INTRODUCTION

On 30th July, 2002, President Bush signed into law the Sarbanes–Oxley Act, which includes what he called 'the most far-reaching reforms of American business practices since the time of Franklin Delano Roosevelt'.¹ The unanimity in both the House and the Senate for this legislation was precipitated by the 'perfect storm' brought about by the financial scandals at companies like Enron and WorldCom. These scandals were said to be caused, in part, by the lack of reliable internal controls, which in turn, created an environment in which fraud was more easily perpetrated. Consequently, among other reforms, Sections 302 and 404 of the Sarbanes–Oxley Act required firms to certify their quarterly and annual financial statements and disclose significant control deficiencies to the audit committee of the board and to their external auditors, and material control weaknesses to the SEC.

Commenting on the value-relevance of the massive requirements imposed by these two relatively small sections of the Sarbanes–Oxley Act, Scott A. Taub,² former Deputy Chief Accountant of the SEC, in a speech delivered just days after the Commission adopted Final Rules to implement Section 404 of the Act, observed that 'we believe that the increased attention to internal controls on the part of management will reduce the potential for errors in the financial statements, including those due to fraud'. Consequently, the intent behind these disclosures is to enable investors to draw conclusions about the effectiveness of the system of internal control over financial reporting, thus allowing investors to assess the veracity of corporate financial statements. Accordingly, former SEC Commissioner, Cynthia Glassman,³ in a public speech observed that 'this disclosure can be an important tool for investors in evaluating the reliability of a company's financial reporting'.

While the Act was passed in 2002, compliance with Section 404 requirements occurred much later starting with accelerated filers with fiscal year-ends after 15th November, 2004. Since the SEC had changed the compliance date a few times during the initial phase of implementing Section 404 requirements, it was not clear to many registrants whether they were required to report control deficiencies during the interim in their public filings. Consequently, many firms with fiscal year-ends prior to the 15th November, 2004 cut-off date chose to voluntarily report their control deficiencies in their SEC filings.⁴ These voluntary disclosures are the subject of our study and we provide evidence on the market impact of such disclosures. Studying voluntary disclosures and their impact on the equity valuation is important because it provides insights on the 'true' information content of such disclosures which were made available to the capital markets for the very first time in anticipation of internal control disclosure requirements imposed by the Sarbanes–Oxley Act of 2002. Our results are important because they provide clear evidence on the impact of such disclosures on a firm's equity prices. Additionally, our results provide firms with insights into avenues to mitigate the negative effects of such disclosures.

Our results indicate that voluntary internal control weakness disclosures made by registrants indeed provide value-relevant information to the capital markets because such disclosures are associated with a decline in a company's stock price, on average. If a company also discloses that remedial steps have been taken to address the disclosed internal control weakness, the stock price decline is, however, not as severe. Further, if a reporting registrant is audited by a Big-4 public accounting firm, we find that disclosing internal control weaknesses have less of an adverse impact on the registrant's stock price. The negative stock price reaction is exacerbated for the firms holding a higher percentage of current liabilities as scaled by a company's total assets but is unrelated to any of the long-term debt measures. This suggests that the reported control deficiencies have implications for default risk in the short term but not in the long term. Our findings have practical implications for the managers of a firm about to disclose internal control weaknesses.

The remainder of this paper is organised as follows. The next section provides brief background on the relevant specifics of Sections 302/404 and the Public Company Accounting Oversight Board (PCAOB) Auditing Standard #2 (AS 2) as they relate to our research question. Next, we contextualise the voluntary control deficiency disclosures in light of prior research. The penultimate section describes sample selection and data collection procedures along with some demographic data on our sample firms. The empirical methods employed are reviewed and the associated results with relevant managerial implications are discussed. The final section concludes with a summary of our findings.

OVERVIEW OF SECTIONS 302/404 REQUIREMENTS

Passed by both the House and the Senate in the shortest possible time in the legislative history of the United States, the Sarbanes–Oxley Act of 2002 was named after its authors Senator Paul Sarbanes (D-MD) and Representative Michael Oxley (R-OH). The legislation was a response to highly publicised financial statement frauds and restatements at former corporate giants like Enron and WorldCom. Consequently, the Act seeks to enhance corporate accountability and financial transparency by: '(a) creating an independent regulatory structure for the accounting industry, (b) higher standards for corporate governance, (c) increased independence of securities analysts, (d) improved transparency of financial reporting, and (e) a panoply of new civil and criminal remedies for violation of the federal securities laws'.⁵ The Act's increased reporting and compliance requirements have caused concern in many quarters. This is especially true of Section 404 of the Act.

As is evident from the two Roundtables convened by the SEC,⁶ Section 404 has generated the major part of anxiety, debate, and discussion among the registrants and their external auditors. Although it is Section 302 of the Act that directs company management to identify and report control deficiencies in various filings with the SEC, it is Section 404 that provides the discipline that forces companies to assess internal controls over financial reporting and take subsequent reporting of the control deficiencies seriously. A number of lobbying groups have referred to Section 404 as the 'Section of unintended consequences'⁷ — in effect, claiming that assessing and reporting on internal controls imposes onerous costs in time and money, which in turn, is making America less competitive in global trade. Certainly, these arguments are in direct conflict with what regulators have been suggesting. The pressure to retract or mitigate the effect of these two sections is so intense that during the last two years, the SEC has convened two separate Roundtables to receive feedback from the registrant, auditor and investing communities. Some SEC personnel (eg see Commissioner Atkins speech dated 20th September, 2005)⁸ have also publicly acknowledged that implementing Section 404 requirements is proving costlier than originally expected.

Given the resistance from companies and trade groups, there is strong interest on the part of investors, company managements, auditors, and regulators to determine whether the control deficiency disclosures have any information content or do they impose unnecessary compliance costs without enhancing market efficiency. Our study provides evidence on the 'value-relevance' of such disclosures made voluntarily by the SEC registrants.

It is not the first time that the accounting industry has tried to tackle issues surrounding internal control over financial reporting. This topic was never seriously taken until mandated by Sections 302 and 404 of the Sarbanes–Oxley Act. Prior to this requirement, external auditors relied on Statement of Auditing Standards (SAS) #55 'Consideration of the Internal Control in a Financial Statement Audit'⁹ for guidance and compliance. Inherent in this process was a significant degree of flexibility and discretion that was not conducive to fraud detection. To counteract this effect, the Sarbanes–Oxley Act limits the discretion from company management and their external auditors by requiring that (1) the CEO and CFO must now claim, in writing, responsibility for maintaining, assessing and reporting on the effectiveness of their company's internal controls over financial reporting in various SEC filings, and (2) the external auditors, as part of their conducting integrated audits, must attest to and report on the internal control assessments made by their clients.

