Impact of SOX IT Material Weaknesses

8/3/2019 Impact of SOX IT Material Weaknesses

1/52

The Impact of Information Technology Material Weaknesses on Corporate Governance:Evidence from Executive and Director Turnover, and IT Governance Changes

Jacob Z. Haislip

Adi Masli

Vernon J. Richardson

Juan Manuel Sanchez

University of Arkansas

August 2011


2/52

The Impact of Information Technology Material Weaknesses on Corporate Governance:

Evidence from Executive and Director Turnover, and IT Governance Changes

Abstract We provide a comprehensive examination of the impact of information technology (IT)internal control material weaknesses on changes in corporate governance. Specifically, weexamine the impact of IT weaknesses on CEO, CFO and director turnover, CEOs, CFOs anddirectors IT knowledge improvements, and upgrades to the companys financial reportingsystem. We find results consistent with our hypothesis that, because IT-related material

weaknesses have a more pervasive negative impact on the reliability of internal controls overfinancial reporting (relative to non-IT material weaknesses), IT material weakness firmsexperience higher CEO, CFO and director turnover rates. We also find that IT material weaknessfirms are more likely to replace executives with professionals possessing higher degrees of ITknowledge, and are more likely to upgrade their financial reporting IT. Finally, we find that in ITmaterial weakness firms that experience CFO turnover, the CFO replacement possessesadditional IT knowledge, and remediate internal control weaknesses in a more timely fashion.


3/52

I. IntroductionInformation technology (IT) serves as the foundation of an effective system of internal

controls over financial reporting (Hunton et al. 2008; Li et al. 2010a; Masli et al. 2010). IT

provides the platform that integrates financial transactions and internal controls to increase the

likelihood of a properly functioning financial reporting process. Despite its importance, there is a

notion that Chief Executive Officers (CEOs) and Chief Financial Officers (CFOs) have not

placed enough attention to IT as a critical component of the financial reporting system process

(Deloitte 2005). Regulators seem to share this sentiment and suggest that boards of directors

need to do a better job providing oversight over their organizations IT functions, especially

those pertaining to internal controls and financial reporting (Nolan and McFarlan 2005; Klamm

and Watson 2009; Bart and Turel 2010).

Recent research (Klamm and Watson 2009) finds that firms with significant IT

deficiencies are more likely to issue misstated financial statements (relative to firms with regular

material weaknesses), further increasing the awareness of the importance of IT on the overall

financial reporting system.1

In this paper, we examine two related questions. First, we examine

the impact of IT material weaknesses on CEO, CFO, and board of director turnover. We focus on

the CEO and CFO because they are primarily responsible for the reliability and accountability of

internal controls over financial reporting. Section 302 of the Sarbanes-Oxley Act of 2002 (SOX)

requires these executives to sign off on financial statements and to report on the quality of the

internal controls surrounding financial reporting. Recent research also emphasizes the important


4/52

members face penalties (in the form of an increased likelihood of turnover) for IT failures that

relate to internal control over financial reporting. This examination is important because while

extant research (Srinivasan 2005; Desai et al. 2006; Collins et al. 2009) documents the

consequences of financial misstatements on a firms governance structure (e.g., executive and

director turnover), little is known about the consequences of IT deficiencies on changes in

corporate governance.

Second, we examine how firms with IT material weaknesses remediate their deficiencies.

Specifically, we examine two distinct areas of remediation. Given the emerging call for greater

IT oversight among executives and board members, we first determine whether IT weakness

firms replace outgoing CEOs, CFOs, and directors with professionals who possess greater levels

of IT knowledge. Replacing the CEO, CFO and/or board members with individuals with greater

IT knowledge would signal the seriousness of a firms commitment to remediating the IT

governance environment. Finally, we examine whether firms with IT weaknesses subsequently

make other major IT changes, including upgrades specifically targeted to the financial and

accounting system. These changes include upgrading the IT, hiring an executive (beyond the

CEO or CFO) dedicated to the oversight and management of IT, or adding a technology

committee to the board. All of these changes are expected to help remediate problems associated

with the IT material weakness.

We rely on a sample of 289 IT material weakness firms identified by reading SOX 404

reports issued from 2004 through 2006. As a control group, we rely on a random sample of non-


5/52

After controlling for economic determinants of turnover, including the number of weaknesses

reported and the incidence of restatements, we find that, IT weakness firms have a 8.2%, 16.3%,

and 19.4% greater likelihood of CEO, CFO, and director turnover than non-IT weakness firms,

respectively. These results imply that weak IT controls have a more pervasive and negative

impact on the financial reporting process and consequently result in greater penalties for the

executives primarily responsible for internal controls. Furthermore, the results suggest that

directors are held accountable for breakdowns in IT-related controls, thus providing support for

the idea that board members are now challenged to extend their monitoring and oversight duties

to IT functions.

When we contrast the turnover rates between IT and non-IT firms conditioning on inside

vs. outside directors, we find that the probability of turnover is greater for outside directors.

When we focus on the audit committee, however, we find that the turnover rate is not

significantly different between IT and non-IT weakness firms. In contrast, when we focus on the

turnover rates of the chairperson of the board, we find that the likelihood of turnover is 12.5%

higher in IT weakness firms. These results suggest that the firm eliminates the professional with

the most authority on the board as part of the remediation of the problems in the financial

reporting process. On balance, these results show that IT weakness firms make changes that are

more significant to the governance structure as compared to non-IT weakness firms.

With respect to the remediation, we find that IT weakness firms are more likely to replace

outgoing CEOs and CFOs, with executives that have greater levels of IT knowledge.2 This result


6/52

IT expertise at the executive level and the quality of internal controls over financial reporting.

Our findings support the notion that IT weakness firms are more likely to obtain the services of

executives with IT knowledge, expecting that such appointments can contribute to improvements

in internal controls over financial reporting. We also find that IT weakness firms are more likely

to make upgrades to the accounting and financial reporting IT. In some cases, the IT weakness is

so pervasive throughout the system that firms opt to scrap the entire financial reporting system.3

On other cases, the IT weakness affected targeted areas, leading to changes only to specific

modules, such as Accounts Payable or Fixed Assets.4

In additional analysis, we examine the remediation efforts that IT weakness firms

undertake and find evidence suggesting that those IT weakness firms that replace (fill) their CFO

(board seats) with individuals possessing IT knowledge (compared to IT weakness firms that do

not) are more likely to experience a reduction in the number of internal control weaknesses

reported by the second year after the initial IT weakness year. This result implies that

replacement appointments of CFOs and/or directors with IT knowledge are among the most

effective remediation strategies for IT weakness firms.

Our study offers various contributions to the accounting information systems (AIS)

literature that examines the importance of IT in financial reporting and auditing. The IT-related

auditing literature focuses on the use of IT by auditors and how it can affect auditor judgment

3For example in 2005 Castle & Co stated, The Company started a business system replacement initiative in thethird quarter of 2005. The project scope includes a replacement of the Companys financial systems as a first phaseof the overall project plan The Company is currently performing parallel testing and expects to be in production


7/52

(e.g., Messier 1995; ODonnell and David 2000; Brazel et al. 2004; ODonnell and Schultz 2003;

Bible et al. 2005; Bedard et al. 2007; Dowling and Leech 2007; Dowling 2009). The IT-related

accounting literature also focuses on the firm performance and internal control benefits firms

derive from IT (e.g., Dehning and Richardson 2002; Hunton et al. 2003; Kobelsky et al. 2008;

Masli et al. 2010). Our paper extends this literature by showing the detrimental effects of a

breakdown within the controls surrounding IT on a firms governance environment.

Prior literature focuses on the importance of financial accounting expertise of executives

and board members as it relates to the financial reporting process (Beasley 1996; DeFond et al.

2004; Hennes et al. 2008; Li et al. 2010b; Johnstone et al. 2010). We extend this literature by

documenting that firms also value the IT expertise of executives and directors when remediating

internal control issues. Furthermore, a stream of literature investigates the characteristics of firms

that report material weaknesses and the consequences the firms face in regard to the weaknesses

(Ge and McVay 2005; Doyle et al. 2007; Hammersley et al. 2008; Johnstone et al. 2010; Li et al.

2010b). We extend this literature by examining a unique type of internal control material

weakness we show to be a greater detriment to the financial reporting process. Finally, our

results provide support for the recommendations within the COSO and COBIT frameworks as

well as the PCAOB standards that advocate management and board oversight and accountability

over IT controls.

We organize the rest of the paper as follows: Section 2 explores the related literature and

develops our testable hypotheses. Section 3 describes the sample used to test the hypotheses.


8/52

Sections 302 and 404 of SOX require management and auditors to report on the quality

of firms internal controls over financial reporting. Through this process, firms identify and

reveal internal control material weaknesses, which the Public Company Accounting Oversight

Board (PCAOB) defines as a significant deficiency, or a combination of significant

deficiencies, that results in more than a remote likelihood that a material misstatement of the

annual or interim financial statements will not be prevented or detected (PCAOB 2004).

Therefore, a material weakness indicates that there is a major problem with a firms financial

reporting process, potentially highlighting the possibility of misstated financial statements.

