The current issue and full text archive of this journal is available at

www.emeraldinsight.com/0268-6902.htm

MAJ
26,2

External auditor characteristics

and internal control reporting
under SOX section 302

114

Nathaniel M. Stephens

Received 29 June 2010

Reviewed 30 August 2010
Accepted 5 September 2010

School of Accountancy, Jon M. Huntsman School of Business,

Utah State University, Logan, Utah, USA
Abstract
Purpose The purpose of this paper is to examine whether external auditor traits influenced the
reporting of internal control deficiencies (ICDs) prior to SOX-mandated audits, holding constant the
existence of a control weakness.
Design/methodology/approach Data are collected from publicly available sources such as
Securities and Exchange Commission filings and Audit Analytics database.
Findings Companies that were audited by industry leading auditors were more likely to disclose
ICDs prior to SOX-mandated audits and that companies with longer client-auditor tenure were less
likely to disclose ICDs prior to SOX-mandated audits.
Originality/value These findings suggest that while external auditors were not required to
participate in internal control evaluation and certifications prior to their audit of internal control for the
2004 fiscal year, they nevertheless influence the likelihood of ICD disclosure prior to their initial audit.
Keywords United States of America, Legislation, Internal control, External auditing
Paper type Research paper

1. Introduction
This study examines the impact of external auditors on firm reporting quality of
information that is not the subject of the external audit. Specifically, it examines the
auditors impact on firm reporting of internal control deficiencies (ICDs) prior to
Sarbanes-Oxley Act (SOX)-mandated audits.
To test the link between auditor characteristics and company reporting, internal
control reports issued by management under section 302 of SOX are used. This section
requires that CEOs and CFOs certify in each quarterly and annual report that they
have evaluated the companys internal controls as of a date within 90 days prior to the
report and that they have presented their conclusions regarding the effectiveness
of their controls in that quarterly or annual report. This requirement relates to all
quarterly and annual filings after August 29, 2002.

Managerial Auditing Journal

Vol. 26 No. 2, 2011
pp. 114-129
q Emerald Group Publishing Limited
0268-6902
DOI 10.1108/02686901111095001

The author thanks his dissertation Committee: Dan Dhaliwal and Bill Felix (Co-Chairs), and
Mark Trombley for their valued guidance. He also appreciates thoughtful comments and
suggestions provided by Jef Doyle, Dana Hermanson, Jessen Hobson, Keith Jones, Jason Smith,
Rick Warne and workshop participants at the Brigham Young University 2007 Accounting
Research Symposium and at Utah State University, the University of Arizona, Virginia Tech
University, George Mason University, and the University of Nebraska. He is grateful for the
financial assistance provided by the University of Arizona and the Deloitte Foundation. All
errors are his own.

The requirements in SOX relating to internal control reporting provide an ideal setting
to examine the impact of auditors on firm reporting in the absence of the audit. Under
section 302, management is required to perform control evaluations; however, the auditor
is not required to evaluate managements assessment of control quality or to perform their
own control evaluation. Beginning with fiscal year ends after November 15, 2004, section
404 of SOX requires that the external financial statement auditor perform an audit of the
firms internal controls over financial reporting and provide an opinion in the annual filing
as to their effectiveness as well as an opinion regarding managements assessment of
internal controls[1]. Therefore, from the period of August 29, 2002 until the firms first
fiscal year end on or after November 15, 2004, the reporting decisions of the firm regarding
internal control quality were controlled by management and other corporate governance
bodies. External auditors had no responsibility during this time period to perform the
extent of control tests necessary to come to a conclusion regarding control effectiveness,
nor did they have a responsibility to publicly report on internal control quality.
This lag time between the implementation of sections 302 and 404 is used to examine
the impact of auditor characteristics on disclosure quality in a setting where it is known
what should have been disclosed (i.e. weaknesses identified in the audited internal
control report)[2].
This paper examines only those companies that disclosed material weaknesses in
internal controls in their first audited internal control report. From this sample of
companies with material weaknesses, the study looks back in time to compare companies
that disclose those ICDs under the section 302 regime with companies that do not disclose
them under the section 302 regime but subsequently disclose them under section 404.
Using this sample, the study examines auditor characteristics relating to the disclosure of
ICDs under section 302 of SOX, holding constant the existence of a weakness[3].
An implicit assumption is that material weaknesses disclosed in companys annual
filings under SOX 404 existed throughout the fiscal year. An attempt was made to limit
those observations where the control weakness was reported under section 404 but did not
exist previously by looking at only the three quarters prior to the first 404 report to
determine whether the observation was in the group disclosing under section 302 or the
group not disclosing under section 302. This assumption is also in line with assumptions
made in prior research as well as by professionals. For example, Glass-Lewis & Company
argue, In our view, the control deficiency probably did not appear overnight.
Consequently, we feel that the problem most likely existed in prior quarters (Glass Lewis
& Company, 2005). Doyle et al. (2007a) argue that many of the internal control weaknesses
have existed for several years prior to their disclosure, if not since the firms inception.
This paper presents evidence that companies that were audited by industry leading
auditors and that have audit committees with an accounting financial expert are more
likely to have disclosed ICDs during the section 302 regime (prior to the SOX
404-mandated audit of internal controls). There is a negative relationship between
auditor tenure and the likelihood of internal control disclosures under the section 302
reporting regime. These findings suggest that while external auditors were not required
to participate in internal control evaluation and/or reporting prior to their audit
of internal control for the 2004 fiscal year, they nevertheless influence the likelihood
of ICD disclosure prior to their initial audit.
The paper proceeds as follows: Section 2 provides background and reviews the
internal control literature. Section 3 contains a discussion of the independent variables

