THE ACCOUNTING REVIEW
V ol.83,No.1
2008
pp.217–250
The Effect of SOX Internal Control Deficiencies and Their Remediation on
Accrual Quality
Hollis Ashbaugh-Skaife
University of Wisconsin–Madison
Daniel W.Collins
The University of Iowa
William R.Kinney,Jr.
The University of Texas at Austin
Ryan LaFond
Massachusetts Institute of Technology and Algert Coldiron Investors
ABSTRACT:This paper investigates the effect of internal control deficiencies and their
remediation on accrual quality.Wefirst document thatfirms reporting internal control
deficiencies have lower quality accruals as measured by accrual noise and absolute
abnormal accruals relative tofirms not reporting internal control problems.Second,we
find thatfirms that report internal control deficiencies have significantly larger positive
and larger negative abnormal accruals relative to controlfirms.Thisfinding suggests
internal control weaknesses are more likely to lead to unintentional errors that add noise
to accruals than intentional misstatements that bias earnings upward.Third,we doc-
ument thatfirms whose auditors confirm remediation of previously reported internal
control deficiencies exhibit an increase in accrual quality relative tofirms that do not
remediate their control problems.Finally,wefindfirms that receive different internal
control audit opinions in successive years exhibit changes in accrual quality consistent
with changes in internal control quality.Collectively,our cross-sectional and intertem-
poral change tests provide strong evidence that the quality of internal control affects
the quality of accruals.
Keywords:SOX;internal control;accrual quality;financial reporting reliability.
We thank seminar participants at Emory University,University of Houston Accounting Research Conference,Penn State Research Conference,University of Technology–Sydney,Washington University in St.Louis,and the Uni-versity of Wisconsin–Madison and two anonymous reviewers for helpful comments on previous versions of this paper.
Editor’s note:This paper was accepted by Dan Dhaliwal.
Submitted June2006
Accepted August2007
217
218Ashbaugh-Skaife,Collins,Kinney,and LaFond
The Accounting Review,January 2008
I.INTRODUCTION
T he reliability of financial reporting is claimed to be a function of the effectiveness of a firm’s internal control (PCAOB 2004;Donaldson 2005).1However,research to date provides mixed evidence on whether internal control weaknesses adversely af-fect accrual quality,an important component of reliable financial statements (Hogan and Wilkins 2005;Bedard 2006;Doyle et al.2007).This paper uses recently available data on the effectiveness of firms’internal controls mandated by the Sarbanes-Oxley Act (SOX)and the PCAOB’s Auditing Standards (AS)No.2to investigate how internal
control quality affects the reliability of financial information (U.S.Congress 2002;PCAOB 2004).We posit that if a firm has weak internal control,managers are less able to determine reliable accrual amounts,and a consequence of these unintentional misrepresentations is that finan-cial information is more noisy and less reliable.In addition,managers of firms with weak internal control can more readily override the controls and intentionally prepare biased accrual estimates that facilitate meeting their opportunistic financial reporting objectives.Thus,regardless of whether misstatements are unintentional or intentional,the quality of accruals is likely diminished when firms have weak internal controls.
absolute relative
We use SOX-mandated internal control deficiency (ICD)disclosures and external au-ditor opinions on internal control to conduct both cross-sectional and within-firm intertem-poral change tests of whether the effectiveness of firms’internal control affect the quality of reported accruals.Specifically,we test whether:(1)firms that have ICDs exhibit noisier accruals and larger abnormal accruals (both absolute and signed)relative to firms not dis-closing ICDs;(2)firms whose external auditors verify remediation of previously disclosed ICDs subsequently exhibit higher quality accruals relative to firms failing to remediate their control problems;and (3)firms that receive different SOX 404audit opinions in successive years exhibit improvements (declines)in accrual quality consistent with strengthened (weakened)internal controls indicated by the different opinions.
