A material weakness in internal control represents a control deficiency that

In this paper, we examine the determinants of material weaknesses in internal control over financial reporting. A material weakness in internal control is defined as “a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected” (PCAOB, 2004).1 We use a sample of companies that disclosed material weaknesses in internal control over financial reporting under Sections 302 and 404 of the Sarbanes-Oxley Act of 2002 from August 2002 to 2005.2 Under Section 302, SEC registrants’ executives are required to certify that they have evaluated the effectiveness of their internal controls over financial reporting. If management identifies a material weakness in their controls, they are precluded from reporting that the controls are effective and must disclose the identified material weakness (SEC, 2002, SEC, 2004). Section 404 requires that each annual report include an assessment by management of the effectiveness of the internal control structure and procedures of the issuer for financial reporting that is attested to by the firm's public accountants.

Although firms were required to maintain an adequate system of internal control before the enactment of Sarbanes-Oxley, they were only required to publicly disclose deficiencies if there was a change in auditor (SEC, 1988). While prior research studies this limited set of disclosures (Krishnan, 2005), there is little evidence regarding internal control quality for firms in general under the new Sarbanes-Oxley regime.

We investigate whether material weaknesses in internal control are associated with (1) firm size, measured by market value of equity; (2) firm age, measured by the number of years the firm has CRSP data; (3) financial health, measured by an aggregate loss indicator variable and a proxy for the likelihood of bankruptcy based on the hazard model developed by Shumway (2001); (4) financial reporting complexity, measured by the number of special purpose entities reported, the number of segments reported, and the existence of a foreign currency translation; (5) rapid growth, measured by merger and acquisition expenditures and extreme sales growth; (6) restructuring charges; and (7) corporate governance, measured using the governance score developed by Brown and Caylor (2006).

Our sample is comprised of 970 unique firms that reported at least one material weakness from August 2002 to 2005, of which 779 have Compustat data. We identify these firms through a combination of a search of Compliance Week, a website which tracks internal control disclosures after Sarbanes-Oxley, and a search of 10-K filings in the EDGAR database.

For the full sample, we find that material weaknesses in internal control are more likely for firms that are smaller, younger, financially weaker, more complex, growing rapidly, and/or undergoing restructuring. These firm-specific characteristics seem to create challenges for companies in maintaining a strong system of internal controls. Our findings also appear to be economically significant in identifying firms with material weaknesses. For example, the joint marginal effect of our main model (i.e., the change in the predicted probability of a material weakness when altering the independent variables in the predicted direction between the 1st and 3rd quartiles or between zero and one for indicator variables) greatly increases the predicted probability of a material weakness—from 3.75 percent to 26.41 percent.

In this paper, we focus solely on material weaknesses for two reasons. First, it is the most severe type of internal control deficiency, and thus offers the greatest power for our determinants tests. Second, the disclosure of material weaknesses is effectively mandatory, while the disclosure of “significant deficiencies” is unambiguously voluntary.3 Focusing on these more mandatory disclosures helps avoid self-selection issues associated with voluntary disclosures. Although disclosures of material weaknesses are effectively mandatory, it is possible that individual firms or auditors apply different materiality standards in deciding what to disclose. While we do not have a model of the materiality threshold of material weaknesses (Mayper, 1982; Mayper et al., 1989; Messier et al., 2005), our determinants results are similar to those documented by Ashbaugh-Skaife et al. (2007) who examine all types of significant deficiencies (i.e., not just those internal control weaknesses that meet the threshold to be classified as “material weaknesses”) and find that firms disclosing significant deficiencies typically have more complex operations, recent changes in organization structure, more accounting risk exposure, and fewer resources to invest in internal control. Therefore, it appears that our results extend to a broader sample that does not rely on a potentially subjective judgment of what constitutes a “material weakness,” although it is still possible that the broader sample in Ashbaugh-Skaife et al. (2007) suffers from the same concern.4 Since Ashbaugh-Skaife et al. (2007) focus on all significant deficiencies, including unambiguously voluntary disclosures, they also include additional variables to model the choice to disclose in their analyses. Since our focus is on material weakness disclosures, we do not include these variables in our main analysis. In untabulated results, our results are robust to their inclusion, though sales growth weakens considerably in the more restricted sample (with or without the additional variables).5

In addition to our general findings about material weakness firms, discussed above, which complement and corroborate the findings of concurrent studies, we differ from Ashbaugh-Skaife et al. (2007) and others by examining the specific types of material weaknesses disclosed, and how the determinants of internal control problems differ based on these types. We find that the type of internal control problem is an important factor when examining determinants, and thus should be considered by future research on internal control. Specifically, while we focus on material weaknesses, the most severe internal control problems, these weaknesses vary widely with respect to severity and underlying reason. For example, consider the two following material weakness disclosures:

As part of the annual audit process, a material weakness was identified in our controls related to the application of generally accepted accounting principles, specifically related to the classification of the Company's short-term investments, resulting in the Company reclassifying approximately $34 million of cash and cash equivalents to short-term investments… (I-Flow Corporation, 12/31/04 10-K).

