A Review of Archival Auditing Research

ARTICLE IN PRESS
Journal of Accounting and Economics 44 (2007) 166–192

www.elsevier.com/locate/jae
The discovery and reporting of internal control

deficiencies prior to SOX-mandated audits$
Hollis Ashbaugh-Skaifea, Daniel W. Collinsb,,
William R. Kinney Jr.c
a
School of Business, University of Wisconsin-Madison, Madison, WI 53707, USA
b
Tippie College of Business, University of Iowa, Iowa City, IA 52242, USA
c
McCombs School of Business, University of Texas at Austin, Austin, TX 78712, USA
Received 1 March 2005; received in revised form 20 October 2006; accepted 26 October 2006
Available online 15 December 2006
Abstract
We use internal control deficiency (ICD) disclosures prior to mandated internal control audits to
investigate economic factors that expose firms to control failures and managements’ incentives to
discover and report control problems. We find that, relative to non-disclosers, firms disclosing ICDs
have more complex operations, recent organizational changes, greater accounting risk, more auditor
resignations and have fewer resources available for internal control. Regarding incentives to discover
and report internal control problems, ICD firms have more prior SEC enforcement actions and
financial restatements, are more likely to use a dominant audit firm, and have more concentrated
institutional ownership.
r 2006 Elsevier B.V. All rights reserved.
JEL classification: G34; G38; K22; M41; M49
Keywords: Internal control; Auditing; Regulation; SOX
$
We thank Andy Bailey, Dave Burgstahler, Ryan LaFond, Thomas Lys, Linda McDaniel, Pamela Murphy,
Joel Horowitz, Robert Lipe, Gene Savin, Lynn Turner, Jerry Zimmerman, Editor, Andy Leone, the referee, and
seminar participants at the University of Kentucky, Michigan State University, University of North Carolina at
Chapel Hill, Ohio State University and the University of Wisconsin-Madison for helpful comments and
suggestions. We also thank Guojin Gong, Neil Schreiber, Kwadwo Asare and John McInnis for their capable
research assistance.
Corresponding author. Tel.: +1 319 335 0912; fax: +1 319 335 1956.
E-mail addresses: hashbaugh@bus.wisc.edu (H. Ashbaugh-Skaife), daniel-collins@uiowa.edu (D.W. Collins),
william.kinney@mccombs.utexas.edu (W.R. Kinney Jr.).
0165-4101/$ - see front matter r 2006 Elsevier B.V. All rights reserved.
doi:10.1016/j.jacceco.2006.10.001
ARTICLE IN PRESS
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192 167
1. Introduction
This study investigates the economic factors that expose a firm to internal control risk
and management’s incentives to discover and report an internal control deficiency (ICD).
Section 404 of the Sarbanes–Oxley Act (US Congress, 2002), denoted SOX requires that
public company financial statements filed on Form 10-K and Form 10-Q contain an
assessment by management of the design and operating effectiveness of its internal control
over financial reporting. Section 404 also requires that the external auditor, on an annual
basis, provide an opinion on management’s assessment of internal control (Securities and
Exchange Commission (SEC), 2003).
Before the implementation of SOX Section 404, Section 302 of SOX required that
management evaluate the effectiveness of disclosure controls and procedures, report results
of their evaluation, and indicate any significant changes in internal control since the last
Form 10-K or Form 10-Q filing (SEC, 2002). The SEC defines disclosure controls and
procedures as ‘‘controls and other procedures of an issuer that are designed to ensure that
information required to be disclosed by the issuer in the reports filed or submitted by it
under the Exchange Act is recorded, processed, summarized and reported, within the time
periods specified in the Commission’s rules and forms’’ (SEC, 2002). However, neither the
SEC nor SOX Section 302 specify particular procedures to be applied by management in
evaluating internal controls nor do they require independent audits of internal controls.
Furthermore, while Section 302 requires management to report any discovered material
weaknesses to their external auditor and the audit committee (SEC, 2003), whether such
ICDs had to be disclosed to shareholders in public SEC filings is less clear. As an example
of this ambiguity, the SEC staff addressed the ‘‘frequently asked’’ question: ‘‘Is a registrant
required to disclose changes or improvements to controls made as a result of preparing for
the registrant’s first management report on internal control over financial reporting?’’
(SEC, 2004, Question 9). The staff’s answer was that they ‘‘would welcome disclosure of all
material changes to controls’’ whether before or after the Section 404 compliance date, but
they ‘‘would not object’’ if a registrant did not disclose changes made in preparation for
the registrant’s first management report under Section 404. The staff added to its response
‘‘However, if the registrant were to identify a material weakness, it should carefully
consider whether that fact should be disclosed as well as changes made in response to the
material weakness’’. Thus, under the provisions of Section 302, the review of internal
control is subject to less scrutiny by both management and the auditor and the disclosure
rules are less specific than subsequently exist under Section 404.1 This suggests that
managers had more discretion in disclosing ICDs during the pre-Section 404 regime.
We use ICD disclosures provided by firms after Section 302 became effective, but before
the effective date for independent internal control audits mandated by Section 404 to study
1
Further evidence that management exercised some discretion in disclosing ICDs during the pre-Section 404
regime is provided by a Glass Lewis & Company report (Glass Lewis, 2005) that 87% of firms disclosing ICDs in
the first 3 months of 2005 certified their controls as effective under SOX 302 in the previous quarter. Some of these
occurrences were due to new GAAP guidance on application of lease accounting rules provided by the SEC in
February 2005 that managers were unaware of when they certified that controls over financial reporting were
effective in the prior quarter (SEC, 2005). However, a large percentage of the ICD disclosures made early in the
SOX 404 regime related to more systemic control problems of long standing (e.g., inadequate recording of
inventory or improper year-end roll-up procedures) suggesting that managers had either not yet detected ICDs or
did not feel compelled to disclose these weaknesses during the SOX 302 regime.
ARTICLE IN PRESS
168 H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192
the firm characteristics that contribute to internal control risks and the incentives faced by
managers to discover and disclose internal control problems. During this era, both
accelerated and non-accelerated filers reported material weaknesses as well as lesser
deficiencies that are not required to be disclosed under SOX 404 reporting.2 Thus, we
document the determinants of ICDs for a broad cross-section of SEC registrants.
Estimating determinants of ICDs across a broad cross-section of firms is important for
developing investor expectations about internal control problems given non-accelerated
filers are not yet required to comply with SOX 404.3
Three conditions must exist for a registrant to disclose an ICD under Section 302. First,
an ICD must exist; second, the deficiency must be discovered by management or the
independent auditor; and third, management, perhaps after consultation with its
independent auditor, must conclude that the deficiency should be publicly disclosed.4
Our sample of ICD disclosers begins with 585 firms identified by Compliance Week
from November 2003 to December 31, 2004 that disclosed ICDs in any SEC filing. To
control for industry and time-specific factors, we collect parallel data on more than 4000
firms in the same industries over the same time period that did not report ICDs prior to
December 31, 2004.
We model pre-SOX 404 ICD disclosures as a function of internal control risk factors
and incentives of managers and auditors to discover and disclose ICDs. Our internal
control risk factors include the complexity and scope of firms’ operations, changes in firms’
organizational structure, accounting measurement application risk (e.g., exposure to
accounting errors caused by difficulty or judgment in applying accounting procedures),
lack of firm resources to devote to internal control and whether the auditor resigned in
2003. We use auditor dominance, sensitivity to regulatory intervention in financial
reporting due to prior restatement or SEC enforcement actions, monitoring by
institutional investors, and industry litigation risk to proxy for incentives to discover
and disclose ICDs.
As expected, ICD disclosers have more complex operations as proxied by the number of
business segments and foreign sales, and more often engage in acquisitions and
restructurings relative to non-ICD disclosure firms. The results also indicate that ICD
disclosers face greater accounting procedure application risk as firms with greater sales
growth and levels of inventory are more likely to report an ICD. We find that smaller
firms, firms reporting a higher frequency of losses and firms in financial distress are more
likely to disclose ICD weaknesses. A highly significant risk factor that explains the
incidence of an ICD is the auditor resigning in the year prior to the ICD disclosure.
2
Non-accelerated filers are firms with total market capitalization less than $75 million. Non-accelerated filers
are not required to comply with the SOX Section 404 reporting provisions until fiscal years ending on or after July
15, 2007.
3
Prior to SOX, public firms could voluntarily assess and report on the effectiveness of internal controls, but few
firms did so. For example, McMullen et al. (1996) report that of 2221 firms listed on NAARS with December 31,
1993 fiscal year ends, only 55 contained a management statement that internal controls were ‘‘effective as of fiscal
year end’’. Furthermore, McMullen et al. (1996) do not indicate whether any of the management reports were
audited or reviewed by their external auditors even though auditing standards allowed such association (AICPA,
1988).
4
See Kinney and McDaniel (1989) for parallel arguments about disclosure of misstatements of quarterly
earnings.
ARTICLE IN PRESS
Regarding variables that proxy for the incentives to discover and report internal control
problems, our results indicate that firms that contract with the largest US audit suppliers,
have had negative publicity about financial reporting as evidenced by prior restatements or
sanctions from SEC Accounting and Auditing Enforcement Releases (AAERs), and that
have concentrated institutional ownership are more likely to disclose an internal control
problem. These results are robust to using alternative measures of internal control risk and
incentives to report.
Many have claimed that the passage of SOX imposed an extreme burden on SEC
registrants by requiring them to document, evaluate, publicly report, and have audited the
effectiveness of their internal controls. Contemporaneous and concurrent research
examines different aspects of SOX in an attempt to evaluate the Act’s costs and benefits
(e.g., see Ashbaugh-Skaife et al., 2006a; Beneish et al., 2006; De Franco et al., 2005; Doyle
et al., 2006b; Hammersley et al., 2005; Hogan and Wilkins, 2006; Ogneva et al., 2005;
Zhang, 2005). Our study contributes to this literature by investigating the causes of ICDs
and managements’ incentives to report these deficiencies during a regulatory transition
period in which there was mandated certification of disclosure controls and procedures,
but no review procedures specified for management, no internal control audit requirement,
limited guidance on classifications of severity of control deficiencies, and considerable
disclosure discretion on the part of management.
Our research is most closely related to a concurrent study by Doyle et al. (2006a) who
examine the determinants of internal control deficiencies based on a sample of firms that
disclosed ‘‘material weakness’’ control deficiencies during both the SOX 302 and 404
reporting regimes. As in our study, Doyle et al. (2006a) find ICDs are more likely for firms
that are smaller, financially weaker, more complex, growing rapidly and undergoing
restructuring.
Our study differs from the Doyle et al. (2006a) study along several dimensions. First,
Doyle et al. (2006a) restrict their analysis only to firms that report ‘‘material weakness’’
ICDs, while we consider all three levels of internal control deficiencies as set forth by the
Public Company Accounting Oversight Board (PCAOB) in Auditing Standards (AS)
No. 2—material weaknesses, significant deficiencies and control deficiencies (PCAOB,
2004).5 We include all levels of control deficiencies because regulatory guidance
defining levels of severity of control deficiencies was not released until March of 2004,
which is well after many firms provided their first disclosure of control problems. As a
result, the inter-firm consistency of these self-reported classifications of control weaknesses
is problematic.6
A second distinction between our study and Doyle et al. (2006a) is that our analysis is
limited to ICDs disclosed during the SOX 302 regulatory regime. Because SOX 302
internal control disclosures are subject to less regulation and allows more management
discretion than control disclosures made during the SOX 404 audit regime, our
determinant model includes a number of variables designed to capture firms’ incentives
to discover and report control deficiencies variables that capture, incentives to detect and
5
See discussion in Section 2 for distinction between these three levels of control deficiencies.
6
For example, a deficiency that one firm considers to be a material weakness, another firm might classify as a
significant deficiency, or vice versa. By considering all types of ICDs in our model, we avoid errors due to
inconsistencies of self-classifications that are introduced when restricting the analysis to ICDs of one classification
type.
ARTICLE IN PRESS
report are omitted from the Doyle et al. (2006a) study because they focus on
material weakness disclosures that they deem to be required disclosures in both the 302
and 404 reporting regimes. Moreover, by restricting their analysis to material weakness
disclosures, Doyle et al. (2006a) ignore lesser control problems that arguably have a
significant impact on the reliability of firms’ financial statements (Ashbaugh-Skaife et al.,
2006b).
Finally, because we study disclosures made during a reporting regime that predated
SOX 404 internal control audits, our study identifies factors that contribute to internal
control problems for a broad cross-section of publicly traded firms that includes both
accelerated and non-accelerated filers. Thus, our ICD model facilitates the formation of
expectations about the determinants of ICDs that is more representative of the underlying
population of firms that face control problems because our sample cuts across firms of all
sizes in contrast to the sample in the Doyle et al. (2006a) study that contains a higher
proportion of accelerated filer (larger) firms. Later in our paper, we demonstrate how this
difference in sample composition influences the results.
The remainder of the paper proceeds as follows. Section 2 elaborates on the regulations
of SOX pertinent to reporting ICDs and introduces our conceptual framework for ICD
disclosures. Section 3 describes our sample and descriptive statistics. Section 4 presents the
multivariate analysis of the determinants of ICDs, as well as marginal effects, and
sensitivity analyses of alternative measures of explanatory variables. Section 5 presents our
summary and conclusions and identifies several avenues for future research.
2. Regulatory and conceptual background
The lack of guidance on distinguishing between levels of severity of internal control

