CEO/CFO turnover and subsequent remediation of information technology material weaknesses

Abstract

Adding to prior research on internal control material weaknesses (ICMW), our study investigates whether information technology material weaknesses (ITMWs) are associated with CEO/CFO turnover, and whether their turnover will promote subsequent remediation. We find that disclosures of ITMW are positively associated with CEO/CFO turnover; however, only CEO turnover promotes subsequent remediation. Our findings on ITMW are different from the prior findings on ICMWaligned with prior research on ICMW, ITMWs are associated with CEO/CFO turnover; however, unlike prior research on ICMW suggests, dismissals of CFOs do not promote subsequent remediation of ITMW. Thus, future research should consider ICMW and ITMW separately in the examination of their consequences and remediation.

Can non‐executive equity incentives reduce internal control ineffectiveness? Evidence from China

“…In our hypothesis, an incentive mechanism for non-executive employees is mainly employed to improve the effectiveness of internal controls by developing the ability of employees to detect and repair internal control problems. Following Li et al (2019), we select firms with internal control weaknesses and assign the value of 1 to ICW_Repair if the weaknesses that existed in the previous year are fixed and 0 otherwise. We set ICW_Repair as the dependent variable into Model (1) for regression.…”

“…Previous studies have mostly emphasised top executives as critical players in the firm (Balsam et al, 2014;Lin et al, 2014;Dai and Song, 2018;Li et al, 2019). There is evidence that the chief executive officer (CEO), chief financial officer (CFO) and other senior executives are responsible for internal control, and the implementation of equity incentives for them can improve the effectiveness of internal control in a firm (Balsam et al, 2014;Dai and Song, 2018).…”

“…For example, when firms have CEOs with higher power, longer tenure, and who are younger, there is a greater potential for an internal control defect (Lin et al, 2014). CEO turnover can also promote the remediation of internal control weaknesses (Li et al, 2019). Balsam et al (2014) find that when the equity incentives of a CEO or CFO are greater, the internal controls are more effective.…”

PCAOB inspections: An analysis of entity-level and application-level control audit deficiencies

“…Finally, a recent PCAOB Practice Alert identifies examples of auditors selecting ITGCs for testing, but failing to (1) test that the selected ITGCs are important to the effective operations of the applications that generated the data or reports, (2) test the query logic used to extract data from the IT applications used in the reports, or (3) address control deficiencies that were identified with respect to the ITCGs over either the applications that process the data used in the reports or the applications that generated the reports (PCAOB, 2013, 26). Taken together, more research to examine the impact of ITGCs on clients' financial reporting systems is needed (Klamm and Watson, 2009;Wallace et al, 2011;Li et al, 2018).…”

Corporate management boards’ information security orientation: an analysis of cybersecurity incidents in DAX 30 companies

“…On the one hand, when top managers have a higher level of IT expertise (Haislip et al, 2017;Vincent et al, 2019) and there is a comprehensive anchorage of IT issues in a firm's decision-making bodies (Higgs et al, 2016;Smith et al, 2019), it seems that there is a reduction in the likelihood of such incidents. On the other hand, CSIs may lead to noticeable changes in the composition of top management teams, such as more senior executive turnover (Masli et al, 2016;Li et al, 2019) or a readjustment in the makeup of boards and committees. Changes may include inviting IT experts with proven experience in a related industry to intervene, or appointing new board members with valuable educational and professional skills in ITrelated areas, the aim being to avoid CSIs from reoccurring and to reduce the likelihood of new IT incidents.…”