Reporting Internal Control Deficiencies in the Post-Sarbanes- Oxley Era: The Role of Auditors and Corporate Governance

Transcription

1 International Journal of Auditing Reporting Internal Control Deficiencies in the Post-Sarbanes- Oxley Era: The Role of Auditors and Corporate Governance Gopal V. Krishnan and Gnanakumar Visvanathan George Mason University, USA This study addresses the role of audit committees and auditors in the reporting of internal control deficiencies after the passage of the Sarbanes-Oxley Act (SOX). We find that a higher number of meetings of the audit committee, lesser proportion of financial experts in the audit committee, and more auditor changes characterize firms that report weaknesses in their internal controls compared to firms with no weaknesses. Prior restatements of financial statements are also higher for firms that report weaknesses in internal controls. These results obtain after controlling for a variety of firm characteristics such as complexity of operations, profitability, and growth. Our results underscore the importance of governance characteristics beyond general firm characteristics in examining the reporting of internal control weaknesses. Key words: SOX, internal control, audit committee, financial expert, section 404 SUMMARY The Sarbanes-Oxley Act enacted significant regulations concerning corporate governance and financial reporting including the reporting of internal control deficiencies. This paper provides an assessment of the role of two key players, namely audit committees and auditors in the reporting of internal control deficiencies. Both corporate governance and the role of external auditors have Correspondence to: Gnanakumar Visvanathan, Assistant Professor of Accounting, School of Management, MSN 5F4, George Mason University, Fairfax, VA 22030, USA. gvisvana@gmu.edu received considerable critical attention consequent to reported accounting scandals at several firms. The quality of governance and the external auditors are likely to play important roles in maintaining good internal controls that are critical to the integrity of financial reporting. We examine a sample of firms that reported internal control deficiencies under section 404 of the Sarbanes- Oxley Act and assess the characteristics of audit committees and auditors for these firms. To this end, we compare firms reporting internal control deficiencies with firms of similar size in the same industry that do not report such deficiencies. We find that firms that report internal control ISSN Journal compilation 2007 Blackwell Publishing Ltd, 9600 Garsington Rd, Oxford OX4 2DQ, UK and Main St., Malden, MA 01248, USA.

2 74 G. V. Krishnan and G. Visvanathan weaknesses are characterized by audit committees that meet more often and have a lesser proportion of directors who qualify as accounting financial experts. Firms reporting weaknesses are also characterized by greater number of auditor changes and prior restatements of financial statements. These results should be of interest to investors, auditors, and regulators who are interested in imposing new governance rules. INTRODUCTION A significant feature of the Sarbanes-Oxley Act (SOX) (US Congress 2002) is section 404 that requires management s assessment of the company s internal controls over financial reporting and an auditor s opinion on the management s assessment. 1 Implementing section 404 has become the top focus of audit committee members and the enormous costs of implementation have invited some criticism (Solomon & Peecher, 2004). 2 The objective of this study is to provide preliminary empirical evidence on the role of two important governance agents, audit committees and auditors, in reporting internal control deficiencies required under section 404 of the SOX. Prior to SOX, disclosures of internal controls were not explicitly required except around auditor changes and thus research evidence on detection of internal controls had been limited. 3 Research examining the pre-sox period found audit committee composition to be significantly associated with internal control deficiencies (J. Krishnan, 2005). Because both SOX and new stock exchange guidelines have significantly altered rules governing auditors and composition of audit committees, the role of governance mechanisms with respect to detection of internal controls has undergone a substantial change. Specifically, SOX requires that all members of the audit committee be independent and companies disclose whether they have a financial expert on the audit committee. Similarly, New York (NYSE), American and NASDAQ stock markets require that audit committees include at least one financial expert. 4 One important consequence of SOX is the emergence of corporate governance convergence, i.e., as firms augment their audit committees there is very little variation across firms in terms of audit committee characteristics, such as the proportion of independent directors or the number of financial experts. Thus, in the post-sox era, it is an empirical question as to whether audit committee attributes will continue to distinguish firms that report internal control deficiencies from those that do not and if so which of the attributes are relevant in addressing this issue. Similar to audit committees, auditors have a substantive role in the reporting of internal controls under SOX. SOX requires auditors to report on management s assessment of internal controls. 