to December 31, 2004 and with the required data for estimating our model of ICD reporting comprise our control sample of 4484 firms.18 3.2. Descriptive statistics and univariate results Panel A of Table 3 presents descriptive statistics and the results of univariate tests that statistically assess the comparisons between the ICD and control samples. Summary statistics for the continuous variables, which represent the average value calculated over the 3 years prior to the filing of the ICD report (i.e., from 2001 to 2003), include the mean, standard deviation (std. dev.), first quartile, third quartile, and median. The mean values reported for the categorical variables show the proportion of treatment or control firms that possess the indicated characteristic. With few exceptions, the descriptive statistics in Table 3 support our predictions about the determinants of ICD disclosures. For the ICD risk attributes, we find that firms reporting control deficiencies have more segments and are more likely to have foreign sales, be involved in mergers and acquisitions, and engage in restructurings. For GROWTH and INVENTORY, the two variables that proxy for accounting measurement application risk, we find significantly higher median values for both variables for the ICD firms relative to control firms as predicted. The univariate results on SIZE as a proxy for 17 Through the end of 2004, Compliance Week identified ICD firms by filtering all SEC filings of all registrants for the key words that would indicate an internal control deficiency. We read the ICD firms’ SEC filings over 2001–2004 to determine the date of the first public disclosure of an ICD. These filings include forms 10-K, 10-Q, 8-K, S-3, S-4 and proxy statements. We find that all firms identified by Compliance Week as having an internal control problem did disclose an ICD in a SEC filing, but approximately 39% of the firms disclosed an ICD in an earlier SEC filing than the one reported in Compliance Week. Beginning January 1, 2005, Compliance Week filters only the SEC filings of firms comprising the Russell 3000, suggesting that samples drawn from Compliance Week after December 31, 2004 are not representative of the US equity market. 18 Accelerated filers comprise 59.8% of our ICD sample and 52.9% of our control sample.

ARTICLE IN PRESS 178

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

investment in internal controls are mixed; the average size of the ICD sample ($.885 billion) is slightly smaller than the control sample ($1.164 billion), while the median size of the ICD firms ($.140 billion) is significantly larger than the control firms ($0.091 billion). Turning to the three other variables used to proxy for firms’ investment in internal controls (%LOSS, ZSCORE and AUDITOR_RESIGN), the descriptive statistics indicate that ICD firms have a higher incidence of losses and more often have their auditors resign from the engagement. The descriptive statistics on ZSCORE show that this variable is highly negatively skewed. Accordingly, we focus on median tests that suggest there is no difference in bankruptcy risk between ICD and control firms. The univariate tests also suggest significant differences between the ICD firms’ and control firms’ ability to detect IC weaknesses and incentives to disclose ICDs. A higher proportion of firms in the ICD sample are audited by a dominant audit firm, are more likely to have restated earnings or have SEC AAERs sometime during the period from 2001 to 2003, and have a higher concentration of institutional shareholders. There is, however, no significant difference in the proportion of ICD firms versus control firms that operate in litigious industries. We present pair-wise correlations in Panel B of Table 3, where the upper right-hand portion of the table presents Pearson product–moment correlations and the lower lefthand portion presents the Spearman rank–order correlations. We discuss the Pearson correlations, but note that the patterns of the two correlations are quite similar. The largest correlations are a significant positive correlation of 0.372 between ZSCORE and AUDITOR, followed by a significant positive correlation of 0.307 between RESTRUCTURE and AUDITOR. The vast majority of other correlations fall between 70.20, which suggests that the variables included in our determinant model capture distinct features of firms’ internal control risks and incentives to report. Overall, the descriptive statistics suggest that firms disclosing ICDs prior to SOX 404 audits face greater operating and reporting risks relative to non-ICD firms. In the next section we conduct more formal tests of our hypotheses using multivariate logistic regression. 4. Multivariate analysis of ICD disclosure We use the following logistic regression model to assess the extent to which internal control risk attributes and incentives to discover and early report internal control problems are associated with firms’ ICD disclosures: ICD_DISCLOSURE ¼ b0 þ b1 SEGMENTS þ b2 FOREIGN_SALES þ b3 M&A þ b4 RESTRUCTURE þ b5 RGROWTH þ b6 INVENTORY þ b7 SIZE þ b8 %LOSS þ b9 RZSCORE þ b10 AUDITOR_RESIGN þ b11 AUDITOR þ b12 RESTATEMENT þ b13 INST_CON þ b14 LITIGATION þ e,

ð1Þ

where ICD_DISCLOSURE is coded one for ICD firms and zero for control firms. We transform GROWTH to be the decile rank of the average sales growth from 2001 to 2003

Table 3 Descriptive statistics on the determinants of internal control deficiency disclosures Mean

Median

Q3

1.000 1.000

1.000*** 1.000

3.000 3.000

— —

— —

— —

— —

— —

— —

— —

— —

— —

— —

— —

0.606 0.642

0.049 0.069

0.048** 0.033

0.212 0.185

0.137 0.137

0.008 0.001

0.084*** 0.061

0.197 0.180

3.113 3.982

0.028 0.014

0.140*** 0.091

0.419 0.522

0.399 0.425

0.333 0.000

0.667*** 0.667

1.000 1.000

15.167 20.506

0.476 0.327

1.513 1.639

2.556 2.826

— —

— —

— —

— —

—

—

—

—

179

— —

ARTICLE IN PRESS

Proxies for incentives to discover and disclose AUDITOR1 ICD sample 0.847***

1.547 1.461

Q1

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Panel A: Distributional properties of independent variables IC risk attributes SEGMENTS ICD sample 2.150*** Control sample 1.945 FOREIGN_SALES ICD sample 0.715*** Control sample 0.636 M&A ICD sample 0.420*** Control sample 0.319 RESTRUCTURE ICD sample 0.485*** Control sample 0.371 GROWTH ICD sample 0.206 Control sample 0.181 INVENTORY ICD sample 0.127* Control sample 0.115 SIZE ICD sample 0.885* Control sample 1.164 %LOSS ICD sample 0.581*** Control sample 0.519 ZSCORE ICD sample 1.827** Control sample 3.377 AUDITOR_RESIGN ICD sample 0.058*** Control sample 0.008

Std. dev.