External auditor
characteristics

115

MAJ
26,2

116

examined and hypotheses with respect to each. Section 4 contains a discussion of the
sample as well as descriptive and univariate test results for each of the independent
variables. Section 5 contains a description of the multivariate model used and results
from its estimation. Section 6 discusses conclusions.
2. Background and prior literature
2.1 Background
The United States Congress (2002) passed the SOX in the wake of many corporate
frauds. In an effort to improve the quality of financial disclosures made by firms,
congress included new requirements in SOX relating to the review and testing of internal
controls. Specifically, SOX section 302 requires that CEOs and CFOs certify, in each
quarterly or annual report, that they have evaluated the companys internal controls
as of a date within 90 days prior to the report and that they have presented their
conclusions regarding the effectiveness of their controls in that quarterly or annual
report. This requirement relates to all quarterly or annual filings after August 29, 2002.
In their evaluations, management is to focus on internal control problems that may
lead to misstatements in the financial statements. Auditing Standard No. 2 (AS2)
defines two terms, borrowed from previous US auditing and attest standards, to be
used to classify control problems. A material weakness is defined by AS2 as:
[. . .] a significant deficiency, or combination of significant deficiencies, that results in more
than a remote likelihood that a material misstatement of the annual or interim financial
statements will not be prevented or detected.

Material weaknesses differ from significant deficiencies in the magnitude of the

potential misstatement resulting from the control weakness. Whereas, a material
weakness could result in a material misstatement, a significant deficiency could result
in a misstatement that is more than inconsequential[4].
Under section 302, management is required to perform control evaluations; however,
the auditor is not required to evaluate managements assessment of control quality or to
perform their own control evaluation until fiscal year ends on or after November 15, 2004.
For these annual filings, section 404 of SOX and AS2 require that the external financial
statement auditor perform an audit of the firms internal controls over financial reporting
and provide an opinion in the annual filing as to their effectiveness as well as an opinion
regarding managements assessment of internal controls. Figure 1 shows a timeline of
the implementation of sections 302 and 404 of SOX and their respective reporting
requirements as well as a graphical view of the sample period used in this study.
2.2 Prior internal control literature
Several papers have examined issues relating to internal control reports since the
passage of SOX and the implementation of sections 302 and 404. Prior studies have
mainly focused on issues relating to the existence or absence of ICDs. Studies have
examined risk factors related to having control problems (Ashbaugh-Skaife et al., 2007a;
Doyle et al., 2007b; Ge and McVay, 2005; Zhang et al., 2007), as well as the difference in
accrual quality (Ashbaugh-Skaife et al., 2007b; Doyle et al., 2007a), cost of equity
(Ogneva et al., 2007), and audit committee quality (Krishnan, 2005; Hoitash et al., 2009)
between companies that have ICDs and those that do not. Other research examines
the market reaction to disclosures of material weaknesses in internal controls

Section 404 regime begins for larger

(accelerated) filers
(audits of internal controls required)

External auditor
characteristics

First quarterly filing

in 2004 fiscal year
Aug. 29, 2002

Nov. 15, 2004

Group
Assignment
period
(vertical lines)

May 30, 2004

117

Sample
Selection
period
(diagonal lines)

Section 302 regime for all filers

(Hammersley et al., 2007). Little research considers the reporting behavior of the subset
of companies that have weaknesses in their internal controls.
Ashbaugh-Skaife et al. (2007a) compare companies that disclose control problems
with those that do not to determine what economic factors may be indicative of internal
control problems within a company. In addition to their main tests of economic
characteristics, Ashbaugh-Skaife et al. (2007a) include in their model variables relating
to incentives that management has to discover and disclose control problems prior to
section 404 mandated audits. They group the variables in their multivariate model into
two categories:
(1) IC risk attributes those variables that may increase the likelihood that a
control deficiency exists.
(2) Proxies for incentives to discover and disclose ICDs those variables that
increase managements incentives to work to discover ICDs and to disclose them.
They find that companies that have had recent Securities and Exchange Commission
(SEC) enforcement actions and financial restatements, who use a dominant audit firm,
and have more concentrated institutional ownership are more likely to disclose ICDs
under section 302. This study controls for the four variables used to proxy for incentives
to discover and disclose ICDs, and extends their findings by also examining additional
auditor and corporate governance attributes that may impact company reporting of ICDs.
In contrast to their study, the sample used in this paper is limited to companies that
had material weaknesses at year end (under section 404 reporting requirements)
to determine whether auditor characteristics influence the disclosure of those ICDs
under the SOX section 302 reporting regime. While Ashbaugh-Skaife et al. (2007a)
also compare disclosers and nondisclosers under section 302, the majority of their
nondiscloser group are companies that never had weaknesses in internal controls.
The sample used in their paper fit their research question well since the main tests in
their model were of risk attributes relating to having an ICD, thus requiring a comparison