5 We focus on a variety of auditor attributes, such as auditor size, auditor changes, and auditor tenure to examine the role of auditors in distinguishing firms with reported internal control deficiencies. To investigate the roles of audit committees and auditors, we identified companies that reported internal control deficiencies in SEC filings subsequent to November 15, ,7 We matched our sample with a control group (firms that did not report such deficiencies) in the same industry based on size. We compared the two groups and found statistically significant differences in the proportion of financial experts in audit committees, the number of meetings held by audit committees, and auditor changes. Firms that reported internal control deficiencies had a smaller proportion of financial experts as defined in SOX. Similarly, greater audit committee activity in terms of the number of meetings rather than composition of audit committee appears to be relevant in timely reporting of internal control deficiencies. Our study differs from other studies that examine internal control reporting. J. Krishnan (2005) examined association between audit committee quality and internal control deficiencies in the pre-sox period. Because reports on internal controls were not required in that period, she could examine only those disclosed around auditor changes. We complement and extend her study by looking at the post-sox period and by examining audit committee and auditor attribute variables that have undergone significant changes because of SOX. We are also able to examine all firms with reported internal control deficiencies and not just those reported around auditor changes. Our results are consistent with J. Krishnan (2005) who found audit committee composition to be the key distinguishing feature in the pre-sox era to the extent that we find expertise matters, but our findings on meetings, auditor changes and management s expertise in accounting differ from hers. Moreover, our control variables are more comprehensive in addressing and controlling for firm level characteristics compared to J. Krishnan (2005). 8

3 Reporting Internal Control Deficiencies in the Post-Sarbanes-Oxley Era 75 In studying the disclosures on internal controls under section 404, we assume that firms that report internal control weaknesses are the only firms with such weaknesses and firms that do not report any such weaknesses (firms that we use as control group) are not subject to weaknesses at the time of the study. While we have verified that control firms did not report any weaknesses at the time of the study, it is possible that some of these firms had internal control weaknesses but report them in subsequent periods. To the extent we have misidentified a control firm as one without a weakness, the procedure biases against finding any significant results. The results in the study with respect to the association of internal control weaknesses and audit committee characteristics have to be interpreted in the context of the time period over which the study has been conducted. The study addresses a period that follows immediately after the passage of SOX, a period also marked by heightened awareness of accounting problems and increased involvement of governance mechanisms such as audit committee meetings. This raises the potential issue that causes and consequences of internal control deficiencies may be more complex than the type of governance variables considered in this study and also the timing of the association may be different in other periods. While the study employs sample collection procedures that should partially alleviate these concerns, the results of the study should be interpreted in the context of this potential shortcoming. We contribute to the literature on internal controls, impact of SOX, and the role of audit committees. Our finding that the audit committee activity rather than its composition is associated with the timely reporting of internal control deficiencies suggests that future studies have to examine attributes of governance other than size of audit committee or the number of independent directors because the changes brought about by SOX essentially create uniformity in these variables. Our finding that firms that report internal control deficiencies have lesser proportion of financial experts suggests that the role of expertise is better examined by defining it as a proportion rather than as a dummy variable as done in many auditing studies. Finally, we highlight the role of prior restatements in addressing firms that report weak internal controls as restatements occur more for these firms and the restatements have a significant impact in altering governance structures. HYPOTHESIS DEVELOPMENT Audit committee composition and diligence The role of audit committees in developing and maintaining sound internal controls has been demonstrated by several studies (BRC, 1999; DeZoort, 1997; Carcello et al., 2002). Prior studies have also examined the broader role of audit committees with respect to earnings manipulation and restatements (Klein, 2002; Abbott et al., 2004). J. Krishnan (2005) hypothesizes that firms that report internal control deficiencies in the pre-sox period have audit committees that are smaller, less independent, and have lesser expertise compared to firms that do not report deficiencies. Prior to SOX, decisions on composition of the audit committee such as number of directors and proportion of independent directors were for the most part voluntarily made by companies. 9 Under SOX, audit committees role has been substantially strengthened and specific requirements on the composition of the committees have been proposed. For example, all directors serving on the audit committees are expected to be independent directors and companies should disclose if they have at least one committee member who qualifies as a financial expert (SEC, 2003). The New York, American, and NASDAQ stock exchanges have adopted new rules for listing purposes that require at least three directors in audit committees and that at least one member of the committee be a financial expert (NYSE Rule 303A and NASDAQ Rule 4350(d)(2)). 10 Such regulatory changes imply that companies are likely to have a great deal of similarity in the composition of their audit committees. Thus, characteristics that capture composition of the committee are unlikely to be different across firms that report internal control deficiencies and those that do not. Thus we focus on characteristics of committees that are not necessarily the result of a regulatory provision. The first characteristic we consider is the size of the audit committee. Larger committees are more likely to have greater participation in the governance process and are more likely to address controls and reporting more comprehensively. Prior auditing literature (see for example, Abbott et al., 2004) has found that the audit committee s effectiveness is positively related to the size of the committee. In contrast, studies such as Yermack (1996) find that larger boards are less efficient than smaller boards. Extending those findings to the