In a report discussing the importance of the role of IT in the design and implementation

of internal controls, the IT Governance Institute (ITGI) states that IT is the foundation of an

effective system of internal controls over financial reporting (ITGI 2006). The Committee of

Sponsoring Organizations of the Treadway Commission (COSO 2009) makes a similar case, but

further emphasizes the importance of properly monitoring the effectiveness of IT. The PCAOB

also recognizes the importance of IT in the internal controls of financial reporting. Auditing

Standard No. 2 (and the superseding Standard No. 5) specifically states that IT controls have a

pervasive effect on the achievement of many overall objectives of the control criteria (PCAOB

2004), so auditors should understand how IT affects the firms flow of transactions and examine

the use of IT within the processes and controls. Overall, the regulatory perspective suggests that

IT plays an important role within the financial reporting system and the internal controls within

that system.


9/52

correct IT material weaknesses. Common IT material weaknesses (as reported within SOX 404

reports) include lack of controls over who can initiate and approve journal entries, accounting

systems that are unable to process complicated transactions, and a lack of training to use the

accounting system software. The severity of these weaknesses can lead to the misstatement of

any account, and therefore cause a significant problem in financial reporting.

The Relation between IT Weaknesses and Executive Turnover

Extant literature provides evidence of executive and director turnover following financial

reporting failures. For example, Desai et al. (2006) find that restatements are associated with an

increased likelihood of CEO turnover, and that terminated executives have difficulty finding

similar positions at other firms following the turnover. Collins et al. (2009) show similar results

for CFOs, but also show that the labor market penalties (i.e., inability to find comparable

position) are more severe in a post-SOX era. Srinivasan (2005) shows that directors lose a

significant number of directorships following the announcement of earnings-decreasing

restatements. More recent research, including Li et al. (2010b) and Johnstone et al. (2010),

shows increased executive and director turnover in firms that report internal control material

weaknesses.

While material internal control weaknesses are associated with significant costs

(Ashbaugh-Skaife et al. 2009; Hammersley et al. (2008); Hogan and Wilkins 2008; Ye and

Krishnan 2008), it is likely that these costs are particularly great for IT material weaknesses

(relative to regular material weakness firms). For example, Klamm and Watson (2009) find that


10/52

weaknesses than for firms with non-IT material weaknesses. Based on this evidence of the

impact of IT material weaknesses on the firm coupled with the evidence of executive turnover

around restatements and all types of material weaknesses, we, in turn, predict that there is a

greater likelihood of executive (CEO or CFO) and director turnover for IT weakness firms.

Therefore, our first hypothesis is as follows:

Hypothesis 1: The likelihood of CEO, CFO, and director turnover is greater for firmsthat report IT material weaknesses in internal control than for firms that report non-ITmaterial weaknesses.

The Relation between IT Weaknesses and IT Governance Changes

It is important to understand how corporate governance can affect financial reporting.

Bowen et al. (2008) find that weak governance allows management to use more discretion in

accounting information, which in turn leads to poor future performance. Farber (2005) finds an

association between the likelihood of fraud and characteristics commonly associated with weak

governance, such as few independent board members, a lack of financial expertise on the board,

and few audit committee meetings. Klein (2002) finds that firms with more independent boards

report lower levels of discretionary accruals. Larcker et al. (2007) find a positive association

between strong governance attributes and future firm performance. Finally, Krishnan (2005) and

Hoitash et al. (2009) both show that strong corporate governance decreases the likelihood of

material weaknesses in internal controls. These papers are important because they show that

strong corporate governance helps firms avoid internal control material weaknesses, thus

strengthening the financial reporting process.


11/52

include hiring more independent directors and directors with financial expertise. The author

shows that following these corrective actions the firms experience in increase in stock

performance suggesting, investors appear to value governance improvements.

Extant research provides strong evidence on the consequences internal control weakness

remediation. For example, Ashbaugh-Skaife et al. (2009) find that when firms address

deficiencies in internal controls their cost of equity decreases, and Goh (2009) shows that the

timeliness of remediation is positively associated with the severity of the weakness. Goh (2009)

states that remediation is key to improving financial reporting quality and restoring investor

confidence. Li et al. (2010b) and Johnstone et al. (2010) document ways that firms attempt to

remediate material weaknesses, including replacing the CFO with a different one of higher

quality and hiring more independent directors. Following this line of research, in the case of IT

material weaknesses, we predict that firms also improve the characteristics of corporate

governance. However, we predict that not only do they try to improve the specific financial

knowledge of the firm, but since these weaknesses are IT related they will increase IT

characteristics of the firm as well. Our second hypothesis is as follows:

Hypothesis 2: Firms that report IT internal control material weaknesses are more likelyto make IT governance changes than firms that report non-IT internal control materialweaknesses.

We are also interested in the different types of IT governance changes these firms are

likely to make. First, we examine if these firms hire executives and directors with characteristics

that will improve financial reporting. Beasley (1996) shows that firms with more independent


12/52

weaknesses, Li et al. (2010b) and Johnstone et al. (2010) find that following the weaknesses

firms hire executives and directors that are more qualified to remediate the weaknesses to

improve financial reporting quality. Li et al. (2010b) specifically show that firms hire CFOs with

more financial expertise and experience. We expect that firms hire executives and directors with

the right skill set to remediate any internal control material weaknesses. For that reason we

predict that firms that report IT related internal control weaknesses are more likely to hire

executives and directors with IT knowledge to remediate the IT weaknesses and improve

financial reporting quality. Specifically, our third hypothesis is as follows:

Hypothesis 3: Firms that report IT internal control material weaknesses are more likelyto hire executives and directors with IT knowledge than firms that report non-IT internal

control material weaknesses.

We also suggest that these firms proceed with other IT initiatives to improve financial

reporting. These initiatives include upgrading the IT financial reporting system, hiring an IT

executive, adding a technology committee to the board, or increasing the importance of the role

of the Chief Information Officer (CIO). The extant literature discusses how these different

initiatives can improve financial reporting. For example, Hunton et al. (2008) find that using IT

for continuous monitoring can decrease the level of real earnings management of firms. Li et al.

(2010a) find that better quality IT financial reporting systems provide higher quality information

to management. Kobelsky et al. (2008) find a positive association between IT budgets and firm

performance and shareholder returns. Finally, Masli et al. (2010) show that implementing

technology specifically used in monitoring the effectiveness of internal controls decreases the


13/52

initiative changes to improve the quality of the internal control environment and financial

reporting. Specifically our fourth hypothesis is as follows:

Hypothesis 4: Firms that report IT internal control material weaknesses are more likelyto make IT initiative changes than firms that report non-IT internal control materialweaknesses.

Following Li et al. (2010a) in our final hypothesis we examine different types of IT

material weaknesses to determine how they differently affect the governance structure of firms.

These three different categories are Data Processing Integrity, Access and Security, and Structure

and Usage. Li et al (2010a) show that the Data Processing Integrity weaknesses are the most

directly aligned with the accurate and reliable production of data and find these weaknesses to

cause the greatest detriment to the information quality. Following this line of reason, we expect

the impact on the corporate governance of the firm for Data Processing Integrity weaknesses to

be greater than the Access and Security and the Structure and Usage IT weaknesses. Specifically

our fifth hypothesis is as follows:

Hypothesis 5: The turnover and remediation efforts are greatest for firms reporting DataProcessing Integrity internal control material weaknesses.

III. Sample Selection

Our sample is constructed using data from Audit Analytics, Annual COMPUSTAT

(financial statement variables), CRSP, I/B/E/S, Thomson Reuters, and SEC filings (DEF 14A,

10-K, etc.). We used Audit Analytics to identify firms that report material weaknesses in their

internal controls over financial reporting. We then used the SOX 404 reports within 10-K filings


14/52

population of material weakness firms. This gives a total sample of 602 firm-year observations

where the firm reports an internal control material weakness (IT related and non-IT related). We

then collected data on management and the board of directors from proxy statements (DEF-14A)

and 10-K filings from 12 months before the year of the weakness to 24 months after the year of

the weakness. Additionally, we collected information for our control variables from

COMPUSTAT, CRSP, Thomson Reuters, and I/B/E/S. After eliminating observations with

missing information, our final sample included 578 firm year observations, 289 of which are IT

material weakness firm year observations. See Panel A of Table 1 for the sample reconciliation.

Panel B of Table 1 presents the industry classification (by two-digit SIC codes) across

our sample firms. In general, firms in our sample are from a broad spectrum of industries.

Specifically, they appear more often in the Services, Financial Institutions, and Electrical

industries. Finally, Panel C of Table 1 provides the distribution of the sample firms across years.

With the exception of 2006, the number of observations by year is around 200 and uniform

across time.

IV. Research Design

Hypothesis 1 posits a positive association between IT material weakness firms and

turnover for executives and directors. To test our first hypothesis, we run variations of the

following logistic regression model (See Table 2 for variable definitions):

Turnoveri = 0 +1IT Weaknessi,t+ 2Number of Weaknesses +3LnAssets i,t+

4Leveragei,t+ 5BTMi,t+ 6ROAi,t+ 7Lossi,t+ 8Institutional Holdingsi,t+ 9Analysti,t

+ 10Restatementi,t-1,t,t+1 + 11Board Sizei,t+ 12Board Independencei,t+ 13CEO


15/52

two years following the weakness. We first examine the turnover for CEOs and CFOs. We then

run the model on different director positions: directors, chairman of the board, independent

directors, and audit committee members. Our variable of interest isIT Weakness, which is coded

1 if the firm is an IT weakness firm, and 0 otherwise. We expect the coefficient on this variable

to be positive and significant indicating that the likelihood of turnover is greater for IT weakness

firms than for non-IT weakness firms.

