Do Material Weaknesses in information technology related Internal Controls Affect Firms 8 K Filing Behavior?

Transcription

1 Do Material Weaknesses in information technology related Internal Controls Affect Firms 8 K Filing Behavior? Anthony Holder a *, Khondkar Karim b, Karen (Jingrong) Lin b, Robert Pinsker c a College of Business and Innovation, the University of Toledo, Toledo, OH b Robert J. Manning School of Business, University of Massachusetts Lowell, Lowell, MA c College of Business, Florida Atlantic University, Boca Raton, FL ARTICLE INFO JEL classification: M15 M41 Keywords: Form 8-K Filing Behavior, Internal Controls, Information Technology, Regulation ABSTRACT Form 8-K reporting represents a different (and relatively unknown) information environment than annual 10-K filings. The current study uses a unique, comprehensive sample of 118,863 firm-year 8-K filing event observations to investigate the association between firms Form 8-K reporting behavior and their internal control weaknesses. In addition, the study investigates the association between firms 8-K reporting and their information technology (IT) related internal control weaknesses. Overall, we find strong and robust evidence of a negative relation between the likelihood of the firm reporting a material internal control weakness and the timeliness of the firms 8-K filing behavior. We also find distinguishing effects of weaknesses in IT-related controls. Given recent interest in IT related controls and far-reaching reforms aimed at improving disclosure timeliness, increasing the quality of internal controls and improving the quality of accounting information, our study is relevant to accounting information systems academics, regulators, accounting standard setters and other interested observers. Preliminary and incomplete (1/23/2015). Please do not cite without authors permission. * Corresponding author. Tel: addresses: Anthony.holder@utoledo.edu (A. Holder), khondkar_karim@uml.edu (K. Karim), Jingrong_Lin@uml.edu (K. Lin), rpinsker@fau.edu (R. Pinsker).

2 Do Material Weaknesses in Information Technology Related Internal Controls Affect Firms 8-K Filing Behavior? Abstract Form 8-K reporting represents a different (and relatively unknown) information environment than annual 10-K filings. The current study takes advantage of a unique, comprehensive sample of 118,863 firm-year 8-K filing event observations to investigate the association between firms Form 8-K reporting behavior and their internal control weaknesses. In addition, the study investigates the association between firms 8-K reporting and their information technology (IT) related internal control weaknesses. Overall, we find strong and robust evidence of a negative relation between the likelihood of the firm reporting a material internal control weakness and the timeliness of the firms 8-K filing behavior. We also find distinguishing effects of weaknesses in IT-related controls. Given recent interest in IT related controls and far-reaching reforms with stated objectives of improving disclosure timeliness, increasing the quality of internal controls and improving the quality of accounting information, we believe that results in our study would be of interest to accounting information systems academics, regulators, accounting standard setters and other interested observers. Keywords: Form 8-K Filing Behavior, Internal Controls, Information Technology, Regulation I. INTRODUCTION The past decade has been fraught with US regulatory and institutional reforms aimed at improving the quality of firm information through the timeliness of publicly traded financial disclosures. 1 Most of the extant research has focused on 10-Ks, 10-Qs, and earnings announcements. Yet, when closely considering the timeliness of information disclosure, the Form 8-K has much stricter requirements (e.g., must be filed within four days of event occurrence with no extensions) and the 8-K has the critical role of providing a continuous stream of corporate information (Securities and Exchange Commission [SEC] Accounting Series Release 306 [1982]). Recent research (Lerman and Livnat 2010; Karim and Pinsker 2011, 2012) finds significant improvement in Form 1 Beyer et al. (2010) and Kothari et al. (2010) provide seminal reviews of the literature in this area. Consistent with the US Conceptual Framework, timeliness is a necessary component of relevant information. 2

3 8-K filing timeliness post-sarbanes-oxley Act (SOX) relative to pre-sox, but it is an open question regarding the reason(s) why. The current study argues that a potential explanation is the interaction between the aforementioned regulatory changes in 8-K reporting and the post SOX internal control reforms. Increased SOX reporting requirements has forced firms to continue to grow the information technology (IT) involved in their financial reporting processes. Consequently, firms face raised expectations from regulators and other market participants to fully utilize their IT to disclose accurate and timely information, while protecting the privacy and security of their information assets (Li et al. 2007). We contend that the relative strength of a firm s internal controls, especially those surrounding IT-related components, play leading roles in affecting the timeliness and four day compliance requirement for Form 8-K filings. Our study distinguishes potential effects from IT-related material weaknesses in controls (ITMW) and other material weaknesses in controls (ICMW). Research suggests that ITMW is much more pervasive and costly to correct than ICMW (Weidenmier and Ramamoorti 2006; Canada et al. 2009). Further, ITMW lead to poor future financial performance, increased restatements, and an increased number of ICMW (Boritz and Lim 2008; Klamm and Watson 2009). Consequently, we also consider any improvement or lack thereof in internal controls in the subsequent year of analysis (t + 1). To address our research questions, we analyze a unique and comprehensive sample of 118,863 firm-year 8-K observations that represents, what we believe is the longest time horizon in the extant literature ( ). 2 Our tests control for firm size, 2 As noted by Goh and Li (2012), most of the research on internal control weaknesses have been conducted in the post-sarbanes Oxley (SOX) period. Section 302 of the Sarbanes Oxley Act of 2002, became 3