4 76 G. V. Krishnan and G. Visvanathan individual committee level would imply that the greater the audit committee size, the less effective the committee is likely to be. Given these conflicting implications of prior research we do not specify a directional prediction for audit committee size. Hence our first hypothesis is: H1a: The size of the audit committee of firms that report internal control deficiencies differs from firms that do not report internal control deficiencies. Audit committee size alone does not result in greater diligence as that would depend upon the technical expertise of the members in the committee. To address this we consider a second characteristic, the proportion of accounting or non-accounting financial experts in the audit committee. DeFond et al. (2005) document positive stock price reactions to appointment of financial experts to audit committees. Bedard et al. (2004) find lower earnings management for firms with experts on their audit committees. Krishnan and Visvanathan (2005) find that firms with financial experts on their audit committees are more conservative in their financial reporting. Such results suggest that greater financial expertise in the audit committee is likely to result in increased monitoring and diligence and thus, higher quality of governance. This would lead to lesser likelihood of internal control deficiencies occurring. On the other hand, arguably the absence of experts makes it difficult to identify and thus report control weaknesses which implies the presence of experts is positively associated with internal control weaknesses. We believe that the former explanation is more likely for the following reasons: as noted before, the prior literature documents that greater presence of expertise is associated with accounting attributes such as conservatism and earnings quality that potentially imply the presence of good control systems; J. Krishnan (2005) documents a negative relationship between audit committee expertise and internal control weaknesses in the pre-sox era. Thus it can be argued that with the presence of audit committee experts, systems and controls are probably in place to prevent weaknesses, and thus lead to lesser likelihood of reporting such weaknesses. Note that SOX requires the disclosure of the presence of an expert and the stock exchanges require the presence of an expert in the audit committee. Because such requirements result in firms designating a single person most of the time as the audit committee expert, there is very little variation among firms on the dimension of expertise. 11 However, if expertise truly matters one must take into account both the number of experts and the size of the audit committee to capture variation among firms in terms of audit committee financial expertise. Hence, we hypothesize that greater number of experts would lead to more effective audit committees and thus we focus on the proportion (of experts on the audit committee to the total number of directors on the audit committee) rather than the mere presence of a single expert in audit committees. We state the hypothesis as: H1b: Audit committees of firms that report internal control deficiencies have lesser proportion of financial experts relative to firms that do not have such deficiencies. The third characteristic we consider is the activity of the audit committees which is also not directly governed by regulations. A committee may consist of a large number of directors all whom are independent and a large proportion of them financial experts, but the committee may not diligently carry out its functions if it does not meet often. PriceWaterhouseCoopers/IIA (2000) and Raghunandan et al. (2001) argue that audit committees can be effective only if they meet frequently and also meet with internal and external auditors to be apprised of recent developments. Meeting frequency of the committee has also been used as a proxy for diligence in prior literature (Menon & Williams, 1994; DeZoort et al., 2002). The significance of the association between audit committee meetings and financial statement fraud or restatement is somewhat mixed, however. Abbott et al. (2004) find that firms that restate their financial statements had a smaller number of audit committee meetings than a group of control firms. Beasley (1996) found no difference in the number of audit committee meetings between fraud and non-fraud firms. In contrast, Farber (2005) finds that fraud firms have a lower number of meetings than control firms in the year prior to fraud detection, but the fraud firms have more meetings in the year of the fraud and the subsequent three years. Such findings suggest a potential tension in the association of frequency of audit committee meetings and the reporting of internal control weaknesses. While results of early studies would generally imply a negative association between meetings and the reporting of internal controls

5 Reporting Internal Control Deficiencies in the Post-Sarbanes-Oxley Era 77 weakness, results in the Farber (2005) study suggest that around the year of reporting on internal controls meeting frequency may increase. Thus, we do not offer a directional prediction for audit committee meetings. We state our hypothesis as: H1c: The number of meetings held by audit committees of firms that report internal control deficiencies differ from the number of meetings held by firms that do not report internal control weaknesses. Auditor attributes Prior to SOX, only maintenance of cost effective internal controls was required by the Foreign Corrupt Practices Act of 1977 and disclosures on internal controls were not required. In that environment, having greater resources and experience with the client through longer tenure would have enabled the auditor to report on and ensure a remedy for any control deficiencies. On the other hand, firms reporting internal control deficiencies are likely to have auditors with shorter tenure and smaller size as documented in J. Krishnan (2005) in the pre-sox environment. However, such predictions regarding auditor attributes are confounded by the dramatically different audit environment that has resulted from the passage of the SOX and the formation of PCAOB. 