We include a set of control variables that prior literature shows can affect director and

management turnover. Ferris et al. (2003) show that the likelihood of turnover increases with

firm size, therefore we predictLnAssets to be positively associated with Turnover. We include

the totalNumber of Weaknessesbecause firms with more material weaknesses reported are more

likely to have an IT weakness. We includeLeveragebecause greater debt levels translate into

additional monitoring by creditors, who could influence the dismissal of poor performing

management and directors (Agrawal and Cooper 2007). We therefore predictLeverage to be

positively associated with Turnover. Since firms with low valuations experience a greater level

of turnover we expectBTMto be positively associated with Turnover. Prior literature also shows

that turnover is more likely for firms with poor operating performance (Weisbach 1988 and

Yermack 2004). Therefore, we expectROA to be negatively associated andLoss to be positively

associated with Turnover.

Following Johnstone et al. (2010), we include the variables Institutional Holdings and

Analystas a control that outsiders provide additional monitoring for the firm. Therefore, we


16/52

Turnover. Extant literature provides mixed evidence regarding how the size of the board affects

corporate governance (Jensen 1993), so we make no prediction about the direction ofBoard Size.

Research also argues that independent boards are more likely to remove poor performers from

both management and the board (Jensen 1993); thus, we expectBoard Independence to be

positively associated with all measures ofTurnover. We include CEO Chairmanbecause as

discussed by Jensen (1993), when the CEO also serves as the board chair they are more

entrenched, so we expect this variable to be negatively associated with management turnover and

positively associated with director turnover. Finally, we include a set of control variables that

represent different high and low technology industries to control for any effects these IT

intensive industries have on our results (Kobelsky et al. 2008). These variables areAutomate,

Transform, High Tech, andLow Tech.

In additional analysis, we investigate whether certain types of IT SOX 404 material

weaknesses will have a greater impact on turnover. Therefore, following Li et al. (2010a), we

categorize IT material weaknesses across three dimensions: a) Data Processing Integrity, b)

System Access and Security, and c) System Structure and Usage. As discussed by Li et al.

(2010a), the three categories were developed by integrating the prior data quality literature,

auditing standards (i.e., AS5), and IT professional guidance. Detailed examples of the IT controls

and the coding of the categories appear in Appendices A and B. When examining the association

of the IT material weakness categories and turnover, we include the following independent

variables:Data Processing Integrity, System Access and Security, and System Structure and


17/52

Hypothesis 2 posits a positive association between IT material weakness firms and IT

governance changes. To test our second hypothesis, we run variations of the following logistic

regression model (See Table 2 for variable definitions):

IT Governance Changei = 0 +1IT Weaknessi,t+2 Number of Weaknesses + 3LnAssets i,t+ 4ROAi,t+ 5Avg Sales Growthi,t+ 6Leveragei,t+ 7Uncertaintyi,t+

8Automatei,t+ 9Transformi,t+ 10High Techi,t+ 11Low Techi,t+ 12Foreigni,t+

13Mergeri,t+ 14Restructuringi,t+ 15Product Differentiationi,t+ 16Cost Leadershipi,t.

(2)

In this model, we examine the probability of a firm making changes to its IT governance

structure. We use two different dependent variables. First,IT Governance Change is definedas

an indicator variable set equal to 1 if the firm made any changes to its IT governance, and 0

otherwise. Second, Count of IT Governance Changes represents the number of changes the firm

makes to the IT governance. The specific IT governance changes that we examine include the

following: replacement of CEO with IT knowledge (CEO IT Knowledge); replacement of CFO

with IT knowledge (CFO IT Knowledge); hiring of chairman of the board of directors with IT

knowledge (Chairman IT Knowledge); hiring of audit committee members with IT knowledge

(Audit Committee IT Knowledge); hiring of directors with IT knowledge (Director IT

Knowledge); upgrading the IT (IT Upgrade); and upgrading IT management (IT Management).

We ascertain if an executive or board members possess IT knowledge by reading their

biographies in the firms proxy statements (form DEF 14A). An executive (board member) is

said to have IT Knowledge if he/she has prior experience as a CIO (or other IT-related

management positions), has previously worked in an IT/technology firm, or has IT-related


18/52

an upgrade to IT management includes hiring an IT specific executive, adding a technology

committee to the board, or promoting the CIO position to become one of the top-five paid

executives of the firm.

Our variable of interest is againIT Weakness. We expect the coefficient to be positive

and significant because we expect firms to make more IT governance changes in response to the

IT material weaknesses to remediate the IT control problems within the financial reporting

process. When examining the association between IT material weakness categories and IT

governance changes, we substitute IT Weakness with the following independent variables:Data

Processing Integrity, System Access and Security, and System Structure and Usage.

We include a set of control variables that we expect will influence IT governance

changes. We includeLnAssetsbecause we predict that size affects a firms ability or desire to

make IT governance changes. We do not make a sign prediction for size. We expectROA to be

positively associated with IT changes, because profitable companies have more resources to

invest in IT changes. Dewan et al. (1998) find that firms with higher sales growth tend to under-

invest in IT, and we therefore expectAvg Sales Growth to be negatively associated with IT

governance changes. High debt levels can constrain a firms resources, so we therefore predict a

negative association forLeverage. We include Uncertainty, because we expect firms with higher

levels of risk to use more IT to help mitigate some of the risk. We therefore expect a positive

sign on the coefficient forUncertainty. We follow Chatterjee et al. (2001) in using theAutomate

and Transform variables determined at the industry level. These indicator variables provide


19/52

scheme similar to Francis and Schipper (1999) to designateHigh Tech andLow Tech firms. We

expect High Tech firms to be more likely to make IT changes since these companies are more

likely to use IT in every day operations. We make no prediction forLow Tech firms because it is

not obvious whether these firms will avoid IT changes because they feel they are unnecessary, or

they will make the changes because they are obviously lacking IT. Finally, prior research

suggests that enterprise IT initiatives and IT management structure often require alignment with

the firms business strategies (e.g., Floyd and Wooldridge 1990; Banker et al. 2010). Therefore,

we include the following set of variables to control for business strategies that companies may

employ: Foreign, Merger Restructuring, Product Differentiation, and Cost Leadership. We make

no directional predictions about these variables.

Hypothesis 3 posits a positive association between IT material weakness firms and the

replacement (hiring) of executives (directors) with IT knowledge. To test our third hypothesis,

we run variations of the following logistic regression model (See Table 2 for variable

definitions)5:

IT Knowledgei = 0 +1IT Weaknessi,t+ 2Number of Weaknesses + 3LnAssets i,t+4ROAi,t+ 5Avg Sales Growthi,t+ 6Leveragei,t+ 7Uncertaintyi,t+ 8Automatei,t+9Transformi,t+ 10High Techi,t+ 11Low Techi,t+ 12Foreigni,t+ 13Mergeri,t+14Restructuringi,t+ 15Product Differentiationi,t+ 16Cost Leadershipi,t.

(3)Equation 3 follows the model in Equation 2, except we are specifically examining the changes in

IT knowledge for executives and directors. We run Equation 3 five different times to examine

the various changes in IT knowledge within the firm. We first run the model examining changes


20/52

the IT knowledge for Chairman of the Board, directors in general, and audit committee members.

We measure Chairman IT knowledge similar to the executives in that we are only interested in

firms that changed from not having IT knowledge before the internal control weakness to hiring

a person with IT knowledge in response to the material weakness. We consider director (audit

committee) IT knowledge change to be positive if after the material weakness, the firm employs

additional directors (audit committee members) with IT knowledge than they did before the

material weakness. Find examples of biographies of executives and directors that possess IT

knowledge in Appendix C.

IT Weakness is again our variable of interest, and we expect it to be positive and

significant. We predict that IT material weakness firms will hire executives and directors with IT

knowledge in an effort to remediate problems that IT weaknesses generate within the financial

reporting process. When examining the association between IT material weakness categories and

IT knowledge changes, we substitute IT Weakness with the following independent variables:

Data Processing Integrity, System Access and Security, and System Structure and Usage.Finally,we include the same control variables used in Equation 2 for Equation 3.