4 sustainable earnings, growth opportunities, equity based performance, financial health, extreme sales growth, operation complexity, foreign transactions, restructuring, firm age and leverage. Further, we use Petersen s (2009) methodology to analyze the data and calculate two-way cluster robust standard errors (i.e., robust to both time-series and cross-sectional correlation). Similar to Li et al. (2012), we argue that stronger (weaker) IT controls over the financial reporting system (FRS) will lead to higher (lower) information quality produced by the system, this will in turn cause greater (lesser) 8-K reporting timeliness. Overall, we find strong and robust evidence of (1) a positive relation between the likelihood of the firm reporting a material weakness in internal control and the lack of timeliness of their 8-K filing and (2) a positive relation between the likelihood of the firm reporting a material weakness in internal control and the probability of the firm not complying with the four day 8-K filing requirement. Given our focus on understanding the roles played by a firm s accounting information system, we also partition our sample into four other groups: (1) events that are complicated, (2) non-complicated events, (3) surprising events and (4) non-surprising events. Our results are robust to these additional classifications. When considering the nature of the material weaknesses, consistent with prior research in different contexts, we find that ITMW are positively associated with reporting lag for the entire group and for the complicated and non-surprising events subgroups. However, we find that, after controlling for other types of material weaknesses in internal effective on August 29, 2002, requiring that management certify in the firm s 10-Q and 10-K their conclusions about the effectiveness of the firms internal control procedures. Furthermore, Section 404 of SOX, which became effective on November 15, 2004 for accelerated filers, requires that management attest to the effectiveness of the internal control structure and procedures in the annual report. The firm s auditor must also attest to management s assessment. Prior to this regulation, firms (with the exception of the banking industry) were only required to disclose significant internal control deficiencies in Form 8-Ks when disclosing a change in auditors (Ge and McVay 2005; Krishnan 2005; Altamuro and Beatty 2010). 4

5 controls, the existence of ITMW does not affect conformance with the form 8-K deadline for the entire group or any of the subsamples. The context of our study intersects two streams of literature: mandatory SEC reporting and management incentives/strategy. Management has conflicting incentives to withhold disclosure of material, negative events (e.g., reputation, bonus, etc.), but also engage in conservative (i.e., timely loss disclosure) behavior. Pre-SOX, fewer firms possessed highly integrated systems (e.g., enterprise resource planning [ERP] systems), separate reports on internal controls were not necessary, and there was a less strict Form 8-K reporting deadline (the SEC reporting deadline for material events ranged from 15 calendar days to no filing deadline). Post-SOX, the 8-K and internal control reporting requirements have changed, IT usage and surrounding expectations have increased, and there is more realization on the part of management that it needs to align its IT and financial reporting strategies. Further, as Li et al. (2012, 183) indicate, there is a lack of archival research that explicitly considers the impact of IT controls on information quality. Our study also adds to the IT governance literature by examining relative differences in timeliness/relevance of information due to the nature of material weakness (ITMW and ICMW). Given recent, far-reaching reforms aimed at improving the timeliness/relevance of management reports, increasing the quality of internal controls and improving the quality of accounting information, our study and its accelerated reporting cycle (relative to 10-K and 10-Q) is relevant to accounting information systems (AIS) academics, regulators, accounting standard setters, capital market participants and other interested observers. 5

6 The study proceeds as follows. Section 2 discusses the institutional and regulatory background. Section 3 discusses the hypotheses development. Section 4 presents the data and results. Section 5 presents the conclusion. II. BACKGROUND AND HYPOTHESES Form 8-K Reporting Requirements The Form 8-K is comprehensive in its coverage and is used to notify investors of any material corporate events. Originally, the form had to be filed with the SEC within ten days of the end of any month during which certain significant events occurred. In June 2002, the SEC proposed a rule that would increase the number of events reportable on a Form 8-K and to shorten the filing deadline for most items to two business days (Lerman and Livnat 2010). Two major reasons were advanced for the proposed rule changes. One, the SEC was motivated by investors increasing demand for real-time access to relevant and reliable information. Two, the changes were expected to reduce opportunities for securities fraud (Lerman and Livnat 2010). Similarly, SOX Section 409 mandated that public disclosure be easily understandable and on a rapid and current basis (Karim and Pinsker 2011). Following its mandate from SOX, the SEC released its final rule # on March 16, 2004, with compliance required by August 23, 2004, and made three major changes to prior guidance (SEC 2004). First, it expanded the scope of the events that were subject to Form 8-K disclosure. The number of reportable events was increased to 22 including eight new mandatory items added to the Form 8-K. In addition, unregistered sale of securities and 6

7 modifications to the rights of security holders, two items previously disclosed on the 10- Q and 10-K were transferred to the 8-K. 3 Second, the rule created a new topical format. Finally, and most significant to our research questions, it shortened the filing deadline. Although the 2002 proposed rule suggested that filings be made within two business days of the event, many of the comment letters that the SEC received expressed concern at this short time frame. The combination of existing IT and internal control structures made this requirement nearly impossible to comply with for the relatively smaller firms. In response to these concerns, the SEC decided on four business days following the occurrence of the event deadline. Given that US publicly traded firms must make their SEC filings available on EDGAR (the Electronic Data Gathering, Analysis, and Retrieval system) within one business day of the filing, the current Form 8-K guidance effectively enables the public to receive information regarding material events within five business days of their occurrence. Internal Controls Recently, Auditing Standard No. 5 defined internal controls over financial reporting as: a process designed by, or under the supervision of, the company's principal executive and principal financial officers, or persons performing similar functions, and effected by the company's board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting (Public Company Accounting Oversight Board [PCAOB] 2007). However, the importance of strong internal controls has been recognized as far back as the Securities and Exchange Acts of 1933 and After several high profile financial scandals and frauds, industry followed-up on the federal government s lead by forming the Committee of Sponsoring 3 Please see the Appendices for a detailed list of categories and items. 7