180

Table 3 (continued ) Mean 0.759

—

—

—

—

0.156*** 0.062

— —

— —

— —

— —

0.009*** 0.007

0.010 0.010

0.273 0.287

A B C D E F G H I J K L M N

0.003 0.001

— —

0.006*** 0.005

— —

0.010 0.009

— —

— —

A

B

C

D

E

F

G

H

I

J

K

L

M

N

— 0.230 0.129 0.187 0.027 0.116 0.270 0.214 0.138 0.011 0.029 0.165 0.072 0.143

0.221 — 0.044 0.252 0.097 0.169 0.271 0.219 0.202 0.014 0.033 0.235 0.187 0.034

0.122 0.044 — 0.118 0.200 0.113 0.238 0.071 0.018 0.015 0.015 0.094 0.017 0.035

0.186 0.252 0.118 — 0.177 0.201 0.315 0.033 0.014 0.004 0.078 0.307 0.154 0.010

0.069 0.152 0.111 0.143 — 0.078 0.188 0.154 0.039 0.009 0.002 0.017 0.034 0.017

0.009 0.099 0.138 0.033 0.107 — 0.019 0.241 0.327 0.008 0.014 0.040 0.120 0.088

0.270 0.154 0.076 0.159 0.031 0.051 — 0.432 0.362 0.067 0.054 0.584 0.132 0.053

0.215 0.217 0.072 0.035 0.105 0.194 0.221 — 0.603 0.062 0.027 0.259 0.122 0.107

0.136 0.186 0.024 0.137 0.058 0.139 0.077 0.295 — 0.065 0.018 0.326 0.285 0.024

0.002 0.014 0.015 0.004 0.012 0.005 0.036 0.061 0.027 — 0.047 0.054 0.001 0.004

0.028 0.033 0.015 0.078 0.001 0.012 0.021 0.028 0.038 0.050 — 0.075 0.038 0.005

0.165 0.235 0.094 0.307 0.128 0.005 0.158 0.259 0.372 0.054 0.075 — 0.369 0.067

0.011 0.102 0.074 0.058 0.076 0.115 0.155 0.016 0.139 0.013 0.014 0.158 — 0.002

0.140 0.034 0.035 0.010 0.039 0.105 0.033 0.106 0.010 0.003 0.005 0.067 0.028 —

***, **, *Indicates significance at the 0.01, 0.05, and 0.10 level or better, respectively, based on t-statistic for difference in means or based on Z-statistic for difference in medians. There are 326 firms in the ICD sample and 4484 firms in the Control sample. All continuous variables have been winsorized at the 1 and 99 percentile values. See Table 1 for variable definitions. 1 In Table 6, we report the results of a sensitivity analysis where we set auditor equal to one if the firm uses one of the Big Four audit firms (PWC, Deloitte and Touche, Ernst and Young and KPMG) and zero otherwise. The proportion of ICD (Control) firms that use Big Four auditors is 0.724 (0.683) whereas 12.2% of the ICD sample firms use BDO Seidman or Grant Thortnon and 7.6% of the control firms use these two auditors (these proportions are different at the 0.05 level). 2 The upper right-hand portion of the table presents Pearson product–moment correlations and the lower left-hand portion presents the Spearman rank-order correlations. Bold text indicates significance at the 0.01 level or better. n ¼ 4810. See Table 1 for variable definitions.

ARTICLE IN PRESS

Panel B: Correlations SEGMENTS2 FOREIGN_SALES M&A RESTRUCTURE GROWTH INVENTORY SIZE %LOSS ZSCORE AUDITOR_RESIGN RESTATEMENT AUDITOR INST_CON LITIGATION

Q3

Median

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Control sample RESTATEMENT ICD sample Control sample INST_CON ICD sample Control sample LITIGATION ICD sample Control sample

Q1

Std. dev.