To conduct our tests,we identify a sample of firms that have at least one SOX 404audit opinion on internal control (i.e.,accelerated filers).We look back to determine whether a sample firm disclosed an ICD under SOX 302and look forward to see if the firm received a second SOX 404opinion.2Managements’prior internal control disclosures in combination with external audit reports allow us to conduct change analysis tests to provide strong evidence on whether weak internal control diminishes the quality of firms’reported accruals.
In cross-section tests,we find that ICD firms have larger absolute,larger positive,and larger negative abnormal total and abnormal working capital accruals relative to non-ICD 1
In Auditing Standards No.2,the Public Company Accounting Oversight Board (PCAOB 2004)states:‘‘The Board believes that effective controls provide the foundation for reliable financial reporting.Congress believed this too,which is why the new reporting by management and the auditor on the effectiveness of internal control over financial reporting received such prominent attention in the [SOX]Act.Internal control over finan-cial reporting enhances a company’s ability to produce fair and complete financial reports.Without reliable financial reports,making good judgments and decisions about a company becomes very difficult for anyone,including the board of directors,management,employees,investors,lenders,customers,and regulators.The auditor’s reportin
g on management’s assessment of the effectiveness of internal control over financial reporting provides users of that report with important assurance about the reliability of the company’s financial reporting ’’(para.E.5.,Appendix E,Background and Basis for Conclusions)(emphasis added).2Section 302of SOX,which became effective in August 2002,requires senior management to evaluate internal controls over financial reporting and certify the effectiveness of the controls (see Ashbaugh-Skaife et al.[2007]for a discussion of the SOX 302reporting requirements).Section 404of SOX requires that public company annual filings contain management’s assessment of the design and operating effectiveness of its internal control and that the external auditor provide an opinion on management’s assessment (Securities and Exchange Com-mission [SEC]2002).Auditing Standards No.2(AS No.2)requires that the auditor form and express a separate opinion on the auditor’s evaluation of internal control.We refer to the auditor’s own opinion as the ‘‘SOX 404opinion.’’
The Effect of SOX Internal Control Deficiencies and Their Remediation on Accrual Quality219firms.In addition,wefind that accruals of ICDfirms map less reliably to past,current,and future cashflows.All of these results are consistent with the accruals of ICDfirms being noisier and less reliable relative to accruals offirms with no reported internal control prob-lems.These results hold after controlling for conditional conservatism andfirm character-istics that prior research has shown to be related to accr
ual quality.As to intertemporal changes in the effectiveness of internal controls,wefind thatfirms that disclose an internal control problem and subsequently receive an unqualified SOX404audit opinion exhibit a decrease in absolute abnormal accruals relative to the year when internal control problems arefirst reported.Wefind no evidence that this decrease is due tofirms becoming more conservative in their accounting choices.In contrast,firms identified as having internal control problems that subsequently receive an adverse SOX404opinion exhibit no signif-icant change in the magnitude of abnormal accruals.
Our analysis of successive year SOX404opinions reveals thatfirms whose internal controls improve(going from adverse to unqualified SOX404opinions)exhibit a modest increase in accrual quality,whilefirms whose internal controls worsen(going from un-qualified to adverse SOX404opinions)exhibit a significant decrease in accrual quality. Firms with the same SOX404opinion in successive years(unqualified or adverse in both years)exhibit no change in accrual quality.
Collectively,our cross-sectional and intertemporal change tests are consistent with the notion expressed by Congress and regulators that strong internal controls provide a signif-icant long-term benefit in improving the accuracy offinancial reporting that leads to higher quality information forfirms’
external stakeholders(Donaldson2005;U.S.House of Rep-resentatives2005;U.S.Senate2002,2004).