Hypothesis 4 posits a positive association between IT material weakness firms and IT

initiative changes. To test our fourth hypothesis, we run variations of the following logistic

regression model (See Table 2 for variable definitions)5:

Major IT Initiativesi = 0 +1IT Weaknessi,t+2Number of Weaknesses + 3 Sum of ITKnowledge Score i,t+ 4LnAssets i,t+ 5ROAi,t+ 6Avg Sales Growthi,t+ 7Leveragei,t+

8Uncertaintyi,t+ 9Automatei,t+ 10Transformi,t+ 11High Techi,t+ 12Low Techi,t+


21/52

Equation 4 follows the model in Equation 2. However, in Equation 4, we are interested in

examining IT governance changes related to IT upgrades and IT management. We examine four

categories of IT upgrades, which include General IT (IT Upgrade), Financial (Financial IT

Upgrade), Accounting (Accounting IT Upgrade), and Non-Financial (Non-Financial IT

Upgrade). Any upgrade to the IT is included in the general IT upgrade. Upgrades specific to the

financial functions of the firm are included in the Financial upgrades. Accounting upgrades are

financial upgrades that specifically mention changes to the AIS. All other IT upgrades are

included in the Non-Financial upgrades. We include examples of IT upgrades and its categories

in Appendix D. Finally, we define an IT management upgrade to be present when the firm hires

an IT specific executive, adds a technology committee to the board, or promotes the CIO to

become one of the top five paid executives.

We again useIT Weakness as our variable of interest, and we expect it to be positive and

significant. When examining the association between IT material weakness categories and IT

knowledge changes, we substitute IT Weakness with the three categories of IT material

weaknesses (Data Processing Integrity, System Access and Security, and System Structure and

Usage).Finally, in Equation 4, we include the same control variables used in Equation 2 with theexception ofSum of IT Knowledge Score. This variable is a count of the total number of IT

knowledge changes the firm has undertaken. We include this variable because it is likely that the

new IT knowledge executive or director will make other IT changes to the firm.

V. Results


22/52

structure and usage, respectively.6 For the control variables, compared to control firms, IT

material weakness firms are generally smaller, less profitable, have lower institutional holdings,

have less analyst following, have less independent directors, less likely to have the CEO as

chairman of the board, have a greater cost leadership, and have a higher sum of IT knowledge

score.

Table 3, Panel B, presents the univariate statistics for the executive and director turnover

variables. As Panel B shows, the CEO and CFO turnover rates in IT material weakness firms

(49.1% and 75.4%) are significantly higher (p< 0.01) than the control-firm CEO and CFO

turnover rates (34.9% and 52.2%). In addition, IT material weakness firms experienced

significantly higher (p


23/52

difference). Moreover, IT material weakness (control) firms complete changes to 1.179 (0.502)

components of their IT governance (p


24/52

positive and significant (p


25/52

IT weakness firms without data processing integrity issues) have a 16.9% and 15.8% greater

likelihood of chairman of the board and independent director turnover, respectively. In addition

the coefficient for System Structure and Usage in regards to audit committee turnover is

significant (p


26/52

Thus, the results imply that IT material weakness firms, compared to control firms, are more

likely replace their CEOs and CFOs with executives that possess IT knowledge. When we

estimate the marginal effects (dy/dx), our results suggest that, after controlling for other

important economic determinants, IT material weakness firms are 1.3% and 4.9% more likely to

replace their CEOs and CFOs, respectively, with individuals possessing IT knowledge. In

models 3 and 4 of Table 6, we use our three classification measures of IT material weaknesses.

The results show no significance on any of the tree classification measures.

Table 7 reports the results of estimation of the change in chairman of the board, director,

and audit committee IT knowledge models. The coefficient forIT Weakness is positive and

significant (p


27/52

integrity issues are 4.49% more likely to replace their chairman of the board with an individual

having IT knowledge

In Table 8, we estimate several variations of our major IT initiative models. The

coefficient forIT Weakness is positive and significant (p


28/52

for model 8, suggesting that IT material weakness firms with data processing integrity issues are

more likely to upgrade their accounting IT. When we estimate the marginal effects (dy/dx), our

results suggest that, after controlling for other important economic determinants, IT material

weakness firms with data processing integrity issues are 18.9% more likely to upgrade their

accounting IT.

Additional Analysis

We find that IT material weakness firms, compared to control firms, are more likely to

replace executives with individuals with IT knowledge as well as make major IT initiative

changes. In subsequent analysis, we examine whether IT weakness firms that undergo such

remediation efforts are better able to remediate their internal control weaknesses. Table 9 reports

results of OLS models that regress the change in the total count of material weaknesses from t to

t+2 on IT knowledge changes, major IT initiative changes, and control variables.7 As shown in

Model 1 of Table 9, the coefficient ofAny IT Knowledge Change is negative and significant

(p


29/52

accounting restatements and material weaknesses in internal control over financial reporting. Our

study extends this literature by examining a unique failure of the financial reporting system.

Specifically we examine IT related internal control material weaknesses, because the evidence

suggests these weaknesses can be more detrimental to firms than other weaknesses.

In this study, we compare the remediation efforts of firms that report IT material

weaknesses to firms that report non-IT weaknesses. We find that the IT weakness firms have

higher levels of turnover of both executives and directors. This suggests that the firms are

punishing these executives and directors for the problems that IT weaknesses cause within the

financial reporting process. We also find that these firms follow this turnover with greater

remediation efforts by making changes to the corporate governance structure. Specifically, we

document that these firms replace (add) outgoing executives (directors) with individuals

possessing IT knowledge, and thus should have a better understanding of the IT weaknesses. In

addition, the IT weakness firms are more likely to upgrade their financial reporting IT and make

other IT initiative changes. However, we find evidence suggesting that IT weakness firms that

replace their CFO (and add directors) with IT knowledge are associated with successful

remediation of internal control weaknesses.

Overall, the evidence suggests that firms do recognize the importance of the role IT plays

within the financial reporting process. In the event of a failure, firms go to great lengths to

remediate the problems. We urge officers and directors of the firm to understand the importance

of IT in the financial reporting process and suggest they maintain strong oversight not just in

References


30/52

References

Agrawal, A., and T. Cooper. 2007. Corporate governance consequences of accounting scandals:Evidence from top management, CFO and auditor turnover. Working paper, University ofAlabama.

Ashbaugh-Skaife, H., D. Collins, W. Kinney, and R. LaFond. 2009. The effect of SOX internalcontrol deficiencies on firm risk and cost of equity.Journal of Accounting Research 47(1): 1-43.

Banker, R. D., N. Hu, J. Luftman, and P. Pavlou. 2010. CIO reporting structure, strategic positioning, and firmperformance: To whom should the CIO report? Working paper, Temple University, University ofWisconsin, and Stevens Institute of Technology.

Bart, C., and O. Turel. 2010. IT and the board of directors: An empirical investigation into the governancequestions Canadian board members ask about IT.Journal of Information Systems 24 (2): 147-172.

Beasley, M. S. 1996. An empirical analysis of the relation between the board of director composition andfinancial statement fraud. The Accounting Review 71 (4): 443-465.

Bedard, J. C., M. L. Ettredge, and K. M. Johnstone. 2007. Using electronic audit workpaper systems in audit

practice: Task analysis, learning, and resistance.Advances in Accounting Behavioral Research 10: 2953.

Bible, L., L. Graham, and A. Rosman. 2005. Comparing auditors performance in paper and electronic workenvironments.Journal of Accounting, Auditing & Finance (March): 27-42.

Bowen, R., S. Rajgopal, and M. Venkatachalam. 2008. Accounting discretion, corporategovernance, and firm performance. Contemporary Accounting Research 25 (2): 351-405.

Brazel, J. F., C. P. Agoglia, and R. C. Hatfield. 2004. Electronic versus face-to-face review: The effects ofalternative forms of review on auditors performance. The Accounting Review 79 (4): 949-966.

Chatterjee, D. C., V. J. Richardson, and R. Zmud. 2001. Examining the shareholder effects of new CIO positionannouncements.Management Information Systems Quarterly 25 (1): 43-70.

Collins, D., A. Masli, A. L. Reitenga, and J. M. Sanchez. 2009. Earnings restatements the Sarbanes-Oxley Actand the disciplining of Chief Financial Officers. The Journal of Accounting, Auditing, and Finance 24(1): 1-34.

Committee of Sponsoring Organizations of the Treadway Commission (COSO). 1992.Internal Control-Integrated Framework. New York, NY: AICPA.

DeFond M L R N Hann and X Hu 2004 Does the market value financial expertise on audit committees of


31/52

DeFond, M. L., R. N. Hann, and X. Hu. 2004. Does the market value financial expertise on audit committees ofboards of directors?Journal of Accounting Research 43 (2): 153-193.

Dehning, B., and V. J. Richardson. 2002. Returns on investments in information technology: A researchsynthesis.Journal of Information Systems 16 (1): 7-30.

Deloitte & Touche LLP. Why information technology controls can't be ignored. 2005 [cited May 10 2011].Available fromhttp://www.deloitte.com/view/en_CA/ca/services/ceocfocertification/article/2b21cb79791fb110VgnVCM100000ba42f00aRCRD.htm.

Desai, H., C. Hogan, and M. Wilkins. 2006. The reputational penalty for aggressive accounting:earnings restatements and management turnover. The Accounting Review 81 (1): 83-112.

Dewan, S., S. C. Michael, and C. Min. 1998. Firm characteristics and investments in information technology:Scale and scope effects.Information Systems Research 9 (3): 219-232.

Dowling, C. 2009. Appropriate audit support system use: The influence of auditor, audit team and firm factors.The Accounting Review 84 (3): 771-810.

, and S. A. Leech. 2007. Audit support system design and decision aids: Current practice and

opportunities for future research.International Journal of Accounting Information Systems 8: 92-116.