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

181

(RGROWTH) because we expect the relation between growth and ICDs to be ordinal rather than cardinal.19 We also convert ZSCORE to decile ranks (RZSCORE) because of the documented skewness in the distribution of ZSCORE (see Panel A of Table 3). Model 1 of Table 4 displays the results of estimating Eq. (1) using only the variables classified as IC risk attributes, which serves as a benchmark for assessing the incremental effect of reporting incentives on the likelihood of firms disclosing ICDs. All of the estimated coefficients on the internal control risk attributes have the expected sign and are significant at conventional levels with the exception of RZSCORE, which has the predicted sign but is insignificant. We find that firms with more complex operations as reflected in the number of business segments and being engaged in foreign operations, as captured by FOREIGN_SALES, hold greater internal control risk than firms that only operate in domestic markets. The results document that firms engaged in organizational change via participation in a M&A or restructuring face greater internal control risk and are more likely to report an ICD. In addition, we find that firms with higher sales growth and firms with relatively larger inventory holdings are more likely to have problems with their internal controls and are thus more likely to report ICDs. After controlling for the scope and complexity of operations, we find that smaller firms and firms with a higher incidence of losses are more likely to report ICDs consistent with our conjecture that smaller, less profitable firms make fewer investments in sophisticated information and operating systems. We also find that the resignation of the auditor is positively related to an ICD disclosure supporting the notion that an auditor resignation may indicate unacceptable audit engagement risk due to weak operating performance and financial distress that reflects inadequate investment in internal control. The benchmark model yields a Likelihood ratio w2 of 98.31, which is significant at the 0.01 level or better. Model 2 of Table 4 displays the logit results incorporating the variables that we use to proxy for the incentives to discover and disclose an ICD. The coefficients on the internal control risk attribute variables are significant with the predicted signs, including RZSCORE, after the addition of the variables that proxy for reporting incentives. After controlling for internal control risk attributes, we document that firms that contract with a dominant auditor supplier are more likely to make an ICD disclosure. This finding suggests that the quality of the external audit has an impact on the detection and reporting of a firm’s internal control problems. We also find that firms that face more reporting risk because they have previously disappointed the market with low quality financial information, as proxied by having to restate their financial statements or being involved in a SEC AAER action during the 2001–2003 period, are more likely to disclose an ICD. Consistent with our prediction, we find that firms with greater concentrated institutional ownership are more likely to voluntarily report ICDs during the SOX 302 reporting regime. Finally, contrary to expectations, we fail to find that firms operating in litigious industries are more likely to report ICDs. The expanded model is highly significant with a Likelihood ratio w2 of 137.69. The Wald 2 w of 41.96 (significant at 0.01) indicates that the addition of the incentives to discover and disclose variables, as a group, add significant incremental explanatory power to the model based only on internal control risk attributes. Overall, the results of the logistic regression support the hypothesis that the early disclosure of ICDs is a joint function of firm-specific 19

In the sensitivity analysis section of the paper, we present results when coding GROWTH as a continuous variable.

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

182

Table 4 Logistic regression of the determinants of internal control deficiency disclosures

ICD_DISCLOSURE ¼ b0 þ b1 SEGMENTS þ b2 FOREIGN_SALES þ b3 M&A þ b4 RESTRUCTURE þ b5 RGROWTH þ b6 INVENTORY þ b7 SIZE þ b8 %LOSS þ b9 RZSCORE þ b10 AUDITOR_RESIGN þ b11 AUDITOR þ b12 RESTATEMENT þ b13 INST_CON þ b14 LITIGATION þ e,

Predicted sign

Intercept

7

Estimated coefficients Model 1

Model 2

3.996 (199.26)***

4.379 (202.55)***

IC risk attributes SEGMENTS

+

FOREIGN_SALES

+

M&A

+

RESTRUCTURE

+

RGROWTH

+

INVENTORY

+

SIZE



%LOSS

+

RZSCORE



AUDITOR_RESIGN

+

0.087 (4.606)** 0.361 (6.757)*** 0.402 (10.314)*** 0.417 (10.910)*** 0.059 (7.581)*** 1.163 (6.943)*** 0.036 (3.081)** 0.475 (6.702)*** 0.015 (0.304) 2.008 (45.912)***

0.074 (3.243)** 0.278 (3.968)** 0.416 (10.78)*** 0.249 (3.579)** 0.060 (7.262)*** 1.346 (8.774)*** 0.032 (2.425)* 0.502 (7.229)*** 0.037 (1.701)* 2.024 (43.619)***

Proxies for incentives to discover and disclose AUDITOR

+

RESTATEMENT

+

INST_CON

+

LITIGATION

+

Likelihood ratio, w2 Wald, w2 Sample size

0.565 (9.681)*** 0.839 (23.964)*** 10.260 (3.176)** 0.136 (0.996) 98.31*** 103.95*** 4810

137.69*** 41.96*** 4810

ICD_DISCLOSURE is coded one for firms that file an internal control deficiency report (n ¼ 326) and zero otherwise (n ¼ 4484). RGROWTH is the decile rank of GROWTH, where GROWTH and other variables are defined in Table 1. Wald w2 values in parentheses. ***Indicates significance at the 0.01 level or better, **Indicates significance at the 0.05 level or better, *Indicates significance at 0.10 level or better.

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

183

economic attributes that expose firms to internal control risks and the incentives of firms’ management and external auditors to provide early warning of internal control problems. 4.1. Marginal analysis In order to provide some insight into what factors are most important in determining the likelihood that a firm will disclose an ICD, we calculate the change in probability of a firm disclosing an ICD as a result of changing the levels of various explanatory variables in Eq. (1). The change in probability is calculated using the following steps. First, we calculate the probability of a firm disclosing an ICD from our logitistic regression model using the following expression: 0