More specifically, Subsection (4) of Section 302 clearly requires that the signing officers of a company must certify in each annual and quarterly report that (1) they are responsible for establishing and maintaining internal controls, (2) have designed such internal controls to ensure that they receive all the material financial information, (3) have evaluated the effectiveness of their internal controls as of a date within 90 days prior to each annual or quarterly report and (4) have presented in the annual or quarterly report their conclusions about the effectiveness of their internal controls. Subsection (a) of Section 404 reinforces these requirements for the management while subsection (b) obligates the registrant's external auditors to 'attest to and report on the assessment made by the management.'¹⁰ In other words, in addition to the traditional auditor's opinion on the fairness of a company's financial statements, they must also now include management's report on internal controls and auditor's opinion on the effectiveness of management's assessment and reporting on internal controls.

Coupled with the internal control assessments by management and by the external auditor is another important issue of how to separate discovered internal control weaknesses into the three categories of control deficiency, significant deficiency, and material weakness. The reason it is important to correctly classify the discovered internal control weaknesses into the three categories is because SEC Final Rules¹¹ require that management of a company disclose all significant deficiencies and material weaknesses to the company's auditors and audit committee of the board and all material weaknesses to the SEC in its periodic filings.¹² The SEC rules and AS 2¹³ further mandate that, in the presence of even a single material weakness, the registrant is not allowed to conclude that it has an effective system of internal control and its auditors must render an adverse Section 404 opinion.

The classification of control weaknesses and the implications for veracity of financial statements can lead to conflict between registrants and their external auditors. Although registrants have complained in both the SEC Roundtables that they would welcome specific management guidance on assessing internal control effectiveness, the companies, for now, are following the guidance provided in AS 2.¹⁴ In spite of such guidance, consistent with the research on positive accounting theory,¹⁵ we can speculate that management will resist such disclosures and adverse Section 404 opinions much the same way it resists certain accounting policy choices required by its auditors.

VOLUNTARY DISCLOSURE OF CONTROL DEFICIENCIES

From the above discussion, it is abundantly clear that Sections 302 and 404 represent a very distinct structural change in the corporate financial reporting environment in the US capital markets. There is no doubt that compliance with these new requirements will entail additional costs both in terms of time and money. To justify these costs, it is only logical to investigate whether the added disclosures on internal control weaknesses provide valuation-relevant information to the equity and debt providers.

As mentioned earlier, our research study examines firms that disclosed internal control weaknesses prior to the mandated deadline date. This can be regarded as a voluntary disclosure of negative information (ie the internal control weakness). A great deal of accounting research has focused on understanding managers' reporting decisions in terms of accounting policy choices and their propensity to voluntarily disclose information to the capital markets. Majority of the disclosure studies assume that managers in a firm have superior information about the future performance of their company than the outsiders. Given that accounting regulation and auditing are less than perfect 'managers trade-off between making accounting decisions and disclosures to communicate their superior knowledge of firm's performance to investors, and to manage reported performance for contracting, political or corporate governance reasons'.¹⁶

Several reasons have been advanced in the accounting literature for voluntary disclosures of information (both positive and negative) by the managers in a firm's financial statements. Based on this research managers tend to disclose positive information to reduce the cost of raising new capital,¹⁷ to correct any potential undervaluation in the price of their equity security to fend-off potential takeover and consequent loss of their job,¹⁸ and to increase the value of their stock-based compensation.¹⁹ Similarly, managers choose to voluntarily disclose negative information for a variety of reasons. Some researchers^{20, 21} suggest that disclosing bad news in a 'timely' manner could reduce litigation risk for the manager. We believe that this rationale is also applicable to a firm's external auditors. Thus, given the numerous lawsuits against registrants and their external auditors and the associated payouts in recent times, it is plausible that the managers of the firms in our sample chose to disclose their internal control weaknesses early believing that the capital markets will be more tolerant (ie lesser propensity to file a class-action lawsuit) of control deficiencies in their internal control over financial reporting if it learned of them earlier than the mandated disclosure date. Additionally, managers of these firms may also believe that the adverse market impact of voluntarily disclosing negative information may be somewhat muted relative to the market reaction if they were to disclose the same information later under the mandatory Section 404 rules.

Thus, to understand managers' motivation in disclosing this negative information early, first we need to demonstrate whether these voluntary internal control weakness disclosures provide any 'value-relevant' information to the capital markets. Our study does this by examining the stock price impacts of these voluntary internal control weakness disclosures around the 'event-date' as described later in this paper. In addition to determining the direction and magnitude of the reaction in registrants' stock prices, this research study also provides evidence on whether the deleterious effects of the control deficiency disclosures can be mitigated in any way by registrants.

SAMPLE SELECTION AND DATA DESCRIPTION

To examine the market reaction to voluntary control deficiency disclosures, we construct an event study sample of 90 firms from a set of 242 firms that disclosed internal control deficiencies from November 2003 to July 2004 in various regulatory filings with the SEC. Simply speaking, an event study is a well-established research methodology in accounting and finance that focuses on isolating the stock market's reaction to a particular event of interest. For us the 'event of interest' is the disclosure of internal control weaknesses by the SEC registrants. Since the focus of our research is to determine whether there is any market reaction to these control deficiency disclosures, it is important that we unequivocally establish the correct 'event date', which theoretically should be the date when the firms in our sample, for the first time, disclosed the internal control deficiencies in their various SEC filings. The rationale to unequivocally isolate the earliest disclosure date is based on the presumption that repeat disclosure of the same internal control deficiencies does not provide new information to the capital markets, and hence should not be considered in evaluating 'value relevance'.