Figure 1.
Timeline of SOX
sections 302 and 404
implementation and
sample selection period

MAJ
26,2

118

between those having ICDs and those not having ICDs. By limiting this papers sample
to only companies disclosing material weaknesses in their audited internal control
report, the tests more directly compare those companies that had weaknesses and
disclosed them with those that had weaknesses but did not disclose them. Thus, this
study focuses on the disclosure quality of ICDs and not on their existence.
Krishnan (2005) examines the impact of audit committee quality on the existence of
internal control problems using pre-SOX data. Prior to SOX, companies were required to
report any known control deficiencies when an auditor change occurred. Using a sample
of companies reporting on internal controls under these requirements, she finds that
companies with higher quality audit committees (measured by independence and
financial expertise) are less likely to be associated with the incidence of internal control
problems. Krishnan and Visvanathan (2007) provide evidence that companies whose
audit committees hold more meetings and have a lesser proportion of financial experts
are more likely to have internal control weaknesses under SOX section 404. This study
extends these findings by holding constant the existence of internal control weaknesses,
in order to examine the impact of auditor characteristics on the disclosure of ICDs when a
material weakness exists.
As noted previously, each of these studies focuses on the existence or absence of
internal control problems. Very little research considers the reporting behavior prior to
SOX-mandated audits of the companies that have weaknesses in their internal controls.
Bronson et al. (2006) examine the characteristics of firms that issued voluntary
management reports on internal controls in 1998, prior to the passage of SOX.
A contemporaneous working paper also examines characteristics of companies that
disclose control problems prior to SOX-mandated audits. Hermanson and Ye (2009)
examine the relationship between companies providing early warning of material
weaknesses and variables related to material weakness characteristics, financing
incentives, and external monitoring for a group of companies receiving an adverse 404
audit opinion. They find significant relationships between disclosing control problems
under section 302 and the following variables: the severity and number of material
weaknesses, prior earnings restatements, future equity financing activities, auditor
independence and effort, CFO change, the number of institutional investors, and the
number of audit committee meetings.
This study differs from theirs in that Hermanson and Ye (2009) focus on reporting
incentives of companies prior to SOX 404 mandated audits. They examine variables
related to upcoming debt and equity issuance, the characteristics of the weakness itself,
and external monitoring of the firm. The focus of this paper is on auditor characteristics
related to the disclosure of ICDs.
3. Variables and hypotheses
For a company to have disclosed an ICD under section 302, at least two conditions must
have been met. First, the company must have discovered the ICD either through their
own control evaluation or through the efforts of their external auditor. Second, they must
have made the decision to disclose the discovered ICD. This study does not distinguish
between discovery and disclosure of ICDs since most characteristics examined may
impact both discovery and disclosure. For example, higher quality auditors may be
better equipped to discover ICDs, but they also may have more incentives to cause the
ICD to be disclosed.

Additionally, prior research finds several firm characteristics to be associated with