Doyle, J., W. Ge, and S. McVay. 2007. Determinants of weaknesses in internal control over financial reporting.Journal of Accounting and Economics 44: 193-223.

Farber, D. B. 2005. Restoring trust after fraud: Does corporate governance matter? The Accounting Review 80(2): 539-561.

Ferris, S., M. Jagannathan, and A. Pritchard. 2003. Too busy to mind the business? Monitoringby directors with multiple board appointments.Journal of Finance 48: 1087-1112.

Floyd, S. W., and B. Wooldridge. 1990. Path analysis of the relationship between competitive strategy,information technology, and financial performance.Journal of Management Information Systems 7 (1):47-64.

Francis, J., and K. Schipper. 1999. Have financial statements lost their relevance?Journal of Accounting

Research 37 (2): 319-352.

Ge, W., and S. McVay. 2005. The disclosure of material weaknesses in internal control after the Sarbanes-Oxley Act.Accounting Horizons 19 (3): 137-158.

Goh B W 2009 Audit committees boards of directors and remediation of material weaknesses

Hennes, K., A. Leone, and B. Miller. 2008. The importance of distinguishing errors from irregularities in


32/52

Hennes, K., A. Leone, and B. Miller. 2008. The importance of distinguishing errors from irregularities inrestatement research: The case of restatements and CEO/CFO turnover. The Accounting Review 83 (6):1487-1519.

Hogan, C., and M. Wilkins. 2008. Evidence on the audit risk model: Do auditors increase audit

fees in the presence of internal control deficiencies? Contemporary Accounting Research25: 219-242.

Hoitash, U., R. Hoitash, and J. Bedard. 2009. Corporate governance and internal control overfinancial reporting: A comparison of regulatory regimes. The Accounting Review 84 (3):839-867.

Hunton, J. E., B. Lippincott, and J. L. Reck. 2003. Enterprise resource planning systems: Comparing firm

performance of adopters and nonadopters.International Journal of Accounting Information Systems 4:165-184.

, E. G. Mauldin, and P. R. Wheeler. 2008. Potential functional and dysfunctional effects of continuousmonitoring. The Accounting Review 83 (6): 1551-1569.

Information Technology Governance Institute (ITGI). 2006.ISACA/ITGI Response to SEC Concept Release.Rolling Meadows, IL: Information Systems Assurance and Control Association (ISACA).

. 2007. COBIT 4.1. Rolling Meadows, IL. Available on-line on March 28, 2008 at:http://www.isaca.org/Template.cfm?Section=COBIT6&Template=/TaggedPage/TaggedPageDisplay.cf

m&TPLID=55&ContentID=7981

Jensen, M. 1993. The modern industrial revolution, exit and the failure of internal controlsystems.Journal of Finance 48: 831-880.

Johnstone, K, C. Li, and K. Rupley. 2010. Changes in corporate governance associated with the revelation ofinternal control material weaknesses and their subsequent remediation. Contemporary AccountingResearch, Forthcoming.

Klamm, B. K., and M. W. Watson. 2009. SOX 404 reported internal control weaknesses: A test of COSOframework components and information technology.Journal of Information Systems 23 (2) Fall: 1-23.

Klein, A. 2002. Audit committees, board of director characteristics, and earnings management.Journal of Accounting and Economics 33: 375-400.

Kobelsky, K., V. J. Richardson, R. E. Smith, and R. W. Zmud. 2008. Determinants and consequences of firminformation technology budgets. The Accounting Review 83 (4): 957-995.

Li, C., G. Peters, V. J. Richardson, and M. W. Watson. 2010a. The consequences of information technology


33/52

, , , , q gycontrol weaknesses on management information systems: The case of Sarbanes-Oxley internal controlreports.Management Information Systems Quarterly, Forthcoming.

, L. Sun, and M. Ettredge. 2010b. Financial executive quality, financial executive turnover,

and adverse SOX 404 opinions.Journal of Accounting and Economics, Forthcoming.

Masli, A., G. Peters, V. J. Richardson, and J. M. Sanchez. 2010. Examining the potential benefits of internalcontrol monitoring technology. The Accounting Review 85 (3): 1001-1034.

Messier, W. 1995. Research in and development of audit-decision aids. InJudgment and Decision-MakingResearch in Accounting and Auditing, edited by Ashton, R., and A. Ashton, 207-230. New York, NY:Cambridge University Press.

Nolan, R. and F. W. McFarlan. 2005. Information technology and the board of directors.Harvard BusinessReview October 2005: 1-11.

ODonnell, E., and J. David. 2000. How information systems influence user decisions: A research frameworkand literature review.International Journal of Accounting Information Systems 1 (3): 178-203.

, and J. J. Schultz. 2003. The influence of business-process-focused audit support software on analytical

procedures judgments.Auditing: A Journal of Practice & Theory 22 (2): 265-279.

Public Company Accounting Oversight Board (PCAOB). 2004.An Audit of Internal Control over FinancialReporting Performed in Conjunction with an Audit of Financial Statements. Auditing Standard No. 2.Washington, D.C.: PCAOB.

. 2007.An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit ofFinancial Statements. Auditing Standard No. 5. Washington,D.C.: PCAOB.

Srinivasan, S. 2005. Consequences of financial reporting failure for outside directors: Evidencefrom accounting restatements and audit committee members.Journal of AccountingResearch 43 (2): 291-334.

Weisbach, M. 1988. Outside directors and CEO Turnover.Journal of Financial Economics 20:431-460.

Ye, Z. and J. Krishnan. 2008. Weak internal controls, auditor fees, and shareholderdissatisfaction. Working paper, Kennesaw State University.

Yermack, D. 2004. Remuneration: Retention and reputation incentives for outside directors.Journal of Finance 59: 2281-2308.

Table 1


34/52

Sample Selection and Distribution

Panel A: Sample reconciliation

Firm year observations identified with IT Material Weaknesses 305

Less: Firms for which no DEF 14A or 10-K was found 9Less: Firms not in the Compustat Database 7

Final # of IT Material Weakness firm year observations 289

Random sample of non-IT Material Weakness firm year observations 289

Final # of firm year observations 578

Panel B: Industry representation

Industry2-Digit SIC

Code n % Total

Chemicals 28-29 36 6.23%

Electrical 36, 38 77 13.32%

Equipment 35 33 5.71%

Financial Institutions 60-65, 67 84 14.53%

Healthcare 80, 82 25 4.33%Media 27, 48 27 4.67%

Oil 13, 46 18 3.11%

Retail Sales 50-59 51 8.82%

Services 70-79 118 20.42%

All Others All Others 109 18.86%

Total 578 100%

Panel C: Year distribution

Year n % of Total

2004 205 35.47%2005 201 34.78%2006 172 29.76%

Total 578 100%

Table 2. Variable Definitions


35/52

Panel A: Turnover Dependent Variable Definitions

Variable Definition

CEO Turnover Equals one if there is CEO turnover in year t, t+1, or t+2; zero otherwise.

CFO Turnover Equals one if there is CFO turnover in year t, t+1, or t+2; zero otherwise.

Chairman TurnoverEquals one if there is Chairman of the board of directors turnover in year t, t+1, ort+2; zero otherwise.

Director Turnover Equals one if there is any director turnover in year t, t+1, or t+2; zero otherwise.Independent DirectorTurnover

Equals one if there is any independent director turnover in year t, t+1, or t+2; zerootherwise.

Audit Committee

Turnover

Equals one if there is any audit committee turnover in year t, t+1, or t+2; zero

otherwise.

Panel B: IT Governance Change Dependent Variable Definitions

Variable Definition

Any IT GovernanceChange

Equals one if the firm hires any managers or directors with IT knowledge or makesan IT Initiative Change in year t, t+1, or t+2; zero otherwise.

Count of ITGovernance Changes

Equals a count of the number of IT changes made in year t, t+1, or t+2. Thisvariable can range from 0 to 7.

CEO IT Knowledge Equals one if the firm replaced a NON-IT knowledge CEO with an IT KnowledgeCEO in year t, t+1, or t+2 ; zero otherwise.

CFO IT KnowledgeEquals one if the firm replaced a NON-IT knowledge CFO with an IT KnowledgeCFO in year t, t+1, or t+2 ; zero otherwise.

Chairman ITKnowledge

Equals one if the firm replaced a NON-IT knowledge BOD Chairman with an ITKnowledge BOD Chairman in year t, t+1, or t+2 ; zero otherwise.

Director ITKnowledge

Equals one if the firm hired at least one director with IT knowledge in year t,t+1, ort+2 ; zero otherwise.

Audit Committee ITKnowledge

Equals one if the firm hired at least one audit committee member with ITknowledge in year t,t+1, or t+2 ; zero otherwise.

IT Upgrade Equals one if the firm upgraded their IT; zero otherwise

Financial IT Upgrade Equals one if the firm upgraded their financial reporting IT; zero otherwise

Accounting ITUpgrade

Equals one if the firm upgraded their accounting IT; zero otherwise

Non-Financial IT

Upgrade Equals one if the firm upgraded their non-financial reporting IT; zero otherwise

IT ManagementEquals one hired an IT executive, added a technology committee, or moved the CIOto be a top 5 executive in year t,t+1, or t+2; zero otherwise.

