Research Questions on Internal Control over Financial Reporting
Lessons for Auditors
Jian Zhang and Kurt Pany
FEBRUARY 2008 - The Sarbanes-Oxley Act (SOX) of 2002’s requirements
regarding internal control over financial reporting requirements
for management and auditors have had a profound effect on both public
companies and public accounting firms. While SOX has resulted in
the public disclosure of numerous internal control deficiencies,
the cost of compliance has also been widely questioned. Attempts
to better understand the law’s overall effect have resulted
in copious amounts of research.
What follows is a brief
summary of certain recent research findings that relate directly
to the audit of internal control over financial reporting. Only
limited references to the studies discussed are provided below;
provides a more detailed list of references. Certain topics that
the authors subjectively feel to be of lesser interest (e.g.,
the relationship of internal control reporting to a lower cost
of capital; changes in investors’ wealth and wealth redistribution;
and material weakness disclosure related to the quality of accounting
accruals) were not included.
In response to the high-profile business failures at Enron and
WorldCom, in July 2002 Congress passed SOX. The law’s aim
was to reinforce investor confidence and protect investors by
improving the accuracy and reliability of corporate disclosures.
SOX introduced challenging internal control performance and reporting
requirements under its section 302 and section 404.
SOX section 302 requires the principal executive officer and
the principal financial officer to certify and sign annual and
quarterly reports submitted to the SEC, including certifying that
those officers are responsible for establishing and maintaining
internal controls. SOX section 404 requires that annual reports
filed by registrants include an assessment of the effectiveness
of the company’s internal controls and an auditor’s
report on that assessment. After the law was passed, the SEC and
the Public Company Accounting Oversight Board (PCAOB) created
detailed guidance for internal control reporting in the form of
Auditing Standard 2, An Audit of Internal Control over Financial
Reporting Performed in Conjunction with an Audit of Financial
Statements (2004). Specifically, the auditor’s report
under AS2 ordinarily included two opinions: one on management’s
assessment of internal control, and one on the effectiveness of
internal control. (In July 2007, the SEC approved AS5, which replaced
AS2. The audit report under AS5 eliminates the separate opinion
on management’s assessment. The PCAOB considered the opinion
on management’s assessment redundant with the opinion on
internal control itself.)
The discussion below focuses on material weaknesses and situations
in which auditors have identified a material weakness and have
issued an adverse opinion relating to internal control. This is
the bulk of the research available on internal control reporting.
Modified audit reports can also be issued because of an inadequate
management assessment of internal control, restrictions on the
scope of audits, referral to the report of other auditors, subsequent
events, and the inclusion of additional information in management’s
report on internal control.
Ideally, reports on internal control not only result in improvements,
they also provide financial statement users with an early warning
about potential future problems that could result from weak controls,
as well as the possibility that past financial results may have
to be restated. Because capital markets operate on the principle
that the vast majority of companies present reliable and complete
financial data for making investment decisions, good internal
control is considered an important factor in achieving good-quality
financial reporting. Material weaknesses in internal control provide
warnings about potential future financial statement problems.
SOX’s internal control requirements quickly became controversial,
because companies complained about the costs involved and the
perceived redundancy between the auditor’s and management’s
tests of controls. While the SEC originally estimated average
costs of the internal control provisions at less than $100,000,
actual costs have been higher. Estimates have varied significantly.
On the high end, Charles River Associates (now CRA International)
found that it cost $7.8 million on average for a company to implement
section 404. Investment News (May 16, 2007) estimated
first-year total compliance costs at $4.51 million per company
in 2004, a number that decreased to $2.9 million in 2006. Note
that individual company estimates are ordinarily made by management,
a group generally predisposed against SOX (78% of 200 companies
in the survey reported by Investment News said that section
404 compliance costs still outweigh any benefits).
Continuing high compliance costs led the PCAOB to consider ways
that would reduce the costs and procedures related to auditors’
internal control reporting. In May 2005, the PCAOB emphasized
that auditors should apply a “top-down” approach that
relied upon the results of a risk assessment performed by the
auditors. The risk-assessment results should identify controls
to test by starting at the top—company-level controls and
the financial statements—and linking to significant accounts,
relevant assertions, and, finally, to the significant underlying
processes in which other important controls exist. Subsequently,
both the SEC and the PCAOB issued standards aimed at controlling
costs related to internal control reporting while attempting to
retain effective reporting.