8 Organizations of the Treadway Commission (COSO) in September COSO produced a framework that provides a foundation for assessing internal control effectiveness. This framework was recently updated in 2013 and serves as the primary internal control framework of the overwhelming majority of US publicly traded firms. Approximately 10 years following the 1992 COSO internal control framework, SOX section 302 (404) required management (auditors) of medium-large public firms to provide documentation (attestation) regarding the effectiveness of their firm s internal controls (Dechow et al. 2010). These requirements involve a thorough understanding of controls surrounding even the most complex accounting estimate. Failure to comply with the SOX requirements results in potentially severe criminal and civil penalties (Dechow et al. 2010). Prior to SOX, firms (with the exception of the banking industry) were required to disclose significant internal control deficiencies in Form 8-Ks only when disclosing a change in auditors (Krishnan 2005). At the time, the head of the American Institute of Certified Public Accountants (AICPA) stated that SOX contains some of the most farreaching changes that Congress has ever introduced to the business world, which included an unprecedented (partial) shift in the regulation of corporate governance from the states to the federal government (Beyer et al. 2010, 320). Proponents of SOX anticipate that the increased internal control requirements should mitigate executives earnings manipulations and other opportunistic management behavior; thereby, improving the quality of reported earnings numbers for the market (e.g. see Cohen et al. 2008). 8

9 Hypotheses Development In this section, we develop the study s first hypothesis regarding the association between IC and firms Form 8-K filing behavior. Next, given the recent research in the IT governance context, we examine potential timeliness impacts of IT-related versus other material weaknesses. Finally, we consider the association between firms 8-K filing timeliness and IC conditional on the asymmetric properties of certain event types. Internal Controls and Firms Form 8-K Filing Behavior The link between the timeliness of firms 8-K filings and the quality of their IC is straightforward and supported by the following three research streams. First, existing research suggests that the quality of a firm s internal controls is positively related to the firm s corporate governance (Ashbaugh-Skaife et al. 2007; Krishnan 2005). Second, a concurrent stream of research suggests that strong corporate governance leads to more timely information disclosure (Core 2001). Finally, the existing literature suggests that timely Form 8-K filings are essential for achieving adequate information disclosure and provide the continuous stream of information outlined by the SEC (1982). Krishnan (2005) examined the association between audit committee composition and the quality of internal controls. For the time period of 1999 to 2001, the author considers Form 8-K auditor change disclosures for two groups of firms: one with internal control problems and one without internal control problems. In general, results suggest a negative association between the proportion of independent members on the audit committee and the existence of internal control problems. Furthermore, the study finds a negative association between the number of audit committee members with financial expertise and the existence of internal control problems. 9

10 Similarly, Ashbaugh-Skaife et al. (2008) investigate the relationship between internal control quality and accrual quality. They find that firms that reported a deficiency in internal controls have noisier accruals (did not map as well into cash flows) relative to a control group of firms. Specifically, they document that firms reporting internal control deficiencies have lower quality accruals as measured by accrual noise and absolute abnormal accruals relative to firms not reporting internal control problems. In addition, the study finds that firms that reported internal control deficiencies have significantly larger positive and larger negative abnormal accruals relative to control firms. Overall, they interpret these results as suggesting that internal control weaknesses are more likely to lead to unintentional errors (which add noise to accruals) than intentional misstatements (which may bias earnings upward). Additionally, Ashbaugh- Skaife et al. (2008) find that firms whose auditors confirm remediation of previously reported internal control deficiencies exhibit an increase in accrual quality relative to firms that did not remediate their internal control problems. To the extent that the latter two findings are not atypical, we argue that the level of internal control quality will be positively associated with better corporative governance mechanisms. A number of studies suggest a positive relation between strong (weak) corporate governance mechanisms and firm compliance (non-compliance) with mandatory disclosure regulation (Core 2001). As noted by Core (p. 442), Corporate finance theory predicts that shareholders endogenously optimize disclosure policy, corporate governance, and management incentives in order to maximize firm value. Additionally, Core indicates that the optimal disclosure policy allows some managerial manipulation of disclosure. However, it is the governance structure that constrains the manager to follow 10

11 the optimal disclosure policy. Several studies provide evidence supporting a positive relation between strong (weak) corporate governance and reduced (higher) information asymmetry between firm management and outside observers. For example, the extant research finds that strong corporate governance is associated with less earnings management (Klein 2002), fewer restatements (Abbott et al. 2004), less fraud (Beasley 1996), and more voluntary disclosures (Gul and Leung 2004). Statement of Financial Accounting Concepts No. 2 (Financial Accounting Standards Board [FASB], 1980) states that financial disclosure should be both relevant and reliable. In order for information to be relevant, it must be available to investors (and other corporate stakeholders) before it loses its capacity to influence their decisions. Thus, the timeliness of information disclosure is a key to making it useful to investors. Timeliness is an important discretionary element of mandatory financial disclosure (Dwyer and Wilson 1989). A significant amount of quantitative and qualitative information is captured, stored, and processed through a firm s accounting information system. The compressed nature of processing and producing Form 8-K information (relative to 10-K and 10-Q reporting processes) and significantly greater inclusion of non-financial information compared to the typical 10-K and 10-Q, make the reliance on internal control quality critical in order to comply with the four-day requirement. Therefore, if the quality of internal controls is associated with better governed firms, then we would expect to observe that these firms report their 8-K filings in a timelier manner. Accordingly, our first set of hypotheses is as follows: 11