problems prior to AS No. 2 makes firms’ classification and users’ interpretation of ICD
reporting under Section 302 somewhat difficult. AS No. 2 identifies three levels of internal
control deficiencies based on the likelihood that a material misstatement of annual or
interim financial statements might result (PCAOB, 2004). Specifically, AS No. 2 states:
A control deficiency exists when the design or operation of a control does not
allow management or employees, in the normal course of performing their
assigned functions, to prevent or detect misstatements on a timely basis (AS
No. 2, paragraph 8).
A significant deficiency is a control deficiency, or combination of control deficiencies,
that adversely affects the company’s ability to initiate, authorize, record, process, or
report external financial data reliably in accordance with generally accepted
accounting principles such that there is more than a remote likelihood that a
misstatement of the company’s annual or interim financial statement that is more
than inconsequential will not be prevented or detected (AS No. 2, paragraph 9).
A material weakness is a significant deficiency, or combination of significant
deficiencies, that results in more than a remote likelihood that a material
misstatement of the annual or interim financial statements will not be prevented or
detected (AS No. 2, paragraph 10).
The three categories differ in the probability that a misstatement of a particular amount
might not be prevented or detected by the company’s disclosure controls and procedures.
Some firms used terminology about classification of the severity of the deficiency from
ARTICLE IN PRESS
ICD risk exposures

Complexity and scope of operations
Organizational change ICD existence
Accounting application risk
Internal control resources
+
ICD discover and disclose incentives