0

pðX Þ ¼ eb X =ð1 þ eb X Þ,

(2)

where b is the vector of coefficients from Model 2 in Table 4 and X is the vector of independent variables set equal to their mean values across the sample of all firms. Conditional on the mean values of the independent variables, the likelihood of reporting an ICD is 4.9%. Next, we calculate the marginal changes in the probability of a firm reporting an ICD for a one standardized unit increase in each explanatory variable while holding the other independent variables at their mean values.20 Each marginal effect is measured by qpðX Þ=qxi ¼ bi pðX Þ½1  pðX Þ calculated at the mean value of the regressors. These marginal effects are reported in column 3 of Table 5. Among the IC risk factors, the variables with the greatest marginal effects are AUDITOR_RESIGN (0.227), and %LOSS (0.210) and M&A (0.193). For incentives to discover and report, AUDITOR (0.268) and RESTATEMENT (0.201) have the greatest marginal impact. An alternative way of assessing the effect of various IC risk factors and incentives to discover and report an ICD is to calculate the values of the logit function, p(X), at selected xi values such as their lower and upper quartiles (Agresti, 2002, p. 167). This entails substituting the quartile values for each xi explanatory variable into Eq. (1) while holding the other variables constant at their means. The linear approximation to changes in p(X) is obtained by multiplying the interquartile range of xi values (see Table 3 for the interquartile ranges) by the marginal effects based on the unstandardized value of the variables (Agresti, 2002, Chapter 5). These values are reported in the last column of Table 5. We first calculate the probability of disclosing an ICD for a hypothetical firm that takes on the lower (upper) quartile values of determinants of an ICD disclosure for variables that are positively (negatively) related to ICDs.21 This yields a probability of disclosing an ICD of about 1.2%. We next repeat this process but now use upper (lower) quartile values of explanatory variables that are positively (negatively) related to the incidence of an ICD. This yields a probability of an ICD of 77.9% with AUDIT_RESIGN accounting for nearly 35%. Leaving AUDIT_RESIGN out of the model lowers the probability of an ICD to 31.7%. Thus, the probability of reporting an ICD is dramatically higher when a firm 20 We use standardized values because the various explanatory variables are measured in different units. Without standardization the marginal probabilities are difficult to compare and interpret (Agresti, 2002, Chapter 5). 21 For attributes measured as a binary variable, the benchmark probability is determined with the zero (one) value when the attribute is positively (negatively) related to reporting an ICD.

ARTICLE IN PRESS 184

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Table 5 Assessment of changes in probabilities of firm disclosing an ICD for selected changes in independent variables Variables

IC risk attributes SEGMENTS FOREIGN_SALES M&A RESTRUCTURE RGROWTH INVENTORY SIZE %LOSS RZSCORE AUDITOR_RESIGN

Predicted sign

+ + + + + +  +  +

Proxies for incentives to discover and disclose AUDITOR + RESTATEMENT + INST_CON + LITIGATION +

Marginal effect Standardized variables

Change in probability Q1 vs. Q3 values

0.108 0.131 0.193 0.117 0.169 0.180 0.113 0.210 0.120 0.227

0.025 0.048 0.072 0.043 0.010 0.042 0.003 0.087 0.032 0.349

0.268 0.201 0.087 0.066

0.097 0.145 0.313 0.023

The Marginal Effects column shows the change in probability of a firm disclosing an ICD due to a one unit change in the variable of interest after standardizing the independent variables. Marginal effects are computed as: 0 0 pðX Þ ¼ eb X =ð1 þ eb X ÞÞ where b0 X is evaluated at the mean values of X. Tabled values in the Change in Probability column show the change in the probability of a firm disclosing an ICD as a result of moving from the first to the third quartile value of the variable of interest, holding all other variables constant at their mean values. RGROWTH is the decile rank of GROWTH and LOGSIZE is the natural log of SIZE, where GROWTH and SIZE, as well as other variables are defined in Table 1.

takes on upper quartile values of the IC risk attributes and factors that are associated with the incentives to discover and report ICDs.22 4.2. Sensitivity analysis The validity of the inferences drawn from our model of ICD disclosure is conditional on the quality of the variables that we use to proxy for IC risk attributes and incentives to discover and disclose ICDs. In this sub-section, we assess the robustness of our results to alternative measures of IC risk and other proxies for incentives to discover and disclose ICDs. The first sensitivity test that we conduct relates to our proxy for audit quality, AUDITOR. As stated earlier, we consider BDO Seidman and Grant Thornton to be dominant audit suppliers in the US audit market during our analysis period because these two firms gained more SEC reporting clients and held a larger US audit market share after 22 We hasten to note that this illustration does not reflect the typical firm in our sample because any given firm will likely not start from a position of having low IC risk factors or incentives to report (1Q or zero value for dummy variables) along all of the multiple dimensions we consider. Nor is it likely that any given firm would be able to move to a position of having high IC risk factors and incentives to report along all dimensions (3Q or one for dummy variables).