Our sample construction process proceeds as follows. The sample firms that had disclosed an internal control weakness were identified using Compliance Week which started tracking internal control weakness disclosures beginning November 2003. After identifying all the firms that made such disclosures in the period covered by this research study, we thoroughly reviewed the nature, type and extent of each of these disclosures with a goal to back-track every single control deficiency disclosure in preceding firm-specific SEC filings (ie 10K, 10Q, 8K, DEF14A, etc) until we found no further prior mention of these deficiencies. Accordingly, an 'event date' or 'date of interest' for each company in the sample was established. This process unequivocally ensures that we have the first date on which the capital markets become aware of the internal control problems at the firm.²²

We begin with an initial sample of 242 firms that were identified by the Compliance Week, as having made control deficiency disclosures to the SEC from November 2003 to July 2004. From November 2003 onwards, Compliance Week has been identifying and publishing, on a monthly basis, names and the actual text of all the internal control weaknesses that various SEC registrants have made to the Commission in their periodic filings. Table 1, Panel A provides a monthly breakdown of the number of companies reporting such deficiencies.

Table 1 - Details of final sample.

Full table

This initial sample of 242 firms was reviewed carefully and was 'sanitised' by imposing several 'filters' to ensure that, methodologically, we have an appropriate and well-defined sample to draw meaningful cause-and-effect conclusions based on our study's empirical analysis. The first 'filter' is that a firm must trade on a recognised stock exchange. This criterion is necessary because we need stock price data to measure the reaction to the disclosure event. Unfortunately, this requirement alone reduces our sample size by 82 companies because these firms are pink sheet stocks. Since pink sheet stocks are considered to be less liquid and are infrequently traded, any stock price reaction to the event may not be timely, and consequently, their inclusion could distort the findings of our study.

The second 'filter' that we imposed was that internal control disclosures must be prompted in response to the Sarbanes–Oxley Act of 2002.²³ This condition further reduces our sample size by 35 firms. Initial internal control disclosures by these 35 firms were either prior to the 2003 time frame (15) or due to various non-Sarbanes reasons, such as control deficiencies cited as a potential risk factor (ten), mentioned in a class action lawsuit (five), or disclosed as part of a memorandum of understanding entered into with bank or other industry specific regulators (five). An additional 16 firms were excluded due to being duplicates or repeat disclosures in the subsequent months. As noted earlier, repeat disclosures of the same internal control weaknesses are presumed to have no new information for the market. Since the market may overreact, we did not want to bias our results by including six highly publicised fraudulent firms in our sample.²⁴ For the remaining 13 excluded firms, various reasons made them unsuitable for inclusion in our study: Specifically, for five firms we were unable to establish, unequivocally, the initial date of their internal control disclosures because these firms used highly ambiguous language to discuss their control deficiencies, two firms disclosed internal control weaknesses in their IPO filings — thus no stock price data was available for them; for four firms, relevant financial information was not available; one firm was a foreign filer, and one firm had filed numerous restatements of its financial results making it difficult to ascertain the correct related financial information. The final sample consisted of 90 firms. Panel B of Table 1 summarises our sample selection procedures.

Based on the 'event date' (not the 'reporting date' by Compliance Week) the resulting sample of 90 firms spans the time period from March 2003 to July 2004. We define this sample as the 'Full Sample'. Out of this 90-firm sample, 45 firms' disclosure dates were not associated with any other contemporaneous announcements, such as earnings announcements, etc. This was established by examining related filings such as Form 8K submitted by the firms to the SEC and various firm-specific press releases, etc. We call this latter sample the 'Clean Sample'. The distribution of these disclosures over the final sample period is reported in Panel A of Table 2.

Table 2 - Final sample by month and industry.

Full table

In Panel B of Table 2, we present the composition of the final sample by industry. Our final sample comes from a diverse set of industries. Slightly more than 20 per cent of the full sample (19 out of 90 events) and 25 per cent of the clean sample (11 out of 45 events), however, come from the 'high-tech' industry group composed of Semiconductor, and Software & Programming firms.²⁵ This suggests that the high-tech industry group may be more prone to internal control weaknesses, or alternately, that they are more apt to disclose those weaknesses compared to other industries.²⁶

Further details of our sample firms with respect to financial characteristics appear in Table 3. The data for this table were obtained from individual firm filings with the SEC. These data are as of the most recent fiscal year-end before the event date. In Panel A, we show characteristics for the full sample while the clean sample's values appear in Panel B. The median value for all firms on the COMPUSTAT²⁷ full coverage and the primary, secondary and tertiary files for the 2003 year are provided in the extreme right-hand column for comparison purposes. The discussion below focuses on the full sample. Our sample firms have a median cash flow from operations of $6.47m while the median COMPUSTAT firm has a value that is higher at $9.5m. The first quartile value for firms on COMPUSTAT was -$0.39m. Thus, our sample firms are better than the first COMPUSTAT quartile in terms of cash flow from operations for fiscal 2003 but less than the median.

Table 3 - Financial characteristics of sample firms.

Full table

In terms of long-term debt, our firms have less debt (median of $6.798m) than the COMPUSTAT median long-term debt ($15m). Interestingly, our sample median total assets are $181m while the COMPUSTAT median is $254.18m.²⁸ Our sample firms, however, appear to have a higher median current liabilities level than the COMPUSTAT median (40.7 versus 30.71). Given that our sample firms are smaller in terms of total assets than the COMPUSTAT median, the current liabilities level for our sample firms appears to be high. This suggests that our sample firms could be relying on short-term liabilities to a greater extent than others. For the Owners' Equity variable, our firms appear to have more equity (median of $79.78m) than the median COMPUSTAT firm ($58.7m) while the opposite is true of the Net Income variable. Lastly, our sample has a median Sales Revenue value of $126.4m which is comparable to the $124.4m COMPUSTAT median values. From this table, the following general picture emerges about our sample firms — our sample firms tend to be: (a) more reliant on short-term liabilities, (b) have lower amounts of long-term debt, (c) have higher book equity, and (d) have inferior cash flow and net income despite having similar sales revenues as the median COMPUSTAT firm.

Additionally, the 90 firms in our sample disclosed a total of 251 internal control deficiencies. Of the 251 internal control weaknesses, 149 were labelled as material weaknesses, nine as significant deficiencies, and 93 were plain vanilla control deficiencies. Similarly, these 90 firms disclosed a total of 271 remediation actions, of which 217 were indicated as already taken or implemented by the reporting firms.