Auditor technology and scrutiny ICD detection
Regulator intervention threats
Investor intervention threats =
Litigation risk
Pre-SOX 404 audit
ICD Disclosure
Fig. 1. Conceptual model of pre-SOX mandated audit disclosure of internal control deficiencies (ICDs).
prior standards for internal control reporting,7 some used AS No. 2 terminology, and some
used neither. Despite the ambiguities, Compliance Week and other researchers have
attempted to retrofit ICD disclosures into the AS No. 2 framework for investigating
Section 302 disclosures (e.g., Hammersley et al., 2005; Doyle et al., 2006a).
Management’s incentive to provide an ICD disclosure prior to a SOX 404 audit involves
trading off the expected benefits from the discovery and disclosure of an ICD and the costs
of disclosing an ICD. One of the potential costs of providing an early ICD disclosure is
that it may expose management to criticism for lax organization and mismanagement. An
ICD disclosure might also cast doubt on the reliability of management’s prior financial
reports including increased concern that financial restatements might result. An additional
cost of an early ICD disclosure is the potential increase in the risk of private litigation by
investors for not discovering and reporting the deficiencies earlier. On the positive side,
however, early disclosure of an ICD may allow management to ‘‘get in front of the issues’’
(Karr, 2005), or perhaps signal that the firm does not have more serious problems such as a
material weakness or heightened likelihood of future restatements (Martinek, 2005).
Furthermore, because the SEC assesses no penalties for having a material weakness or
significant deficiency in internal control, there is no risk of regulatory sanctions for internal
control weaknesses per se. Rather, there is risk of sanctions for not disclosing known
material weaknesses in internal control or changes in internal control status.
A conceptual model of the existence, detection and reporting of internal control
deficiencies before SOX 404 audits is presented in Fig. 1. We model the existence of
internal control deficiencies as a function of a number of internal control risk factors and
the detection and reporting as a function of audit quality and the incentives that
management and its auditor have for early reporting of internal control problems.
Although we classify the determinants of ICD disclosure into the two broad categories of
7
Many Section 302 certifications from 2003 and early 2004 refer to ‘‘reportable conditions,’’ a term from
AICPA auditing and attest standards guidance that predates SOX (AICPA, 1988, 2001). AS No. 2 also specifies
new uncertainty terminology such as ‘‘a remote likelihood’’ to characterize the likelihood of material misstatement
required to make an ICD a material weakness whereas prior guidance used ‘‘a relatively low level [of] risk’’
(AICPA, 1988). The possible differences in management and auditor implementation due solely to the 2004
changes in guidance led us to combine all ICD disclosures.
ARTICLE IN PRESS
IC risk exposures and ICD discovery and disclosure incentives, we recognize that several of
the variables we use could proxy for both risk effects and incentive effects. We highlight
this potential dual role for several explanatory variables below.
The IC risk factors include the complexity and scope of firms’ operations, changes in
organizational structure, accounting measurement application risk, and firm resources
(or lack thereof) invested in internal controls. We posit that firms with greater complexity
and scope of operations are more likely to encounter internal control problems. The
complexity of firm operations, and consequently, the intricacy of its transactions increase
as the firm operates in diverse industries or in international markets. The more
complicated the firm’s transactions, the more difficult to structure adequate internal
controls. In addition, multi-segment firms potentially face more internal control problems
related to the preparation of consolidated reports (e.g., the proper elimination of intra-
company transactions). Moreover, the more diverse and multifaceted a firm’s operations
the greater the chance there will be breaches in the year-end closing and roll up procedures.
We use SEGMENTS, defined as the number of reported business segments in 2003, and
FOREIGN_SALES, coded one if a firm reports foreign sales in 2003 and zero otherwise,
to proxy for the complexity and scope of operations. Both SEGMENTS and
FOREIGN_SALES are identified using the Compustat Segment file.
We conjecture that firms are more likely to have ICDs when they have recently changed
organization structure either through mergers or acquisitions or through restructurings.
Acquiring firms face significant internal control challenges when integrating their
operations, systems, and cultures with those of acquired firms. Furthermore, failure to
develop adequate controls over accounting for acquired assets can increase internal control
risk for acquiring firms. Firms participating in down-sizing and restructurings are likely to
face greater internal control risk due to personnel problems related to the segregation of
duties, inadequate staffing and supervision problems. We use M&A and RESTRUC-
TURE to proxy for recent changes in organizational structure. M&A is coded one if the
firm has been involved in a merger or acquisition from 2001 to 2003 (Compustat
AFTNT1), and zero otherwise. RESTRUCTURE is coded one if a firm has been involved
in a restructuring from 2001 to 2003 and zero otherwise, where non-zero values of
Compustat data items 376, 377, 378 or 379 are used to identify sample firms engaged in
restructurings. We expect a positive relation between firms’ ICD disclosures and M&A and
RESTRUCTURE.
We use GROWTH, defined as the average percentage change in sales (Compustat #12),
and INVENTORY, defined as inventory (Compustat #3) as a percentage of total assets
(Compustat #6), to capture firms’ operating characteristics that are likely to expose them
to greater accounting measurement application risks (Kinney and McDaniel, 1989).
Rapidly growing firms are more likely to have systems that fail to keep pace with increases
in customer demand or entry into new markets. Furthermore, growing firms are more
likely to encounter staffing issues as the scope and complexity of their operations expand.
Firms with more inventory face increased internal control risks related to the proper
measurement and recording of inventory, misreporting due to theft, and timely recognition
of inventory obsolescence.
Information and control systems have a large fixed cost component and are costly to
install and maintain. Conditional on their resources, firms will make differential
investments in information and control systems. We reason that smaller firms have less
to invest in sophisticated information systems (e.g., enterprise resource planning systems
ARTICLE IN PRESS
such as SAP) that can enhance internal control, and they are less likely to have adequate
personnel and expertise to maintain these systems. We use SIZE, as measured by the
market value of equity (Compustat #199*Compustat #25), to proxy for firms’ investment
in information systems and internal control, where smaller firms are expected to have
weaker internal controls (DeFond and Jiambalvo, 1991). Following the work of Wright
and Wright (1996) who find a negative association between firm size and accounting errors,
we predict a negative relation between SIZE and ICD disclosures.
We use two additional variables to capture the impact of low investment in information
and control systems on the likelihood of ICDs. We posit that poorly performing firms and
firms in financial distress are more likely to under invest in systems and controls and have
staffing problems that lead to IC weaknesses. We use %LOSS, defined as the proportion of
years from 2001 to 2003 that the firm reported negative earnings (Compustat #118), to
proxy for poor performance. Firms with a greater frequency of losses are expected to
exhibit a higher likelihood of an ICD due to lack of investment in internal controls
(Krishnan, 2005). We use the Altman z-score, ZSCORE, to capture distress risk with
higher z-scores indicating less distress risk (Altman, 1968).8 We predict a positive
coefficient on %LOSS and a negative coefficient on ZSCORE.
The resignation of the auditor in the year prior to an ICD disclosure is viewed as another
ICD risk factor. An auditor will resign from an audit engagement when the expected costs
of being associated with an audit client exceed anticipated revenues. This might occur
when the auditor believes that a client’s internal controls are excessively weak and that
adequate client resources are not available to remedy the problem.9 We use Audit
Analytics to identify firms in both the ICD sample and the control sample that switched
auditors during the 12-month period beginning in the fourth month after the close of fiscal
year 2002 through the third month after the close of fiscal year 2003.10 We collect the 8-K
filings for sample firms that changed auditors and code AUDITOR_RESIGN as one for
firms that state their auditor resigned during this 12-month period, and zero otherwise. We
predict a positive relation between ICD and AUDITOR_RESIGN as an auditor
resignation may indicate unacceptable audit engagement risk due to weak operating
performance and financial distress that reflects inadequate investment in internal control.11
8
Prior and concurrent research often times uses accounting-based performance metrics such as return-on-equity
(ROE) or return-on-assets (ROA) as a proxy for the resources available to invest in internal control systems.
While useful in assessing firm performance, we elect not to use ROE or ROA as a determinant in our ICD
disclosure model because using these measures implicitly assumes a monotonically increasing investment in
internal control as performance improves. As stated above, much of the investment in internal control is fixed, and
as such, we argue %LOSS and ZSCORE are better indicators of lack of investment in IC.
9
An auditor’s decision to resign from an engagement is complex and may result from various causes (Shu,
2000). For example, auditor resignation may reflect the auditor’s belief that client management lacks integrity and
may commit fraud by overriding internal controls. Alternatively, the auditor may believe that it can earn higher
returns with other clients and therefore resigns from the audit. Auditor resignation due to the latter reason
introduces noise in this explanatory variable.
10
We allow for a 3-month window after fiscal year-end because most auditor changes occur after the fiscal year-
end closing date but before the annual shareholder meeting (typically held in the fourth month after fiscal year-
end) at which time a proxy vote for appointment of the external auditor takes place.
11
Firms changing auditors have long been required to disclose any internal control problems identified by
predecessor auditors (AICPA, 1988; SEC, 1988; Whisenant et al., 2003). In the sensitivity section of the paper, we
report the results of our ICD determinant model after deleting the 12 ICD firms that disclosed an internal control
deficiency in conjunction with reporting a change in their external auditor.
ARTICLE IN PRESS
Fig. 1 also models the factors that contribute to the detection and reporting of an ICD.
We use auditor dominance, regulatory oversight in financial reporting due to prior
restatement or SEC enforcement actions, monitoring by institutional investors, and
industry litigation risk to proxy for incentives to discover and disclose ICDs.
The quality of the external auditor is one factor that contributes to the detection of an
ICD even in the era prior to mandated audits of internal control under Section 404. This is
because detection of an ICD by the auditor is a function of its strategy and scrutiny in
conducting financial statement audits and the quality of any optional audit technology that
might be used in evaluating internal control as part of the financial statement audit.
We expect dominant audit suppliers to be more likely to uncover, as well as to require
management disclosure of any known ICD for several reasons. First, dominant audit
suppliers are likely to provide higher quality financial statement audits that include more
systematic examination and review of internal controls relative to other audit suppliers
because dominant audit suppliers face greater loss of reputation by conducting poor
quality audits (DeAngelo, 1981; Shu, 2000). Second, dominant audit suppliers invest more
in technology and training that facilitates the discovery of internal control problems.
Third, based on Dye’s (1993) work that links audit quality to auditor wealth, dominant
audit suppliers hold greater litigation risk and thus face greater incentives to require ICD
disclosure in order to avoid costly lawsuits.
We classify BDO Seidman, Deloitte and Touche, Ernst and Young, Grant Thornton,
KPMG, and PricewaterhouseCoopers as the dominant audit suppliers. We include BDO
Seidman and Grant Thornton in the dominant auditor classification because these two
firms acquired a significant number of SEC reporting clients following the demise of
Arthur Andersen, which results in these firms facing additional litigation risk related to
ICD reporting.12 AUDITOR is coded one for firms that contract with a dominant audit
supplier, and zero otherwise. We predict a positive relation between AUDITOR and ICD
disclosures.
Fig. 1 also links managers’ incentives to discover and report internal control problems
with the likelihood of an ICD disclosure. In general, management faces greater incentives
to discover and report internal control weaknesses when the firm is subject to greater
monitoring by stakeholders and when those stakeholders have greater incentives to initiate
litigation if the firm’s financial reporting process is deemed to be deficient. We use three
variables to capture managers’ incentives to discover and report ICDs prior to SOX 404
audits—either prior restatements or an SEC AAER, concentrated institutional ownership,
and industry litigation risk.
RESTATEMENT is coded one if the firm restated its financial statements or was the
object of an AAER from 2001 to 2003, and zero otherwise.13 We view RESTATEMENT
12
In the sensitivity section of the paper we report the results when classifying Deloitte and Touche, Ernst and
Young, KPMG, and PricewaterhouseCoopers as the dominant audit suppliers.
13
Restatements announced by public companies from January 1, 2001 to December 31, 2003 are identified from
various sources using the procedure outlined in Kinney et al. (2004), and the population of AAERs released by the
SEC during the same time period comprises the AAER component of RESTATEMENT. Specifically,
restatements are identified from public sources by searching the Lexis-Nexis News and Form 8-K library files,
the Securities Class Action Alert, and various business journals such as the Wall Street Journal, New York Times,
Washington Post, and Los Angeles Times. The key word search used ‘‘restat,’’ ‘‘revis,’’ ‘‘adjust,’’ and ‘‘error,’’ and
phrases such as ‘‘responding to guidance from the SEC.’’ Our AAER search identified specific issuers that were
the subject of the release.
ARTICLE IN PRESS
as a proxy for managers’ incentives to discover and report ICDs because we posit that
firms are more likely to be forthcoming about control problems when the quality of their
financial statements has been questioned by market regulators or auditors in the past.14
Prior research suggests that firms suffer, on average, a 25% decline in stock price when
earnings restatements are announced (Richardson et al., 2003). Thus, the market imposes a
heavy penalty on firms that restate earnings. We expect that management of firms that
have incurred such penalties in the recent past will have strong incentives to avoid
incurring these penalties in the near future and, therefore, will be particularly diligent
about discovering and reporting ICDs to reduce the risk of another restatement or AAER.
Accordingly, we predict a positive relation between RESTATEMENT and ICD
disclosures.15
We also posit that managers of firms with more concentrated ownership face greater
incentives to discover and disclose ICDs due to increased monitoring and greater litigation
threats from concentrated owners. Prior research suggests that institutional owners that
hold large blocks of shares have both the incentives to monitor management and they have
the voting power to bring pressure to bear on management to effect change when control
problems surface (Jensen, 1993; Shleifer and Vishny, 1997). We use INST_CON, measured
as the percentage of shares held by institutions divided by the number of institutions that
own a firm’s stock (Compact D), as our measure of concentrated institutional ownership.
We predict a positive relation between INST_CON and ICD disclosures.
The last variable used to proxy for managers’ incentives to discover and disclose ICDs is
LITIGATION, which is coded one if a firm operates in a litigious industry and zero
otherwise.16 Managers of firms facing greater risk of lawsuits have greater incentives to
disclose the adverse news of an IC problem to minimize potential share price declines that
can trigger shareholder litigation. The LITIGATION variable could also serve as a proxy
for IC risk if industries are subject to litigation because there is significant reporting
control risk. For either reason, we expect a positive relation between LITIGATION and
ICD disclosures.
In summary, we posit that the disclosure of an ICD prior to a SOX 404 audit is a joint
function of firm-specific economic attributes that expose firms to internal control risks and
the incentives of firms’ management and external auditors to discover and disclose internal
14
One might conjecture that restatements are primarily due to internal control problems. However, for our
Section 302 ICD sample firms with restatements, only 12% mention internal control problems as the primary
restatement cause, while 15%, 27%, and 12%, respectively, mention management fraud, judgment error, and
GAAP interpretation different from the SEC’s, with 34% silent about cause.
15
RESTATEMENT might also be viewed as an internal control risk proxy. But the predicted relation between
RESTATEMENT and ICD is ambiguous in this case. On the one hand, firms with prior restatements may exhibit
lower incidence of ICDs in the future because they have improved their accounting processes in order to avoid the
negative market consequences of reporting another restatement, making it less likely that ICDs will exist (and be
reported) going forward. On the other hand, one could argue that firms with prior restatements are more likely to
have additional internal control problems that will resurface in the future, leading to a predicted positive relation
between RESTATEMENT and ICD. Thus, if RESTATEMENT serves as an internal control risk proxy, its
predicted relation with an ICD disclosure is indeterminate. Based on extant guidance and analysis of stated
reasons for prior restatements noted in footnote 15, we conclude that our sample’s restatements more likely proxy
for incentives to report than internal control risk. However, we acknowledge that the significance of this variable
may reflect both internal control risk effects and incentive to discovery and report effects.
16
Consistent with Francis et al. (1994) firms with primary SIC codes of 2833–2836 (biotechnology), 3570–3577
(computer equipment), 3600–3674 (electronics), 5200–5961 (retailing), and 7370–7374 (computer services) are
coded one, and zero otherwise.
ARTICLE IN PRESS
Table 1
Variable definitions
Variables Predicted Definitions and data source