12 H1a: Firms with (without) internal control weaknesses will file their 8-Ks in a less (more) timely manner. H1b: Firms with (without) internal control weaknesses are less (more) likely to file their 8-Ks in conformity with the SEC s mandatory four day reporting requirement. IT-Related Versus Non-IT Material Weaknesses We have motivated our prior hypotheses using the corporate governance literature. A newer area of this literature involves IT corporate governance (ITG). ITG is defined by Debreceny (2013, 129) as the process by which organizations seek to ensure that their investment in information technology facilitates strategic and tactical goals. It represents an increasingly important subset of the broader corporate governance environment. A 2011 ISACA survey indicates that more than 70 percent of organizations with less than 500 full-time employee equivalents (FTEs) and 85 percent of organizations with more than 500 FTEs report the existence of some ITG processes (ISACA 2011). According to Rathnam et al. ( ), the alignment of both business strategy and IT strategy has emerged as a critical issue for all firms. Poor alignment can cause costly IT failures and a steady decline in competitive ability (Liebowitz 1999). ITG can be considered as the corporate structure facilitating strategy alignment and IT-related material internal control weaknesses can be considered the by-product of poor ITG. ITrelated controls are distinct from non-it controls and receive special attention in professional publications and auditing standards (Boritz et al. 2013). Particular attention to IT-related controls can help firms focus on the accuracy and timeliness of disclosure, while also ensuring protection, privacy, and security of their information assets (Li et al. 2007). Relative to other material control weaknesses, IT-related weaknesses have been 12

13 considered by the literature as more pervasive (since IT typically touches all major components of publicly-traded firms; Canada et al. 2009), more costly to fix/remediate (Boritz et al. 2012; Bedard et al. 2012; Brown and Lim 2012; Hammersley et al. 2013), and more likely to persist into future periods (Klamm et al. 2012). SOX Sections 302 and 404, highlight the importance of financial reporting controls to both managers and auditors. Managers, especially, use the information produced in its financial reporting system to report to firm stakeholders; thus, the quality of IT-related controls appears to affect this reporting process. Li et al. (2012) provide evidence that IT-related controls affect the quality of information produced by a firm s system. Without specific reference to IT-related versus other internal controls, Doyle et al. (2007) suggest that the impact of internal controls varies based on the type of material weakness. From an auditing perspective, Ettredge et al. (2006) find that 1) material weaknesses in internal controls over financial reporting are positively associated with audit delay and 2) firm-wide weaknesses are associated with longer delays than specific account/transaction weaknesses. However, it is an empirical question whether differences in internal control weaknesses would impact a far more frequent form of reporting that primarily contains nonfinancial information (i.e., Form 8-K). 4 In sum, good ITG suggests that strong alignment between IT strategy and business strategy results in good firm performance. Internal controls are the mechanism to ensure the alignment. Along these lines, Klamm and Watson (2009) isolate IT internal controls from non-it internal controls. This study documented that, for a sample of Anecdotal evidence indicates that most firms possessing Enterprise Resource Planning Systems store nonfinancial data in different locations within their systems than financial data. 13

14 firms which disclosed material weaknesses in internal control under Section 404 of the Sarbanes Oxley Act, firms with IT-related weak components reported more material weaknesses and misstatements than firms without IT related weak components. 5 Overall, the authors interpreted their results as providing evidence on the pervasive negative impact of weak IT controls, especially in control environment, risk assessment, and monitoring. In addition, Klamm et al. (2012) find firms with IT-related material weaknesses subsequently report more material weaknesses (both IT and non-it) in future years, relative to firms which only possessed non-it weaknesses, suggesting persistence and pervasiveness of IT-related internal controls. Therefore, this budding segment of the ITG literature seems to suggest that weaker IT-related controls would be associated with less timely Form 8-K filings, a lack of compliance with the four day reporting requirement, and an increase in non-it control weaknesses. Consequently, it is an empirical question whether IT-related material weaknesses in internal control will be associated with 8-Ks, which are filed in a less (more) timely manner. The last set of hypotheses are as follows: H2a: Firms with (without) IT-related material internal control weaknesses will file their 8-Ks in a less (more) timely manner -even after controlling for other types of material weaknesses in internal controls. H2b: Firms with (without) IT-related material internal control weaknesses are less (more) likely to file their 8-Ks in conformity with the SEC s mandatory four day reporting requirement - even after controlling for other types of material weaknesses in internal controls. 5 Recent post SOX research examines the relationship between information systems complexity and information systems vulnerability (Cong and Romero 2013). Their argument centers around increased regulation leading to increase IT controls, but this situation increases complexity, which makes the firm more vulnerable to security-related issues. This finding augments the importance of understanding the pervasive effects of IT-related controls identified in the extant literature. 14