Panel C: Independent Variables


36/52

Variable Definition

Main Independent

Variables

IT Weakness FirmEquals one if the firm reported and IT material weakness in internal controls in year

t; zero otherwise.Data ProcessingIntegrity Equals one if a firm has ITMW related to data processing integrity; zero otherwise.System Access andSecurity

Equals one if a firm has ITMW in the data quality dimension of access; zerootherwise.

System Structure andUsage Equals one if a firm has ITMW in IT structure quality dimensions; zero otherwise.

Control Variables

Number ofWeaknesses

Equal to the total number of SOX 404 material weaknesses in internal controlreport by the firm in year t.

LnAssets Equal to the natural log of total assets in year t.

Leverage Equals to total debt divided by total assets in year t.

BTM Equals to the book to market ratio in year t.

ROAEquals to the return on assets calculated as net income divided by total assets inyear t.

Loss Equals one if the company reports a net loss in year t; zero otherwise.Institutional Holdings

Equals to the proportion of institutional shareholdings of common stock in the firmin year t.

Analyst Equals to the average number of analysts following the firm in year t.

RestatementEquals one if the company reports a restatement in year t-1, t, or t+1; zerootherwise.

Board Size Equals to the number of directors serving on the board in year t.

Board Independence Equals to the proportion of independent directors serving on the board in year t.

CEO Chairman Equals one if the CEO is also the chairman of the board in year t; zero otherwise.

Avg Sales GrowthEquals average sales growth for t-1 and t. (sales growth is calculated as sales in yeart/ sales in year t-1)

UncertaintyEquals the standard deviation of earnings before extraordinary items for previousfive years scaled by sales

Automate Equals one if automate industry IT role, zero otherwise.

Transform Equals one if transform industry IT role, zero otherwise.

High Tech Equals one if high-tech industry, zero otherwise.Low Tech Equals one if low-tech industry, zero otherwise.

Foreign Equals one if the firm engaged in foreign transactions, zero otherwise.

Merger Equals one if the firm engaged in mergers and acquisitions, zero otherwise.

Restructuring Equals one if the firm engaged in restructuring activity, zero otherwise.

Table 3. Selected Summary Statistics for IT Material Weakness and Non-IT Material Weakness Firms


37/52

Panel A: Descriptive statistics for control variables

IT Weakness Firms Non-IT Weakness Firms

N= 289 N= 289 p-value

Variables Mean Median Mean Median Diff

Data Processing Integrity 0.716 1

System Access and Security 0.512 1

System Structure and Usage 0.208 0

Number of Weaknesses 3.888 3 1.594 1


38/52

Panel C: Descriptive statistics for change in IT governance variables

IT Weakness Firms Non-IT Weakness Firms

n= 289 n= 289 p-value

Variables Mean Median Mean Median Diff

Any Change to IT Governance 0.675 1 0.349 0


39/52

(Note:Controlvariablesincludedintheregressionappearonthenextpage)

The sample consists of IT and non-IT material weakness firm-year observations. The dependent variableis an indicator variable set equal to one if there was turnover in the specified position in any of the yearst, t+1, and t+2.

Panel A. Executive and director turnover

Model 1 Model 2 Model 3 Model 4 Model 5 Model 6

Variables PredCEO

TurnoverCFO

TurnoverDirectorTurnover

CEOTurnover

CFOTurnover

DirectorTurnover

IT Weakness + 0.338** 0.738*** 0.982***(0.047) (0.000) (0.000)

IT WeaknessClassification

Data ProcessingIntegrity

+ 0.438** 0.629** 0.733***

(0.047) (0.014) (0.005)System Access andSecurity

+ -0.516 -0.021 0.014

(0.968) (0.528) (0.481)

System Structure andUsage

+ 0.156 -0.258 0.082

(0.318) (0.738) (0.408)

Table 4 Panel A continued



40/52


Variables PredCEO

Turnover

CFO

Turnover

Director

Turnover

CEO

Turnover

CFO

Turnover

Director

TurnoverControl Variables

Number of Weaknesses + 0.103*** 0.164*** -0.079 0.128*** 0.193*** -0.059(0.006) (0.002) (0.973) (0.002) (0.001) (0.911)

LnAssets + -0.094 -0.045 -0.076 -0.092 -0.035 -0.056

(0.904) (0.717) (0.831) (0.897) (0.669) (0.760)

Leverage + 0.139 -0.533 -0.565 0.113 -0.578 -0.629

(0.352) (0.891) (0.912) (0.379) (0.908) (0.932)

BTM + 0.022* 0.032** -0.559 0.025* 0.032** -0.597

(0.089) (0.019) (0.999) (0.085) (0.018) (0.999)

ROA - 0.155 -0.082 0.225 0.132 -0.092 0.214

(0.786) (0.386) (0.841) (0.750) (0.377) (0.833)

Loss + 0.384** 0.494** 0.069 0.363** 0.483** 0.054

(0.027) (0.012) (0.374) (0.035) (0.014) (0.400)

Institutional Holdings + -0.408 -0.612 0.482* -0.440 -0.613 0.494*

(0.885) (0.959) (0.086) (0.899) (0.962) (0.080)

Analyst + 0.010 0.034** -0.004 0.010 0.032* -0.005

(0.314) (0.049) (0.578) (0.314) (0.054) (0.599)

Restatement + -0.094 0.391** 0.614*** -0.162 0.352** 0.564***

(0.687) (0.027) (0.001) (0.794) (0.042) (0.003)

Board Size ? 0.167*** -0.022 0.136*** 0.167*** -0.021 0.133**

(0.000) (0.607) (0.009) (0.000) (0.624) (0.011)

Board Independence + -0.627 -0.047 -0.729 -0.816 -0.245 -0.995

(0.836) (0.529) (0.853) (0.902) (0.647) (0.930)

CEO Chairman -/+ 0.147 -0.177 0.918*** 0.153 -0.175 0.855***

(0.702) (0.278) (0.004) (0.709) (0.272) (0.006)

Automate ? -0.053 0.999* 0.153 -0.055 0.965* 0.132

(0.904) (0.058) (0.753) (0.897) (0.074) (0.780)Transform ? 0.753*** 0.184 -0.016 0.725*** 0.143 -0.055

(0.006) (0.520) (0.957) (0.008) (0.610) (0.845)

High Tech ? 0.306 -0.115 -0.248 0.256 -0.138 -0.289

(0.168) (0.628) (0.293) (0.255) (0.556) (0.215)

Low tech ? 0.225 0.007 0.316 0.179 -0.102 0.229

(0.669) (0.989) (0.578) (0.729) (0.833) (0.685)

Intercept -1.590** -0.196 0.175 -1.311** 0.013 0.472

(0.018) (0.766) (0.809) (0.050) (0.984) (0.515)Year Indicator Included Included Included Included Included Included

Number of observations 578 578 578 578 578 578

Model 2 42.29 61.35 65.47 43.58 55.00 54.51

Pseudo R2 0.067 0.111 0.101 0.069 0.104 0.087

Correctly Classified 0 634 0 692 0 688 0 634 0 697 0 689

P l B T f di t t


41/52

Panel B. Type of director turnover


Variables Pred

Chairman

of BODTurnover

Independent

DirectorTurnover

Audit

CommitteeTurnover

Chairman

of BODTurnover

Independent

DirectorTurnover

Audit

CommitteeTurnover

IT Weakness + 0.966*** 0.951*** 0.216(0.001) (0.000) (0.155)

IT Weakness

Classification

DataProcessing

Integrity

+ 1.169*** 0.679*** 0.107

(0.000) (0.004) (0.351)SystemAccess andSecurity

+ -0.476 0.132 -0.002

(0.922) (0.315) (0.502)SystemStructure and

Usage

+ -0.199 0.009 0.486*

(0.687) (0.489) (0.071)

Table 4 Panel B Continued


Chairman Independent Audit Chairman Independent Audit


42/52

Variables Pred

Chairman

of BOD

Turnover

Independent

Director

Turnover

Audit

Committee

Turnover

Chairman

of BOD

Turnover

Independent

Director

Turnover

Audit

Committee

Turnover

Control Variables

Number of Weaknesses + 0.017 -0.088 -0.079 0.038 -0.072 -0.085(0.347) (0.989) (0.969) (0.217) (0.965) (0.973)

LnAssets + 0.029 -0.025 -0.001 0.063 -0.003 0.005(0.379) (0.631) (0.505) (0.260) (0.518) (0.524)

Leverage + 0.024 -0.352 -0.142 -0.062 -0.430 -0.146(0.480) (0.798) (0.631) (0.550) (0.846) (0.634)

BTM + -0.414 -0.474 -0.254 -0.444 -0.507 -0.237(0.996) (0.979) (0.983) (0.995) (0.984) (0.973)

ROA - -0.120 0.253 0.081 -0.148 0.231 0.064

(0.314) (0.805) (0.643) (0.271) (0.797) (0.620)Loss + 0.185 0.243 0.034 0.174 0.221 -0.001

(0.234) (0.120) (0.436) (0.251) (0.139) (0.503)

Institutional Holdings + 0.177 0.680** -0.153 0.175 0.691** -0.174(0.348) (0.021) (0.669) (0.348) (0.019) (0.690)