sign
IC risk attributes
SEGMENTS + Number of reported business segments in 2003 (Compustat
Segment file).
FOREIGN_SALES + Coded one if a firm reports foreign sales in 2003, and zero
otherwise (Compustat Segment file).
M&A + Coded one if a firm is involved in a merger or acquisition from
2001 to 2003, and zero otherwise (Compustat AFNT #1).
RESTRUCTURE + Coded one if a firm was involved in a restructuring from 2001 to
2003, and zero otherwise. This variable is coded one if any of the
following Compustat data items are non-zero: 376, 377, 378 or
379.
GROWTH + Average growth rate in sales from 2001 to 2003 (Percent change
in Compustat #12).
INVENTORY + Average inventory to total assets from 2001 to 2003 (Compustat
#3/#6).
SIZE Average market value of equity from 2001 to 2003 in $ billions
(Compustat #199 * #25).
%LOSS + Proportion of years from 2001 to 2003 that a firm reports
negative earnings.
RZSCORE Decile rank of Altman (1980) z-score measure of distress risk.
AUDITOR_RESIGN + Coded 1 if auditor resigned from the client during the 12-month
period beginning in the fourth month after the close of fiscal year
2002 through the third month after the close of fiscal year 2003,
zero otherwise (Audit Analytics and 8-K filings).
Proxies for incentives to discover and disclose
AUDITOR + Coded one if a firm engaged one of the largest six audit firms for
2003, and zero otherwise (Compustat). Largest six audit firms
include PWC, Deloitte & Touche, Ernst and Young, KPMG,
Grant Thornton and BDO Seidman.
RESTATEMENT + Coded one if a firm had a restatement or an SEC AAER from
2001 to 2003 and zero otherwise.
INST_CON + Percentage of shares held by institutional investors divided by the
number of institutions that own the stock as of December 31,
2003 (Compact D).
LITIGATION + Coded one if a firm was in a litigious industry—SIC codes
2833–2836; 3570–3577; 3600–3674; 5200–5961; and 7370, and
zero otherwise.
control problems. The variables used to capture the determinants of pre-404 ICD
disclosures are summarized in Table 1.
3. Sample and descriptive statistics
3.1. Sample
Our initial sample of firms providing disclosure of ICDs is obtained from monthly
compilations of SEC filings reported in Compliance Week, a weekly electronic newsletter
ARTICLE IN PRESS
Table 2
Sample selection criteria
Number of firms disclosing internal control deficiencies 11-03 through 12-04a 585
Elimination of duplicate firms (47)
Elimination of firms from financial services and utilities industries (16)
Firms not covered by Compustat (73)
Firms with insufficient Compustat data (108)
Firms with insufficient return/price data (15)
Internal control deficiency (ICD) sample 326
Control sampleb 4484
a
Source: Compliance week.
b
All firms having the necessary data on Compustat and CRSP to estimate the ICD disclosure model.
published by Boston’s Financial Media Holdings Group. The sample period spans filings
made from November 2003 to December 2004 and includes 585 separate disclosures made
by 538 firms.17 Additional data requirements to estimate the multivariate logit model
(described more fully below) reduced the final sample to 326 firms as detailed in Table 2.
Henceforth, we refer to this group of firms as the ICD sample. All remaining firms on the
Compustat Annual Industrial Full Coverage and Research files not identified as providing
a disclosure of ICD prior to December 31, 2004 and with the required data for estimating
our model of ICD reporting comprise our control sample of 4484 firms.18
3.2. Descriptive statistics and univariate results
Panel A of Table 3 presents descriptive statistics and the results of univariate tests that
statistically assess the comparisons between the ICD and control samples. Summary
statistics for the continuous variables, which represent the average value calculated over
the 3 years prior to the filing of the ICD report (i.e., from 2001 to 2003), include the mean,
standard deviation (std. dev.), first quartile, third quartile, and median. The mean values
reported for the categorical variables show the proportion of treatment or control firms
that possess the indicated characteristic.
With few exceptions, the descriptive statistics in Table 3 support our predictions about
the determinants of ICD disclosures. For the ICD risk attributes, we find that firms
reporting control deficiencies have more segments and are more likely to have foreign
sales, be involved in mergers and acquisitions, and engage in restructurings. For
GROWTH and INVENTORY, the two variables that proxy for accounting measurement
application risk, we find significantly higher median values for both variables for the ICD
firms relative to control firms as predicted. The univariate results on SIZE as a proxy for
17
Through the end of 2004, Compliance Week identified ICD firms by filtering all SEC filings of all registrants
for the key words that would indicate an internal control deficiency. We read the ICD firms’ SEC filings over
2001–2004 to determine the date of the first public disclosure of an ICD. These filings include forms 10-K, 10-Q,
8-K, S-3, S-4 and proxy statements. We find that all firms identified by Compliance Week as having an internal
control problem did disclose an ICD in a SEC filing, but approximately 39% of the firms disclosed an ICD in an
earlier SEC filing than the one reported in Compliance Week. Beginning January 1, 2005, Compliance Week filters
only the SEC filings of firms comprising the Russell 3000, suggesting that samples drawn from Compliance Week
after December 31, 2004 are not representative of the US equity market.
18
Accelerated filers comprise 59.8% of our ICD sample and 52.9% of our control sample.
ARTICLE IN PRESS
investment in internal controls are mixed; the average size of the ICD sample ($.885
billion) is slightly smaller than the control sample ($1.164 billion), while the median size of
the ICD firms ($.140 billion) is significantly larger than the control firms ($0.091 billion).
Turning to the three other variables used to proxy for firms’ investment in internal controls
(%LOSS, ZSCORE and AUDITOR_RESIGN), the descriptive statistics indicate that
ICD firms have a higher incidence of losses and more often have their auditors resign from
the engagement. The descriptive statistics on ZSCORE show that this variable is highly
negatively skewed. Accordingly, we focus on median tests that suggest there is no
difference in bankruptcy risk between ICD and control firms.
The univariate tests also suggest significant differences between the ICD firms’ and
control firms’ ability to detect IC weaknesses and incentives to disclose ICDs. A higher
proportion of firms in the ICD sample are audited by a dominant audit firm, are more
likely to have restated earnings or have SEC AAERs sometime during the period from
2001 to 2003, and have a higher concentration of institutional shareholders. There is,
however, no significant difference in the proportion of ICD firms versus control firms that
operate in litigious industries.
We present pair-wise correlations in Panel B of Table 3, where the upper right-hand
portion of the table presents Pearson product–moment correlations and the lower left-
hand portion presents the Spearman rank–order correlations. We discuss the Pearson
correlations, but note that the patterns of the two correlations are quite similar. The largest
correlations are a significant positive correlation of 0.372 between ZSCORE and
AUDITOR, followed by a significant positive correlation of 0.307 between RESTRUC-
TURE and AUDITOR. The vast majority of other correlations fall between 70.20, which
suggests that the variables included in our determinant model capture distinct features of
firms’ internal control risks and incentives to report.
Overall, the descriptive statistics suggest that firms disclosing ICDs prior to SOX 404
audits face greater operating and reporting risks relative to non-ICD firms. In the next
section we conduct more formal tests of our hypotheses using multivariate logistic
regression.
4. Multivariate analysis of ICD disclosure
We use the following logistic regression model to assess the extent to which internal
control risk attributes and incentives to discover and early report internal control problems
are associated with firms’ ICD disclosures:
ICD_DISCLOSURE
¼ b0 þ b1 SEGMENTS þ b2 FOREIGN_SALES
þ b3 M&A þ b4 RESTRUCTURE þ b5 RGROWTH
þ b6 INVENTORY þ b7 SIZE þ b8 %LOSS þ b9 RZSCORE
þ b10 AUDITOR_RESIGN þ b11 AUDITOR
þ b12 RESTATEMENT þ b13 INST_CON
þ b14 LITIGATION þ e, ð1Þ
where ICD_DISCLOSURE is coded one for ICD firms and zero for control firms. We
transform GROWTH to be the decile rank of the average sales growth from 2001 to 2003
Table 3
Descriptive statistics on the determinants of internal control deficiency disclosures
Mean Std. dev. Q1 Median Q3
Panel A: Distributional properties of independent variables

IC risk attributes
H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

SEGMENTS
ICD sample 2.150*** 1.547 1.000 1.000*** 3.000
Control sample 1.945 1.461 1.000 1.000 3.000
FOREIGN_SALES
ICD sample 0.715*** — — — —
Control sample 0.636 — — — —
M&A
ICD sample 0.420*** — — — —
ARTICLE IN PRESS
RESTRUCTURE
ICD sample 0.485*** — — — —
GROWTH
ICD sample 0.206 0.606 0.049 0.048** 0.212
Control sample 0.181 0.642 0.069 0.033 0.185
INVENTORY
ICD sample 0.127* 0.137 0.008 0.084*** 0.197
Control sample 0.115 0.137 0.001 0.061 0.180
SIZE
ICD sample 0.885* 3.113 0.028 0.140*** 0.419
Control sample 1.164 3.982 0.014 0.091 0.522
%LOSS
ICD sample 0.581*** 0.399 0.333 0.667*** 1.000
Control sample 0.519 0.425 0.000 0.667 1.000
ZSCORE
ICD sample 1.827** 15.167 0.476 1.513 2.556
Control sample 3.377 20.506 0.327 1.639 2.826
AUDITOR_RESIGN
ICD sample 0.058*** — — — —
AUDITOR1
179
ICD sample 0.847*** — — — —
180
Table 3 (continued )
Mean Std. dev. Q1 Median Q3