15 III. METHOD Research Design Our first hypothesis set investigates whether internal controls are associated with managers Form 8-K filing behavior. To test these hypotheses, we employ the following model: REPLAGit = α0 + α1icmwit-1+ α2 SIZEi,t + α3 LEVi,t + α4roai,t + α5reti,t + α6lossi,t + α7agei,t + α8restructurei,t + α9foreigntransactioni,t + α10extremegrthi,t + α11logsegnumi,t + α12big4i,t + εi,t Eq. (1) where the dependent variable, REPLAG, captures the reporting lag. This variable is measured as the 8-k filing date minus the event date. The variable of interest, ICMW, captures the firm s internal control quality. It is equal to 1 if the company has reported a material weakness in internal control and 0 elsewhere. The choice of the control variables follows prior research and economic theory. Prior research suggests that the timeliness of firms regulatory filings are related to firm size (SIZE); (Impink et al. 2012; Carter and Soo 1999; Alford et al. 1994), leverage (LEV) (Impink et al. 2012; Carter and Soo 1999; Alford et al. 1994); audit firm size (Big4) ( Impink et al. 2012; Ge and McVay 2005; Doyle et al. 2007) 6 ; incidence of losses (Loss) (Impink et al. 2012; Doyle et al. 2007); profitability (ROA) (Carter and Soo 1999); and returns (RET) (Carter and Soo 1999; Griffin 2003). Additionally, consistent with existing literature (e.g. Doyle et al. 2007), we control for other issues which are both correlated with weak internal controls and are known to affect a firms overall information 6 We create an indicator variable (Big4) capturing whether a company hires a Big 4 auditor, because we expect greater pressure from large auditors for timely filing. Schwartz and Soo (1996) suggest that the timeliness of Form 8-K filings divulging an auditor change is affected by whether the new audit firm is a Big N or non-big N firm. Their study notes that filing delays are bigger and late filing occurs more frequently when non-big N auditors are involved. 15

16 environment including: financial health (Loss), Extreme Sales Growth (ExtremeGrth), Operation Complexity/Number of business segments (LogSegNum), Foreign Transactions (ForeignTransaction), Restructuring (Restructure) and firm age (Age). We estimate this model over the seven years in our sample period, We use pooled time series cross sectional regressions in our analysis. The residuals in the pooled time series cross sectional analyses may be correlated within firms or over time, leading to biases in estimates of the coefficient standard errors (Petersen 2009). Therefore, our t-statistics are calculated based on standard errors adjusted for firm and year clustering, as recommended by Petersen. Finally, we include both year and industry fixed effects. A positive (negative) α1 in equation (1) above is consistent with material weaknesses in internal control exacerbating (mitigating) managers Form 8-K filing timeliness. However, this test is not informative as to whether material weaknesses in internal control are associated with managers overall compliance with the 8-K regulation guidelines. A more restrictive test of our first hypothesis would investigate the association between late 8-K filers and internal control material weaknesses. To test this association, we use the following logistical specification of equation (1): Prob (NonConformit =1) REPLAGit = α0 + α1icmwit-1+ α2 SIZEi,t + α3 LEVi,t + α4roai,t + α5reti,t + α6lossi,t + α7agei,t + α8 Restructurei,t + α9foreigntransactioni,t + α10extremegrthi,t + α11logsegnumi,t + α12big4i,t + εi,t Eq. (2) where the dependent variable, NONCONFORM, is equal to 1 if the 8-K filing exceeds the mandatory four day requirement and 0 otherwise. All other variables are 16

17 measured as described above. Similar to the previous test, we estimate this logit model over the seven years in our sample period. Our z-statistics are calculated based on the standard errors adjusted for firm and year clustering (Petersen 2009). A positive (negative) β1 is consistent with material weaknesses in internal control exacerbating (mitigating) managers 8-K filing compliance. In other words, a positive coefficient would indicate that material weaknesses in internal controls are more likely to cause managers to file their Form 8-Ks late. Our second hypothesis predicts that management s 8-K filing timeliness behavior will be associated with the existence of IT material weaknesses in internal controls, even after controlling for all other types of material weaknesses in internal controls. To test this hypothesis we modify equations (1) and (2) as follows: REPLAGit = α0 + α1itmwit + α2other_mwi,t + αn Controlsi,t+ εi,t Eq. (3) Prob (NonConformit =1) = β0 + β1itmwit+ β2other_mwi,t + + εi,t Eq. (4) In the above specifications, ITMW is equal to 1 if the firm has an IT-related internal control material weaknesses, otherwise ITMW is equal to 0. OTHER_MW is equal to 1 if the firm has an internal control material weaknesses other than an IT-related internal control weakness and 0 otherwise. All other variables are measured as described above. Similar to the previous model, our t-statistics (OLS regressions) and z-statistics (logit regressions) are calculated based on the standard errors adjusted for firm and year clustering (Petersen 2009). A positive (negative) α1 and β1 is consistent with IT-related material weaknesses in internal control having additional explanatory power in exacerbating (mitigating) managers 8-K filing reporting. 17