the likelihood that an ICD exists (Ashbaugh-Skaife et al., 2007a; Doyle et al., 2007b).
Because all companies in this papers sample have ICDs, there is no effort to explicitly
control for the factors found to be associated with the existence or absence of ICDs.
The external auditor could influence either the discovery or disclosure decision. For
example, prior to the requirements outlined in SOX, auditors performed internal control
assessments at a higher level than that required by SOX in order to determine the most
efficient method for auditing the financial statements of the firm. Hammersley et al. (2007)
report that in their sample of SOX 302 material weakness disclosers, more companies
credit their auditor with material weakness discovery than those that credit themselves.
(164 auditor-discovered weaknesses compared to 143 management-discovered.) This
paper examines three proxies for audit quality that may impact the likelihood that an
auditor discovered or influenced the disclosure of ICDs in their clients internal control
systems: auditor size, auditor industry specialization, and auditor tenure.
First, a Big 4/non-Big 4 dummy (BIG4) is used. The Big 4 dummy is equal to one if
a Big 4 auditor was engaged by the company for the majority of the 2004 fiscal year and
zero otherwise[5]. Large audit firms are expected to be more likely to discover and cause to
be disclosed ICDs during the section 302 regime due to reputation concerns, investment in
technology and training, and litigation concerns (Ashbaugh-Skaife et al., 2007a). First,
large auditors have greater reputation concerns than lower tier auditors (DeAngelo, 1981).
These reputation concerns may lead to more thorough audits to avoid incorrect
conclusions. Additionally, larger auditors reputations are likely to be impaired if their
clients fail to disclose known material weaknesses which should have been disclosed.
Therefore, after discovering ICDs, the expectation is that large auditors will exert greater
pressure on management to disclose the ICDs to shareholders. Second, large auditors tend
to invest more money in technology and training leading to the more efficient discovery of
weaknesses in internal controls (Ashbaugh-Skaife et al., 2007a). Third, dominant audit
suppliers have greater litigation risk coming from their greater wealth and may therefore
be more diligent in identifying misstatements and their causes in the prior years financial
statement audit, leading to more identification of control problems in prior years.
In addition, the threat of lawsuits is likely to cause auditors to be more aggressive in
requiring the disclosure of known control weaknesses so as to avoid costly lawsuits
relating to the auditors knowledge of control problems that go undisclosed.
The second measure of audit quality is an indicator variable equal to one if the
companys auditor was an industry leader in 2003 and zero otherwise (IND_LEADER).
Industry leaders should be associated with companies reporting weaknesses in their
controls during the section 302 regime for the following reasons:
.
Auditors that have specialized knowledge in a particular industry and are
familiar with common problem areas in that industry are likely to be better able
to identify weaknesses in internal controls. The auditor from the 2003 fiscal year
is used because it is possible that the auditor identified ICDs during their
financial statement audit as they tested controls for their reliance decision.
.
Prior research provides evidence that the clients of industry-specialized auditors
have higher financial reporting quality (Balsam et al., 2003).
The increased reporting quality may come about because auditors that have more
experience in like companies are be better able to focus on higher risk areas of the firm

External auditor
characteristics

119

MAJ
26,2

120

during the audit. Alternatively, industry-specialized auditors have greater incentives

to discover misstatements and more bargaining power with their client to cause
adjustments to be made prior to disclosure. For example, prior research demonstrates a
fee premium paid to industry-specialized auditors over nonspecialized Big 4 auditors
(Craswell et al., 1995; Francis et al., 2005) indicating that industry specialists have more
to lose if their reputations are impaired by providing ineffective audits. If the same
incentives for accurate reporting hold for internal controls, since internal control
quality may impact financial reporting quality, the expectation is that industry leaders
will be more likely to pressure management to disclose known ICDs.
Industry leader is equal to one if the auditor collects the greatest percentage of audit
fees in the clients industry nationally (i.e. total fees collected by a particular auditor in
a given industry nationally, divided by the total audit fees collected by all auditors in
that industry nationally). In the sample, 173 out of 520 companies are audited by
industry leaders in 2003. Of the 173 observations audited by industry leaders, 170 are
Big 4 auditors and three are non-Big4 auditors (Grant Thornton or BDO Seidman)[6].
The third measure of audit quality is an auditor tenure variable (AUD_TENURE)
equal to the number of years the current financial statement auditor has been in that
capacity with the company. Previous research generally provides evidence that longer
auditor/client relationships result in higher quality reporting. For example, Myers et al.
(2003) provide evidence of higher earnings quality with longer auditor tenure. Similarly,
Geiger and Raghunandan (2002) document an inverse relationship between auditor
tenure and audit reporting failures for a sample of companies entering into bankruptcy
during the period 1996-1998. Relying on these findings, I hypothesize that companies
with longer auditor/client relationships are more likely to report control problems prior
to section 404-mandated audits (under the SOX section 302 reporting regime).
3.1 Control variables
The following two company-level governance quality measures are intended to control
for internal corporate governance impact on the reporting of ICDs. First, I expect
companies with audit committees that have accounting expertise (ACOMMEXP) to be
more likely to disclose ICDs under section 302. Prior research examines the association
between audit committee quality and the quality of internal controls. Using pre-SOX
data, Krishnan (2005) finds that companies with audit committees that are independent
and audit committees with financial expertise are significantly less likely to be
associated with companies disclosing internal control problems prior to SOX-mandated
disclosures. Krishnan and Visvanathan (2007) provide evidence that companies whose
audit committees hold more meetings and have a lesser proportion of financial experts
are more likely to disclose control weaknesses under section 404. This study extends
these findings by holding constant the existence of internal control weaknesses in order
to examine the impact of audit committee quality on the discovery and disclosure of
ICDs as well as the accuracy of the ICD severity assessment.
Recent research investigates the importance of having an accounting financial
expert on the audit committee. For example, Defond et al. (2005) find a significant positive
market reaction to the appointment of accounting financial experts to the audit committee
but no market reaction to the appointment of nonaccounting financial experts to the audit
committee. Their findings indicate that the market values the added ability to serve
effectively on the audit committee derived from having a background in accounting.