12 Thus, we expect associations between reporting of internal control deficiencies and auditor attributes but do not always anticipate the direction of the associations. The first auditor characteristic that we consider is auditor size. The Big 4 auditors have more market-based incentives, expertise and resources than non-brand name auditors in protecting their reputation capital and therefore tend to be more conservative than non-big 4 auditors (Francis & Krishnan, 1999; Basu et al., 2000; G. Krishnan, 2005). Because of greater resources and concern for reputation, Big 4 auditors are more likely to detect and report on internal control problems. Thus, Big 4 auditors are less likely to be associated with the reporting of internal control weaknesses than non-big 4 auditors which leads to a positive association between audit firm size and internal control weakness disclosures. 13 However, findings of the prior literature with respect to significance of auditor size are not uniform. For example, DeFond & Jiambalvo (1991) found that bigger (then Big 8) audit firms do not differ from smaller firms in error detection. Similarly, Petroni & Beasley (1996) examined the accuracy and bias in estimates of claim loss reserves for property-casualty insurers and did not find that Big 8 auditors were more conservative than non-big 8 auditors. Thus, it is an empirical question whether there is a positive or negative association between size of auditors and firms that report internal control weaknesses. Hence, we state the hypothesis as: H2a: Auditor size of firms that report internal control deficiencies is different from auditor size of firms that do not report such deficiencies. The second characteristic that we consider in auditor attributes is auditor changes. Auditor changes have increased significantly since the year 2000, in particular after the passage of SOX, and several factors contribute to this phenomenon. To the extent auditors have become more sensitive to clients with higher perceived risk and drop such clients, auditor changes could be an indication of potential internal control deficiencies. Also, prior to SOX, disclosure of any internal control deficiencies were required around auditor changes (J. Krishnan, 2005; Whisenant et al., 2003). 14 Thus, we predict a positive association for reporting of deficiencies and auditor changes. 15 H2b: Auditor changes are higher for firms that report internal control deficiencies than for firms that do not report such deficiencies. Control variables Restatements A voluntary restatement of financial statements or an SEC enforcement action that results in a financial statement restatement suggests problems in the financial reporting model or earnings manipulation by the management. Such weaknesses could also be symptomatic of underlying poor internal controls. Thus a restatement could signify undetected internal control deficiencies. Also, firms that have been the subject of restatements are more likely to look closely at their internal controls to identify any potential weaknesses for remediation because of management s incentives to avoid costly restatements. Thus prior restatements, either as symptoms or as incentives to detect, are likely to be positively associated with reporting of internal control deficiencies.

6 78 G. V. Krishnan and G. Visvanathan CFO experience While we consider the expertise of audit committee members, we also need to take into account the expertise of officers involved in the accounting function within the company as they provide and supervise the inputs into the financial reporting systems and attendant controls. Prior research finds that managers work experience in accounting and finance areas is relevant to reporting of internal control deficiencies (J. Krishnan, 2005). Thus, we include variables to capture Chief Financial Officers experience and training in accounting and finance areas and expect such qualifications to be inversely related to reporting of internal control deficiencies. Other controls Ashbaugh et al. (2005) and Doyle et al. (2005) document several firm characteristics as determinants of reporting internal control deficiencies. In documenting the role of governance characteristics that distinguish firms that report internal control deficiencies from those that do not, we need to control for firm characteristics that have been shown to be important determinants as well. Thus, we consider the following factors as control variables in our empirical models. Profitability: Firms that are more profitable likely have more resources to establish and maintain internal controls than firms that are less profitable and thus are less likely to encounter such deficiencies. Complexity: Firms that operate in multiple product lines or in many countries are likely to be more complex in their operations and organizational structure. Such firms are likely to face more challenges in their internal controls considering the different cultures involved across countries and products. Thus, firms that have complex operations are more likely to report internal control deficiencies than firms whose operations are less complex. Growth: Firms undergoing significant growth are more likely to face internal control issues as they cope with sudden changes in their organization. Both organic growth and growth through acquisitions involve significant internal control design challenges. Furthermore, greater growth may result in greater inventories and accruals that pose additional internal control risks in terms of measuring and monitoring expanding current assets. Thus, we expect firms with higher growth to report more internal control deficiencies. Organizational changes: Similar to growth, firms that undergo significant organizational change, such as restructuring are likely to face more internal control issues and thus are more likely to report internal control deficiencies. METHODOLOGY Sample selection We collected our sample based on the publication Compliance Week. Compliance Week scans all regulatory filings