The material weaknesses identified by the independent registered accounting firm include the following weaknesses in certain divisions of the Company: (1) Failure to reconcile certain general ledger accounts on a timely and regular basis and lack of management review of certain reconciliations. (2) Inconsistent application of accounting policies, including capitalization policies and procedures for determining unrecorded liabilities. (3) Failure of financial management in certain operating segments to properly supervise personnel, enforce and follow policies and procedures, and perform their assigned duties. (4) Lack of adequately staffed accounting departments (Evergreen Holdings, Inc., 2/29/2004 10-K/A).

While I-Flow's disclosure relates to an account-specific balance sheet classification error, Evergreen's disclosure speaks of larger, more pervasive problems in the company. This distinction is deemed to be important by Moody's, the bond rating company. Moody's posits that while account-specific weaknesses are auditable, company-level weaknesses are more difficult to audit around and call into question not only management's ability to prepare accurate financial reports but also its ability to control the business (Doss and Jonas, 2004). We investigate whether the determinants of these two types of weaknesses differ.

We find that firms that report account-specific weaknesses tend to be larger, older, and financially healthier than firms that report company-level weaknesses. They also have more complex and diversified business operations and are growing more rapidly. The complexity of their operating environment, along with the rapid change evidenced by merger and acquisition activity and high sales growth, seems to hinder these firms in maintaining adequate account-specific internal controls. In contrast, firms with company-wide problems seem to lack the resources or experience to maintain comprehensive control systems.

We also examine whether the determinants differ based on whether the firm attributes its material weakness to staffing issues (e.g., segregation of duties), complexity issues (e.g., trouble in calculating the deferred tax provision) or more general issues (e.g., lack of supporting documentation). Not surprisingly, firms disclosing staffing problems are more likely to be smaller and younger than other firms disclosing material weaknesses. These firms also tend to be the weakest financially, with the highest incidence of losses and the highest bankruptcy risk. Resource constraints likely hinder the ability of such firms to adequately staff their operations with competent personnel.

Firms disclosing material weaknesses related to complexity are the largest and oldest companies of the three groups and have the most sophisticated and diversified operations. In addition, when compared to the average Compustat firm, these firms continue to have more diversified and complex operations, and also tend to be weaker financially and have higher restructuring charges. Thus, complex operations, combined with relatively poor financial health and a quickly changing environment, appear to yield difficult financial reporting issues for these firms.

When examining firms providing more general material weakness disclosures, we find that each of the constructs examined tends to be associated with these firm disclosures, consistent with this subgroup containing many differing weaknesses (e.g., inadequate reconciliation procedures, revenue recognition problems, or a complete lack of policies and procedures in place). As a final analysis, we examine only those firms with material weaknesses related to revenue recognition problems and find that these disclosures are negatively associated with our proxy for good corporate governance.

In Section 2, we discuss the new requirements on internal control disclosures, prior research, and our hypotheses. In Section 3, we discuss our sample selection procedure and the data items used as construct proxies. In Section 4, we describe the methodology used to test our hypotheses and discuss the results. We summarize and conclude in Section 5.

Cited by (744)

• Credit ratings and social capital

  2023, Journal of Corporate Finance

  Show abstractNavigate Down

  We posit that credit ratings are higher for firms headquartered in high social capital regions, where managers are more likely to be trustworthy. To test this hypothesis, 9460 corporate debt ratings of US firms from 2001– 2015 was examined. We find that firms headquartered in a county with high social capital in the US have a higher credit rating. This effect is incremental and economically comparable to that of corporate social responsibility. Additional tests suggest that the impact of social capital on ratings is likely because analysts find them more credible. We conclude that credit analysts may consider the social norm around the firm's headquarters when rating firms.

• Board faultlines and risk-taking

  2023, Finance Research Letters

  Show abstractNavigate Down

  We use the 2009–2020 data of Chinese A-share non-financial listed companies to explore the impact of board faultlines on corporate risk-taking. The results show that: (1) Board faultlines reduce corporate risk-taking capacity, and mainly manifested as a decline in idiosyncratic risk-taking. (2) The impact of faultlines is primarily driven by faultlines of cognitive characteristics; the impact of faultlines of demographic characteristics is insignificant. (3) Board faultlines influence corporate risk-taking by disrupting internal board order, lowering its monitoring willingness and ability, and reducing investment efficiency. (4) The heterogeneity test results identify four firm-level factors: industry competition, performance pressure, financial risk, and equity incentives, which can activate faultlines.