Interestingly, in spite of reporting these internal control weaknesses, the management of 67 companies reported that their company had an effective system of internal controls over financial reporting. Of the 90 companies, 67 were audited by Big-4 CPA firms: 21 by PricewaterhouseCoopers, 20 by Ernst & Young, 18 by KPMG, and eight by Deloitte & Touché. Of the remaining 23 companies, 11 were audited by Grant Thornton and 12 by other smaller CPA firms. Further, 35 registrants had received a standard unqualified audit opinion from their external auditors in the fiscal period immediately preceding the disclosure of the internal control weakness. Although the remaining 55 registrants had also received a unqualified audit opinion, for 45 registrants their external auditors added some language emphasising a matter regarding their financial statements, for eight registrants the auditors expressed a substantial doubt about company's ability to continue as a going concern, and for the two registrants the auditors indicated that Generally Accepted Accounting Principles were not consistently followed by the company. Of the 90 companies in our sample, 37 experienced an auditor change (19 companies terminated their current auditor and in 18 companies the current auditor either resigned or refused re-election) during the period of reporting internal control weaknesses.

Data to examine the market impact of the internal control weakness disclosures is derived from online sources providing historical prices, dividends, and split factors where relevant. These online sources include Bloomberg and Yahoo Finance.²⁹ Daily stock returns were then computed from these prices, dividends and split factors, and used in the event study. For financial statement variables and data concerning the disclosure of the internal control weakness, we obtained information from individual firm filings with the SEC.

EMPIRICAL TESTS AND ASSOCIATED RESULTS

Our test consists of a stock returns event study using the announcement date of the internal control weakness as the event date. In this method, the stock price reaction in response to the internal control weakness disclosure is measured after deducting a value that accounts for the normally expected movement of the stock in response to normal market variations. Thus, this resulting 'excess stock return' captures the market's true response to the news of the internal control weakness disclosure.³⁰ This is an established method to isolate such cause and effect relationships and our methodology is similar to the one used by Mikkelson and Partch (1988).³¹ To further demonstrate the robustness of our findings, we complement this method with two other widely accepted methods.³²

The event study results for the full sample of 90 firms are presented in Panel A of Table 4. This panel presents the results under three different but commonly accepted methods of calculating the mean abnormal returns: (a) market model, (b) comparison period, and (c) raw returns method. We also calculate the mean abnormal return over three different event windows: [-5, -1], [0, +1], and [+2, +5]. For example, the event window of [0, +1] calculates the mean abnormal return under the condition when the common stock of the firms in our sample is purchased at the opening price of day 0 and sold at the closing price on day +1.

Table 4 - Stock price reaction to internal control weakness disclosures.

Full table

Focusing on the mean abnormal return as calculated under the market model method over the typical two-day event window of [0, +1], we find that the 90 companies in our sample experienced an average decline of 3.07 per cent in their stock price. These results are further confirmed when we calculate the mean abnormal return under alternatives methods: comparison period method (-3.51 per cent) and the raw return method (-3.25 per cent). It is important to note that irrespective of the method used, we consistently find that the negative return is statistically significant at the 0.01 level. To further ensure that the mean abnormal returns as reported above are not caused by a select few outlier firms, we run another widely accepted non-parametric statistical test. This test checks whether the proportion of firms reporting positive abnormal returns is statistically significantly different from the firms reporting negative abnormal returns. Once again, our findings are significant at the 0.05 level (see column 3 of the Panel A in Table 4). Based on these results, one can conclusively state that the abnormal return is on the order of -3.3 per cent, on average, over the two-day window for our sample of 90 firms. Similarly, for the clean sample of 45 firms as reported in Panel B, the abnormal return is again negative (average decline of 2.1 per cent) and statistically significant using the parametric (at 0.01 level) and non-parametric (at 0.05 level) tests in all three methods.

Figure 1 also summarises the cumulative abnormal return for the full sample using the market model results over the -5 to +5 day period surrounding the disclosure. Although the results presented in this figure reinforce the value-relevance of the control deficiency disclosures for the firms in our sample, it is important to note that the stock price decline is not fully recovered within the -5 to +5 day window. In summary, the above series of tests show that there is a robust negative, statistically significant stock price reaction, on average, to disclosures of internal control weaknesses. In other words, capital markets find the information provided by these disclosures to be relevant and valuable in pricing equity securities of publicly traded companies.

Figure 1.

Cumulative abnormal return surrounding the internal control weakness disclosure

Full figure and legend (61K)

We next study the cross-sectional determinants of the stock price reaction to the internal control weakness disclosure.³³ A cross-sectional investigation focuses on examining variables at a point in time that may mitigate as well as exert an influence on the market's response to the event under investigation. Such investigations, typically involve, estimating a regression equation with appropriate independent variables. Consequently, we employ the following independent variables predicated on the research question developed earlier in the paper:

• BIG4 — this variable equals one if the auditor was a Big4 auditing firm and zero otherwise. Prior literature indicates that if the auditing firm is a reputable firm with deep pockets, then the investors have some downside protection if the firm fails.³⁴ Our expectations are that registrants audited by Big-4 audit firms should experience a less negative stock price reaction when compared with the registrants audited by non Big-4 auditing firms. In other words, this variable should be positively associated with the mean abnormal return in response to a firm's internal control weakness disclosure.
• STDRatio — this variable is computed as the ratio of Current Liabilities to Total Assets using values from the financial statements that most closely preceded the event date. We hypothesise that if the internal control weakness disclosure has implications for short-term default risk, this risk is exacerbated if the firm has a higher current liabilities level since these liabilities represent the most immediate obligations of the firm. Consequently, we predict that there will be a negative relationship between the STDRatio and the mean abnormal return in response to a firm's internal control weakness disclosure.
• LTDRatio — this variable is computed as the ratio of Long Term Debt to Total Assets using values from the financial statements immediately preceding the event date. We hypothesise that if the disclosure has implications for long-term default risk, this risk should be exacerbated if the long-term debt levels are high. Our prediction here is that LTDRatio will be negatively related to the mean abnormal return in response to a firm's internal control weakness disclosure.
• REMACTN — this variable equals the number of remedial actions already taken by management, which is revealed by registrants in Item 9A titled 'Controls and Procedures' along with the disclosure of the internal control weakness. In other words, the market sees this information at the same time as when the internal control weakness is disclosed. Such remedial actions already taken reveal the presence of a proactive management that has responded to the internal control weakness to mitigate financial reporting disclosure risks. Consequently, we predict that this variable should be positively associated with the mean abnormal return in response to a firm's internal control weakness disclosure.
• COUNT — this variable is equal to the total number of internal control weaknesses identified and disclosed. If the market believes that the presence of many weaknesses is more damaging than the presence of just one, we should see this variable being negatively related to the abnormal return. On the other hand, if the presence of just one weakness is as damaging as the presence of many weaknesses, this variable will not be significantly related to the abnormal return.
• AUDITOPN — this variable is equal to one if the audit opinion on most recent set of financial statements is a standard unqualified opinion³⁵ and zero otherwise. For our sample firms, the former case occurs in 35 events out of the full sample of 90 events. The latter case where AUDITOPN is zero occurs typically under the following conditions:
  • Unqualified opinion with auditor emphasising some matter³⁶ pertaining to the financial statements (47 events)
  • Unqualified opinion with auditor expressing doubts about a company continuing as a going concern³⁷ (8 events)