with the SEC and reports on a monthly basis firms disclosing internal control issues in any of the filings. While we relied on this source, we also verified the selection process of Compliance Week by directly searching the EDGAR website of the SEC during random time periods in and found it to be accurate. Our sample encompasses the period from November 15, 2004 to March 1, Our starting date is determined by the regulatory requirement while our ending date is picked such that we get a reasonable sample for which we could collect manually all the governance data, in particular, expertise on the audit committee. Compliance Week reports that 164 firms mention internal control issues in their filings with SEC during the sample period. For 25 firms COMPUSTAT financial data is not available and for an additional 21 firms, governance data or proxy/ 10-K statements where governance data are usually provided are not available. Of the remaining 118 firms, 90 firms report material weaknesses in their internal controls. Selection of control firms We selected control firms by matching on industry (represented by the same two-digit SIC code) and size (measured by total assets). We verified that none of these companies reported internal control deficiencies as of July Our matching procedure was designed to address concerns that large organizations with greater resources are likely to differ significantly from smaller firms in establishing and maintaining good internal control systems. The matching was done as of the end of the fiscal year 2003 as that is the year prior to fiscal

7 Reporting Internal Control Deficiencies in the Post-Sarbanes-Oxley Era 79 year 2004 which is the latest fiscal year for the sample firms. As discussed in the hypothesis development, we expect our explanatory variables to be determinants of reporting internal control deficiencies and thus we measure them as of the beginning of the period rather than contemporaneously. Empirical specification of test variables All our variables were obtained from publicly available sources. We collected information on the nature of the internal control deficiency reported by the sample firms from their relevant filings with the SEC. 16 All governance variables, including audit committee characteristics, were collected from proxy statements for the fiscal year Data on management s training in accounting and finance were collected from proxy and 10-K statements. Financial statement data were collected from Compustat. Our governance variables were constructed as follows. We measured the size of the audit committee, AUSIZE, by the number of directors in the committee. Our measure of audit committee expertise is the proportion of directors in the committee who are deemed as accounting or non-accounting financial experts. For the purpose of financial expertise we consider experience as a public accountant, auditor, principal or Chief Financial Officer, controller, principal or Chief Accounting Officer. Non-accounting financial experts are directors with experience as the Chief Executive Officer, President, or Managing Director of a for-profit corporation. Following DeFond et al. (2005), directors qualifying under any of these categories are deemed financial experts. We follow this methodology rather than using the company designated audit committee financial experts based on section 407 of SOX, as companies typically designate only one person under this category. 17 Furthermore, this classification scheme provides uniformity in the variable across companies. The variable NMEETG represents the number of audit committee meetings during the year. To represent auditor attributes we examined auditor size and auditor changes. As commonly used in the audit literature, we represent size by a dummy variable that equals 1 if the auditor is one of the Big 4 international accounting firms and is equal to 0 otherwise. Following Ashbaugh et al. (2005), we also measured auditor size by a Big 6 variable that includes Grant Thornton and BDO Seidman as large auditors. Auditor changes are represented by AUCHG that equals 1 if the current auditor is different from the prior auditor and 0 otherwise. To represent management s training in accounting and finance we created two variables following J. Krishnan (2005). CFOEXP is a dummy variable that equals 1 if the Chief Financial Officer (or Chief Accounting Officer or Controller) has previous experience in a similar capacity with another company, and equals 0 otherwise. ACCTEXP is a dummy variable that equals 1 if the Chief Financial Officer (or Chief Accounting Officer or Controller) has CPA certification or previous experience in public accounting and equals 0 otherwise. We measure RESTATE as a dummy variable that equals 1 if the firm had restated its financial statements or had been the subject of SEC s AAER during the period Thus, restatements that are concurrent or consequent to the discovery of a material weakness in internal controls are not considered. Our measurement of other control variables draws upon Ashbaugh et al. (2005) and Doyle et al. (2005). To measure profitability, we use ROA measured as operating income scaled by average total assets and LOSS which is a dummy variable that equals 1 if earnings before extraordinary items is less than zero and equals 0 otherwise. Complexity of operations is measured by OPSEG, the log of the number of operating segments, GEOSEG, the log of the number of geographic segments, and by FCA a dummy variable that equals 1 if the firm reports a non-zero foreign currency adjustment. To represent growth we use SGROW measured as change in sales scaled by prior year sales and ACQUIS measured as the dollar value of firm s acquisitions scaled by market value of equity. To represent the effect of organizational restructuring, we use special items reported by Compustat scaled by total assets. RESULTS Descriptive statistics and univariate analysis Internal control deficiencies are classified into significant deficiencies and material weaknesses under SOX and the rules issued by the SEC and PCAOB Standard No. 2 pursuant to SOX. Prior to SOX, auditor judgment about internal controls was governed by SAS No. 55 (AICPA, 1988a), SAS No.