Research Questions: Magnitude of the Problem
How many companies disclose material weaknesses in
internal control? Glass Lewis & Co. found that
1,118 U.S. companies and 90 foreign companies—one of every
12 companies with U.S. listed securities—filed a total of
1,342 material weakness disclosures in 2006. Furthermore, 97 U.S.
companies voluntarily disclosed significant deficiencies in 2006,
down from 116 in 2005 (see “The Materially Weak,”
Yellow Card Trend Alert, February 27, 2007). This total
includes both SEC registrants currently required to have integrated
audits, and those not so required. Companies that were required
to disclose section 404 material weaknesses in 2006 reported 35%
fewer material weaknesses than in 2005, while companies voluntarily
disclosing such weaknesses reported 20% more. Exhibit
1, using data from the Glass Lewis & Co. study, shows
material-weakness disclosures by stock exchange. Compliance
Week added to the analysis, finding that while the number
of companies that cannot meet filing deadlines may have risen
in the second year of SOX compliance, fewer companies reported
problems with internal controls.
How many companies have received an adverse opinion
on internal control? Glass Lewis & Co. reports
that in 2005, the first year of SOX section 404 audits, 16% of
companies received adverse opinions from independent auditors.
In 2006, the second year, 11% of companies received adverse opinions.
Do companies that disclose material weaknesses in
internal control differ systematically from those that do not?
A number of studies have reported relatively comparable
results as to the nature of companies that reported material weaknesses.
While subject to many exceptions, on average, they are younger,
smaller in size, growing more rapidly, and less profitable than
companies that do not report material weaknesses. Research also
finds that they often have more-complex structures (e.g., involve
multiple segments and foreign currency), and are more likely to
be audited by a large national firm. (Some of the research findings
relied on multiple regression analysis.)
Research Questions: Cause and Effect
What specific issues have resulted in material weaknesses?
Although researchers summarize material weaknesses in varying
2 provides a summary of the accounting, internal control,
and other issues most commonly resulting in material weaknesses.
During 2006, improper accounting for stock options was the most
frequent accounting issue, as contrasted to lease accounting in
2005. Nonroutine transactions (the PCAOB’s examples include
taking physical inventory, calculating depreciation expense, and
adjusting for foreign currencies) were the most frequent internal
control issues in both years. In addition, the period-end closing
process also frequently represented a material weakness.
How likely is it that companies reporting material
weaknesses will restate their financial statements due to accounting
errors? Restatements for accounting errors occur
when material errors existing in financial statements are not
detected by either internal controls or external auditors prior
to the issuance of the financial statements. Internal control
plays an important role in preventing material errors (and restatements)
Glass Lewis & Co. (“The Errors of Their Ways,”
Yellow Card Trend Alert, February 27, 2007) reported
that, of a total of 1,420 restatements made by U.S. companies
in 2006, 685 also disclosed material weakness within one year
(either before or after) of restatement. Of those 685 companies
the material weakness was disclosed as follows:
- 277 before the restatement;
- 297 after the restatement;
- 111 both before and after restatement.
The reported data are consistent with the “Special Comment”
by Moody’s Investors Service (“The Second Year of
Section 404 Reporting on Internal Control,” May 2006), which
concluded that material weakness reports are often lagging indicators
of financial statement problems, undermining their usefulness
to users of financial statements.
Similar findings were reported by Audit Analytics, which performed
an analysis of nearly 3,000 filings and found that material year-end
adjustments and restatements of financial statements served as
predictors of a material weakness.
Do identified material weaknesses increase the cost
of audits and delay audit reports? The limited research
available suggests that the answer in both cases is yes: when
material weaknesses are identified, the cost of an audit increases,
as does the time to complete the audit. Companies with control
deficiencies in personnel, inadequate segregation of duties, and
problems with the closing process experience longer delays.
Research Questions: Investor Impact
Do investors care about material weaknesses in internal
control? One might expect the answer of “some
do and some don’t,” and there is undoubtedly some
validity to this position. Yet, researchers need a more objective
way to address questions about whether the disclosure of particular
information (such as a material weakness) matters to investors.
Researchers examine whether the information in question affects
the market price of a company’s stock. They calculate the
difference between the actual return for a stock and the market
as a whole around the date on which the information becomes publicly
available, and determine whether there is an abnormal return for
In the case of a material weakness, that information may become
available through a number of means, although most frequently
it is through SEC forms 8-K, 10-Q, or 10-K, depending in part
upon the timing. One would expect a negative market reaction to
such information, because it would generally represent an unexpected
internal control deficiency.