Our study makes several contributions.First,we add to the literature that seeks to identify the determinants of accrual quality,much of which focuses on innatefirm operating characteristics as the primary determinants of accrual quality(Dechow and Dichev2002; Dechow et al.1995;Francis et al.2004;Kothari et al.2005)or intentional misuse of accounting discretion to manipulate earnings through accruals(Dechow et al.1996).Our study is one of thefirst to investigate how internal control,which is intended to attenuate both intentional and unintentional misstatements,affects the quality of accruals and thereby the reliability offinancial statements.We empirically link the strength offirms’internal control overfinancial reporting to the quality of accruals through the use of SOX302and SOX404reporting.Most importantly,because independent auditors’SOX404opinions provide unambiguous signals about changes in the effectiveness offirms’internal controls, our research design allows tests of the effects of changes in internal control quality on accrual quality in ways that minimize competing explanations for our results.
This study also contributes to the literature designed to assess thefinancial reporting consequences of SOX.While much of the prior literature addresses the costs of imple-menting and auditing SOX requirements(Li et al.2008;Zhang2007;Berger et al.2005), our study is among thefirst to provide evid
ence about potential benefits of strong internal control in terms of the quality of externally reportedfinancial information.
Our research is most closely related to concurrent studies by Hogan and Wilkins(2005), Bedard(2006),and Doyle et al.(2007)that examine the relation between internal control weaknesses and earnings(accrual)quality.Hogan and Wilkins(2005)find no difference in the Dechow and Dichev(2002)measure of accrual noise between ICDfirms and a set of controlfirms and only modest differences in absolute abnormal total accruals using the modified Jones model(Dechow et al.1995).Bedard(2006)finds no difference in the absolute value of unexpected total accruals between ICD and controlfirms in the two years prior to the ICDfirms’disclosures and in the two years that follow disclosure.However,
The Accounting Review,January2008
220Ashbaugh-Skaife,Collins,Kinney,and LaFond The Accounting Review,January 2008
Bedard (2006)finds that ICD firms exhibit larger absolute abnormal accruals relative to control firms in the disclosure year.Doyle et al.(2007)find that firms that disclosed ICDs under SOX 302(before required internal control audits)exhibit lower accrual quality rel-ative to control firms,but these differen
ces relate only to overall company level control problems and not to account specific weaknesses.Interestingly,Doyle et al.(2007)find no differences in accrual quality between ICD and non-ICD firms for internal control weak-nesses disclosed during the SOX 404regime.
Our study extends these prior studies in several important ways.First,all three of the prior studies are restricted to cross-sectional tests of differences in accrual quality between ICD and non-ICD firms.Accordingly,as in all cross-sectional designs,there are potential concerns of endogeneity,self-selection,and correlated omitted variables,which limit the ability to draw strong causal inferences from the results.3We address these concerns by focusing on firms that received one or more SOX 404opinions and identify which firms have continuously good,continuously bad,or changes in the quality of their internal control.
Incorporating SOX 404opinions is a central feature of our research design and is important because:(1)it provides an unambiguous signal from an independent third-party about the effectiveness of a firm’s internal control;(2)it allows identification of which firms were able to remediate internal control weaknesses and when the improvement took place;and (3)it allows identification of subsets of firms that experienced significant changes in internal controls from year to year.In contrast to the prior studies,we use the sequence of ICD disclosures and SOX 404opinions to conduct within-firm and acr
oss-firm testing of the effects of changes in the effectiveness of internal controls over time in ways that minimize competing explanations for observed differences in the quality of accounting accruals.By linking changes in the strength or effectiveness of internal controls with changes in measures of accrual quality,we mitigate concerns about self-selection,correlated omitted variables,and endogeneity that cloud the interpretation of results from studies that rely solely on cross-sectional tests,and we provide stronger tests of causal linkages between internal control weaknesses and the quality of external accounting numbers.
The remainder of our paper is organized as follows.Section II provides institutional background and provides examples of how internal control weaknesses are likely to intro-duce noise into accruals.Section III describes the accrual quality measures used in our analysis,summarizes the determinants of accrual quality,and sets forth our predictions on the effects of internal control weaknesses and remediation on accrual quality.Section IV describes our sample and provides descriptive statistics.Section V presents our empirical findings and Section VI concludes.