18 Sample Composition Panel A of Table 1 summarizes the sample selection procedures. First, we used DirectEDGAR (2012) to identify firms that filed 8-K reports for the time period spanning 2005 to We focus on filings with calendar year filing days. We then generate the fiscal year (i.e., which fiscal year the filing belongs to) and merge the resulting database with the COMPUSTAT database. 7 We start with a total of 370,204 observations in our sample. We then deleted 226,814 observations with missing information. Our final sample is composed of 118,863 usable firm-year observations that have available data. [Insert Table 1 about here] Panel B of Table 1 presents the sample distributions across years. In order to facilitate our subsequent analyses and to sharpen our understanding of the roles played by a firm s AIS, we divided our sample into two groups: events that are complicated (CompEvent) or otherwise (NonCompEvent). That is, we assume IT weakness is more evident in decreasing a firm s reporting timeliness if the event to be reported is complicated. We contend that this is a more reasonable categorization of events with regard to our sample than other ITMW categorizations (e.g., Klamm and Watson s [2009] grouping based on the COSO framework or Masli et al. s [2009] grouping of 25 specific ITMWs into seven arbitrary categories). Panel C of Table 1 provides the sample distribution across the different 8-K events. Consistent with Lerman and Livnat (2010), many of our sample firms filed 8-Ks to report the entry into material definitive agreements (ENTERAGREE; 28,684) and the 7 Note that historical CIK before 2007 is not available in COMPUSTAT, so we use 2007 CIK as the historical CIK for firms filing 8-Ks during the 2005 to 2006 time periods. 18

19 resignation of directors/officers and Regulation Fair Disclosure events (OFFDIRECHANGE; 33,324). IV. RESULTS Descriptive Statistics Table 2, Panel A shows the descriptive statistics for the full sample. The mean, standard deviation, minimums and maximums are reported. In addition to the variables of interest which include REPLAG, NONCONFORM, ICMW, IT_MW, OTHER_MW, IT_IMPROVE and IT_ADVERSE, we include other variables used in our models as described above. [Insert Table 2 about here] The distributions are similar to those reported in the existing literature. We find that our sample firms, in general, file timely disclosure of Form 8-K material events, with 95% of our complicated event sample filing within four business days of the event date and about 96% of our non-complicated event sample filing within the required time frame. On average, our complicated event sample firms take about three days to file their 8-Ks (Mean REPLAG of 3.039). Our non-complicated event firms take about two days to file their 8-Ks (Mean REPLAG of 2.212). These findings are comparable to that found by Lerman and Livnat (2010), but somewhat lower than Karim and Pinsker s (2012), post- SOX results. Our average [median] sample returns, RET, (0.086) are comparable to existing literature (e.g., Goh and Li (2011) report 0.19 [0.06], for this variable). Conversely, our firms seems to be more highly leveraged than would be expected. We report average leverage, LEV, of [.384], which is considerably higher than the

20 [.12] reported by Goh and Li (2011). Our sample means [medians] for firm age, AGE, [10.000], restructuring charges, RESTRUCTURE, (0.000) Foreign Transactions, FOREIGNCURRENCY, [0.000], and business segments, LOGSEGNUM [2.485], are all comparable to existing literature (e.g., Doyle et al. (2007) report [8.00], [0.000], [0.000], [4.000], respectively for these variables). Extreme Sales Growth [0.000] for our sample firms is somewhat lower than has been previously reported (e.g., Doyle et al. (2007) report 0.193, [0.000] for this variable). Table 2, Panel B shows the correlation matrix for the variables used in the study. We observe that material weakness in internal control is significantly positively correlated with IT material weakness in internal control (0.52) and other non-it material weakness (0.83). We also observe a positive and significant correlations between material weaknesses in Internal Control and both IT_Improve (0.13) and IT_adverse (0.34). The negative and significant Pearson correlations between the size of the firm (-0.14), ROA (- 0.08), returns (-0.07), Firm Age (-0.01), Big4 (-0.12) and the likelihood of the firm reporting a material weakness in internal control are all as expected and consistent with extant literature as suggested above. We also report positive and significant Pearson correlations between Restructuring charges (0.02), Foreign Transactions (.03) and the likelihood of the firm reporting a material weakness in internal control. Main Empirical Results Our first hypothesis investigates whether internal controls are associated with managers Form 8-K filing behavior. Specifically, we are interested in whether internal 20

21 controls affect the 8-K reporting lag. Tables 3 and 4 show the coefficients from the estimation of the regression in Equations (1) and (2) for the period from 2005 to [Insert Tables 3 and 4 about here] We report results for baseline models (columns 1 and 4 in Table 3 include the entire sample) and sets of subsamples. The complicated events (CompEvents) subsample covers four types of events: ENTERAGREE, MATIMPAIR, ACQDISPCOMPLETE, UNREGSALE, and the non-complicated events (NonCompEvents), subsample includes the non-complicated events, which include firms reported one or more of the other types of events. ENTERAGREE refers to Entry into a Materially Definitive Agreement, MATIMPAIR refers to Material Impairments, ACQDISPCOMPLETE refers to Completion of Acquisition or Disposition of Assets, and UNREGSALE refers to Unregistered Sales of Equity Securities. All other events are defined in Appendix B. In Table four, we further divide our sample into surprising events (SurpEvents), and non-surprising events (NonSurpEvents). Unlike the previously-cited categorization studies, we contend that surprising events (especially) represent the biggest challenge for firms to comply with the strict 8-K reporting guidelines if they possess ICMW. Four types of events are classified as surprising: ACCELEROBLIG (Triggering Events which Accelerate or Increase a Direct Financial Obligation under an Off-Balance Sheet Arrangement), CREDITENHANC (Change in Credit Enhancement or Other External Support), EBPSUSPEN (Temporary Suspension of Trading Under Registrant s Employee Benefit Plans) and UNREGSALE (Unregistered Sales of Equity Securities). The remaining observations are coded as unsurprising events. Overall, we interpret the results in Tables 3 and 4 as supporting hypotheses 1a and 1b: material weaknesses in 21