Although based on the technical definitions, as highlighted in notes^{35, 36, 37}, all the firms in our sample have unqualified audit opinions, we use this variable to test whether the market reacts negatively to the internal control weakness disclosure despite a registrant receiving a standard unqualified audit opinion in its most recent financial statements. The motivation to test for the significance of this variable is based on the assumption that market perceives the standard unqualified audit opinion as of the highest quality (ie Grade A) and all other audit opinions somewhat of the lower quality (ie Grade B or C). Therefore, if the market ignores internal control weaknesses when a standard unqualified audit opinion is given, this implies that audit firms were able to shield clients, in our sample, by providing such clean opinions. On the other hand, if the stock price reaction is immune to the nature of the audit opinion (ie an insignificant relationship between AUDITOPN and the abnormal return); this implies that (1) market did not differentiate between Grade A and Grade B audit opinions, and (2) the information in the audit opinion cannot subsume the information in the internal control weakness disclosure made by the registrants.

• EFFECTIVE — this variable is equal to one if management concludes that its internal controls and disclosure controls are effective and zero otherwise. If the market gives any credence to management's opinion of the effectiveness of their system of internal control over financial reporting, this should be reflected in the stock price reaction to the internal control weakness disclosure. Conversely, if the market disregards management's conclusion, this variable should not be related to the abnormal return.
• WEAKTYPE — this variable takes the value of one if any one of the weaknesses is identified as a 'material weakness', and zero otherwise for the less severe forms.³⁸ As mentioned in a prior section, from capital market's perspective the worst classification of weakness is 'material weakness'. If the market regards the severity of the weakness as being important in valuation, this variable should be significantly negatively related to the abnormal return. Specifically, the more severe the control weakness, the more negative is the stock price reaction.
• LNSALES — this variable is the natural logarithm of the sales revenues of the firm in question as of the most recent fiscal period immediately preceding the event. We use this variable as a proxy for size of the firm.³⁹ The size of the firm has been used as a measure for asymmetric information about the firm.⁴⁰ A firm with lower sales revenue will be less known to the market and be characterised by greater asymmetric information. Under asymmetric information, the revelation of a weakness is more damaging and should result in a more negative stock price reaction. Thus, under this hypothesis, the LNSALES variable should be positively related to the stock price reaction.

To determine the cross-sectional determinants of the impact on mean abnormal return, we employ the methodology of linear regressions. This analytical tool enables an examination of whether there is any relationship between the stock price reaction to the internal control weakness and the variables mentioned above. We first perform an examination using one explanatory variable at a time (ie univariate cross-sectional regression). These results are shown in Table 5.

Table 5 - Cross-sectional determinants of the stock price reaction to internal control weakness disclosures-univariate regressions.

Full table

As seen in Table 5, the only statistically significant determinants of the stock price reaction to the internal control weakness disclosure are (1) whether a registrant is audited by a Big-4 CPA firm (variable BIG4), (2) the ratio of current liabilities to total assets (variable STDRatio), and (3) number of remediation actions already taken by a registrant (variable REMACTN). In other words, our results confirm our expectations on the potential impact of these three variables on a firm's stock price in the presence of an internal control weakness disclosure. The sign of the variables BIG4 and REMACTN is of particular interest to us. The positive sign for both of these variables indicate that a registrant is able to mitigate the adverse negative stock price reaction to the internal control weakness disclosures if its financial statements are audited by one of the Big-4 CPA firms and/or it discloses what remediation actions it has already taken to rectify the reported internal control weaknesses. Similarly, the negative sign of the STDRatio indicates that market perceives a higher short-term default risk for companies with higher current liabilities in the presence of internal control weakness disclosures.

Since the univariate regression models investigate the impact of each one of the above-mentioned three independent variables separately, we do not learn anything about what would happen to the stock price of a registrant that exhibits all the three independent variables. Thus, to investigate the joint effect of these three variables, we included them all together in a multiple regression. Multiple regression methodology enables one to draw conclusions about the joint effect of the independent variables on the variable of interest. The results of this analysis are shown in the first row (model 1) of Table 6. Interestingly, the only variable that appeared marginally significant (at the 0.1 level) was the STDRatio despite a statistically significant adjusted R-square of 0.09 for the overall regression. This result indicated to us that it is important to further examine the relationship between the remaining two explanatory variables: BIG4 and REMACTN.

Table 6 - Cross-sectional determinants of the stock price reaction to internal control weakness disclosures-multiple regression analysis.

Full table

When we examined the correlations between these two variables, we found that BIG4 variable was positively correlated to the REMACTN variable. Stated differently, this suggests that registrants that are audited by Big-4 CPA firms tend to disclose more remedial actions than the firms that are audited by non Big-4 CPA firms. One possible explanation for this difference could be that Big-4 audit firms have a significant influence on their audit clients to respond and fix the control deficiency in a timely manner, and perhaps spur proactive behaviour by management. Another possible explanation for these findings could be that in the post Sarbanes–Oxley era, the Big-4 CPA firms have become increasingly sensitive about their legal liability risks leading them to force their clients to remediate any disclosed internal control weaknesses.⁴¹

To round out this analysis, another model using only STDRatio and INTERACN (measured as the product of BIG4 and REMACTN) as independent variables was estimated. The results of this estimation appear in row 3 of Table 6. Here, it is clear that the interaction between BIG4 and REMACTN is significantly positively related to the mean abnormal return. From a practical perspective, these results indicate that registrants that report internal control weaknesses who employ Big-4 CPA firms as their auditors and concurrently take remedial actions to fix their disclosed internal control weaknesses are not punished as severely by the capital markets as are other firms that disclose the internal control weaknesses in the absence of Big-4 CPA firms and remediation actions already taken. These findings support prior audit quality-related research⁴² in addition to suggesting that a registrant scheduled to disclose an internal control weakness may positively benefit from its association with a Big-4 CPA firm and with remedial actions already underway to address the control weakness.