Similarly, Krishnan and Visvanathan (2008) provide evidence that audit committee
financial expertise is positively related to accounting conservatism only when financial
expertise is measured as accounting financial expertise, indicating that accounting
financial experts may be able to influence external reporting to be more conservative.
ACOMMEXP is equal to one if the audit committee has at least one accounting
financial expert on the committee during 2004 and 0 otherwise. An accounting financial
expert is defined as a member of the committee with experience in public accounting,
auditor, principal or chief financial officer, controller, or principal or chief accounting
officer (Defond et al., 2005). Given the above findings I hypothesize that companies that
have audit committees with at least one accounting financial expert are more likely to
discover and disclose ICDs prior to their first SOX 404 report than companies without
such accounting financial expertise.
Second, I expect CFOs who are more qualified to be better able to discover ICDs
(CFOQUAL). Under SOX 302, CEOs and CFOs are required to certify that the information
in their companys quarterly and annual reports is correct and that no important
information has been omitted. Given this requirement to personally certify to the accuracy
of their disclosures, it seems likely that CFOs would make significant efforts to ensure that
their internal control report was accurate by disclosing all known weaknesses and by
ensuring that a thorough analysis of controls was performed. Li et al. (2008) provide initial
evidence that at least the board and/or the CEO felt that internal control quality falls under
the responsibility of the CFO. They provide evidence of higher CFO turnover for firms
disclosing initial adverse SOX 404 opinions compared to firms disclosing no weaknesses.
CFOQUAL is defined following Li et al. (2008) by creating an indicator variable equal
to one if the companys CFO has a Certified Public Accountant (CPA) license or has
worked for a public accounting firm and zero otherwise. I hypothesize that companies
that have CFOs that have greater financial accounting background are more likely to
discover and disclose weaknesses in their internal controls under section 302.
Prior research provides evidence that control weakness disclosure is affected by
management discovery and disclosure incentives. Ashbaugh-Skaife et al. (2007a)
include the following three discovery/disclosure incentive variables in their model:
(1) prior restatements or an SEC Accounting and Auditing Enforcement Release
(AAER) (RESTATEMENT);
(2) institutional ownership concentration (INST_CON); and
(3) industry litigation risk (LITIGATION).
Each of these incentives is controlled for in my model.
Doyle et al. (2007b) provide evidence that the financial resources available to
the company (SUM_LOSS) impact the likelihood that they disclose weaknesses in internal
controls under section 302. Implementation of the sections of SOX dealing with internal
controls was costly to companies (Solomon and Peecher, 2004). Those companies with
fewer financial resources may have found it difficult to effectively evaluate controls to the
level necessary to discover existing weaknesses. Therefore, it is likely that companies
with fewer financial resources had greater difficulty assessing controls adequately and are
therefore less likely to discover and disclose ICDs under section 302.
On the other hand, companies with poorer financial health may have more pervasive or
serious control problems coming from their inability to invest in internal controls in prior
years. Companies with more obvious control problems are more likely to discover them

External auditor
characteristics

121

MAJ
26,2

122

than companies with fewer problems. Additionally, companies with poor financial health
have less to lose by disclosing the problems to shareholders if the market already assesses
the likelihood of control problems to be high. SUM_LOSS is equal to one if the sum of the
current and previous years income is negative and zero otherwise (Doyle et al., 2007b)[7].
To control for other factors not explicitly controlled for relating to internal control
reporting quality under section 302 a size control variable (SIZE) is included which is
equal to the natural log of total assets.
4. Sample and descriptive statistics
The sample consists of all companies disclosing a material weakness in their internal
controls from November 15, 2004 through May 30, 2005[8]. It also includes
26 observations that disclosed weaknesses under section 302 but not under section
404 (implying a remediation of weak controls). These observations are included since
they are a part of the full sample of companies that had material weaknesses in their
internal controls and represent companies that disclosed those weaknesses under
section 302[9]. Figure 2 shows my sample selection procedure.
Internal control data, auditor characteristics data, and data for the LITIGATION and
RESTATEMENT variables are obtained from Audit Analytics Internal Control,
Restatement, and Disclosure Control files. Data for the SUM_LOSS variable is obtained
from Compustat. Data for the RESTATEMENT (AAERs), ACOMMEXP, and CFOQUAL
variables were hand collected from 10-Ks, Proxy Statements, and the SECs AAER listing
using Lexis-Nexis. Finally, data for the INST_CON variable were obtained from the
Thomson Financial 13-f dataset. Table I provides a summary of variable definitions.
The dependent variable (DISCLOSE) is equal to one if a company disclosed an ICD
at least once under section 302 and zero otherwise. To determine whether a company
disclosed prior ICDs I examine SEC filings during the year immediately prior to the
companys first section 404 report. Any company disclosing an ICD in any of those
reports is assigned to the disclosure group (coded 1 for the DISCLOSE variable)
and those not disclosing in any of the three previous quarters are assigned
to the non-disclosure group (coded 0 for the DISCLOSE variable). As discussed earlier,
there are 26 observations that disclosed ICDs under section 302, but did not have
a material weakness in their first section 404 report. These observations are included
in the DISCLOSE 1 group as they are part of the sample of companies that identified
ICDs and disclosed them prior to the 404 audit of IC.
Companies disclosing material
weaknesses under the SOX 404 reporting
regime (569 companies less 50 with
missing data resulting in 519 companies in
the sample)