22 internal control (ICMW) increase both reporting lag and the non-conforming of the reporting deadlines. The internal control measure loads positive and significant in both the OLS and logistic specification models. 8 This result is invariant to whether the events are complicated or non-complicated, or surprising or unsurprising. We interpret this result as suggesting that the presence of material weaknesses in internal control are likely to cause delays in 8-K filings. Our regressions range from a total of 118,863 observations in the baseline models to 2,815 observations in the surprising events subsamples. Turning our attention to the control variables, we observe that, as expected, the coefficient on Size is significantly negative for all but one model (in each table), consistent with larger firms having smaller reporting lags. 9 The coefficient on leverage is also significantly negative for all but one model, consistent with more levered firms having shorter 8-K reporting lags. The coefficient on extreme sales growth is significantly negative for all but one model, consistent with extreme growth firms having shorter 8-K reporting lags. Finally, we observe a reliably negative association between the presence of Big 4 auditors and the firm reporting behavior. This result suggest that firms with Big 4 auditors have shorter 8-K reporting lags. Overall, results from Tables 3 and 4 suggest that firms with internal control material weaknesses are more likely to experience delays in managers 8-K reporting filings. Our second hypothesis predicts that management s Form 8-K filing timeliness behavior is associated with the existence of IT material weaknesses in internal controls, 8 Recall that an IC equal to 1 indicates that the firm has reported a material weakness in internal control versus 0 elsewhere. 9 This is expected because larger firms are likely to be more mature, with richer information environments (usually with more analyst following these firms), which reduces the overall uncertainty and other information asymmetries (Khan and Watts 2009). 22

23 even after controlling for all other types of material weaknesses in internal controls. Tables 5 and 6 report the effect of IT related (IT_mw) and other weakness (other_mw) on reporting timeliness. [Insert Tables 5 and 6 about here] Overall, we interpret the results in Tables 5 and 6 as providing mixed evidence. Columns 1 and 2 (Table 5) and 2 in Table 6 show that the presence of IT-related material weakness (IT_MW) prolong the reporting process when the firm reports complicated and non-surprising events. We observe significant positive coefficients (0.015, and 0.013). 10 However, the insignificant association between IT_MW and the reporting lag dependent variables for the noncomplicated and surprising events subsamples suggest that other types of material weaknesses in internal control are more likely to be associated with less timely 8-K reporting behavior than IT-related internal control weaknesses for these two types of events. Finally, we observe insignificant associations between IT_MW and the nonconforming dependent variables for all five reported models. Overall, we interpret the results in Tables 5 and 6 as indicating that IT-related material weaknesses are more likely to impair the 8-K reporting process for complicated events. Robustness Checks The extant literature suggest that remediation (deterioration) in the quality of IT internal controls may be positively (negatively) associated with managers 8-K filing 10 For example, firms experiencing auditor changes would require relatively less time for the AIS to report changes. 23

24 behavior (e.g., See Li et al. 2012). To investigate this issue, we modify equations (1) and (2) as follows: REPLAGit = α0 + α1it_improveit + α2 IT_ADVERSE i,t + εi,t Eq. (5) Prob (NonConformit =1) = β0 + β1it_improveit+ β2it_adversei,t + Eq. (6) where IT_IMPROVE is equal to 1 if the firm has IT_MW in year t, but has no IT_MW in year t+1 and 0 otherwise. IT_ADVERSE is equal to 1 if a firm has IT_MW in both year t and t+1 and 0 otherwise. All other variables are measured as described above. Tables 7 and 8 present the results of estimating equations (5) and (6). As previously stated, we estimate versions of the models focusing on both complicated and non-complicated events. Consistent with findings from the extant material weakness remediation literature (e.g., Bedard et al. 2012; Hammersly et al. 2013), a positive (negative) α1 and β1 would suggest that remediation in IT-related material weaknesses in internal control is effective at reducing (increasing) the timeliness of management s 8-K filing behavior. A positive (negative) α2 and β2 would suggest that a remediation (deterioration) in the quality of ITrelated internal controls increases (reduces) the probability that management will comply with 8-K filing deadlines. [Insert Tables 7 and 8 about here] For all models we observe an insignificant coefficient on the remediation in the quality of IT-related internal control variable (IT_improve). We interpret this result as suggesting that improving the IT-related internal control has no effect on managers 8-K reporting behavior. Similarly, we observe insignificant coefficients on the deterioration in the quality of IT-related internal control variable (IT_worse) for all models. Overall, the 24

25 results from Tables 7 and 8 suggest that neither improving nor deteriorating IT weaknesses are associated with 8-K reporting lags. However, both of these tests require more restrictive assumptions. In order to calculate the deterioration (remediation) in our IT material weaknesses we need to use lag(lead) observations which greatly reduces the power of our tests. Therefore, we believe the lack of results here are (at least partially) driven by the constrained samples. Similar to the previous model, our t-statistics (OLS regressions) and z-statistics (logit regressions) are calculated based on the standard errors adjusted for firm and year clustering (Petersen 2009). Our sample period co-insides with the financial crisis episode. Consequently, there is some concern that our overall results are potentially misrepresented by the inclusion of this turbulent period. In untabulated tests, we control for the financial crisis period and find that our primary results are qualitatively similar. 11 V. CONCLUSION As indicated earlier, management has conflicting incentives regarding timely disclosure of material, negative events. Motivated by recent regulatory and institutional reforms, as well as the intersections of the mandatory SEC reporting, management incentives/strategy, and budding IT governance literatures, we investigate the connection between internal control quality, form of internal control material weakness and firms 8- K filing timeliness. Post-SOX, the SEC extended the list of events that were required to be disclosed in their 8-K filings and also shortened the mandatory filing period to four business days. Additionally, the 8-K and internal control reporting requirements have changed, IT significantly improved resulting in increased expectations related to 11 We thank an anonymous referee for suggesting this possibility. 25