Analyst + 0.013 -0.004 -0.012 0.014 -0.004 -0.011(0.307) (0.583) (0.717) (0.299) (0.584) (0.699)

Restatement + 0.460* 0.395** 0.469** 0.400* 0.361** 0.469**(0.051) (0.021) (0.011) (0.077) (0.032) (0.011)

Board Size ? 0.111** 0.171*** 0.079* 0.113** 0.169*** 0.078*(0.040) (0.000) (0.063) (0.042) (0.000) (0.064)

Board Independence + 1.329 1.714*** 0.618 0.946 1.415** 0.530(0.121) (0.005) (0.189) (0.195) (0.013) (0.222)

CEO Chairman + 0.088 0.518** 0.524** 0.073 0.452* 0.506**(0.410) (0.042) (0.038) (0.427) (0.064) (0.042)

Automate ? 0.208 -0.193 -0.483 0.195 -0.223 -0.474(0.712) (0.669) (0.378) (0.732) (0.618) (0.395)

Transform ? -0.105 0.316 0.325 -0.087 0.278 0.306(0.775) (0.248) (0.227) (0.814) (0.301) (0.261)

High Tech ? 0.118 -0.125 0.204 0.072 -0.161 0.175(0.679) (0.579) (0.373) (0.804) (0.473) (0.446)

Low tech ? 0.457 0.206 0.355 0.351 0.146 0.390(0.456) (0.700) (0.488) (0.589) (0.782) (0.447)

Intercept -5.205*** -2.902*** -2.040*** -4.932*** -2.615*** -1.974***(0.000) (0.000) (0.004) (0.000) (0.000) (0.006)

Year Indicator Included Included Included Included Included Included Number of observations 578 578 578 578 578 578

Model 2 38.73 57.36 25.89 43.13 50.26 27.09

Pseudo R2 0.098 0.099 0.042 0.101 0.087 0.045Correctly Classified 0.847 0.643 0.689 0.846 0.657 0.694

note: *** p


43/52

to IT Governance is an indicator variable set equal to one if there were any changes to IT Governance made in any ofthe years t, t+1, or t+2. The dependent variable Count of IT Governance Changes is a count of the total number ofchanges made to IT Governance made in the years t, t+1, and t+2. These IT Governance changes include hiring orappointing a CEO, CFO, director, chairman, or audit committee member with IT knowledge, upgrading the FinancialIT, or making an IT management Change.

Model 1 Model 2 Model 3 Model 4

Variables Pred

Any Change

to IT

Governance

Count of IT

Governance

Changes

Any Change

to IT

Governance

Count of IT

Governance

Changes

IT Weakness Firm + 1.211*** 1.157***(0.000) (0.000)

IT Weakness Classification

Data Processing Integrity + 0.840*** 0.610***(0.001) (0.004)

System Access and Security + 0.303 0.282(0.132) (0.125)

System Structure and Usage + -0.310 -0.103(0.808) (0.635)

Control Variables

Number of Weaknesses + 0.108*** 0.108*** 0.133*** 0.130***(0.006) (0.000) (0.002) (0.000)

LnAssets ? -0.132** -0.100 -0.113 -0.091(0.049) (0.145) (0.102) (0.190)

ROA + 0.199 -0.017 0.185 -0.022(0.163) (0.533) (0.172) (0.545)

Avg Sales Growth - -0.284* -0.147 -0.268* -0.136(0.093) (0.225) (0.097) (0.231)

Leverage - -0.461 -0.429 -0.500* -0.430(0.119) (0.128) (0.100) (0.123)

Uncertainty + 0.023** 0.012* 0.021* 0.010(0.044) (0.085) (0.056) (0.126)

Automate + 0.363 0.143 0.308 0.074(0.237) (0.363) (0.274) (0.432)

Transform + -0.463 -0.131 -0.499 -0.169(0.943) (0.671) (0.962) (0.726)

High Tech + 0.114 0.465** 0.070 0.419**(0.314) (0.017) (0.383) (0.029)

Low Tech ? -0.499 -0.405 -0.634 -0.490(0.342) (0.401) (0.205) (0.284)

Foreign ? 0.468** 0.603*** 0.487** 0.610***(0.025) (0.001) (0.018) (0.001)

Merger ? -0.156 0.126 -0.072 0.145

(0.755) (0.808) (0.874) (0.760)Restructuring ? 0.620*** 0.459** 0.596*** 0.466**(0.006) (0.021) (0.007) (0.019)

Product Differentiation ? -0.059 -0.006 -0.060 -0.008(0.253) (0.871) (0.272) (0.827)

Cost Leadership ? 0.182 0.287** 0.207 0.307**(0 168) (0 024) (0 124) (0 019)

Table 6. IT Material Weaknesses and Executive IT KnowledgeThe sample consists of IT and non-IT material weakness firm-year observations. The dependent variable is anindicator variable set equal to one if the company replaced an executive lacking IT knowledge with an IT


44/52

q p y p g gknowledge executive in any of the years t, t+1, or t+2.

Model 1 Model 2 Model 3 Model 4

Variables PredCEO IT

Knowledge

CFO IT

Knowledge

CEO IT

Knowledge

CFO IT

Knowledge

IT Weakness Firm + 0.821* 0.845**(0.075) (0.011)


Data Processing Integrity + 0.437 -0.154(0.249) (0.620)

System Access and Security + -0.215 0.554(0.646) (0.133)

System Structure and Usage + 0.152 -0.040(0.411) (0.532)

Control Variables Number of Weaknesses + 0.059 0.149*** 0.094* 0.174***

(0.185) (0.002) (0.092) (0.001)LnAssets ? -0.171 -0.190 -0.170 -0.195

(0.444) (0.215) (0.464) (0.214)ROA + -0.358 0.487* -0.362 0.442

(0.864) (0.090) (0.877) (0.111)Avg Sales Growth - -1.061** 0.083 -0.989* 0.093

(0.048) (0.639) (0.056) (0.655)Leverage - -0.810 -0.551 -0.840 -0.517

(0.216) (0.217) (0.202) (0.246)Uncertainty + 0.002 -0.000 -0.001 -0.001

(0.477) (0.508) (0.514) (0.518)Automate + 1.492 -0.081 1.368 -0.179

(0.104) (0.535) (0.117) (0.576)Transform + 1.231** -1.041 1.213** -1.025

(0.019) (0.971) (0.026) (0.973)High Tech + 0.328 -0.990** 0.310 -0.973**

(0.297) (0.991) (0.312) (0.991)

Low Tech ? 1.351 -1.410 1.240 -1.346(0.209) (0.280) (0.267) (0.291)

Foreign ? 0.623 0.290 0.578 0.327(0.162) (0.393) (0.202) (0.339)

Merger ? 1.159 0.569 1.178 0.644(0.179) (0.343) (0.165) (0.291)

Restructuring ? 1.373*** 0.978*** 1.382*** 0.969***(0.007) (0.006) (0.007) (0.006)

Product Differentiation ? 0.049 -0.152 0.039 -0.136

(0.687) (0.117) (0.751) (0.137)Cost Leadership ? 0.539* 0.193 0.525* 0.209

(0.064) (0.309) (0.075) (0.278)Intercept -3.459** -2.583** -3.273* -2.320**

(0.048) (0.016) (0.060) (0.027)Year Indicator Included Included Included Included

N b f b i 578 578 578 578

Table 7. IT Material Weaknesses and Board of Directors IT Knowledge

The sample consists of IT and non-IT material weakness firm-year observations. The dependent variable is an indicatorvariable set equal to one if the company replaced a chairman lacking IT knowledge with an IT knowledge chairman or


45/52

increased the total number of IT knowledge directors in any of the years t, t+1, or t+2.


Variables Pred

Chairman

IT

Knowledge

Director

IT

Knowledge

Audit

Committee

ITKnowledge

Chairman

IT

Knowledge

Director

IT

Knowledge

Audit

Committee

ITKnowledge

IT Weakness Firm + 0.725** 0.211 0.303(0.011) (0.217) (0.188)


Data Processing Integrity + 0.581* -0.358 0.234(0.065) (0.824) (0.300)

System Access and Security + -0.471 0.400 0.407(0.884) (0.142) (0.186)

System Structure and Usage + 0.449 0.143 -0.531(0.142) (0.367) (0.833)Control Variables

Number of Weaknesses + 0.072* 0.083** 0.012 0.097** 0.095** 0.003(0.063) (0.036) (0.409) (0.025) (0.022) (0.482)

LnAssets ? -0.484*** -0.066 0.065 -0.491*** -0.066 0.085(0.000) (0.546) (0.535) (0.000) (0.549) (0.435)

ROA + 0.539** -0.493 -0.422 0.500** -0.507 -0.436(0.011) (0.978) (0.954) (0.012) (0.983) (0.962)

Avg Sales Growth - -0.162 -0.127 0.068 -0.146 -0.129 0.040(0.229) (0.333) (0.602) (0.254) (0.334) (0.565)

Leverage - 0.765 -1.081** -1.233 0.717 -1.099** -1.283*(0.933) (0.022) (0.94) (0.940) (0.020) (0.052)