Figure 2.
Sample description

A. Companies disclosing control

problems under section
302
(147 companies)

B. Companies not disclosing

control problems under section
302
(372 companies)

Variables
DISCLOSE

Predicted
sign
Definitions

External auditor
characteristics

Dependent Coded 1 if the company reported a material weakness under

variable section 302 and 0 otherwise

Auditor variables
BIG4

IND_LEADER

AUD_TENURE

Control variables
ACOMMEXP

CFOQUAL

RESTATEMENT

INST_CON

LITIGATION
SUM_LOSS

SIZE

Coded 1 if a Big4 auditor was engaged by the company for the

majority of the 2004 fiscal year and 0 otherwise
Coded 1 if the company was audited by an industry expert
auditor in 2003 and 0 otherwise
Measured as the number of years the current external financial
statement auditor has been engaged in that capacity

123

Coded 1 if the audit committee has at least one accounting

financial expert on the committee during 2004 and 0 otherwise
Coded 1 if the companys CFO has a CPA license or has worked
for a public accounting firm and 0 otherwise
Coded 1 if the company restated its financial statements or was
the object of an AAER during the three years from 2002 to 2004,
and 0 otherwise
Measured as the percentage of shares held by institutions
divided by the number of institutions that own a firms stock
Coded 1 if the firm is in a litigious industry and 0 otherwise
Coded 1 if the sum of the current and previous years income is negative
and 0 otherwise
Equal to the natural log of total assets for the fiscal year
ended 2004

Notes: This table contains definitions of each of the test variables and control variables used in the
univariate and multivariate tests; predicted signs for the multivariate model are also presented

Univariate results are displayed in Table II. BIG4 is insignificant ( p . 0.4) in the
predicted direction with the mean being higher for those companies disclosing ICDs
under section 302 than for those companies not disclosing under section 302.
The difference in the means of IND_LEADER, ACOMMEXP, and RESTATEMENT
are highly significantly different in the predicted direction ( p , 0.01). These results
indicate that companies with higher quality audit committees or that have industry
leading auditors are more likely to disclose ICDs under the section 302 regime. Also,
companies that restated their financial statements or were the object of an AAER during
the two years from 2002 to 2003 are more likely to disclose weaknesses in their internal
control systems.
CFOQUAL is significantly different between the two groups ( p , 0.05) in the predicted
direction indicating that CFOs with more financial accounting background are better able
to discover and/or more likely to disclose ICDs than CFOs without similar background.
Opposite the prediction, companies not reporting ICDs under section 302 had,
on average, significantly longer relationships with their auditors than companies
that reported the weaknesses. This finding is consistent with the common argument that
longer auditor/client tenure results in a lack of independence and therefore lower quality
reporting. However, it could also be driven by companies with longer auditor/client
relationships having less severe control problems that only surfaced when a thorough
audit of internal controls was performed at year-end.

Table I.
Variable definitions

MAJ
26,2
Variablesa

124

Table II.
Descriptive statistics
by reporting or
non-reporting of
control deficiencies

BIG4
IND_LEADER
AUD_TENURE
ACOMMEXP
CFOQUAL
RESTATEMENT
INST_CON
LITIGATION
SUM_LOSS
SIZE

n
519
519
519
519
408
519
451
519
519
519

Control deficiency
reported under
section 302
n1
Mean
SD

Control deficiency not

reported under
section 302
n2
Mean
SD

147
147
147
147
125
147
123
147
147
147

372
372
372
372
283
372
328
372
372
372

0.8639
0.4354
7.1224
0.7211
0.456
0.2789
0.0075
0.3197
0.5102
6.401

0.344
0.4975
7.7326
0.45
0.5
0.45
0.0062
0.468
0.5016
1.8955

0.8602
0.293
9.2634
0.586
0.4028
0.1344
0.0073
0.3387
0.3414
6.4836

0.3472
0.4558
7.8696
0.4932
0.4913
0.3416
0.005
0.4739
0.4748
1.8019

t-statistics

p-value

0.111
3.123
2 2.806
2.88
1.002
3.952
0.472
2 0.413
3.591
2 0.464

0.456
0.001 * * *
0.003 * * *
0.002 * * *
0.158
0***
0.3185
0.34
0.0002 * * *
0.322

Notes: Significance at the *0.1, * *0.05, and * * *0.01 levels, respectively; aall variables are defined in
Table I; this table reports univariate statistics by whether the company reported internal control
deficiencies under the section 302 regime or not; all companies in the sample disclosed material
weaknesses as of the end of the 2004 fiscal year under the section 404 reporting regime; the t-statistics
shown is for the null hypothesis that the difference between the mean value of those reporting under
section 302 less the mean value of those not reporting under section 302 is equal to zero

