Determinants of the Persistence of Internal Control Weaknesses

Abstract

SYNOPSIS This paper analyzes the degree to which material weaknesses (MWs) in internal control reported under the Sarbanes-Oxley Act of 2002 (SOX) affect the future reporting of MWs. Particularly, we examine information technology (IT) and non-IT MWs and their breakdown into specific IT-related entity-level, non-IT-related entity-level, and account-level deficiencies. Analysis reveals that most account-level and entity-level deficiencies occur at a significantly higher rate in SOX 404 reports with at least one IT MW than in MW reports with only non-IT MWs. Further, the presence and count of both types of MWs and all three types of deficiencies are associated with increased future MWs, as are lower profitability, non-Big 6 auditor, and firm complexity. Specific control deficiencies related to senior management, training, and IT control environment have the strongest impact on future MWs. These results indicate that effective corporate governance of both the IT and non-IT domains is pivotal in establishing and maintaining strong internal controls over financial reporting. Data Availability: Data are available from the public sources identified in the paper.

The financial close process: Implications for future research

“…5 (see paragraphs 24 to 27). However, several recent SEC filings document internal control weaknesses that can be attributed to the financial close process (Approva, 2006;Doyle et al, 2007;Klamm et al, 2012). Management is ultimately responsible for internal controls over the financial close process.…”

“…Second, the efficiency of the financial close process may be negatively impacted as accountants' period end workload expands to include meeting several new regulation requirements (e.g., reducing the report lag between period end and issuance of financial reports (SEC, 2002(SEC, , 2005Geerts et al, 2013), changes in materiality thresholds (Chhabra, 2010), new disclosure requirements such as XBRL (SEC, 2009), new fair value accounting standards (FASB, 2007), and potentially IFRS (Clark, 2010)). Third, audit standards (PCAOB, 2007) now identify the financial close process as a high risk area and several companies have disclosed internal control weaknesses related to the financial close process in recent SEC filings (Approva, 2006;Doyle et al, 2007;PCAOB, 2007PCAOB, , 2010Klamm et al, 2012). Finally, some academic researchers use the speed of the financial close process as a proxy for the quality of a company's internal information environment (Jennings et al, 2012;Gallemore and Labro, 2013).…”

External reputational penalties for CEOs and CFOs following information technology material weaknesses

“…Extant research supports the former view along several dimensions. First, the percentage of firms reporting effective controls has increased (from 84 to 97%) since implementation (Klamm et al, 2012). 6 Thus, the quality of internal controls appears to have improved under SOX.…”

“…5 Our analysis is important for at least three reasons. First, our study extends the stream of research investigating the impact of material weaknesses and ITMW on firms and executives (Li et al, 2007(Li et al, , 2010Goh, 2009;Klamm and Watson, 2009;Johnstone et al, 2011;Stoel and Muhanna, 2011;Klamm et al, 2012;Haislip et al, 2014;Masli et al, 2014) by examining external reputational penalties. Second, our results show that executives are indeed experiencing greater external penalties for IT failures in line with the recommendations made by COSO (2009) andPublic Firm Accounting Oversight Board (PCAOB, 2007).…”

“…Specifically, IT provides the foundation for an effective system of internal controls over financial reporting (Hunton et al, 2008;Masli et al, 2010;Li et al, 2012), making ITMWs have an even greater adverse effect on the reliability of financial reporting than non-ITMWs in terms of the total number of material weaknesses and misstatements as well as time to remediate (Klamm and Watson, 2009;Klamm et al, 2012). In addition, ITMWs also increase external auditing costs (Canada et al, 2009), most likely because auditors cannot rely on automated controls and must expand substantive testing.…”