• Are voluntary internal control weakness disclosures in initial public offerings associated with managerial ability and subsequent financial reporting quality?

  2022, Advances in Accounting

  Show abstractNavigate Down

  This study examines whether voluntary disclosure of internal control weaknesses (ICWs) in IPO registration statements is associated with managerial ability and subsequent SOX 404 adverse audit opinions. Using a sample of IPO registrants that voluntarily disclosed ICWs in their registration statements, we examine the relationship between ICW disclosure, managerial ability, and subsequent material weaknesses in internal control. We find that IPO registrants with higher managerial ability are more likely to disclose ICWs voluntarily than other registrants. Further, we find evidence that registrants that include voluntary ICW disclosures are more likely to subsequently receive an adverse SOX 404 audit opinion. Additionally, we find evidence that registrants are associated with negative cumulative abnormal returns when an auditor issues an adverse SOX 404 auditor opinion regardless of whether the ICWs were disclosed in the registration statement.

• “Surprise” material weakness disclosures: Effects on audit fees and audit report lags

  2022, Journal of Accounting and Public Policy

  Show abstractNavigate Down

  Prior research shows that many of the companies that disclose material weaknesses in internal control (MWs) do not disclose such weaknesses in earlier quarterly 10-Q filings for the same year—i.e., the year-end MW disclosures are “surprise” disclosures. I first show, using data from 2009 to 2019, that such surprise MWs continue to be the majority of MW disclosures as late as 2019. I find that accelerated filer companies with surprise MWs pay lower fees compared to companies with no-surprise MWs; however, this finding does not hold for non-accelerated filers. I also find that there are no significant differences in the audit report lag of surprise and no-surprise MW disclosers. Thus, the lower audit fee paid by surprise MW disclosure companies may offer a possible explanation for the widespread prevalence of surprise MW disclosures. The results also highlight the importance of the external auditor in public disclosures of MWs. The findings have public policy relevance given the ongoing efforts to expand the set of companies that would be exempt from the auditor attestation of internal controls.

• Firm life cycle and financial statement comparability

  2022, Advances in Accounting

  Show abstractNavigate Down

  This paper examines how financial statement comparability varies between firms in the mature stage of their life cycle and firms in other life cycle stages. We hypothesize that mature firms are inclined to produce financial statements that are comparable among their industry peers. Using a sample of U.S. listed companies from 1987 to 2019, we find evidence to support our hypothesis. We also find that this association between life cycle and comparability is moderated by information asymmetry. A battery of robustness tests validates our initial findings. We extend the financial statement comparability literature by providing evidence on a determinant of comparability. Our study provides insights to policymakers regarding the necessity to consider firm life cycle when designing financial accounting standards.

• A systematic literature review on risk disclosure research: State-of-the-art and future research agenda

  2022, International Review of Financial Analysis

  Show abstractNavigate Down

  This study presents a systematic review of the existing literature on corporate risk disclosure (RD). The study reviews 104 studies published in 51 high-ranked journals over the period 1999–2019 following the systematic literature review methodology developed and employed by past works. The results highlight the substantial knowledge gaps and inconclusive findings of extant literature in several aspects, including identifying avenues for further research in terms of research designs, settings, scope and theories. The findings also indicate that limited studies focus on developing countries, private institutions, and non-profit organizations. Similarly, our findings show that existing research that examines other firm and cross-country drivers of risk, such as national accounting, auditing, economic, governance, language, and legal systems, are not well documented. By contrast, our review illustrates that there is an increase in the number of studies published in recent years with over one-half of those that we review in this research published in the last six years of our sample period. Furthermore, our results suggest that past review studies have also focused excessively on the immediate firm-level characteristics, such as firm size, growth, leverage, value, and cost of capital. The findings of our review will be of great interest to academics, accounting standard-setters, managers and practitioners, policymakers, regulators, researchers, and students.

Recommended articles (6)

• Research article

  Internal control in accounting research: A review

  Journal of Accounting Literature, Volume 42, 2019, pp. 80-103

  Show abstractNavigate Down

  In 2001, the US moved to regulate internal control reporting by management and auditors. While some jurisdictions have followed the lead of the US, many others have not. An important question, therefore, is the relevance of internal control to stakeholders. The more specific issue of the benefits of US-style regulation of internal control reporting is also topical. We review studies on the determinants of internal control quality and its economic consequences for stakeholders including investors, creditors, managers, auditors and financial analysts. We extend previous reviews by focusing on US studies published since 2013 as well as all non-US studies investigating IC quality including countries regulating IC disclosure as well as unregulated settings and both developed and developing economies. In doing so, we identify research questions where evidence remains mixed and new directions in which there are research opportunities.