Uncertainty + 0.009 0.007 -0.181* 0.006 0.007 -0.169*(0.269) (0.376) (0.966) (0.352) (0.377) (0.960)

Automate + -0.031 -0.277 -0.038 -0.297(0.516) (0.601) (0.519) (0.607)

Transform + 0.332 0.451* 0.483 0.309 0.457* 0.494(0.178) (0.092) (0.132) (0.189) (0.090) (0.124)

High Tech + 0.555** 0.955*** 1.437*** 0.472* 0.964*** 1.467***(0.041) (0.001) (0.000) (0.074) (0.001) (0.000)

Low Tech ? -0.514 0.322 0.021 -0.504 0.375 -0.021(0.639) (0.625) (0.983) (0.650) (0.566) (0.983)

Foreign ? 0.839*** 0.581** 0.144 0.831*** 0.582** 0.152(0.004) (0.026) (0.671) (0.006) (0.026) (0.656)

Merger ? 0.170 -0.039 -1.555 0.233 -0.020 -1.531(0.767) (0.948) (0.144) (0.686) (0.973) (0.148)

Restructuring ? 1.019*** 0.309 -0.363 1.017*** 0.337 -0.357

(0.001) (0.253) (0.294) (0.001) (0.214) (0.299)Product Differentiation ? -0.016 0.099 0.191 -0.030 0.101 0.180(0.783) (0.178) (0.139) (0.617) (0.161) (0.134)

Cost Leadership ? -0.315 -0.036 -0.111 -0.336 -0.024 -0.101(0.187) (0.852) (0.639) (0.160) (0.899) (0.667)

Intercept -0.675 -1.796** -3.234*** -0.451 -1.770** -3.326***(0 473) (0 023) (0 001) (0 632) (0 027) (0 001)


46/52

Restructuring ? 0.125 0.119 -0.644** 0.697* -0.144 0.088 0.082 -0.655** 0.740* -0.159

(0.628) (0.661) (0.029) (0.097) (0.695) (0.729) (0.758) (0.028) (0.084) (0.668)


47/52

45

Product Differentiation ? -0.028 -0.026 -0.031 -0.005 0.309 -0.030 -0.030 -0.039 0.005 0.243

(0.588) (0.634) (0.653) (0.962) (0.186) (0.528) (0.539) (0.529) (0.965) (0.286)

Cost Leadership ? 0.379*** 0.423*** 0.220 0.398 0.682*** 0.404*** 0.442*** 0.239 0.398 0.686***

(0.008) (0.005) (0.189) (0.114) (0.001) (0.007) (0.005) (0.165) (0.117) (0.001)

Intercept -4.073*** -4.934*** -6.018*** -1.726 -1.165 -3.899*** -4.494*** -5.355*** -1.770 -1.038(0.000) (0.000) (0.000) (0.230) (0.355) (0.000) (0.000) (0.000) (0.203) (0.411)

Year Indicator Included Included Included Included Included Included Included Included Included Included

Number of observations 578 578 578 556 578 578 578 578 556 578

Model 2 114.21 117.81 78.28 29.66 56.89 99.07 102.39 76.78 34.41 58.94

Pseudo R2 0.222 0.273 0.256 0.086 0.121 0.183 0.215 0.199 0.094 0.128

Correctly Classified 0.775 0.812 0.843 0.946 0.922 0.777 0.793 0.854 0.945 0.918

note: *** p


48/52

404 material weaknesses reported from year t to t+2. Any IT Knowledge Change is defined as 1 if CEO IT Knowledge=1 OR CFOIT Knowledge=1 OR Chairman IT Knowledge=1 OR Director IT Knowledge=1 OR Audit Committee IT Knowledge=1, 0otherwise. The changes in control variables represent changes from t to t+2. Please see Table 2 for other variable definitions.

DV =Change in # of Weaknesses from t to t+2

Pred Model 1 Model 2 Model 3 Model 4

IT Knowledge Changes

Any IT Knowledge Change - -0.745**(0.048)

CEO IT Knowledge - -0.169 -0.064 -0.034(0.391) (0.409) (0.484)

CFO IT Knowledge - -1.004* -0.930* -0.909*(0.070) (0.089) (0.072)

Chairman IT Knowledge - 0.426 0.423 0.409(0.694) (0.695) (0.725)

Director IT Knowledge - -0.945* -0.913* -0.900**

(0.058) (0.065) (0.045)Audit Committee IT Knowledge - 0.885 0.915 0.911

(0.561) (0.560) (0.588)Major IT Initiatives

Financial IT Upgrade - -0.318 -0.314(0.230) (0.225)

IT management - -0.234(0.364)

Control Variables

Change in Ln Assets - 0.451 0.332 0.327 0.332(0.679) (0.757) (0.762) (0.740)

Change in Leverage + -0.750 -0.719 -0.653 -0.650(0.694) (0.711) (0.734) (0.775)

Change in BTM + -0.002 0.002 0.001 0.001(0.901) (0.794) (0.859) (0.921)

Change in ROA - 0.143 0.217 0.237 0.232(0.809) (0.753) (0.736) (0.781)

Change in Loss + 0.181 0.101 0.132 0.130(0.620) (0.783) (0.723) (0.738)

Change in Merger + -1.301 -1.417 -1.436 -1.468(0.946) (0.961) (0.960) (0.962)

Change in Foreign + -0.898 -0.952 -1.035 -1.038(0.940) (0.944) (0.951) (0.964)

Change in Restructuring + -0.612 -0.692 -0.702 -0.702(0.943) (0.959) (0.960) (0.959)

Change in Growth - 0.003 -0.066 -0.059 -0.054(0.995) (0.773) (0.801) (0.785)

Change in Board Size + 0.124 0.108 0.114 0.119(0.326) (0.398) (0.376) (0.290)

Change in Board Independence - -0.089 0.464 0.443 0.437(0.965) (0.903) (0.908) (0.914)

Change in Institutional Holdings - -1.582* -1.585* -1.546* -1.558**(0.080) (0.082) (0.085) (0.042)

Automate ? 0.128 0.230 0.330 0.299(0.842) (0.725) (0.630) (0.773)

Transform ? -0.343 -0.539 -0.586 -0.602(0.631) (0.450) (0.414) (0.339)

High Tech ? 0.130 -0.209 -0.213 -0.215

Appendix A. IT Control Quality Dimensions (Adapted from Li et al. 2010a)

QualityDimension

Identifier Definitions* Examples from the SOX 404 Managements Report on Internal Control


49/52

47

Dimension

Data processingintegrity

IT PROCESS The extent to which data arecorrect and reliable.

Ability to change closed accounting periods in systemAbility to delete (used) accounts from the systemData or program changes lack user review/approval/authorization/testingDid not properly maintain master files (e.g., vendor, price, inventory)Inadequate development and maintenance (e.g., new system, updates)Inadequate IS/IT support staffInadequate system to support business processes (includes manually intense processes)Integrity of computer data not verified (e.g., accuracy, validity, completeness)Lack of IS/IT controlsLack of IS/IT controls over subsidiary/foreign operationsLack of IT experience (inadequate skills)Program change controls missing or inadequate

Programming errorsRelying on systems of others (outsourcing) where controls not verifiedSpreadsheet(s), lack of controls over(Too) Functionally complex systemsWeak application controlsWeak general controlsWeak IT Control ActivitiesWeak IT Control EnvironmentWeak IT Risk Assessment

Weak IT MonitoringSystem Access

and SecurityIT SECURITY The extent to which:

data are available, or easilyand quickly retrievable and

access to data is restrictedappropriately to maintainits security.

(Business user) Segregation of duties not implemented in systemInadequate records and storage retentionLack of disaster recovery plan for systemsIS/IT personnel access not properly segregatedLogical access issuesSecurity issues

System Structureand Usage

ITSTRUCTURE

The extent to which data are:

easily comprehended presented in the same

format

Decentralized systemsDisparate (non-integrated) systems

Insufficient training on systemLack of system documentation, policies, proceduresWeak Information & Communication


50/52


51/52

Appendix D. Examples of IT Upgrades


52/52

50

IT Upgrade (Affirmative Insurance Holdings Inc.)

To remediate the IT material weakness described above, we have implemented new policies and procedures to ensure proper access controls are

maintained and monitored. We have increased the supervisory control over access controls, centralizing it for more direct monitoring. In someinstances, we have adjusted system configurations and incorporated software tools where appropriate to limit and restrict the ability of system usersto enter, change and view data and to provide a detailed history of changes to the applications and data.

Financial IT Upgrade (Richardson Electronics LTD)

The Company is in the application development stage of implementing certain modules of enterprise resource management software (PeopleSoft).

Accounting IT Upgrade (Adelphia Communications)With respect to the access to financial applications and data material weakness described above, subsequent to December 31, 2004, we havesubstantially completed our remediation efforts. We have implemented controls, including policies and procedures that govern security and access toour IT systems, programs and data, including those supporting our financial data relating to property and equipment and our general ledger andfinancial reporting applications.

Non-Financial IT Upgrade (Actividentity Corp.)

To meet these challenges we implemented a new customer relationship management system in fiscal 2005, and are continuing the process ofmodifying and refining it to better meet our needs.

Documents

Impact of SOX IT Material Weaknesses