26 accuracy, timeliness, and security of information to be disclosed, and there has been more realization on the part of management that it needs to align its IT and financial reporting strategies. Prior to these changes, firms (with the exception of the banking industry) were required to disclose significant internal control deficiencies in 8-Ks only when disclosing a change in auditors (Dechow et al. 2010). The current study uses a proprietary database to identify a large sample of firms that filed 8-K reports for the time period spanning 2005 to We then examine the association between internal control weaknesses and firms form 8-K filing timeliness. Our focus is on understanding the roles played by a firm s AIS, so we divide our sample into complicated and non-complicated event firms and further divide our sample into surprising and unsurprising event firms. Overall, we find a negative relation between the likelihood of the firm reporting a material weakness in internal control and the timeliness of the firms 8-K filing behavior. This result is invariant to whether the events are complicated or non-complicated or surprising or unsurprising events. Our primary hypothesis examines the association between management s 8-K filing timeliness behavior and the presence of IT-related material weaknesses in internal controls. For complicated events we find evidence that IT-related material weaknesses in internal controls are more likely to cause delays in 8-K reporting even after controlling for all other types of material weaknesses in internal controls. For non-complicated events, we find no association between IT-related material weaknesses in internal controls and the 8-K reporting timeliness after controlling for other types of material weaknesses in internal controls. Consistent with prior research procedures using Form 10-K data, we also investigate if remediation (deterioration) in the quality of IT-related 26

27 internal controls are associated with managers 8-K filing behavior. We are unable to find an association between firms with improving or deteriorating IT-related weaknesses and firms reporting lag behavior. As Li et al. (2012, 183) indicate, there is a lack of archival research that explicitly considers the impact of IT controls on information quality. Our study adds to Li et al. s (2007, 2012) and Boritz et al. s (2013) results specifically and more generally to the budding IT governance literature by examining relative differences in timeliness/relevance of information due to the nature of material weakness (ITMW and ICMW). Although we do not classify specific IT-related controls, we still find a pervasive effect in a novel context. Future research should continue along this path to examine even more reporting contexts using Li et al. s (2012) classifications. Our study is confined by the standard limitations associated with archival research. 27

28 REFERENCES Abbott, L. J., Parker, S., & Peters, G. F Audit committee characteristics and restatements. Auditing: A Journal of Practice & Theory, 23(1), Alford, A. W., Jones, J. J., & Zmijewski, M. E Extensions and violations of the statutory SEC Form 10-K filing requirements. Journal of Accounting and Economics, 17(1), Altamuro, J., & Beatty, A How does internal control regulation affect financial reporting?. Journal of Accounting and Economics, 49(1), Ashbaugh-Skaife, H., Collins, D. W., & Kinney Jr, W. R The discovery and reporting of internal control deficiencies prior to SOX-mandated audits. Journal of Accounting and Economics, 44(1), Ashbaugh-Skaife, H., Collins, D. W., Kinney Jr, W. R., & LaFond, R The effect of SOX internal control deficiencies and their remediation on accrual quality. The Accounting Review, 83(1), Beasley, M. S An empirical analysis of the relation between the board of director composition and financial statement fraud. Accounting Review, Bedard, J. C., Hoitash, R., Hoitash, U., & Westermann, K Material weakness remediation and earnings quality: A detailed examination by type of control deficiency. Auditing: A Journal of Practice & Theory, 31 (1), Beyer, A., Cohen, D. A., Lys, T. Z., & Walther, B. R The financial reporting environment: Review of the recent literature. Journal of Accounting and Economics, 50(2), Boritz, E., & Lim, J. H IT control weaknesses, IT governance and firm performance. Working paper, University of Waterloo , Hayes, L., & Lim, J. H What do auditor s reports on internal control tell us about IT control weaknesses in financial reporting systems? Working paper, University of Waterloo A content analysis of auditors reports on IT internal control weaknesses: The comparative advantages of an automated approach to control weakness identification. International Journal of Accounting Information Systems, 14, Brown, K., & J. H. Lim The effect of internal control deficiencies on the usefulness of earnings in executive compensation. Advances in Accounting, 28 (1), Canada, J., Sutton, S., & Kuhn Jr, R The pervasive nature of IT controls: An examination of material weaknesses in IT controls and audit fees. International Journal of Accounting and Information Management 17 (1), Carter, M. E., and B. S. Soo. (1999). The relevance of form 8-K reports. Journal of Accounting Research, Cohen, D., Dey, A., and T. Lys., Real and accruals-based earnings management in the pre-and post-sarbanes Oxley eras. The Accounting Review 83, Cong, Y., & Romero, J On Information Systems Complexity and Vulnerability. Journal of Information Systems, 27(2), Core, J. E A review of the empirical disclosure literature: discussion. Journal of Accounting and Economics, 31(1),