8 80 G. V. Krishnan and G. Visvanathan 78 (AICPA, 1995) and by SAS No. 60 (AICPA, 1988b). SAS No. 60 defines first level of internal control deficiencies termed reportable conditions as significant deficiencies in the design or operation of internal control, which could adversely affect the organization s ability to initiate, record, process, and report financial data consistent with the assertions of management in the financial statements. Severe reportable conditions are considered material weaknesses. PCAOB Standard No. 2 made changes to the definition of material weaknesses and under the standard, a material weakness exists if the likelihood of a material error is more than remote (Ramos, 2004). A significant majority of the firms in the sample report material weaknesses and only a minority reported significant deficiencies or reportable conditions, terms that are defined to mean the same by SEC (PCAOB Standard No. 2, E70). Because material weaknesses are substantial in their severity and because a substantial majority report material weaknesses (90 out of 118), we report results only for firms that report material weaknesses. Table 1 presents the industry distribution of our sample and control firms. We use two-digit SIC codes, with one exception where we are unable to find a similar sized firm at the two-digit level, for creating the control group and thus distribution is shown at the two-digit level. Most industries are represented in the sample with Business services (SIC 73) being the largest. Chemicals and pharmaceuticals (SIC 28), Machinery and equipment (SIC 35), Scientific instruments (SIC 38) are some of the other industries that are well represented in the sample. The Business services industry is also a major industry in the pre-sox sample examined by J. Krishnan (2005). The medians are at the 45th percentile (30th percentile) of all Compustat firms in 2003 for total assets (net income), which indicates that the sample firms are smaller and less profitable than the Compustat firms. This is noteworthy given that the sample does not address very small firms that are exempt by the SEC from filing internal reports during the sample time period. Table 2 presents the univariate analysis. Typical audit committee size is 3 for both firms that report material weaknesses in their internal controls (hereafter ICD firms) and for control firms and as such they do not differ in the dimension of committee size. The proportion of directors that meet the definition of financial experts for the ICD sample is smaller, with a mean of 66%, than the proportion for the control sample, with a mean of 72%. The differences in mean and median values of financial experts are significant at the 0.10 level or better. The variable that represents activity of the committee, NMEETG, is greater for the sample firms (significant at the 0.05 level), with a mean value of 8.4 meetings compared to 6.7 meetings for the control group. In contrast to audit committee expertise, management s financial expertise is not significantly different between the two groups as evidenced by the CFOEXP and ACCTEXP variables. In auditor attributes, there are no significant differences in auditor size as measured by the BIG 4 or BIG 6 variables. Auditor changes are higher for the ICD sample with a mean of 12% than the control sample that has a mean of 4.5%. Prior restatements are far greater for the ICD group with as many as 23.3% of the firms with restatements compared to the control sample with 7.8% of firms having restatements. The two groups do not significantly differ in their profitability, except in the median measure that indicates lower profitability for the ICD group. Among other control variables measuring complexity, the ICD group has more geographic segments and foreign operations as indicated by the significant differences in GEOSEG and FCA. SPECIAL items reported by the two groups are not significantly different. Among variables that proxy for growth, ACQUIS are greater for the ICD sample than the control sample but other variables such as SGROW are not significantly different. Table 3 reports correlations between variables used in the study. Among the governance variables, numerous correlations are found for number of meetings of audit committee, NMEETG, and auditor size, BIG 4. The high correlations between ROA and other variables are predictable based on the construction of these variables. Multivariate analysis Table 4 presents the results of the logistic regression that tests hypotheses H1 and H2. ICD, a dichotomous variable that equals 1 for firms reporting internal control weaknesses and 0 for the control firms, is the dependent variable. The explanatory variables in the model include audit committee variables that test hypotheses H1a c, auditor variables that test hypotheses H2a b, and control variables discussed previously. The

9 Reporting Internal Control Deficiencies in the Post-Sarbanes-Oxley Era 81 Table 1: Industry distribution for sample firms reporting material weakness in internal controls Two-digit SIC code Industry Firms reporting internal control deficiencies Control group firms No. of firms % No. of firms % 10 Metal mining Oil and gas Construction Food and kindred products Apparel and other products Lumber and wood products Paper and allied products Printing and publishing Chemicals and pharmaceuticals Rubber Machinery and computer equipment Electrical and electronic equipment Transportation equipment Scientific instruments Motor freight transportation Water transportation Communications Electric, gas, and sanitary services Apparel and accessory stores Home furniture and furnishings Eating and drinking places Miscellaneous retail Depository institutions Non-depository credit institutions Insurance carriers Holding & other investment offices Business services Motion pictures Health services Educational services Miscellaneous services Engineering and other services Total number of firms