These findings have important implications for SEC registrants given that a recent study⁴³ finds that almost 45 per cent of the firms reporting control deficiencies during the 12-month period ending 31st October, 2004 experienced auditor change. What is more interesting is the finding that on a net basis, Big-4 CPA firms lost clients, while the non-Big 4 auditors gained clients, almost by a margin of 2:1. It may imply that firms that are engaging in 'auditor shopping' may be in for a rude surprise when they disclose their internal control weaknesses. Overall, our research findings are consistent with what various SEC officials had been suggesting in their public speeches that capital markets are much more tolerant of the internal control weakness disclosures when they are accompanied with explanations of appropriate remediation measures.

Upon further analysis of the other variables investigated and reported in Table 5, we do not find AUDITOPN to be a significant determinant of the market reaction. Thus, based on our sample of the 90 firms, it appears that the market neither differentiates between Grade A or Grade B quality audit opinions nor the audit opinion subsumes the information that is provided by these new control deficiency disclosures. Similarly, we do not find LTDRatio also to be a significant determinant of the market reaction. Given the findings that the STDRatio variable was found to be significant, one can surmise that the reason markets do not associate long-term default risk with internal control weaknesses disclosures is due to the expectation that a company will remediate all such weaknesses in the long term.

We also do not find COUNT or WEAKTYPE to be significant determinants of the market reaction. In our model, the COUNT variable represents the total number of control deficiencies disclosed by the registrant in its filings, while the WEAKTYPE variable represents whether the reported internal control weakness is a control deficiency, a significant deficiency, or a material weakness. Normally, one would expect larger negative stock price reaction in the presence of higher number of control deficiencies and for the worst type of internal control weaknesses. Although our findings are statistically insignificant, the sign of the WEAKTYPE variable is in the expected direction indicating that material weaknesses are viewed more negatively than the other types of internal control weaknesses.

One of the reasons we may be seeing this insignificant result is due to the fact that the definitions of the significant deficiency and material weaknesses mandated by AS 2 were not in effect at the time of the voluntary disclosures covered by our study. Thus, our sample firms were free to use either the SAS #60⁴⁴ based definitions to classify and disclose their internal control weaknesses or they could use the definitions adopted by the AS 2. Our review of the control deficiency disclosures in the SEC filings revealed to us that firms referred to SAS #60 criteria as well as AS 2 criteria while classifying the discovered internal control weaknesses. Since this has the potential to create confusion, it is possible that market just chose to ignore any classification labels attached to the internal control weaknesses by the firms and instead just focus on whether a firm is reporting any control deficiencies at all. In other words, inability of the market to distinguish how (or what criteria a firm is using) a firm is classifying its internal control weaknesses may have led it to treat each control deficiency at the same level irrespective of how it is classified and reported by the firm.

As stated earlier, the EFFECTIVE variable measures whether the management of a firm concludes its system of internal control over financial reporting is effective. For our sample, this variable is also insignificant meaning the market disregards management's conclusion on the effectiveness of its system of internal control. In fact, the negative sign for the coefficient indicates that the market tends to penalise the registrant when its management concludes that its system of internal control is effective despite an admission of an internal control weakness in its periodic filings with the SEC. An examination of the data helps one understand why we are seeing these results. For our sample, in the presence of internal control weaknesses, only 10 per cent of the firms conceded that their system of internal controls and disclosure controls, as mandated by the Rules 13a-15 and 15d-15 of the Exchange Act of 1934, is ineffective. In other words, despite identifying control deficiencies, in our sample, the registrant management has conveniently concluded that their company has an effective system of internal controls over financial reporting. What is of further interest is that for the majority of our sample firms, internal control weaknesses were discovered and disclosed due to the auditors' initiative. Under these circumstances, it appears reasonable for the capital markets to not only ignore the managements' assertion that their system of internal control is effective, but also to penalise it for unsubstantiated claims pertaining to the effectiveness of its internal controls over financial reporting.

Overall, this study's findings are further validated by other academic research studies currently in progress in this area. For example, one such research study⁴⁵ reports a significant increase in a company's overall idiosyncratic risk, systematic risk and the cost of capital subsequent to its disclosure of the internal control weakness. The same study also reports that significant reductions occur in a firm's cost of capital after it reports the actions it took to correct the reported control deficiencies. Similarly, another recent research study⁴⁶ reports significant increase in the cost of capital of the disclosing firms accompanied with a significant negative stock price reaction.

SUMMARY

We examine the market reaction to voluntary internal control weakness disclosures under the Sections 302 and 404 of the Sarbanes–Oxley Act of 2002. These voluntary disclosures are associated with a negative stock price reaction that is both economically and statistically significant. While there has been much outcry from firms regarding the increased compliance costs in terms of money and time, our research study demonstrates that such disclosures contain valuation-relevant information. Consequently, compliance costs may not be in vain if the disclosures aid in valuation.

From a positive accounting theory perspective, the negative effects of these disclosures can be mitigated if the firm employs a Big-4 CPA firm as its external auditor and concurrently reveals that significant remediation efforts have already been taken to address the reported internal control weaknesses. Registrants that are proactive in taking remedial actions should experience a less negative stock price reaction to their internal control weakness disclosures. Our results exhibit a strong correlation between the presence of Big-4 audit firms and reported remedial actions. These findings suggest that Big-4 audit firms may be responsible, in some small measure, for the undertaking of those remedial actions, thus reducing losses in stockholder wealth when internal control weakness disclosures are made by their clients.

From a valuation perspective, the stock price reaction to these disclosures is significantly related to the usage of short-term liabilities by the reporting companies. Our results suggest that internal control weaknesses may lead to banks and other short-term lenders reducing the collateral potential of the reporting firm's current assets. Various credit rating agencies, such as Moody's,⁴⁷ Standard & Poors⁴⁸ and Fitch⁴⁹ have issued position papers outlining that certain types of internal control weakness disclosures may trigger a debt ratings review. This could lead to higher borrowing costs on short-term debt and increased default risk. This certainly is an important area for future research because transparency and disclosure are critical to the successful functioning of the capital markets in a market-based society.

