Current Research Questions on Internal Control over Financial Reporting Under Sarbanes-Oxley
Lessons for Auditors
By Jian Zhang and Kurt Pany
FEBRUARY 2008 - The Sarbanes-Oxley Act (SOX) of 2002’s requirements regarding internal control over financial reporting requirements for management and auditors have had a profound effect on both public companies and public accounting firms. While SOX has resulted in the public disclosure of numerous internal control deficiencies, the cost of compliance has also been widely questioned. Attempts to better understand the law’s overall effect have resulted in copious amounts of research.
What follows is a brief summary of certain recent research findings that relate directly to the audit of internal control over financial reporting. Only limited references to the studies discussed are provided below; the Sidebar provides a more detailed list of references. Certain topics that the authors subjectively feel to be of lesser interest (e.g., the relationship of internal control reporting to a lower cost of capital; changes in investors’ wealth and wealth redistribution; and material weakness disclosure related to the quality of accounting accruals) were not included.
Background
In response to the high-profile business failures at Enron and WorldCom, in July 2002 Congress passed SOX. The law’s aim was to reinforce investor confidence and protect investors by improving the accuracy and reliability of corporate disclosures. SOX introduced challenging internal control performance and reporting requirements under its section 302 and section 404.
SOX section 302 requires the principal executive officer and the principal financial officer to certify and sign annual and quarterly reports submitted to the SEC, including certifying that those officers are responsible for establishing and maintaining internal controls. SOX section 404 requires that annual reports filed by registrants include an assessment of the effectiveness of the company’s internal controls and an auditor’s report on that assessment. After the law was passed, the SEC and the Public Company Accounting Oversight Board (PCAOB) created detailed guidance for internal control reporting in the form of Auditing Standard 2, An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements (2004). Specifically, the auditor’s report under AS2 ordinarily included two opinions: one on management’s assessment of internal control, and one on the effectiveness of internal control. (In July 2007, the SEC approved AS5, which replaced AS2. The audit report under AS5 eliminates the separate opinion on management’s assessment. The PCAOB considered the opinion on management’s assessment redundant with the opinion on internal control itself.)
The discussion below focuses on material weaknesses and situations in which auditors have identified a material weakness and have issued an adverse opinion relating to internal control. This is the bulk of the research available on internal control reporting. Modified audit reports can also be issued because of an inadequate management assessment of internal control, restrictions on the scope of audits, referral to the report of other auditors, subsequent events, and the inclusion of additional information in management’s report on internal control.
Ideally, reports on internal control not only result in improvements, they also provide financial statement users with an early warning about potential future problems that could result from weak controls, as well as the possibility that past financial results may have to be restated. Because capital markets operate on the principle that the vast majority of companies present reliable and complete financial data for making investment decisions, good internal control is considered an important factor in achieving good-quality financial reporting. Material weaknesses in internal control provide warnings about potential future financial statement problems.
SOX’s internal control requirements quickly became controversial, because companies complained about the costs involved and the perceived redundancy between the auditor’s and management’s tests of controls. While the SEC originally estimated average costs of the internal control provisions at less than $100,000, actual costs have been higher. Estimates have varied significantly. On the high end, Charles River Associates (now CRA International) found that it cost $7.8 million on average for a company to implement section 404. Investment News (May 16, 2007) estimated first-year total compliance costs at $4.51 million per company in 2004, a number that decreased to $2.9 million in 2006. Note that individual company estimates are ordinarily made by management, a group generally predisposed against SOX (78% of 200 companies in the survey reported by Investment News said that section 404 compliance costs still outweigh any benefits).
Continuing high compliance costs led the PCAOB to consider ways that would reduce the costs and procedures related to auditors’ internal control reporting. In May 2005, the PCAOB emphasized that auditors should apply a “top-down” approach that relied upon the results of a risk assessment performed by the auditors. The risk-assessment results should identify controls to test by starting at the top—company-level controls and the financial statements—and linking to significant accounts, relevant assertions, and, finally, to the significant underlying processes in which other important controls exist. Subsequently, both the SEC and the PCAOB issued standards aimed at controlling costs related to internal control reporting while attempting to retain effective reporting.