RESTATEMENT
ICD sample 0.156*** — — — —
INST_CON
ICD sample 0.009*** 0.010 0.003 0.006*** 0.010
Control sample 0.007 0.010 0.001 0.005 0.009
LITIGATION
ICD sample 0.273 — — — —
ARTICLE IN PRESS
A B C D E F G H I J K L M N
Panel B: Correlations
SEGMENTS2 A — 0.221 0.122 0.186 0.069 0.009 0.270 0.215 0.136 0.002 0.028 0.165 0.011 0.140
FOREIGN_SALES B 0.230 — 0.044 0.252 0.152 0.099 0.154 0.217 0.186 0.014 0.033 0.235 0.102 0.034
M&A C 0.129 0.044 — 0.118 0.111 0.138 0.076 0.072 0.024 0.015 0.015 0.094 0.074 0.035
RESTRUCTURE D 0.187 0.252 0.118 — 0.143 0.033 0.159 0.035 0.137 0.004 0.078 0.307 0.058 0.010
GROWTH E 0.027 0.097 0.200 0.177 — 0.107 0.031 0.105 0.058 0.012 0.001 0.128 0.076 0.039
INVENTORY F 0.116 0.169 0.113 0.201 0.078 — 0.051 0.194 0.139 0.005 0.012 0.005 0.115 0.105
SIZE G 0.270 0.271 0.238 0.315 0.188 0.019 — 0.221 0.077 0.036 0.021 0.158 0.155 0.033
%LOSS H 0.214 0.219 0.071 0.033 0.154 0.241 0.432 — 0.295 0.061 0.028 0.259 0.016 0.106
ZSCORE I 0.138 0.202 0.018 0.014 0.039 0.327 0.362 0.603 — 0.027 0.038 0.372 0.139 0.010
AUDITOR_RESIGN J 0.011 0.014 0.015 0.004 0.009 0.008 0.067 0.062 0.065 — 0.050 0.054 0.013 0.003
RESTATEMENT K 0.029 0.033 0.015 0.078 0.002 0.014 0.054 0.027 0.018 0.047 — 0.075 0.014 0.005
AUDITOR L 0.165 0.235 0.094 0.307 0.017 0.040 0.584 0.259 0.326 0.054 0.075 — 0.158 0.067
INST_CON M 0.072 0.187 0.017 0.154 0.034 0.120 0.132 0.122 0.285 0.001 0.038 0.369 — 0.028
LITIGATION N 0.143 0.034 0.035 0.010 0.017 0.088 0.053 0.107 0.024 0.004 0.005 0.067 0.002 —
***, **, *Indicates significance at the 0.01, 0.05, and 0.10 level or better, respectively, based on t-statistic for difference in means or based on Z-statistic for difference
in medians. There are 326 firms in the ICD sample and 4484 firms in the Control sample. All continuous variables have been winsorized at the 1 and 99 percentile
values. See Table 1 for variable definitions.
1
In Table 6, we report the results of a sensitivity analysis where we set auditor equal to one if the firm uses one of the Big Four audit firms (PWC, Deloitte and
Touche, Ernst and Young and KPMG) and zero otherwise. The proportion of ICD (Control) firms that use Big Four auditors is 0.724 (0.683) whereas 12.2% of the
ICD sample firms use BDO Seidman or Grant Thortnon and 7.6% of the control firms use these two auditors (these proportions are different at the 0.05 level).
2
The upper right-hand portion of the table presents Pearson product–moment correlations and the lower left-hand portion presents the Spearman rank-order
correlations. Bold text indicates significance at the 0.01 level or better. n ¼ 4810. See Table 1 for variable definitions.
ARTICLE IN PRESS
(RGROWTH) because we expect the relation between growth and ICDs to be ordinal
rather than cardinal.19 We also convert ZSCORE to decile ranks (RZSCORE) because of
the documented skewness in the distribution of ZSCORE (see Panel A of Table 3).
Model 1 of Table 4 displays the results of estimating Eq. (1) using only the variables
classified as IC risk attributes, which serves as a benchmark for assessing the incremental
effect of reporting incentives on the likelihood of firms disclosing ICDs. All of the
estimated coefficients on the internal control risk attributes have the expected sign and are
significant at conventional levels with the exception of RZSCORE, which has the predicted
sign but is insignificant. We find that firms with more complex operations as reflected in the
number of business segments and being engaged in foreign operations, as captured by
FOREIGN_SALES, hold greater internal control risk than firms that only operate in
domestic markets. The results document that firms engaged in organizational change via
participation in a M&A or restructuring face greater internal control risk and are more
likely to report an ICD. In addition, we find that firms with higher sales growth and firms
with relatively larger inventory holdings are more likely to have problems with their
internal controls and are thus more likely to report ICDs. After controlling for the scope
and complexity of operations, we find that smaller firms and firms with a higher incidence
of losses are more likely to report ICDs consistent with our conjecture that smaller, less
profitable firms make fewer investments in sophisticated information and operating
systems. We also find that the resignation of the auditor is positively related to an ICD
disclosure supporting the notion that an auditor resignation may indicate unacceptable
audit engagement risk due to weak operating performance and financial distress that
reflects inadequate investment in internal control. The benchmark model yields a
Likelihood ratio w2 of 98.31, which is significant at the 0.01 level or better.
Model 2 of Table 4 displays the logit results incorporating the variables that we use to
proxy for the incentives to discover and disclose an ICD. The coefficients on the internal
control risk attribute variables are significant with the predicted signs, including
RZSCORE, after the addition of the variables that proxy for reporting incentives. After
controlling for internal control risk attributes, we document that firms that contract with a
dominant auditor supplier are more likely to make an ICD disclosure. This finding
suggests that the quality of the external audit has an impact on the detection and reporting
of a firm’s internal control problems. We also find that firms that face more reporting risk
because they have previously disappointed the market with low quality financial
information, as proxied by having to restate their financial statements or being involved
in a SEC AAER action during the 2001–2003 period, are more likely to disclose an ICD.
Consistent with our prediction, we find that firms with greater concentrated institutional
ownership are more likely to voluntarily report ICDs during the SOX 302 reporting
regime. Finally, contrary to expectations, we fail to find that firms operating in litigious
industries are more likely to report ICDs.
The expanded model is highly significant with a Likelihood ratio w2 of 137.69. The Wald
2
w of 41.96 (significant at 0.01) indicates that the addition of the incentives to discover and
disclose variables, as a group, add significant incremental explanatory power to the model
based only on internal control risk attributes. Overall, the results of the logistic regression
support the hypothesis that the early disclosure of ICDs is a joint function of firm-specific
19
In the sensitivity analysis section of the paper, we present results when coding GROWTH as a continuous
variable.
ARTICLE IN PRESS
Table 4
Logistic regression of the determinants of internal control deficiency disclosures
ICD_DISCLOSURE ¼ b0 þ b1 SEGMENTS þ b2 FOREIGN_SALES

þ b3 M&A þ b4 RESTRUCTURE þ b5 RGROWTH þ b6 INVENTORY þ b7 SIZE
þ b8 %LOSS þ b9 RZSCORE þ b10 AUDITOR_RESIGN þ b11 AUDITOR
þ b12 RESTATEMENT þ b13 INST_CON þ b14 LITIGATION þ e,
Predicted sign Estimated coefficients
Model 1 Model 2
Intercept 7 3.996 4.379

(199.26)*** (202.55)***
IC risk attributes
SEGMENTS + 0.087 0.074

(4.606)** (3.243)**
FOREIGN_SALES + 0.361 0.278
(6.757)*** (3.968)**
M&A + 0.402 0.416
(10.314)*** (10.78)***
RESTRUCTURE + 0.417 0.249
(10.910)*** (3.579)**
RGROWTH + 0.059 0.060
(7.581)*** (7.262)***
INVENTORY + 1.163 1.346
(6.943)*** (8.774)***
SIZE 0.036 0.032
(3.081)** (2.425)*
%LOSS + 0.475 0.502
(6.702)*** (7.229)***
RZSCORE 0.015 0.037
(0.304) (1.701)*
AUDITOR_RESIGN + 2.008 2.024
(45.912)*** (43.619)***
AUDITOR + 0.565
(9.681)***
RESTATEMENT + 0.839
(23.964)***
INST_CON + 10.260
(3.176)**
LITIGATION + 0.136
(0.996)
Likelihood ratio, w2 98.31*** 137.69***