References

References and Notes

1. Fried, Frank, Harris, Shriver and Jacobson Law Firm (2002) 'Sarbanes–Oxley Act Adds New Corporate Responsibility and Disclosure Requirements and Creates Auditor Oversight Board', Legal Brief to Clients, 2nd August, p. 1, available at http://www.ffhsj.com/cmemos/020802_sarb_corp_resp.pdf.
2. Taub, S. A. (2003) 'Speech by SEC Staff: The SEC's Internal Control Report Rules and Thoughts on the Sarbanes–Oxley Act', May 29.
3. Glassman, C. A. (2005) 'Speech by SEC Commissioner', February 22.
4. Compliance Week, a trade publication that tracks all such disclosures in various SEC filings, reported 582 disclosures during 2004 alone.
5. Fried, Frank, Harris, Shriver and Jacobson Law Firm, ref. 1 above.
6. The First Roundtable. Roundtable on Implementation of Internal Control Provisions' was held on 13th April, 2005 and the Second Roundtable '2006 Roundtable on Second-Year Experiences with Internal Control Reporting and Auditing Provisions' was held on 10th May, 2006, available at http://www.sec.gov/spotlight/soxcomp.htm.
7. See, for example a report by American Electronics Association (2005) 'Sarbanes–Oxley Section 404: The 'Section' of Unintended Consequences and Its Impact on Small Business', February.
8. Atkins, P. S. (2005) 'Speech by SEC Commissioner: Remarks Before the National Association of State Treasurers', September 20.
9. American Institute of Certified Public Accountants (AICPA) (2004) 'AU Section 319: Consideration of Internal Control in a Financial Statement Audit', Codification of Auditing Standards, AICPA, New York, January 1.
10. Sarbanes–Oxley Act of 2002, Pub. L. no. 107-204, 116 Stat. 745 (2002) (codified in scattered sections of 11, 15, 18, 28, and 29 of U.S.C.).
11. Securities and Exchange Commission (2002) 'Final Rule: Certification of Disclosure in Companies' Quarterly and Annual Reports', RIN 3235-A154, and ' Final Rule: Management's Reports on Internal Controls over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports', (2003) RIN 3235-A166 and 3235-A179.
12. Thus, the mildest form of the weakness — 'control deficiency' is never revealed to anyone, which illustrates the importance of correct classification.
13. Public Company Accounting Oversight Board (2004) 'Auditing Standard 2: An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements', PCAOB Release No. 2004-001, March 9.
14. In response to these demands, the SEC released, for public comment, and Exposure Draft of its Interpretive Guidance on December 19, 2006. The comment period ends on February 26, 2007.
15. Watts, R. L. and Zimmerman, J. L. (1986). Positive Accounting Theory, Prentice-Hall International, New Jersey.
16. Healy, P. and Palepu, K. (2001) 'Information asymmetry, corporate disclosure, and the capital markets: A review of the empirical disclosure literature', Journal of Accounting and Economics, 31(1–3), 405–440 (see page 420 specifically). | Article |
17. See, for example, research by Merton, R. C. (1987) 'A simple model of capital market equilibrium with incomplete information', The Journal of Finance, 42, 483–510; Barry, C. B. and Brown, S. J. (1985) 'Differential information and security market equilibrium', Journal of Financial and Quantitative Analysis, 20, 407–422; Barry, C. B. and Brown, S. J. (1986) 'Limited information as a source of risk', The Journal of Portfolio Management, 12, 66–72. | Article |
18. See, for example, research byWarner, J. Watts, R. and Wruck, K. (1988) 'Stock prices and top management changes', Journal of Financial Economics, 20, 461–493 and Weisbach, M. (1988) 'Outside directors and CEO turnover', Journal of Financial Economics, 20, 431–461. | Article |
19. See, for example, research by Aboody, D. and Kasznik, R. (2000) 'CEO stock option awards and timing of corporate voluntary disclosures', Journal of Accounting and Economics, 29, 73–100 and Noe, C. (1999) 'Voluntary disclosures and insider transactions', Journal of Accounting and Economics, 27, 305–327. | Article |
20. Skinner, D. (1994) 'Why firms voluntarily disclose bad news?' Journal of Accounting Research, 32, 38–60. | Article |
21. Francis, J., Philbrick, D. and Schipper, K. (1994) 'Shareholder litigation and corporate disclosures', Journal of Accounting Research, 32, 137–165. | Article |
22. These dates were double checked with the SEC's EDGAR Filing system and accordingly adjusted for weekends and holidays.
23. During 2002, in response to the provisions of the Sarbanes–Oxley Act of 2002, the Commission adopted new rules regarding an issuer's controls and procedures. During 2003, Item 307 was amended. Regulation S-K Item 307, as amended, requires an issuer to disclose the conclusions of the registrant's principal executive and principal financial officers, or persons performing similar functions, about the effectiveness of the registrant's disclosure controls and procedures as of the end of the period covered by the report, based on the evaluation of these controls and procedures required by paragraph (b) of Rule 13a-15 or Rule 15d-15. (PricewaterhouseCoopers, SEC Volume 2, Assurance Services 2004, SEC 6010, pages 10–11). Thus any internal control disclosures that were made for the first time prior to 2003 were excluded from our sample.
24. These firms were: Fannie Mae, Global Crossing, Goodyear Tyre and Rubber, Lucent Technology, Nortel Networks, and WorldCom. Inclusion of these firms in our sample only makes the stock price reaction more negative and further supports our results of a significantly negative stock price reaction to internal control weakness disclosures. Since the experience of these firms does not capture the typical reaction for the average firm in our sample, it is better to focus on the results without these firms.
25. In a descriptive study of control deficiencies of 329 firms, the companies from Semiconductor and Software & Programming industries continue to dominate in making such disclosures. See, for example, Gupta, P. P. and Leech, T. (2005) 'Control Deficiency Reporting: Review and Analysis of Filings During 2004', Financial Executives Research Foundation, New Jersey, 1–49.
26. In our empirical tests, we conducted checks to see if the results are robust to dropping the high-tech group from the analyses. Our conclusions are unchanged when we omitted the high-tech firms.
27. COMPUSTAT, a database sold by Standard & Poors, contains comprehensive financial information on all publicly listed companies in the United States.
28. The long-term debt to total assets ratio is thus 3.6 per cent for our sample versus 5.9 per cent for the COMPUSTAT median.
29. These results were later confirmed using the CRSP 2004 database.