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

185

the demise of Arthur Andersen. An additional partitioning of audit firm dominance based on historical market share considers Deloitte, Ernst and Young, KPMG, and PricewaterhouseCoopers to be the dominant audit suppliers as these four firms, along with Arthur Andersen, audited the vast majority of SEC reporting firms since 1995. Model 1 of Table 6 reports the results of our ICD disclosure determinant model adding an additional indicator variable, AUDITOR(BIGFOUR), that is set equal to one if the firm contracts with Deloitte, Ernst and Young, KPMG, and PricewaterhouseCoopers and zero otherwise. With AUDITOR(BIGFOUR) in the model, the coefficient on AUDITOR picks up the marginal likelihood of a client of BDO Seidman or Grant Thornton reporting an ICD. Interestingly, the coefficient on AUDITOR(BIGFOUR) is negative and significant at a ¼ 0:10, while the coefficient on AUDITOR is positive and highly significant.23 One interpretation of these results is that BDO Seidman and Grant Thornton audit clients with greater internal control risk. Alternatively, the results suggest that BDO Seidman and Grant Thornton, in building their reputation with SEC clients, exercise more diligence in identifying internal control problems. The signs and significance of the coefficients on the remaining variables are similar to those of Model 2 reported in Table 4 with the exception that the coefficient on RZSCORE, which becomes insignificant. Our second set of sensitivity tests uses alternative measures of firm growth and litigation risk. Model 2 column of Table 6 displays the results of estimating Eq. (1) using a continuous measure of growth (SALESGRWTH), where SALESGRWTH is defined as the 3-year average sales growth over 2001–2003. The coefficient on SALESGRWTH is marginally significant as compared to the highly significant coefficient on the rank growth measure (RGROWTH) in Table 4. Using this measure of growth does not change inferences drawn about other variables in the model. In Model 3 of Table 6, we replace LITIGATION, a categorical variable capturing high litigation risk industries, with SHU_LIT, which is based on the work of Shu (2000).24 After controlling for other factors that provide incentives for managers to discover and report ICDs, we do not find that firms with high litigation risk as measured by Shu (2000) are any more likely to provide an ICD disclosure than other firms. Thus, this result affirms our earlier finding reported in Table 4 that ICD disclosure is not related to litigation risk. There were 12 ICD firms that concurrently reported an auditor resignation and an ICD in 2003 and early 2004 on an 8-K filing. Because there is a one-to-one mapping of ICD disclosure and the independent variable of AUDITOR_RESIGN, it is important to see if our findings are robust to deleting these observations. In the Model 4 column of Table 6, we report the results of estimating our logistic model after deleting these 12 firms. The most important point is that the deletion of these observations does not adversely affect the significance of the coefficient on AUDITOR_RESIGN. Moreover, except for RZSCORE, the signs and significance of the other coefficients remain unchanged from those reported in Table 4. Thus, we conclude that the inferences drawn from the primary analysis are robust to the deletion of these 12 firms. 23 Obviously, there is a high correlation between AUDITOR and AUDITOR(BIGFOUR), r ¼ 0.82. If we exclude AUDITOR from the model, the coefficient on AUDITOR(BIGFOUR) is positive and significant. 24 Shu (2000) models litigation risk as a function of firm size, inventory holdings, receivables, return-on-assets, current ratio, financial leverage, sales growth, stock return, stock volume, beta, stock turnover, delisting decision, operating in technology-related industries, and receiving a qualified audit opinion. To calculate SHU_LIT, we take the parameter estimates from Table 3 of Shu (2000) and apply them to the accounting and market measures of the sample firms that have the necessary data to calculate the measures.

186

Variables

Estimated coefficient

+

FOREIGN_SALES

+

M&A

+

RESTRUCTURE

+

RGROWTH

+

INVENTORY

+

SIZE



%LOSS

+

RZSCORE



AUDITOR_RESIGN

+

SALESGRWTH

+

Proxies for incentives to discover and disclose AUDITOR + AUDITOR (BIGFOUR)

+

Model 2

Model 3

Model 4

Model 5

Model 6

0.075 (3.341)** 0.277 (3.975)*** 0.423 (11.334)*** 0.265 (4.032)*** 0.061 (7.514)*** 1.269 (7.680)*** 0.031 (2.241)* 0.487 (6.754)*** 0.034 (1.415) 1.980 (40.928)*** —

0.070 (2.912)** 0.261 (3.493)** 0.472 (14.328)*** 0.200 (2.365)* —

0.096 (4.395)** 0.096 (0.310) 0.494 (10.627)*** 0.212 (1.813)* 0.022 (0.581) 1.723 (9.333)*** 0.034 (2.410)* 0.668 (9.561)*** 0.040 (1.189) 1.137 (6.013)*** —

0.074 (3.164)** 0.238 (2.855)** 0.408 (10.082)*** 0.295 (4.885)*** 0.067 (8.797)*** 1.349 (8.543)*** 0.031 (2.241)* 0.493 (6.786)*** 0.033 (1.294) 1.935 (36.051)*** —

0.074 (3.197)*** 0.273 (3.826)** 0.412 (10.470)*** 0.241 (3.359)** 0.059 (7.018)*** 1.312 (8.252)*** 0.028 (1.978)* 0.496 (6.987)*** 0.042 (2.151)* 2.112 (47.244)*** —

0.096 (3.760)** 0.412 (4.544)** 0.457 (8.039)*** 0.708 (17.578)*** 0.104 (11.086)*** 0.987 (2.391)* 0.030 (2.155)* 0.367 (2.453)** 0.009 (0.056) 1.819 (16.701)*** —

0.415 (1.959)* —

0.578 (9.687)*** —

0.631 (12.107)*** —

2.173 (21.444)*** —

0.801 (11.446)*** 0.295 (2.294)*

1.305 (8.235)*** 0.031 (2.225)* 0.423 (5.258)*** 0.039 (1.915)* 2.021 (43.557)*** 0.128 (1.892)* 0.594 (10.625)*** —

ARTICLE IN PRESS

IC risk attributes SEGMENTS

Model 1

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Table 6 Logistic regression results of determinants of ICD disclosures-sensitivity analysis

+

INST_CON

+

LITIGATION

+

SHU_LIT

+

AUDITOR_DIMISS

+

0.847 (24.519)*** 9.586 (2.781)** 0.131 (0.920) —

—

—

139.88*** 4810 326 4484

132.18*** 4810 326 4484

0.951 (21.611)*** 8.771 (1.295) — 1.434 (0.209) — 77.755*** 2894 224 2670

0.785 (19.673)*** 11.016 (3.598)** 0.117 (0.716) — — 124.36*** 4798 314 4484

0.794 (21.159)*** 8.912 (2.346)* 0.147 (1.153) — 1.127 (28.467)*** 114.07*** 4021 303 4324