The univariate results for the financial position proxy (SUM_LOSS) indicate that on
average companies disclosing ICDs under section 302 were more likely to have poor
financial performance during the current and previous years ( p , 0.01). This may be
because companies that have had worse financial performance over the prior two years
had less to invest in control systems, making ICDs easier to find. An alternative
explanation could be that companies reporting negative income felt they had less to lose
by disclosing control weaknesses than companies that were performing well.
5. Multivariate analysis
A logit model is used to examine the differences in auditor characteristics between
those companies that disclose ICDs under section 302 and those that do not. Table I
summarizes the variable definitions:
DISCLOSE i b0 b*1 BIG4i b*2 IND_LEADERi b*3 AUD_TENURE
b*4 ACOMMEXP i b*5 CFOQUALi b*6 RESTATEMENT i
b*7 INST_CON i b*8 LITIGATION i b*9 SUM _LOSS
b*10 SIZE 1i
Table III presents the results from estimating both the full model shown above (model 2)
and a model in which I eliminate the CFOQUAL and INST_CON variables from the
estimation (model 1). These two variables are eliminated from the model because
of the impact they have on the sample size and, therefore, the power of the estimation[10].
The results from models 1 and 2 are similar.

Variablea

Predicted sign

Model 1 coefficientsb

N/A

2 1.521
(2 3.13) * * *

2 1.365
(2 1.87) *

Auditor variables
BIG4

IND_LEADER

AUD_TENURE

2 0.115
(2 0.36)
0.659
2 2.95 * * *
2 0.036
(2 2.39) * *

2 0.583
(2 1.49)
0.979
2 3.56 * * *
2 0.055
(2 2.71) * * *

Control variables
ACOMMEXP

0.575
2 2.6 * * *

CFOQUAL

RESTATEMENT

INST_CON

LITIGATION

SUM_LOSS

SIZE

0.489
2 1.82 *
0.018
2 0.94
0.393
2 1.26
20.849
2 0.83
2 0.295
(2 1.11)
0.479
2 1.86 *
0.068
2 0.79
104
247
351
34.49
0.0002
0.0808

CONSTANT

n1 2 Disclose l
n2 2 Disclose 0
Total n
Wald x 2
Probability . x 2
Pseudo-R 2

0.685
2 2.71 * * *
2 0.151
(2 0.67)
0.608
2 2.8 * * *
0.004
2 0.07
147
372
519
45.95
0
0.0743

Model 2 coefficientsb

Notes: Significance at the *0.1, * *0.05, and * * *0.01 levels, respectively, based on two-tailed tests;
all variables are defined in Table I; bnumbers in parentheses are z-statistics for the associated coefficient;
this table presents coefficients and t-statistics for a logit regression with DISCLOSE as the dependent
variable; the dependent variable is equal to 1 if the company disclosed an ICD during at least one of the
three quarters leading up to their initial SOX 404 internal control disclosure and audit and 0 otherwise

In general, the models support the hypothesis that higher auditor quality increases the
reporting quality of ICDs in the absence of external audit reporting requirements.
Companies that are audited by industry-specialized auditors and that have an accounting
financial expert on their audit committee are significantly more likely to disclose
ICDs during the three quarterly filings prior to their first SOX 404 audit report[11].
Opposite the prediction, companies that have shorter auditor/client relationships are
more likely to report ICDs under section 302 reporting requirements. This finding
is consistent with the common argument that longer auditor/client tenure results in a
lack of independence and, therefore, lower quality reporting. However, it could also be
driven by companies with longer auditor/client relationships having less severe control
problems that only surfaced when a thorough audit of internal controls was performed
at year-end. To control for the possibility that recent auditor changes caused by internal
control discover may be driving this result, a dummy variable is included in the model