Wald, w2 103.95*** 41.96***
Sample size 4810 4810
ICD_DISCLOSURE is coded one for firms that file an internal control deficiency report (n ¼ 326) and zero
otherwise (n ¼ 4484). RGROWTH is the decile rank of GROWTH, where GROWTH and other variables are
defined in Table 1. Wald w2 values in parentheses. ***Indicates significance at the 0.01 level or better, **Indicates
significance at the 0.05 level or better, *Indicates significance at 0.10 level or better.
ARTICLE IN PRESS
economic attributes that expose firms to internal control risks and the incentives of firms’
management and external auditors to provide early warning of internal control problems.
4.1. Marginal analysis
In order to provide some insight into what factors are most important in determining the
likelihood that a firm will disclose an ICD, we calculate the change in probability of a firm
disclosing an ICD as a result of changing the levels of various explanatory variables in
Eq. (1). The change in probability is calculated using the following steps. First, we
calculate the probability of a firm disclosing an ICD from our logitistic regression model
using the following expression:
0 0
pðX Þ ¼ eb X =ð1 þ eb X Þ, (2)
where b is the vector of coefficients from Model 2 in Table 4 and X is the vector of
independent variables set equal to their mean values across the sample of all firms.
Conditional on the mean values of the independent variables, the likelihood of reporting
an ICD is 4.9%. Next, we calculate the marginal changes in the probability of a firm
reporting an ICD for a one standardized unit increase in each explanatory variable while
holding the other independent variables at their mean values.20 Each marginal effect is
measured by qpðX Þ=qxi ¼ bi pðX Þ½1 pðX Þ calculated at the mean value of the regressors.
These marginal effects are reported in column 3 of Table 5. Among the IC risk factors,
the variables with the greatest marginal effects are AUDITOR_RESIGN (0.227), and
%LOSS (0.210) and M&A (0.193). For incentives to discover and report, AUDITOR
(0.268) and RESTATEMENT (0.201) have the greatest marginal impact.
An alternative way of assessing the effect of various IC risk factors and incentives to
discover and report an ICD is to calculate the values of the logit function, p(X), at selected
xi values such as their lower and upper quartiles (Agresti, 2002, p. 167). This entails
substituting the quartile values for each xi explanatory variable into Eq. (1) while holding
the other variables constant at their means. The linear approximation to changes in p(X)
is obtained by multiplying the interquartile range of xi values (see Table 3 for the
interquartile ranges) by the marginal effects based on the unstandardized value of
the variables (Agresti, 2002, Chapter 5). These values are reported in the last column of
Table 5.
We first calculate the probability of disclosing an ICD for a hypothetical firm that takes
on the lower (upper) quartile values of determinants of an ICD disclosure for variables
that are positively (negatively) related to ICDs.21 This yields a probability of disclosing an
ICD of about 1.2%. We next repeat this process but now use upper (lower) quartile values
of explanatory variables that are positively (negatively) related to the incidence of an ICD.
This yields a probability of an ICD of 77.9% with AUDIT_RESIGN accounting for
nearly 35%. Leaving AUDIT_RESIGN out of the model lowers the probability of an ICD
to 31.7%. Thus, the probability of reporting an ICD is dramatically higher when a firm
20
We use standardized values because the various explanatory variables are measured in different units.
Without standardization the marginal probabilities are difficult to compare and interpret (Agresti, 2002, Chapter
5).
21
For attributes measured as a binary variable, the benchmark probability is determined with the zero (one)
value when the attribute is positively (negatively) related to reporting an ICD.
ARTICLE IN PRESS
Table 5
Assessment of changes in probabilities of firm disclosing an ICD for selected changes in independent variables
Variables Predicted sign Marginal effect Change in probability

Standardized variables Q1 vs. Q3 values
IC risk attributes
SEGMENTS + 0.108 0.025
FOREIGN_SALES + 0.131 0.048
M&A + 0.193 0.072
RESTRUCTURE + 0.117 0.043
RGROWTH + 0.169 0.010
INVENTORY + 0.180 0.042
SIZE 0.113 0.003
%LOSS + 0.210 0.087
RZSCORE 0.120 0.032
AUDITOR_RESIGN + 0.227 0.349
AUDITOR + 0.268 0.097
RESTATEMENT + 0.201 0.145
INST_CON + 0.087 0.313
LITIGATION + 0.066 0.023
The Marginal Effects column shows the change in probability of a firm disclosing an ICD due to a one unit
change in the variable of interest after standardizing the independent variables. Marginal effects are computed as:
0 0
pðX Þ ¼ eb X =ð1 þ eb X ÞÞ where b0 X is evaluated at the mean values of X. Tabled values in the Change in
Probability column show the change in the probability of a firm disclosing an ICD as a result of moving from the
first to the third quartile value of the variable of interest, holding all other variables constant at their mean values.
RGROWTH is the decile rank of GROWTH and LOGSIZE is the natural log of SIZE, where GROWTH and
SIZE, as well as other variables are defined in Table 1.
takes on upper quartile values of the IC risk attributes and factors that are associated with
the incentives to discover and report ICDs.22
4.2. Sensitivity analysis
The validity of the inferences drawn from our model of ICD disclosure is conditional on
the quality of the variables that we use to proxy for IC risk attributes and incentives to
discover and disclose ICDs. In this sub-section, we assess the robustness of our results to
alternative measures of IC risk and other proxies for incentives to discover and disclose
ICDs.
The first sensitivity test that we conduct relates to our proxy for audit quality,
AUDITOR. As stated earlier, we consider BDO Seidman and Grant Thornton to be
dominant audit suppliers in the US audit market during our analysis period because these
two firms gained more SEC reporting clients and held a larger US audit market share after
22
We hasten to note that this illustration does not reflect the typical firm in our sample because any given firm
will likely not start from a position of having low IC risk factors or incentives to report (1Q or zero value for
dummy variables) along all of the multiple dimensions we consider. Nor is it likely that any given firm would be
able to move to a position of having high IC risk factors and incentives to report along all dimensions (3Q or one
for dummy variables).
ARTICLE IN PRESS
the demise of Arthur Andersen. An additional partitioning of audit firm dominance based
on historical market share considers Deloitte, Ernst and Young, KPMG, and
PricewaterhouseCoopers to be the dominant audit suppliers as these four firms, along
with Arthur Andersen, audited the vast majority of SEC reporting firms since 1995. Model
1 of Table 6 reports the results of our ICD disclosure determinant model adding an
additional indicator variable, AUDITOR(BIGFOUR), that is set equal to one if the firm
contracts with Deloitte, Ernst and Young, KPMG, and PricewaterhouseCoopers and zero
otherwise. With AUDITOR(BIGFOUR) in the model, the coefficient on AUDITOR picks
up the marginal likelihood of a client of BDO Seidman or Grant Thornton reporting an
ICD. Interestingly, the coefficient on AUDITOR(BIGFOUR) is negative and significant
at a ¼ 0:10, while the coefficient on AUDITOR is positive and highly significant.23 One
interpretation of these results is that BDO Seidman and Grant Thornton audit clients with
greater internal control risk. Alternatively, the results suggest that BDO Seidman and
Grant Thornton, in building their reputation with SEC clients, exercise more diligence in
identifying internal control problems. The signs and significance of the coefficients on the
remaining variables are similar to those of Model 2 reported in Table 4 with the exception
that the coefficient on RZSCORE, which becomes insignificant.
Our second set of sensitivity tests uses alternative measures of firm growth and litigation
risk. Model 2 column of Table 6 displays the results of estimating Eq. (1) using a
continuous measure of growth (SALESGRWTH), where SALESGRWTH is defined as
the 3-year average sales growth over 2001–2003. The coefficient on SALESGRWTH is
marginally significant as compared to the highly significant coefficient on the rank growth
measure (RGROWTH) in Table 4. Using this measure of growth does not change
inferences drawn about other variables in the model.
In Model 3 of Table 6, we replace LITIGATION, a categorical variable capturing high
litigation risk industries, with SHU_LIT, which is based on the work of Shu (2000).24 After
controlling for other factors that provide incentives for managers to discover and report
ICDs, we do not find that firms with high litigation risk as measured by Shu (2000) are any
more likely to provide an ICD disclosure than other firms. Thus, this result affirms our
earlier finding reported in Table 4 that ICD disclosure is not related to litigation risk.
There were 12 ICD firms that concurrently reported an auditor resignation and an ICD
in 2003 and early 2004 on an 8-K filing. Because there is a one-to-one mapping of ICD
disclosure and the independent variable of AUDITOR_RESIGN, it is important to see if
our findings are robust to deleting these observations. In the Model 4 column of Table 6,
we report the results of estimating our logistic model after deleting these 12 firms. The most
important point is that the deletion of these observations does not adversely affect the
significance of the coefficient on AUDITOR_RESIGN. Moreover, except for RZSCORE,
the signs and significance of the other coefficients remain unchanged from those reported
in Table 4. Thus, we conclude that the inferences drawn from the primary analysis are
robust to the deletion of these 12 firms.
23
Obviously, there is a high correlation between AUDITOR and AUDITOR(BIGFOUR), r ¼ 0.82. If we
exclude AUDITOR from the model, the coefficient on AUDITOR(BIGFOUR) is positive and significant.
24
Shu (2000) models litigation risk as a function of firm size, inventory holdings, receivables, return-on-assets,
current ratio, financial leverage, sales growth, stock return, stock volume, beta, stock turnover, delisting decision,
operating in technology-related industries, and receiving a qualified audit opinion. To calculate SHU_LIT, we
take the parameter estimates from Table 3 of Shu (2000) and apply them to the accounting and market measures
of the sample firms that have the necessary data to calculate the measures.
186
Table 6

Logistic regression results of determinants of ICD disclosures-sensitivity analysis
Variables Estimated coefficient
Model 1 Model 2 Model 3 Model 4 Model 5 Model 6
IC risk attributes
SEGMENTS + 0.075 0.070 0.096 0.074 0.074 0.096
(3.341)** (2.912)** (4.395)** (3.164)** (3.197)*** (3.760)**
FOREIGN_SALES + 0.277 0.261 0.096 0.238 0.273 0.412
ARTICLE IN PRESS
(3.975)*** (3.493)** (0.310) (2.855)** (3.826)** (4.544)**
M&A + 0.423 0.472 0.494 0.408 0.412 0.457
(11.334)*** (14.328)*** (10.627)*** (10.082)*** (10.470)*** (8.039)***
RESTRUCTURE + 0.265 0.200 0.212 0.295 0.241 0.708
(4.032)*** (2.365)* (1.813)* (4.885)*** (3.359)** (17.578)***
RGROWTH + 0.061 — 0.022 0.067 0.059 0.104
(7.514)*** (0.581) (8.797)*** (7.018)*** (11.086)***
INVENTORY + 1.269 1.305 1.723 1.349 1.312 0.987
(7.680)*** (8.235)*** (9.333)*** (8.543)*** (8.252)*** (2.391)*
SIZE 0.031 0.031 0.034 0.031 0.028 0.030
(2.241)* (2.225)* (2.410)* (2.241)* (1.978)* (2.155)*
%LOSS + 0.487 0.423 0.668 0.493 0.496 0.367
(6.754)*** (5.258)*** (9.561)*** (6.786)*** (6.987)*** (2.453)**
RZSCORE 0.034 0.039 0.040 0.033 0.042 0.009
(1.415) (1.915)* (1.189) (1.294) (2.151)* (0.056)
AUDITOR_RESIGN + 1.980 2.021 1.137 1.935 2.112 1.819
(40.928)*** (43.557)*** (6.013)*** (36.051)*** (47.244)*** (16.701)***
SALESGRWTH + — 0.128 — — — —
(1.892)*
AUDITOR + 0.801 0.594 0.415 0.578 0.631 2.173
(11.446)*** (10.625)*** (1.959)* (9.687)*** (12.107)*** (21.444)***
AUDITOR (BIGFOUR) + 0.295 — — — — —
(2.294)*
RESTATEMENT + 0.840 0.847 0.951 0.785 0.794 1.045
(23.944)*** (24.519)*** (21.611)*** (19.673)*** (21.159)*** (27.731)***
INST_CON + 9.925 9.586 8.771 11.016 8.912 15.820
(2.985)** (2.781)** (1.295) (3.598)** (2.346)* (2.185)*
LITIGATION + 0.139 0.131 — 0.117 0.147 0.107