II.INSTITUTIONAL BACKGROUND AND EXAMPLES
OF CONTROL WEAKNESSES
Auditing Standards No.2(AS No.2,PCAOB 2004,para.7)defines internal control over financial reporting (ICFR)as:
a process designed by ...the company’s principal executive and principal financial officers ...and effected by the company’s board of directors,management,and other personnel,to provide reasonable assurance regarding the reliability of financial report-ing and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.
3Indeed,Doyle et al.(2007,30),recognize this limitation and state:‘‘[O]ur ability to infer causality between internal control problems and accrual quality is limited.’’
The Effect of SOX Internal Control Deficiencies and Their Remediation on Accrual Quality 221The Accounting Review,January 2008An ICD exists ‘‘when the design or operation of a control does not allow management or its employees,in the normal course of performing their assigned functions,to prevent or detect misstatements on a timely basis (AS No.2,para.8).Thus,ICFR is focused on timely prevention and detection of financial misstatements,whether unintentional or intentional.4
Internal Control—Integrated Framework (The Framework),the external standard or criteria for evaluating ICFR quality (corresponding to GAAP for financial statements),sug-gests five components
or elements of internal control:the control environment,risk assess-ments,control activities,information and communication,and monitoring (Committee of Sponsoring Organizations of the Treadway Commission [COSO]1992).5A high-quality control environment establishes the importance of internal control throughout the firm.Within such an environment,potential causes of financial misstatements are assessed as to risk and control activities are designed and put in place to mitigate important risks,and exceptions that arise are communicated to parties who can take corrective actions.Finally,the entire internal control process is monitored for exceptions by management and the internal audit function.
ICDs can affect the noise and the magnitude of abnormal accruals in financial state-ments in two principal ways.One way is through random,unintentional misstatements due to the lack of adequate policies,training,or diligence by company employees.Examples are:inventory counting and pricing errors that misreport inventory on hand and related cost of sales,omission of items such as failure to record credit purchases,variation in revenue recording due to lack of specific policies (or employee discretion)for revenue recognition,expensing amounts that should be capitalized and vice versa ,inadequate basis for account-ing estimates such as the allowance of inventory obsolescence,and unreliable procedures for ‘‘rolling up’’amounts from segments and subsidiaries.These random misstatements can lead to increases or decreases in accruals and resulting net income.
A second way that ICDs can adversely affect the quality of accruals is through inten-tional misrepresentations or omissions by employees or by management.These non-random misstatements typically overstate earnings for the current period,but ‘‘big bath’’write-offs or cookie jar reserves result in opportunistic understatement of current earnings as well.For example,management’s exercise of discretion in accounting choices allows financial misrepresentation through manipulation of accruals for recording important accounting es-timates such as warranty liabilities,reserves for sales returns,and allowance for uncollec-tible receivables.Furthermore,employee fraud is made possible by inadequate segregation of internal control duties.Weak internal control in the form of inadequate segregation of duties can allow the misappropriation of assets and alteration of recorded amounts by an employee that is not detected because the company has inadequate staff for monitoring,or lack of action by top management because of a lax control environment.In addition,mis-statements can be introduced into the financial reporting process through ‘‘selective over-sights or omissions’’in accumulating segment and subsidiary information for consolidated reports,as well as through management emphasizing earnings targets in instructions to employees.
4
There are inherent limitations in ICFR as noted in AS No.2,para.16.These limitations are due to lapses in human judgment,compliance,and diligence,plus collusion and improper management override of ICFR.While these inherent limitations cannot be eliminated,AS No.2asserts that it is possible to design into the ICFR process safeguards that will reduce the risk that they will arise.5The control environment and monitoring may be useful in protecting against manipulation of records as a response to management-prescribed targets based on financial performance.

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。