Research Questions: Magnitude of the Problem
How many companies disclose material weaknesses in internal control? Glass Lewis & Co. found that 1,118 U.S. companies and 90 foreign companies—one of every 12 companies with U.S. listed securities—filed a total of 1,342 material weakness disclosures in 2006. Furthermore, 97 U.S. companies voluntarily disclosed significant deficiencies in 2006, down from 116 in 2005 (see “The Materially Weak,” Yellow Card Trend Alert, February 27, 2007). This total includes both SEC registrants currently required to have integrated audits, and those not so required. Companies that were required to disclose section 404 material weaknesses in 2006 reported 35% fewer material weaknesses than in 2005, while companies voluntarily disclosing such weaknesses reported 20% more. Exhibit 1, using data from the Glass Lewis & Co. study, shows material-weakness disclosures by stock exchange. Compliance Week added to the analysis, finding that while the number of companies that cannot meet filing deadlines may have risen in the second year of SOX compliance, fewer companies reported problems with internal controls.
How many companies have received an adverse opinion on internal control? Glass Lewis & Co. reports that in 2005, the first year of SOX section 404 audits, 16% of companies received adverse opinions from independent auditors. In 2006, the second year, 11% of companies received adverse opinions.
Do companies that disclose material weaknesses in internal control differ systematically from those that do not? A number of studies have reported relatively comparable results as to the nature of companies that reported material weaknesses. While subject to many exceptions, on average, they are younger, smaller in size, growing more rapidly, and less profitable than companies that do not report material weaknesses. Research also finds that they often have more-complex structures (e.g., involve multiple segments and foreign currency), and are more likely to be audited by a large national firm. (Some of the research findings relied on multiple regression analysis.)
Research Questions: Cause and Effect
What specific issues have resulted in material weaknesses? Although researchers summarize material weaknesses in varying manners, Exhibit 2 provides a summary of the accounting, internal control, and other issues most commonly resulting in material weaknesses. During 2006, improper accounting for stock options was the most frequent accounting issue, as contrasted to lease accounting in 2005. Nonroutine transactions (the PCAOB’s examples include taking physical inventory, calculating depreciation expense, and adjusting for foreign currencies) were the most frequent internal control issues in both years. In addition, the period-end closing process also frequently represented a material weakness.
How likely is it that companies reporting material weaknesses will restate their financial statements due to accounting errors? Restatements for accounting errors occur when material errors existing in financial statements are not detected by either internal controls or external auditors prior to the issuance of the financial statements. Internal control plays an important role in preventing material errors (and restatements) from occurring.
Glass Lewis & Co. (“The Errors of Their Ways,” Yellow Card Trend Alert, February 27, 2007) reported that, of a total of 1,420 restatements made by U.S. companies in 2006, 685 also disclosed material weakness within one year (either before or after) of restatement. Of those 685 companies the material weakness was disclosed as follows:
277 before the restatement;
297 after the restatement;
111 both before and after restatement.
The reported data are consistent with the “Special Comment” by Moody’s Investors Service (“The Second Year of Section 404 Reporting on Internal Control,” May 2006), which concluded that material weakness reports are often lagging indicators of financial statement problems, undermining their usefulness to users of financial statements.
Similar findings were reported by Audit Analytics, which performed an analysis of nearly 3,000 filings and found that material year-end adjustments and restatements of financial statements served as predictors of a material weakness.
Do identified material weaknesses increase the cost of audits and delay audit reports? The limited research available suggests that the answer in both cases is yes: when material weaknesses are identified, the cost of an audit increases, as does the time to complete the audit. Companies with control deficiencies in personnel, inadequate segregation of duties, and problems with the closing process experience longer delays.
Research Questions: Investor Impact
Do investors care about material weaknesses in internal control? One might expect the answer of “some do and some don’t,” and there is undoubtedly some validity to this position. Yet, researchers need a more objective way to address questions about whether the disclosure of particular information (such as a material weakness) matters to investors. Researchers examine whether the information in question affects the market price of a company’s stock. They calculate the difference between the actual return for a stock and the market as a whole around the date on which the information becomes publicly available, and determine whether there is an abnormal return for the security.
In the case of a material weakness, that information may become available through a number of means, although most frequently it is through SEC forms 8-K, 10-Q, or 10-K, depending in part upon the timing. One would expect a negative market reaction to such information, because it would generally represent an unexpected internal control deficiency.