(1.031) (0.920) (0.716) (1.153) (0.372)
SHU_LIT + — — 1.434 — — —
(0.209)
AUDITOR_DIMISS + — — — — 1.127 —
(28.467)***
Likelihood ratio, w2 139.88*** 132.18*** 77.755*** 124.36*** 114.07*** 176.95***

Sample size 4810 4810 2894 4798 4021 4679
ICD sample 326 326 224 314 303 195
ARTICLE IN PRESS
Control sample 4484 4484 2670 4484 4324 4484
***Indicates significance at the 0.01 level or better, **indicates significance at the 0.05 level or better, *Indicates significance at 0.10 level or better. See Table 1 for
variable definitions.
Model 1—Base model with BIGFOUR auditor, where BIGFOUR is coded one if the firm contracts with Deloitte & Touche, Ernst & Young, KPMG, or
PricewaterhouseCoopers, else zero. As shown in footnote 1 to Table 3, 72.4% (68.3%) of the ICD firms (control firms) use BIGFOUR audit firms.
Model 2—Base model with continuous sales growth, where SALESGRWTH is defined as the average percentage change in sales from 2001 to 2003.
Model 3—Base model with the Shu litigation measure, where SHU_LIT is calculated as the parameter estimates from Table 3 of Shu (2000) applied to the accounting
and market measures of the sample firms that have the necessary data to calculate the measures.
Model 4—Base model estimated with concurrent auditor change and ICD disclosures observations (n ¼ 12) deleted.
Model 5—Base model with AUDITOR_DISMISS as an additional incentive to discover and disclose measure. AUDITOR_DISMISS ¼ 1 if the client dismissed its
auditor during the twelve month period beginning in the fourth month after the close of fiscal year 2002 through the third month after the close of fiscal year 2003,
zero otherwise (auditor dismissals were determined from Audit Analytics and 8-K filings).
Model 6—Base model estimated deleting observations of ICD firms that are non-accelerated filers. Estimated coefficients in italics represent estimates that result in
different inferences drawn from those of our primary analysis.
See Table 1 for all other variable definitions.
187
ARTICLE IN PRESS
Our fifth sensitivity test explores whether the termination of a firm’s auditor signals
problems with internal control. One potential reason why a firm terminates its contract
with the incumbent auditor is for unsatisfactory performance after management discovers
internal control problems in preparation for a SOX 404 audit that the incumbent auditor
had not discovered in a prior audit.25 If the auditor is dismissed, managers have incentives
to make an ICD disclosure in conjunction with ‘‘pointing the finger’’ at the terminated
auditor for poor internal control oversight. AUDITOR_DISMISS is coded one for firms
that disclose in an 8-K filing the dismissal of their auditor in 2003 (and zero otherwise).
The results when adding AUDITOR_DISMISS to the ICD disclosure determinant model
are displayed in the Model 5 column of Table 6. The coefficient on AUDITOR_DISMISS
is positive and highly significant and the signs and significance of the coefficients on the
other independent variables are similar to those of Model 2 reported in Table 4. The
significantly positive coefficient on AUDITOR_DISMISS is consistent with the notion
that firms that dismissed their auditors in 2003 are more likely to report ICDs as managers
take steps to improve internal control scrutiny.
Our last sensitivity test is motivated by the fact that our sample includes both
accelerated and non-accelerated filers because our study focuses on the Section 302
reporting era. In contrast, the Doyle et al. (2006a) study uses a sample that includes
disclosures made in both the SOX 302 and 404 reporting regimes, with observations from
the later period being heavily weighted towards accelerated filers. To investigate how the
differences in samples affect the inferences drawn on internal control risk, we re-estimate
our ICD reporting model deleting ICD firms that are non-accelerated filers.26 The Model 6
column of Table 6 displays the results. We continue to include our variables that proxy for
the incentives to detect and report ICDs because we posit that even though accelerated
filers are required to report material weaknesses in internal control under SOX 404, these
firms still faced differential incentives to detect and report internal control problems during
the SOX 302 regime. We find the signs and significance on several of the internal control
risk and reporting variables to be different from those of our benchmark results reported in
the Model 2 column of Table 4. Specifically, we find restructurings to increase in
importance in explaining ICDs and the effect of inventory levels, frequency of losses, and
likelihood of financial distress on the likelihood of ICDs disclosures to be less significant.
More importantly, the results indicate a significant negative relation between INST_CON
and ICD reporting, whereas we found a positive relation in our Table 4 results when non-
accelerated filers were included in the ICD sample.27
25
This point highlights the fact that AUDITOR can be considered an endogenous choice. Prior research
examining firms’ auditor choices models auditor choice as a function of operating risk, financial risk and the
demand for external monitoring (see e.g., Chow, 1982). Our empirical model of ICD disclosure includes many of
the same variables used in prior audit choice research to proxy for these risks, and as such, our research design
inherently controls for selection effects. Furthermore, the majority of sample firms made their auditor choices
across different years much earlier than our year of analysis (i.e., the average auditor tenure for our sample of
firms is over 6 years) and as such we think it reasonable to consider AUDITOR as an exogenous variable for this
sensitivity test.
26
It is important to note that in order to draw strong inferences regarding the determinants of ICD reporting in
the SOX 404 regime, non-accelerated filers also should be deleted from the control sample. We do not take this
step to allow more direct comparisons to the Doyle et al. (2006a) study.
27
To be more similar to the ICD risk model of Doyle et al. (2006a), we extend this sensitivity analysis by adding
firm AGE, defined as the natural log of the number of years on CRSP, to the model. Unlike Doyle et al. (2006a),
ARTICLE IN PRESS
Based on the sensitivity analysis reported above, it appears that it is important to control
for firms’ incentives to detect internal control problems when evaluating the likelihood of
ICD reporting. We also find that including firms of all sizes (both accelerated and non-
accelerated filers) affects the significance of several of the variables in our ICD determinant
model.
4.3. Factors deterring managers from disclosing ICDs
We model ICD disclosures as a function of factors that proxy for managers’ incentives
to discover and disclose an ICD, but we do not include any explicit factors that
deter managers from providing early ICD disclosures. One potential factor that may deter
managers from making an early ICD disclosure is management reputation. Managers
may forego disclosing an ICD to avoid criticism in the market for lax organization
or mismanagement of operations ultimately reducing their employment options. If
reputation is an incentive factor, we would expect new managers to be more likely to
disclose ICDs because they can place the blame of internal control problems on prior
management. Therefore, we expect firms that have management with longer tenure to be
less likely to disclose ICDs. To investigate this issue we collect CEO tenure for all sample
firms covered by the Board Analyst database and add CEO tenure to our ICD determi
nant model. We code CEO tenure both as a continuous variable as well as a binary
variable that is set equal to one if the CEO tenure is less than 2 years, and zero otherwise.
In untabulated results, we do not find a statistically significant difference between the CEO
tenure of ICD firms and control firms after controlling for other ICD risk and reporting
determinants.
Another potential factor deterring managers from making an early ICD disclosure is
management compensation. An ICD disclosure might cast doubt on the reliability of
management’s financial reporting, which impacts the uncertainty of information quality
thereby increasing the firm’s cost of capital (Easley and O’Hara, 2004) and decreasing its
market value. A CEO that has a large number of stock options (or stock option awards)
might not want to disclose an ICD. On the other hand, a CEO that has stock grants as part
of his compensation package may actually have incentives to disclose ICDs prior to
receiving grants in the hopes that such disclosure would lower the strike price on the
options granted during the year, thus raising the value of his options. Given the prediction
about the effects of stock-based compensation on managements’ incentives to disclose
ICDs is not clear-cut and requires collecting detailed information on the timing of the
release of stock option grants relative to disclosure of the ICD, we leave this question to
future research.
5. Summary and future research
Many have claimed that the passage of the Sarbanes–Oxley Act of 2002 imposed an
extreme burden on SEC registrants by requiring them to document, evaluate, publicly
report, and have audited the effectiveness of their internal controls. This paper investigates
(footnote continued)
we do not find a significant coefficient on AGE after controlling for the other ICD risk and reporting
determinants.
ARTICLE IN PRESS
the economic events, strategic operating decisions, and investments in internal controls
that expose firms to internal control risks. Because our study uses data prior to audits
mandated by Section 404 of the Sarbanes–Oxley Act, we are also able to investigate the
incentives to discover and report internal control deficiencies (ICDs) in the absence of well
defined ICD discovery and reporting criteria and no mandated internal control audit.
More importantly, because we restrict our sample to pre-404 disclosures made by
accelerated and non-accelerated filers, our study provides insights into the determinants of
ICDs for a broad cross-section of SEC registrants, which is important for developing
expectations of internal control problems given that non-accelerated filers are not required
to comply with SOX 404 until 2007.
We find that firms that report ICDs have more complex operations as proxied by the
number of business segments and foreign sales, more often engage in mergers and
acquisitions and restructurings, hold more inventory and are faster growing relative to
firms that do not disclose internal control weaknesses. In addition, the results indicate that
firms with fewer resources to invest in internal control, as proxied by the frequency of
losses and greater financial distress, more often disclose problems with their internal
controls. Moreover, the higher incidence of auditor resignations prior to ICD disclosures
suggests auditors have greater concerns about ICD firms’ accounting application risk and
status as going concerns.
With respect to incentives to discover and report internal control problems, we find that
firms that provide early (pre-SOX 404) warnings of ICDs are more likely to be audited by
dominant auditors, have a higher incidence of restatements of financial statements and
SEC AAERs in prior years, and are more likely to have concentrated institutional owners.
Collectively, these results support our conjecture that firms that face greater internal
control risk and have greater reporting incentives are more likely to disclose internal
control deficiencies prior to the SOX-mandated internal control audit reporting
requirements.
The vast majority of firms that reported control deficiencies in the first 3 months of 2005
as a result of SOX 404 audits previously certified their controls as effective under SOX 302
(Glass Lewis, 2005). Future research can investigate whether there are significant
differences in internal control risk profiles and incentives to report for firms that disclosed
internal control deficiencies prior to SOX-mandated audits versus firms that report
deficiencies under Section 404 of the Sarbanes–Oxley Act. Exploring the relation between
internal control weaknesses and the quality of externally reported numbers is another
natural extension of the present analysis (Ashbaugh-Skaife et al., 2006b; Doyle et al.,
2006b). Finally, another avenue of fruitful research is to investigate whether internal
control deficiencies result in higher information risk that increases firms’ cost of equity
capital (Ashbaugh-Skaife et al., 2006a; Ogneva et al., 2005).
References
Agresti, A., 2002. Categorical Data Analysis. Wiley, New York.