1.045 (27.731)*** 15.820 (2.185)* 0.107 (0.372) — — 176.95*** 4679 195 4484

***Indicates significance at the 0.01 level or better, **indicates significance at the 0.05 level or better, *Indicates significance at 0.10 level or better. See Table 1 for variable definitions. Model 1—Base model with BIGFOUR auditor, where BIGFOUR is coded one if the firm contracts with Deloitte & Touche, Ernst & Young, KPMG, or PricewaterhouseCoopers, else zero. As shown in footnote 1 to Table 3, 72.4% (68.3%) of the ICD firms (control firms) use BIGFOUR audit firms. Model 2—Base model with continuous sales growth, where SALESGRWTH is defined as the average percentage change in sales from 2001 to 2003. Model 3—Base model with the Shu litigation measure, where SHU_LIT is calculated as the parameter estimates from Table 3 of Shu (2000) applied to the accounting and market measures of the sample firms that have the necessary data to calculate the measures. Model 4—Base model estimated with concurrent auditor change and ICD disclosures observations (n ¼ 12) deleted. Model 5—Base model with AUDITOR_DISMISS as an additional incentive to discover and disclose measure. AUDITOR_DISMISS ¼ 1 if the client dismissed its auditor during the twelve month period beginning in the fourth month after the close of fiscal year 2002 through the third month after the close of fiscal year 2003, zero otherwise (auditor dismissals were determined from Audit Analytics and 8-K filings). Model 6—Base model estimated deleting observations of ICD firms that are non-accelerated filers. Estimated coefficients in italics represent estimates that result in different inferences drawn from those of our primary analysis. See Table 1 for all other variable definitions.

ARTICLE IN PRESS

Likelihood ratio, w2 Sample size ICD sample Control sample

0.840 (23.944)*** 9.925 (2.985)** 0.139 (1.031) —

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

RESTATEMENT

187

ARTICLE IN PRESS 188

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Our fifth sensitivity test explores whether the termination of a firm’s auditor signals problems with internal control. One potential reason why a firm terminates its contract with the incumbent auditor is for unsatisfactory performance after management discovers internal control problems in preparation for a SOX 404 audit that the incumbent auditor had not discovered in a prior audit.25 If the auditor is dismissed, managers have incentives to make an ICD disclosure in conjunction with ‘‘pointing the finger’’ at the terminated auditor for poor internal control oversight. AUDITOR_DISMISS is coded one for firms that disclose in an 8-K filing the dismissal of their auditor in 2003 (and zero otherwise). The results when adding AUDITOR_DISMISS to the ICD disclosure determinant model are displayed in the Model 5 column of Table 6. The coefficient on AUDITOR_DISMISS is positive and highly significant and the signs and significance of the coefficients on the other independent variables are similar to those of Model 2 reported in Table 4. The significantly positive coefficient on AUDITOR_DISMISS is consistent with the notion that firms that dismissed their auditors in 2003 are more likely to report ICDs as managers take steps to improve internal control scrutiny. Our last sensitivity test is motivated by the fact that our sample includes both accelerated and non-accelerated filers because our study focuses on the Section 302 reporting era. In contrast, the Doyle et al. (2006a) study uses a sample that includes disclosures made in both the SOX 302 and 404 reporting regimes, with observations from the later period being heavily weighted towards accelerated filers. To investigate how the differences in samples affect the inferences drawn on internal control risk, we re-estimate our ICD reporting model deleting ICD firms that are non-accelerated filers.26 The Model 6 column of Table 6 displays the results. We continue to include our variables that proxy for the incentives to detect and report ICDs because we posit that even though accelerated filers are required to report material weaknesses in internal control under SOX 404, these firms still faced differential incentives to detect and report internal control problems during the SOX 302 regime. We find the signs and significance on several of the internal control risk and reporting variables to be different from those of our benchmark results reported in the Model 2 column of Table 4. Specifically, we find restructurings to increase in importance in explaining ICDs and the effect of inventory levels, frequency of losses, and likelihood of financial distress on the likelihood of ICDs disclosures to be less significant. More importantly, the results indicate a significant negative relation between INST_CON and ICD reporting, whereas we found a positive relation in our Table 4 results when nonaccelerated filers were included in the ICD sample.27

25 This point highlights the fact that AUDITOR can be considered an endogenous choice. Prior research examining firms’ auditor choices models auditor choice as a function of operating risk, financial risk and the demand for external monitoring (see e.g., Chow, 1982). Our empirical model of ICD disclosure includes many of the same variables used in prior audit choice research to proxy for these risks, and as such, our research design inherently controls for selection effects. Furthermore, the majority of sample firms made their auditor choices across different years much earlier than our year of analysis (i.e., the average auditor tenure for our sample of firms is over 6 years) and as such we think it reasonable to consider AUDITOR as an exogenous variable for this sensitivity test. 26 It is important to note that in order to draw strong inferences regarding the determinants of ICD reporting in the SOX 404 regime, non-accelerated filers also should be deleted from the control sample. We do not take this step to allow more direct comparisons to the Doyle et al. (2006a) study. 27 To be more similar to the ICD risk model of Doyle et al. (2006a), we extend this sensitivity analysis by adding firm AGE, defined as the natural log of the number of years on CRSP, to the model. Unlike Doyle et al. (2006a),