10 82 G. V. Krishnan and G. Visvanathan Table 2: Univariate analysis of independent variables Variable ICD Sample Control Group t-stat Z-stat Mean Median Mean Median AUSIZE AUEXPT * -1.90** NMEETG *** 1.80** CFOEXP ACCTEXP BIG BIG AUCHG ** 1.86** RESTATE *** 2.84*** ROA * LOSS OPSEG GEOSEG ** 1.41* FCA ** 1.76** SPECIAL ACQUIS ** 0.91 SGROW All data are for the year AUSIZE = Number of directors in audit committee AUEXPT = Proportion of directors in the audit committee who are deemed as accounting or non-accounting financial experts. For the purpose of financial expertise we consider experience as a public accountant, auditor, principal or CFO, controller, principal or Chief Accounting Officer. Non-accounting financial experts are directors with experience as the CEO, President, or managing director of a for-profit corporation (DeFond et al., 2005). Directors qualifying under both these categories are deemed financial experts NMEETG = Number of meetings by audit committee CFOEXP = 1 if the Chief Financial Officer (or Chief Accounting Officer or Controller) has previous experience in a similar capacity with another company, 0 otherwise ACCTEXP = 1 if the Chief Financial Officer (or Chief Accounting Officer or Controller) has CPA certification or previous experience in public accounting, 0 otherwise BIG4 = 1 if the auditor is a Big 4 auditor; 0 otherwise BIG6 = 1 if the auditor is a member of Big 4 or Grant Thornton or BDO Seidman, 0 otherwise AUCHG = 1 if the current auditor is different from the auditor for the prior year and 0 otherwise RESTATE = 1 if the firm had restated its financial statements or had been the subject of SEC AAER from 2000 to 2003 ROA = Return on assets LOSS = 1 if earnings before extraordinary items is less than 0; 0 otherwise OPSEG = Log of the number of operating segments GEOSEG = Log of the number of geographic segments FCA = 1 if the firm reported a non-zero foreign currency adjustment; 0 otherwise SPECIAL = Special items scaled by total assets ACQUIS = Dollar value of firm s acquisitions scaled by market value of the firm SGROW = (Sales Prior year Sales) / Prior year Sales t-statistics are from t-tests of the differences in the means, and z-statistics are from median two-sample tests. ***, **, and * indicate statistical significance respectively, at 1%, 5%, and 10% levels for a two-tailed test for NMEETG, AUSIZE, and BIG 4(6); one-tailed test for others. objective of the model is to test whether our hypothesized variables are significant after controlling for other factors that are potentially associated with internal control weaknesses. The model is significant (chi-square p-value of 0.01) with a pseudo R 2 of AUSIZE is not significant and thus, there is no support for hypothesis 1a. The results show that both the audit committees meetings and the proportion of financial experts on the audit committee are significant at the 0.05 and 0.10 levels respectively, in distinguishing ICD firms from control firms.

11 Reporting Internal Control Deficiencies in the Post-Sarbanes-Oxley Era 83 Table 3: Pearson correlations for selected variables AUSIZE AUEXPT NMEETG CFOEXP ACCTEXP BIG 4 AUCHG RESTATE ROA AUSIZE * AUEXPT NMEETG ** ** 0.22** CFOEXP ACCTEXP BIG *** * AUCHG RESTATE ** ROA 1.00 LOSS OPSEG GEOSEG FCA SPECIAL ACQUIS SGROW AUSIZE AUEXPT ** NMEETG -0.18** 0.33*** 0.15** 0.18** * CFOEXP ** ACCTEXP * 0.10 BIG * 0.18** 0.28*** AUCHG * * RESTATE *** ** 0.09 ROA -0.70*** 0.16** *** *** LOSS *** ** -0.14* -0.24*** OPSEG * *** 0.07 GEOSEG *** ** 0.03 FCA SPECIAL ACQUIS SGROW 1.00 See Table 2 for definitions of variables. ***, **, * indicate statistical significance respectively, at 1%, 5%, and 10% levels for a two-tailed test.

12 84 G. V. Krishnan and G. Visvanathan Table 4: Results of logistic regression analysis Variable Expected Sign Hypothesis number Coefficient (chi square) Intercept? (0.32) AUSIZE? H1a (0.38) AUEXPT - H1b (2.05*) NMEETG? H1c (6.09**) BIG 4? H2a (1.30) AUCHG + H2b (2.30*) Control variables CFOEXP (0.39) ACCTEXP (0.95) RESTATE (4.47**) ROA (2.58**) LOSS (1.29) OPSEG (0.33) GEOSEG (0.22) FCA (1.73*) SPECIAL (2.40**) ACQUIS (1.24) SGROW (1.88*) Chi-Square p-value (0.01) Pseudo R Dependent variable is ICD. ICD equals 1 for firms reporting material weakness in their internal controls and 0 for control firms not reporting such weaknesses. See Table 2 for definitions of other variables. **, * indicate statistical significance respectively, at 5%, and 10% levels, one-tailed when signs are predicted, two-tailed otherwise. While the number of directors on the committee is similar for both groups of firms, the composition of the committee, as measured by the proportion of financial experts, is lower for the ICD firms. Note that all companies in the sample designate members in the audit committee as financial experts and invariably such a designation is restricted to one person. Such boilerplate disclosures are not helpful in ascertaining whether having experts on the audit committee is helpful in the monitoring role of audit committees in the reporting of internal control deficiencies. Thus, we measure the proportion of financial experts rather than the mere existence of one. The evidence in Table 4 suggests that the proportion of experts is significantly different for ICD firms and control firms, and this is consistent with J. Krishnan (2005) who studies ICD in the pre-sox period and uses a different definition of financial expertise as simply the number of experts on the audit committee. Note that the results for financial expertise are obtained after controlling for the management s expertise in finance and accounting. 