Altman, E., 1968. Financial ratios, discriminant analysis, and the prediction of corporate bankrupcy. Journal of
Finance 23, 589–609.
American Institute of Certified Public Accountants (AICPA), 1988. Statement on Auditing Standards
No. 60: Communication of Internal Control Structure Related Matters Noted in an Audit, AICPA,
New York.
ARTICLE IN PRESS
American Institute of Certified Public Accountants (AICPA), 2001. Statement on Standards for Attestation
Engagements No. 10: Reporting on an Entity’s Internal Control Over Financial Reporting, AICPA,
New York.
Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006a. The Effect of Internal Control Deficiencies on
Firm Risk and Cost of Equity Capital, Working paper, University of Iowa.
Ashbaugh-Skaife, H., Collins, D., Kinney, W., LaFond, R., 2006b. Internal Control Deficiencies, Remediation
and Accrual Quality, Working paper, University of Iowa.
Beneish, M., Billings, M., Hodder, L., 2006. Internal Control Weaknesses and Information Uncertainty, Working
paper, Indiana University.
Chow, C., 1982. The demand for external auditing: Size, debt, and ownership influences. The Accounting Review
57, 272–291.
DeAngelo, L., 1981. Auditor size and audit quality. Journal of Accounting and Economics 3, 183–200.
DeFond, M., Jiambalvo, J., 1991. Incidence and circumstances of accounting errors. The Accounting Review 66,
643–655.
De Franco, G., Guan, Y., Lu, H., 2005. The Wealth Change and Redistribution Effects of Sarbanes–Oxley
Internal Control Disclosures. Working paper, University of Toronto.
Doyle, J., Ge, W., McVay, S., 2006a. Determinants of Weaknesses in Internal Control over Financial Reporting,
Working paper, New York University.
Doyle, J., Ge, W., McVay, S., 2006b. Accruals Quality and Internal Control over Financial Reporting, Working
paper, New York University.
Dye, R., 1993. Auditing standards, legal liabilities, and auditor wealth. Journal of Political Economy 101,
887–914.
Easley, D., O’Hara, M., 2004. Information and the Cost of Capital, Working paper, Cornell University.
Francis, J., Philbrick, D., Schipper, K., 1994. Shareholder litigation and corporate disclosures. Journal of
Accounting Research 32, 137–164.
Glass Lewis & Company, 2005. Interim Control Deficiency Disclosures-Interim Alert, Yellow Card Interim Alert,
Glass-Lewis and Company, LLC, April 12, p. 3.
Hammersley, J., Myers, L., Shakespeare, C., 2005. Market Reactions to Internal Control Disclosures, Working
paper, University of Michigan.
Hogan, C., Wilkins, M., 2006. Evidence on the Audit Risk Model: Do Auditors Increase Audit Effort in the
Presence of Internal Control Weaknesses? Working paper, Southern Methodist University.
Jensen, M., 1993. The modern industrial revolution, exit, and the failure of internal control systems. Journal of
Finance 48, 831–880.
Karr, S., 2005. 404 Disclosure: Experts Say Get in Front of the Issue, Compliance Week, February 15.
Kinney, W., McDaniel, L., 1989. Characteristics of firms correcting previously reported quarterly earnings.
Journal of Accounting and Economics 11, 71–93.
Kinney, W., Palmrose, Z., Scholz, S., 2004. Auditor independence, non-audit services, and restatements: Was the
US government right? Journal of Accounting Research 42, 561–588.
Krishnan, J., 2005. Audit committee quality and internal control: An empirical analysis. The Accounting Review
80, 649–675.
Martinek, P., 2005. SOX ‘Catch 22: Certifying Controls Later Found Weak, Compliance Week, February 22.
McMullen, D., Raghunandan, A., Rama, K., 1996. Internal control reports and financial reporting problems.
Accounting Horizons 10, 67–75.
Ogneva, M., Raghunandan, K., Subramanyam, K.R., 2005. Internal Control Weakness and Cost of
Equity: Evidence from SOX Section 404 Certifications, Working paper, University of Southern
California.
Public Company Accounting Oversight Board, 2004. Auditing Standard No. 2, An Audit of Internal
Control Over Financial Reporting Performed in Conjunction with An Audit of Financial Statements,
PCAOB, March 9.
Richardson, S., Tuna, I., Wu, M., 2003. Predicting Earnings Management: The Case of Earnings Restatements,
Working paper, University of Pennsylvania, Wharton School.
Securities and Exchange Commission (SEC), 1988. Disclosure Amendments to Regulation S-K, Form 8-K and
Schedule 14A Regarding Changes in Accountants and Potential Opinion Shopping Situations. Financial
Reporting Release No. 31, SEC, Washington, DC.
Securities and Exchange Commission (SEC), 2002. Certification of Disclosure in Companies’ Quarterly and
Annual Reports. Release Nos. 33-8124, 34-46427, SEC, Washington, DC, August 29.
ARTICLE IN PRESS
Securities and Exchange Commission (SEC), 2003. Final Rule: Management’s Reports on Internal Control Over
Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports. Release Nos. 33-8238,
34-47986, SEC, Washington, DC, June 11.
Securities and Exchange Commission (SEC), 2004. Management’s Reports on Internal Control Over Financial
Reporting and Certification of Disclosure in Exchange Act Period Reports—Frequently Asked Questions,
SEC, Washington, DC, October 6.
Securities and Exchange Commission (SEC), 2005. Letter from the SEC Chief Accountant, SEC, Washington,
DC, February 7.
Shleifer, A., Vishny, R., 1997. A survey of corporate governance. Journal of Finance 52, 737–783.
Shu, S., 2000. Auditor resignations: clientele effects and legal liability. Journal of Accounting and Economics 29,
173–205.
US Congress, 2002. The Sarbanes–Oxley Act of 2002. 107th Congress of the United States of America. H.R. 3763.
Government Printing Office, Washington, DC.
Whisenant, S., Sankaraguruswamy, S., Raghunandan, K., 2003. Market reactions to disclosure of reportable
events. Auditing: A Journal of Practice and Theory 22, 181–194.
Wright, A., Wright, S., 1996. The relationship between assessments of internal control strength and error
occurrence, impact and cause. Accounting and Business Research 27, 58–71.
Zhang, I., 2005. Economic Consequences of the Sarbanes–Oxley Act of 2002, Working paper, University of
Rochester.

A Review of Archival Auditing Research

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

A Review of Archival Auditing Research

Uploaded by

Copyright:

Available Formats

ARTICLE IN PRESS

Journal of Accounting and Economics 44 (2007) 166–192

The discovery and reporting of internal control

JEL classification: G34; G38; K22; M41; M49

Keywords: Internal control; Auditing; Regulation; SOX

2. Regulatory and conceptual background

The lack of guidance on distinguishing between levels of severity of internal control

ICD risk exposures

ICD discover and disclose incentives

Variables Predicted Deﬁnitions and data source

3. Sample and descriptive statistics

3.2. Descriptive statistics and univariate results

4. Multivariate analysis of ICD disclosure

Mean Std. dev. Q1 Median Q3

Panel A: Distributional properties of independent variables

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Mean Std. dev. Q1 Median Q3

Control sample 0.759 — — — —

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

ICD_DISCLOSURE ¼ b0 þ b1 SEGMENTS þ b2 FOREIGN_SALES

Predicted sign Estimated coefﬁcients

Intercept 7 3.996 4.379

SEGMENTS + 0.087 0.074

Likelihood ratio, w2 98.31*** 137.69***

4.1. Marginal analysis

Variables Predicted sign Marginal effect Change in probability

4.2. Sensitivity analysis

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Variables Estimated coefﬁcient

Model 1 Model 2 Model 3 Model 4 Model 5 Model 6

H. Ashbaugh-Skaife et al. / Journal of Accounting and Economics 44 (2007) 166–192

Likelihood ratio, w2 139.88*** 132.18*** 77.755*** 124.36*** 114.07*** 176.95***

4.3. Factors deterring managers from disclosing ICDs

5. Summary and future research

Agresti, A., 2002. Categorical Data Analysis. Wiley, New York.

You might also like

Likelihood ratio, w2 98.31* 137.69*

Likelihood ratio, w2 139.88* 132.18* 77.755* 124.36* 114.07* 176.95*