30. According to DSS, a software provider of computer programs that helps in analysing the data, a typical event study involves the following steps: (1) identifying the event of interest and defining an event window, (2) selecting a set of cases to include in the analysis, (3) predicting a 'normal' outcome during the event window in the absence of an event, (4) estimating the cumulative abnormal outcome within the event window, where the cumulative abnormal return is defined as the difference between the actual and predicted returns during the event window, and (5) testing whether the cumulative abnormal return is statistically different from zero. Available from http://dss.princeton.edu/online_help/analysis/event_studies.htm.
31. Mikkelson, W. H. and Partch, M. M. (1988) 'Withdrawn security offerings', Journal of Financial and Quantitative Analysis, 23(2), 119–134, Errata, 1988, 23(4), 487.
32. Details of the statistical methodology are available upon request from the authors. Our robustness checks consist of (a) Comparison Period Methodology as utilised in the following research paper:Masulis, R. and Korwar, A. (1986) 'Seasoned equity offerings', Journal of Financial Economics, 15, 91–118 and (b) Raw Returns Method (ie without adjusting for market-wide movements). Also see research by Cowan, A. R. (1992) 'Nonparametric event study tests', Review of Quantitative Finance and Accounting2(4), 343–358 and Prabhala, N. R. (1997) 'Conditional methods in event studies and an equilibrium justification for standard event-study procedures', Review of Financial Studies, 10(1), 1–38. | Article |
33. In this analysis, we use ordinary least squares regressions and White's heteroskedasticity corrected t-statistics to see if the coefficients are significant.
34. See, for example, research byChow, C. W. (1982) 'The demand for external auditing: Size, debt and ownership influences', The Accounting Review, 57, April, 272–291; Menon, K., Williams, D. D. (1994) 'The insurance hypothesis and market prices', The Accounting Review, 69, April, 327–342 and Lennox, C. S. (1999) 'Audit quality and auditor size: An evaluation of the reputation and deep pockets hypotheses', Journal of Business, Finance and Accounting, 26, September/October, 779–805.
35. By definition a standard unqualified audit opinion is also commonly referred to as the 'clean opinion'. It can only be issued by the external auditor only when (1) the registrant's financial statements are prepared in accordance with US generally accepted accounting principles, and (2) the audit is conducted in accordance with US generally accepted auditing standards with no scope limitation imposed on the auditor's work.
36. In certain circumstances an auditor may issue a unqualified audit opinion that departs from the wording of a standard audit report. Auditors, typically, add an emphasis paragraph to call to readers' attention matters such as unusually important significant events, accounting matters affecting comparability of financial statements, etc.
37. Although SAS 59 does not require external auditors to perform specific procedures to test the going-concern assumption, the auditor must evaluate the validity of this assumption as part of its normal audit procedures. And, if in spite of these tests the auditor still believes that substantial doubt exists about the continued existence of the entity, it can modify the standard unqualified audit opinion by adding an additional paragraph to that effect.
38. A finer breakdown of this variable was also used. Specifically, a material weakness was assigned a value of one, while the less severe 'significant deficiency' and 'reportable condition' (or 'control deficiency') were assigned values of 0 and -1, respectively. The qualitative results are the same as when using the original definition.
39. We also used the natural log of the market value of equity measured five trading days before the event day as a measure of firm size in the cross-sectional regressions. The results are qualitatively similar as those for LNSALES. To the extent that large firms have more sales revenues, this result is not entirely unexpected.
40. See, for example, research byAtiase, R. (1986) 'Predisclosure information, firm capitalization, and security price behavior around earnings announcements', Journal of Accounting Research, Spring, 21–36; Collins, D. W., Kothari, S. P. (1989) 'An analysis of intertemporal and cross-sectional determinants of earnings response coefficients', Journal of Accounting and Economics, 11, 143–181; Barclay, M. J., Smith, C. W (1995) 'The maturity structure of corporate debt', Journal of Finance, 50, 609-632 and Barclay, M. J., Smith, C. W. (1995) 'The priority structure of corporate liabilities', Journal of Finance, 50, 899–917.
41. From a research methodology viewpoint, this correlation between BIG4 and REMACTN violates the assumptions of independence implicit in multiple regression models. To deal with this methodological issue, we created an interaction variable, INTERACN, which is the product of the two variables, BIG4 and REMACTN and used this new variable in the regression. The results for this regression are shown in the second row of Table VI. In the presence of the interaction variable, the BIG4 variable is not significantly related to the abnormal return, whereas the INTERACN variable is highly significant.
42. See, for example, research by DeAngelo, L. E. (1981) 'Auditor size and audit quality', Journal of Accounting and Economics, 3 (December), 183–199 and Hay, D., Davis, D. (2004), 'The voluntary choice of an auditor of any level of quality', Auditing: A Journal of Practice & Theory, 23(2), September, 37–53. | Article |
43. Gupta and Leech, ref. 23 above.
44. American Institute of Certified Public Accountants (AICPA) (2004) 'AU Section 325: Communication of Internal Control Related Matters Noted in an Audit', Codification of Auditing Standards, AICPA, New York, January 1.
45. Ashbaugh-Skaife, H., Collins, D. W., Kinney Jr., W. R. and LaFond, R. (2006) 'The effect of internal control deficiencies on firm risk and cost of equity capital', Working Paper. Available at SSRN:http://ssrn.com/abstract=896760.
46. Beneish, M. D., Billings, M. B. and Hodder, L. D. (2006) 'Internal control weaknesses and information uncertainty', Working Paper. Available at SSRN:http://ssrn.com/abstract=896192.
47. Moody's Investor Service (2004) 'Section 404 Reports on Internal Control: Impact on Ratings will depend on Nature of Material Weakness Reported', Moody's Special Comment, October.
48. Standard & Poor's (2004) 'Credit Policy Update: Sarbanes–Oxley Section 404, and Standard & Poor's Approach to Evaluating Control Deficiencies', November 22.
49. Fitch Ratings (2005) 'Sarbanes–Oxley Section 404: Fitch's Approach to Evaluating Management and Auditor Assessments of Internal Controls', Special Report, January 19.

Acknowledgements

We are grateful for helpful comments received from Donald Deis, Kathleen Weiss Hanley (Economic Fellow at the SEC's Office of Economic Analysis), Steve Liedtka, Heibatollah Sami, Jerry Zimmerman, and also, participants at the 2006 AAA Auditing Section's mid-year conference in Los Angeles. The authors are grateful to the Frank L. Magee Chair (Gupta) and the Hans J. Bär Endowed Chair (Nayar) for financial assistance, and to Lili Lin for help in data collection.