Recent studies generally conclude that, on average, the initial disclosure of a material weakness in internal control results in a negative stock market reaction. Thus, by this measure, stockholders do care about material weaknesses and punish companies that have them.
Does an adverse audit opinion result in a negative market reaction? This question is more difficult to address with the method used in the preceding question. Given that a material weakness is generally disclosed by management prior to the auditor issuing an adverse opinion on internal control, one would not expect the stock market to be “surprised” by such an adverse opinion. If the audit report is the first disclosure of the material weakness, however, one would expect a market reaction. One study (Lopez, Vandervelde, and Wu, “An Auditor’s Internal Control Report, An Experiment Investigation of Relevance,” unpublished working paper, University of South Carolina, 2006) concluded that, at least for the participants in their study, the auditor’s opinion on the effectiveness of internal controls is value-relevant. They conclude that the assessed stock price for companies receiving an adverse opinion on the effectiveness of internal controls is significantly less than for companies receiving an unqualified opinion.
Does the stock market react to the details (characteristics) of material weakness disclosures? During his tenure as SEC Chief Accountant, Donald Nicolaisen stated that not all material weaknesses are likely to be viewed as equally significant. Consistent with this statement, Moody’s Investor Service published a report in 2004 that proposed material weaknesses could be classified into “Category A,” which relates to controls over specific account balances or transaction-level processes, or “Category B,” which relates to company-level controls such as the control environment or the financial reporting process. Moody’s believes that auditors can effectively “audit around” Category A material weaknesses by performing additional substantive procedures in the area where the material weaknesses exist. Thus, for companies with Category A material weakness, there is ordinarily no negative reaction, assuming management takes corrective action to address the material weakness in a timely manner. On the other hand, Category B material weaknesses may result in a negative reaction (e.g., a decrease in stock price or bond rating). This is mainly due to a belief that auditors may not be able to effectively audit around problems that have a pervasive effect on a company’s financial reporting.
Can investors distinguish between different types of material weakness, as Moody’s suggests? Several studies have found that the Moody’s distinction appears to be accepted by investors. For example, one study (J.S. Hammersley, L.A. Myers, and C. Shakespeare, “Market Reactions to Internal Control Weakness Disclosures,” Review of Accounting Studies, forthcoming) examined the stock price reaction to management’s disclosure of internal control weaknesses required under SOX section 302. The study found that some characteristics of internal control weaknesses—their severity, management’s conclusion regarding the effectiveness of controls, their auditability, and the specificity of disclosures—are informative. Of the 57 types of weaknesses identified, the following five were considered less auditable than others:
Internal control weaknesses that are red flags for fraud or that allow fraud to occur;
Insufficient documentation to support transactions or adjusting entries;
Inadequate lines of communication between management and accounting staff and auditors that prevent transactions from being recorded correctly;
Problems with financial statement closing procedures;
Lack of key personnel (CFO or controller), and evidence that management overrode internal controls.
These items generally correspond to the categories proposed by Moody’s. The study also found that the information content of internal control weakness disclosures (the size of the market reaction) depends upon the severity of internal control weakness.
What the Current Research Indicates
These available research on audits of internal control of financial reporting in the wake of SOX can be summarized with a few conclusions:
Approximately 11% of companies received adverse opinions on internal control in 2006, down from 16% in 2005.
Companies that disclose material weakness are younger, smaller in size, growing rapidly, but less profitable. In addition, these companies have relatively more-complex capital structures.
Stock options, lease accounting, nonroutine transactions, and the period-end closing process have frequently been the source of material weaknesses.
Companies with material weaknesses frequently find the need to restate earnings. Disclosure of the material weakness often occurs subsequent to the restatement.
The existence of material weaknesses often results in more expensive and time-consuming audits.
The stock price of companies with material weaknesses generally falls after the disclosure.
Investors distinguish between an account-specific material weaknesses, which may be auditable, and a company-level material weakness, which may not. Investors react more negatively to company-level material weakness disclosures.
--------------------------------------------------------------------------------
Jian Zhang, PhD, is an assistant professor in the college of business at San Jose State University, San Jose, Calif.
Kurt Pany, CPA, PhD, is a professor of accountancy in the W.P. Carey School of Business at Arizona State University, Tempe, Ariz.