Recent studies generally conclude that, on average, the initial
disclosure of a material weakness in internal control results
in a negative stock market reaction. Thus, by this measure, stockholders
do care about material weaknesses and punish companies that have
Does an adverse audit opinion result in a negative
market reaction? This question is more difficult
to address with the method used in the preceding question. Given
that a material weakness is generally disclosed by management
prior to the auditor issuing an adverse opinion on internal control,
one would not expect the stock market to be “surprised”
by such an adverse opinion. If the audit report is the first disclosure
of the material weakness, however, one would expect a market reaction.
One study (Lopez, Vandervelde, and Wu, “An Auditor’s
Internal Control Report, An Experiment Investigation of Relevance,”
unpublished working paper, University of South Carolina, 2006)
concluded that, at least for the participants in their study,
the auditor’s opinion on the effectiveness of internal controls
is value-relevant. They conclude that the assessed stock price
for companies receiving an adverse opinion on the effectiveness
of internal controls is significantly less than for companies
receiving an unqualified opinion.
Does the stock market react to the details (characteristics)
of material weakness disclosures? During his tenure
as SEC Chief Accountant, Donald Nicolaisen stated that not all
material weaknesses are likely to be viewed as equally significant.
Consistent with this statement, Moody’s Investor Service
published a report in 2004 that proposed material weaknesses could
be classified into “Category A,” which relates to
controls over specific account balances or transaction-level processes,
or “Category B,” which relates to company-level controls
such as the control environment or the financial reporting process.
Moody’s believes that auditors can effectively “audit
around” Category A material weaknesses by performing additional
substantive procedures in the area where the material weaknesses
exist. Thus, for companies with Category A material weakness,
there is ordinarily no negative reaction, assuming management
takes corrective action to address the material weakness in a
timely manner. On the other hand, Category B material weaknesses
may result in a negative reaction (e.g., a decrease in stock price
or bond rating). This is mainly due to a belief that auditors
may not be able to effectively audit around problems that have
a pervasive effect on a company’s financial reporting.
Can investors distinguish between different types of material
weakness, as Moody’s suggests? Several studies have found
that the Moody’s distinction appears to be accepted by investors.
For example, one study (J.S. Hammersley, L.A. Myers, and C. Shakespeare,
“Market Reactions to Internal Control Weakness Disclosures,”
Review of Accounting Studies, forthcoming) examined the
stock price reaction to management’s disclosure of internal
control weaknesses required under SOX section 302. The study found
that some characteristics of internal control weaknesses—their
severity, management’s conclusion regarding the effectiveness
of controls, their auditability, and the specificity of disclosures—are
informative. Of the 57 types of weaknesses identified, the following
five were considered less auditable than others:
- Internal control weaknesses that are red flags for fraud
or that allow fraud to occur;
- Insufficient documentation to support transactions or adjusting
- Inadequate lines of communication between management and
accounting staff and auditors that prevent transactions from
being recorded correctly;
- Problems with financial statement closing procedures;
- Lack of key personnel (CFO or controller), and evidence that
management overrode internal controls.
These items generally correspond to the categories proposed by
Moody’s. The study also found that the information content
of internal control weakness disclosures (the size of the market
reaction) depends upon the severity of internal control weakness.
What the Current Research Indicates
These available research on audits of internal control of financial
reporting in the wake of SOX can be summarized with a few conclusions:
- Approximately 11% of companies received adverse opinions
on internal control in 2006, down from 16% in 2005.
- Companies that disclose material weakness are younger, smaller
in size, growing rapidly, but less profitable. In addition,
these companies have relatively more-complex capital structures.
- Stock options, lease accounting, nonroutine transactions,
and the period-end closing process have frequently been the
source of material weaknesses.
- Companies with material weaknesses frequently find the need
to restate earnings. Disclosure of the material weakness often
occurs subsequent to the restatement.
- The existence of material weaknesses often results in more
expensive and time-consuming audits.
- The stock price of companies with material weaknesses generally
falls after the disclosure.
- Investors distinguish between an account-specific material
weaknesses, which may be auditable, and a company-level material
weakness, which may not. Investors react more negatively to
company-level material weakness disclosures.
Jian Zhang, PhD, is an assistant professor
in the college of business at San Jose State University, San Jose,
Kurt Pany, CPA, PhD, is a professor of accountancy
in the W.P. Carey School of Business at Arizona State University,