18 Results with respect to number of meetings by the audit committee indicate that the ICD firms held more meetings than the control firms. Prior research on internal controls such as J. Krishnan (2005) has not considered the role of audit committee meetings. Prior studies in other contexts (such as Abbott et al., 2004) generally find greater number of meetings to be associated with lesser frequency of restatements or other earnings manipulation. However, other studies provide mixed evidence on the timing of the association between meeting frequency and fraud (Beasley, 1996; Farber, 2005). Our results indicating that audit committee meeting frequency is positively associated with reporting of internal control weaknesses adds to the literature on the consequences of audit committee meetings. The finding suggests that while meetings are a differentiating factor, the sign of the association indicates that one explanation of the finding is that firms with internal control weaknesses are in the process of increasing their audit committee diligence similar to results in Farber (2005) where frequency of meetings increases in the year of fraud to a level higher than those of the control firms. The results in Table 4 indicate that the auditor size variable, BIG 4, is not significant. The insignificance of the auditor size variable is potentially due to the fact that our sample and control firms are matched by size and to the extent that auditor size is correlated with firm size, the auditor size by itself is not likely to be significantly different between the two groups. Results for the AUCHG variable indicate that it is significantly higher for firms that report ICD. There could be two explanations for why auditor changes are more for firms that report deficiencies: first, such changes

13 Reporting Internal Control Deficiencies in the Post-Sarbanes-Oxley Era 85 could have occurred because auditors identify the client as too risky and then voluntarily initiate the change which suggests that the potential exists for reporting of ICD; second, even prior to SOX, disclosures were required if any internal control issues were communicated to the audit committee prior to the change in auditor. Thus auditor changes could be an indication that there could be potential internal control problems. In either case, focus on internal controls is likely to be higher and so is the reporting of any deficiencies. In summary, the findings for the primary variables are consistent with hypotheses 1b, 1c and 2b but not with hypotheses 1a and 2a. The model in Table 4 also considers RESTATE and other control variables as explanatory variables in the logistic model. Restatements for ICD firms in the years preceding the year of ICD reporting are significantly higher than those for the control firms. Note that we do not consider the year of reporting ICD as many firms in the sample report restatements concurrent with or consequent to the discovery of internal control deficiencies and thus disentangling the role of restatements in internal control problems is complicated. The result that a past restatement is a significant determinant of reporting control deficiencies suggests that restatements could be symptomatic of underlying internal control problems or because firms that have undergone restatements and such firms auditors look more closely at their control mechanisms resulting in detection of deficiencies. A past restatement could also result in changes in governance mechanisms that we examine and we consider this in the subsequent analysis. Among other control variables that are used by Ashbaugh et al. (2005) and Doyle et al. (2005), ROA and SPECIAL items are significant. The negative sign on ROA indicates that ICD firms have lower profitability while the sign on SPECIAL indicates that ICD firms have more special items reported including transitory elements such as restructuring charges. Results also indicate some support for ICD firms having higher growth, as indicated by the positive sign on SGROW. 19 Also significant is the positive association between firms reporting weaknesses and foreign currency operations but the segment variables are not significant, however. In contrast to Ashbaugh et al. (2005) and Doyle et al. (2005) we do not compare ICD firms to the entire Compustat population but to size and industry matched control firms and also our sample is post November 15, 2004, the 404 compliance period, while theirs is prior to this time period. The insignificance of segment variables suggests that size and industry effects may subsume the segment effect. When the model in Table 4 is specified by excluding the control variables, NMEETG, AUEXPT and AUCHG variables continue to be significant and their significance levels are higher. The model is significant (chi-square p-value of 0.01) and has a pseudo R 2 of The evidence in Table 4, as indicated by the significance of governance variables and as evidenced by the increase in pseudo R 2 over the reduced model with no control variables, underscores the importance of considering governance variables in investigating firms that report internal control deficiencies. More generally, considering only firm level characteristics without addressing governance aspects omits an important determinant of internal control reporting differences. Sensitivity analyses We conduct several tests to assure the robustness of our results. Auditor tenure: Auditor tenure has been found to be an important variable by previous studies that document significant association of tenure with quality of earnings and accounting restatements (Myers et al., 2003a,b). When we include auditor tenure in the model it is not significant. Firm size: Because we match firms by size (as measured by total assets) we do not include a size variable in the model. When included, the size variable is insignificant. Other governance variables: Beasley & Salterio (2001) and Klein (2002) argue that the composition of the board of directors is an important monitoring mechanism that is broader than the audit committee composition. Thus, characteristics such as board independence, proportion of ownership of CEO, and whether CEO is also chairman are also considered as control variables (Abbott et al., 2004). Finally, we also consider other aspects of audit committee quality such as governance expertise of audit committee members and presence of a block shareholder in the audit committee, following Carcello & Neal (2003). These governance variables when included in the model are not significant.