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

189

Based on the sensitivity analysis reported above, it appears that it is important to control for firms’ incentives to detect internal control problems when evaluating the likelihood of ICD reporting. We also find that including firms of all sizes (both accelerated and nonaccelerated filers) affects the significance of several of the variables in our ICD determinant model. 4.3. Factors deterring managers from disclosing ICDs We model ICD disclosures as a function of factors that proxy for managers’ incentives to discover and disclose an ICD, but we do not include any explicit factors that deter managers from providing early ICD disclosures. One potential factor that may deter managers from making an early ICD disclosure is management reputation. Managers may forego disclosing an ICD to avoid criticism in the market for lax organization or mismanagement of operations ultimately reducing their employment options. If reputation is an incentive factor, we would expect new managers to be more likely to disclose ICDs because they can place the blame of internal control problems on prior management. Therefore, we expect firms that have management with longer tenure to be less likely to disclose ICDs. To investigate this issue we collect CEO tenure for all sample firms covered by the Board Analyst database and add CEO tenure to our ICD determi nant model. We code CEO tenure both as a continuous variable as well as a binary variable that is set equal to one if the CEO tenure is less than 2 years, and zero otherwise. In untabulated results, we do not find a statistically significant difference between the CEO tenure of ICD firms and control firms after controlling for other ICD risk and reporting determinants. Another potential factor deterring managers from making an early ICD disclosure is management compensation. An ICD disclosure might cast doubt on the reliability of management’s financial reporting, which impacts the uncertainty of information quality thereby increasing the firm’s cost of capital (Easley and O’Hara, 2004) and decreasing its market value. A CEO that has a large number of stock options (or stock option awards) might not want to disclose an ICD. On the other hand, a CEO that has stock grants as part of his compensation package may actually have incentives to disclose ICDs prior to receiving grants in the hopes that such disclosure would lower the strike price on the options granted during the year, thus raising the value of his options. Given the prediction about the effects of stock-based compensation on managements’ incentives to disclose ICDs is not clear-cut and requires collecting detailed information on the timing of the release of stock option grants relative to disclosure of the ICD, we leave this question to future research. 5. Summary and future research Many have claimed that the passage of the Sarbanes–Oxley Act of 2002 imposed an extreme burden on SEC registrants by requiring them to document, evaluate, publicly report, and have audited the effectiveness of their internal controls. This paper investigates (footnote continued) we do not find a significant coefficient on AGE after controlling for the other ICD risk and reporting determinants.

ARTICLE IN PRESS 190

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

the economic events, strategic operating decisions, and investments in internal controls that expose firms to internal control risks. Because our study uses data prior to audits mandated by Section 404 of the Sarbanes–Oxley Act, we are also able to investigate the incentives to discover and report internal control deficiencies (ICDs) in the absence of well defined ICD discovery and reporting criteria and no mandated internal control audit. More importantly, because we restrict our sample to pre-404 disclosures made by accelerated and non-accelerated filers, our study provides insights into the determinants of ICDs for a broad cross-section of SEC registrants, which is important for developing expectations of internal control problems given that non-accelerated filers are not required to comply with SOX 404 until 2007. We find that firms that report ICDs have more complex operations as proxied by the number of business segments and foreign sales, more often engage in mergers and acquisitions and restructurings, hold more inventory and are faster growing relative to firms that do not disclose internal control weaknesses. In addition, the results indicate that firms with fewer resources to invest in internal control, as proxied by the frequency of losses and greater financial distress, more often disclose problems with their internal controls. Moreover, the higher incidence of auditor resignations prior to ICD disclosures suggests auditors have greater concerns about ICD firms’ accounting application risk and status as going concerns. With respect to incentives to discover and report internal control problems, we find that firms that provide early (pre-SOX 404) warnings of ICDs are more likely to be audited by dominant auditors, have a higher incidence of restatements of financial statements and SEC AAERs in prior years, and are more likely to have concentrated institutional owners. Collectively, these results support our conjecture that firms that face greater internal control risk and have greater reporting incentives are more likely to disclose internal control deficiencies prior to the SOX-mandated internal control audit reporting requirements. The vast majority of firms that reported control deficiencies in the first 3 months of 2005 as a result of SOX 404 audits previously certified their controls as effective under SOX 302 (Glass Lewis, 2005). Future research can investigate whether there are significant differences in internal control risk profiles and incentives to report for firms that disclosed internal control deficiencies prior to SOX-mandated audits versus firms that report deficiencies under Section 404 of the Sarbanes–Oxley Act. Exploring the relation between internal control weaknesses and the quality of externally reported numbers is another natural extension of the present analysis (Ashbaugh-Skaife et al., 2006b; Doyle et al., 2006b). Finally, another avenue of fruitful research is to investigate whether internal control deficiencies result in higher information risk that increases firms’ cost of equity capital (Ashbaugh-Skaife et al., 2006a; Ogneva et al., 2005).

References Agresti, A., 2002. Categorical Data Analysis. Wiley, New York. Altman, E., 1968. Financial ratios, discriminant analysis, and the prediction of corporate bankrupcy. Journal of Finance 23, 589–609. American Institute of Certified Public Accountants (AICPA), 1988. Statement on Auditing Standards No. 60: Communication of Internal Control Structure Related Matters Noted in an Audit, AICPA, New York.