  Three main insights arise from our analysis. First, evidence on the economic consequences of internal control quality suggests that the quality of internal control can have a significant effect on decision making by users of financial information. Second, the results of research on the empirical association between ownership structure, certain board characteristics and internal control quality is generally mixed. Empirical evidence concerning the association between audit committee characteristics and internal control quality generally supports a positive and significant association. Finally, while studies in non-US jurisdictions are increasing, opportunities remain to explore the determinants and consequences of internal control in other jurisdictions. Our review provides evidence for policy makers of whether there are benefits from requiring management and auditors to report on internal control over financial reporting.

• Research article

  Does corporate integrity improve the quality of internal control?

  China Journal of Accounting Research, Volume 11, Issue 4, 2018, pp. 407-427

  Show abstractNavigate Down

  Using unique survey data to measure corporate integrity, we examine the relation between corporate integrity and internal control quality. The results show that corporate integrity is significantly and negatively associated with internal control weaknesses. We find a substitution effect between informal and formal institutions for improving internal control quality. In other words, the negative association between corporate integrity and internal control weaknesses is more significant when the legal development or market competition is weaker. Furthermore, we find that more effective corporate governance can strengthen the relation between corporate integrity and internal control quality. These findings indicate that corporate integrity can improve the quality of internal control. Our findings also provide empirical evidence for the construction of stronger internal controls.

• Research article

  Internal control weakness, investment and firm valuation

  Finance Research Letters, Volume 25, 2018, pp. 165-171

  Show abstractNavigate Down

  We propose reduced investment as a potential explanation for why firms with internal control weakness (ICW) exhibit lower valuation relative to non-ICW firms. We show that ICW firms significantly reduce investment around ICW disclosure and also have poor stock performance. Additional evidence shows that many of the investment reductions have been announced during the year before ICW disclosure. A possible explanation for investment reductions is the higher costs of financial friction associated with ICW. Consistent with this explanation, we show that ICW firms with credit ratings do not reduce their investment as much and have much better stock performance than ICW firms without credit ratings.

• Research article

  Information Content of Internal Control Weaknesses: The Evidence from Japan

  The International Journal of Accounting, Volume 49, Issue 1, 2014, pp. 1-26

  Show abstractNavigate Down

  This paper investigates how capital markets in a code-law country, Japan, react to the disclosure of internal control weaknesses (ICW). The Japanese government attempted to implement a more concise, efficient, and, thus, less strict internal control reporting system than Section 404 of the US-SOX. In fact, for the first two years, the disclosure rate of ICW has been much lower in Japan than in the U.S. While market reactions to the disclosure of ICW are not significantly different from zero in our event study analysis, they become significantly negative after controlling for other information released around the disclosure date, audit quality, and other firm attributes. Our results are consistent with the notion that the disclosure of ICW is informative to the market because it is less frequent and exceptional in Japan.

• Research article

  Employee quality and financial reporting outcomes

  Journal of Accounting and Economics, Volume 64, Issue 1, 2017, pp. 123-149

  Show abstractNavigate Down

  We examine the association between employee quality and financial reporting outcomes. Using the average workforce education level in MSA(s) where the firm operates as a proxy for employee quality, we find that firms with a high-quality workforce exhibit higher accruals quality, fewer internal control violations, and fewer restatements. These firms also issue superior management forecasts, in terms of frequency, timeliness, accuracy, precision, and bias. Employees located at the firm's headquarters primarily drive our findings. Our evidence suggests employee quality, particularly at a firm's headquarters, is associated with both mandatory and voluntary disclosure quality.

• Research article

  Developing a decision support system to detect material weaknesses in internal control

  Decision Support Systems, Volume 151, 2021, Article 113631

  Show abstractNavigate Down

  Wells Fargo employees set up 3.5 million fraudulent accounts over several years. Wells Fargo ended up paying $4.5 billion in fines. The Wells Fargo scandal highlights the importance of management actions to prevent misstatements and potential frauds on a timely basis. This study utilized the design science research paradigm to develop a predictive framework (IT artifact) in order to stratify firms into multiple risk groups for disclosing material weakness(es) in internal control (MWIC). The proposed methodology employed a hybrid heuristic optimization-based machine learning methodology. Synthetic minority over-sampling technique (SMOTE) was utilized to handle the learning problem with the imbalanced data. The best performing model was the proposed hybrid Genetic Algorithms (GA) and Support Vector Machines (SVM). The proposed methodology was internally validated via k-fold cross validation, and then externally validated using several separate datasets. The (GA) selected variables were ranked from the most important to the least through Information fusion (IF) sensitivity. A web-based decision support system was built to predict the firm-specific MWIC risk category. The web-based tool can be used to create an early warning system for predicting MWIC(s).