ARTICLE IN PRESS H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

191

American Institute of Certified Public Accountants (AICPA), 2001. Statement on Standards for Attestation Engagements No. 10: Reporting on an Entity’s Internal Control Over Financial Reporting, AICPA, New York. Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006a. The Effect of Internal Control Deficiencies on Firm Risk and Cost of Equity Capital, Working paper, University of Iowa. Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006b. Internal Control Deficiencies, Remediation and Accrual Quality, Working paper, University of Iowa. Beneish, M., Billings, M., Hodder, L., 2006. Internal Control Weaknesses and Information Uncertainty, Working paper, Indiana University. Chow, C., 1982. The demand for external auditing: Size, debt, and ownership influences. The Accounting Review 57, 272–291. DeAngelo, L., 1981. Auditor size and audit quality. Journal of Accounting and Economics 3, 183–200. DeFond, M., Jiambalvo, J., 1991. Incidence and circumstances of accounting errors. The Accounting Review 66, 643–655. De Franco, G., Guan, Y., Lu, H., 2005. The Wealth Change and Redistribution Effects of Sarbanes–Oxley Internal Control Disclosures. Working paper, University of Toronto. Doyle, J., Ge, W., McVay, S., 2006a. Determinants of Weaknesses in Internal Control over Financial Reporting, Working paper, New York University. Doyle, J., Ge, W., McVay, S., 2006b. Accruals Quality and Internal Control over Financial Reporting, Working paper, New York University. Dye, R., 1993. Auditing standards, legal liabilities, and auditor wealth. Journal of Political Economy 101, 887–914. Easley, D., O’Hara, M., 2004. Information and the Cost of Capital, Working paper, Cornell University. Francis, J., Philbrick, D., Schipper, K., 1994. Shareholder litigation and corporate disclosures. Journal of Accounting Research 32, 137–164. Glass Lewis & Company, 2005. Interim Control Deficiency Disclosures-Interim Alert, Yellow Card Interim Alert, Glass-Lewis and Company, LLC, April 12, p. 3. Hammersley, J., Myers, L., Shakespeare, C., 2005. Market Reactions to Internal Control Disclosures, Working paper, University of Michigan. Hogan, C., Wilkins, M., 2006. Evidence on the Audit Risk Model: Do Auditors Increase Audit Effort in the Presence of Internal Control Weaknesses? Working paper, Southern Methodist University. Jensen, M., 1993. The modern industrial revolution, exit, and the failure of internal control systems. Journal of Finance 48, 831–880. Karr, S., 2005. 404 Disclosure: Experts Say Get in Front of the Issue, Compliance Week, February 15. Kinney, W., McDaniel, L., 1989. Characteristics of firms correcting previously reported quarterly earnings. Journal of Accounting and Economics 11, 71–93. Kinney, W., Palmrose, Z., Scholz, S., 2004. Auditor independence, non-audit services, and restatements: Was the US government right? Journal of Accounting Research 42, 561–588. Krishnan, J., 2005. Audit committee quality and internal control: An empirical analysis. The Accounting Review 80, 649–675. Martinek, P., 2005. SOX ‘Catch 22: Certifying Controls Later Found Weak, Compliance Week, February 22. McMullen, D., Raghunandan, A., Rama, K., 1996. Internal control reports and financial reporting problems. Accounting Horizons 10, 67–75. Ogneva, M., Raghunandan, K., Subramanyam, K.R., 2005. Internal Control Weakness and Cost of Equity: Evidence from SOX Section 404 Certifications, Working paper, University of Southern California. Public Company Accounting Oversight Board, 2004. Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with An Audit of Financial Statements, PCAOB, March 9. Richardson, S., Tuna, I., Wu, M., 2003. Predicting Earnings Management: The Case of Earnings Restatements, Working paper, University of Pennsylvania, Wharton School. Securities and Exchange Commission (SEC), 1988. Disclosure Amendments to Regulation S-K, Form 8-K and Schedule 14A Regarding Changes in Accountants and Potential Opinion Shopping Situations. Financial Reporting Release No. 31, SEC, Washington, DC. Securities and Exchange Commission (SEC), 2002. Certification of Disclosure in Companies’ Quarterly and Annual Reports. Release Nos. 33-8124, 34-46427, SEC, Washington, DC, August 29.

ARTICLE IN PRESS 192

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Securities and Exchange Commission (SEC), 2003. Final Rule: Management’s Reports on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports. Release Nos. 33-8238, 34-47986, SEC, Washington, DC, June 11. Securities and Exchange Commission (SEC), 2004. Management’s Reports on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Period Reports—Frequently Asked Questions, SEC, Washington, DC, October 6. Securities and Exchange Commission (SEC), 2005. Letter from the SEC Chief Accountant, SEC, Washington, DC, February 7. Shleifer, A., Vishny, R., 1997. A survey of corporate governance. Journal of Finance 52, 737–783. Shu, S., 2000. Auditor resignations: clientele effects and legal liability. Journal of Accounting and Economics 29, 173–205. US Congress, 2002. The Sarbanes–Oxley Act of 2002. 107th Congress of the United States of America. H.R. 3763. Government Printing Office, Washington, DC. Whisenant, S., Sankaraguruswamy, S., Raghunandan, K., 2003. Market reactions to disclosure of reportable events. Auditing: A Journal of Practice and Theory 22, 181–194. Wright, A., Wright, S., 1996. The relationship between assessments of internal control strength and error occurrence, impact and cause. Accounting and Business Research 27, 58–71. Zhang, I., 2005. Economic Consequences of the Sarbanes–Oxley Act of 2002, Working paper, University of Rochester.