External auditor
characteristics

125

Table III.
Logit regressions of
DISCLOSE on auditor
characteristics and
controls

MAJ
26,2

126

which is equal to one if an auditor change occurred during the three most recent years
(the three years where section 302 was being implemented 2002-2004). Results persist
after controlling for this variable.
Also opposite the prediction, there is no evidence in the multivariate tests that the
financial accounting background of the CFO impacts the reporting quality of ICDs.
It appears that the audit committee, who is charged with oversight of the financial
reporting process, more directly influences the reporting of discovered ICDs.
Companies with poorer financial health (SUM_LOSS) are significantly more likely to
disclose weaknesses during the three quarterly filings prior to their first SOX 404 report.
This finding suggests that companies with poorer financial health may have more
pervasive or serious control problems coming from their inability to invest in internal
controls, making it easier to discover weaknesses. Alternatively, companies reporting
negative earnings during the current and previous years may have less to lose by
disclosing weaknesses once discovered.
6. Conclusions
This paper examines the role external auditors play in firm reporting of ICDs prior to
SOX-mandated audits. The findings suggest that companies that were audited by
industry leading auditors and that have audit committees with an accounting financial
expert are more likely to have disclosed ICDs during the section 302 regime (prior to the
SOX 404-mandated audit of internal controls). These findings suggest that while
external auditors were not required to participate in internal control evaluation and/or
reporting prior to their audit of internal control for the 2004 fiscal year, they nevertheless
influence the likelihood of ICD disclosure prior to their initial audit.
Contrary to expectations, longer auditor tenure is associated with decreased likelihood
of ICD disclosure under SOX 302. After controlling for recent auditor changes which might
have been due to discovered internal control weaknesses, the results persist. This finding
is consistent with the common argument that longer auditor/client tenure results in a lack
of independence and therefore lower quality reporting. However, it could also be driven by
companies with longer auditor/client relationships having less severe control problems
that only surfaced when a thorough audit of internal controls was performed at year-end.
Notes
1. The effective date listed for section 404 is for larger public companies (accelerated filers).
The requirement of auditors to provide an opinion regarding managements assessment of
controls is eliminated in Auditing Standard No. 5 (PCAOB, 2007); however, AS2 is the
guidance followed by auditors during the time period covered in this paper. AS2 details the
requirements of audits of internal controls mentioned in section 404 of SOX.
2. It is important to note that the SEC allowed companies not to disclose weaknesses
discovered using 404 processes during the 302 time period (SEC, 2004). However, this paper
does not focus on the correctness/incorrectness of reporting, only whether reporting of ICDs
occurred or not, given that a weakness existed.
3. It is important to note that disclosure of internal control material weaknesses in an annual
filing under SOX 404 is not absolute proof that a material weakness existed during the previous
periods. I attempt to limit those observations where the control weakness was reported under
section 404 but did not exist previously by looking at only the three quarters prior to the first
404 report to determine whether the observation was in the group disclosing under section
302 or the group not disclosing under section 302. In addition Glass-Lewis & Company argue,

In our view, the control deficiency probably did not appear overnight. Consequently,
we feel that the problem most likely existed in prior quarters (Glass Lewis & Company, 2005).
Doyle et al. (2007a) argue that many of the internal control weaknesses have existed for
several years prior to their disclosure, if not since the firms inception.
4. The PCAOB (2004) released AS2 in March 2004. Therefore, for previous quarters management
may have used previous guidance for identification of a material weakness. AU section 325A
(American Institute of Certified Public Accountants), which was effective for financial
statement audits as of January 1, 1989, defines a material weakness in internal controls as a
reportable condition in which the design or operation of one or more of the internal control
components does not reduce to a relatively low level the risk that misstatements caused by
error or fraud in amounts that would be material in relation to the financial statements being
audited may occur and not be detected within a timely period by employees in the normal
course of performing their assigned functions. The two definitions are very similar in the
probability and magnitude of misstatements going undetected by the control system.
5. I do this to try to capture the size of the auditor that had the most impact on the 2004 quarterly
reports wherein the 302 disclosures were made. Thus, if a Big 4 auditor resigned in August
of 2004 and was replaced by a non-Big 4 auditor I would define the Big 4 dummy equal to
1 since the Big 4 auditor was there the majority of the time (i.e. the Big 4 auditor could have
influenced the reporting of two quarterly reports vs one for the non-Big 4 auditor). Excluding
companies from the sample that had auditor changes during the year yields qualitatively
similar results.
6. The correlation coefficient between the Big4 variable and the Industry leader variable is 0.25,
p , 0.01. In sensitivity tests, I create a new variable equal to 1 if the auditor is both an industry
leader and Big4, and 0 if either an industry leader or a Big4 auditor, but not both. I drop
37 observations where the auditor was neither Big4 nor industry leader and replace both the
BIG4 and IND_LEADER variables with the new variable. Results are similar on every
coefficient both in magnitude and significance. The coefficient on the new variable is 0.89,
p , 0.01 indicating that companies that are audited by audit firms that are both industry leaders
and Big4 firms are more likely to disclose ICDs prior to 404 reporting. I leave both variables in the
model to show the incremental effect of being an industry leader over just being a Big4 auditor.
7. Results are robust to replacing this variable with an indicator variable equal to one if the
sum of the cash flow from operations for the current and previous years is negative.
8. This period covers the first six months of mandatory audits under SOX 404. I examine this
time period since it is possible that reporting behavior changed as companies and their
auditors and consultants gained experience in identifying control problems. In order to limit
the amount of learning that might impact my results, I examine a relatively short-time period
where a majority of companies have fiscal year-ends.
9. Including these 26 observations in the model results in comparing companies that
have remediated their controls by the time of the first 404 report, and those that have
not. However, since my intent is to develop a group of companies that had weaknesses in their
controls, found them, and disclosed them and a group of companies that did not disclose them I
include all companies that disclosed weaknesses during the 302 era in the DISCLOSE 1
group. All results are robust to excluding these observations except that the SUM_LOSS
variable goes from p , 0.10 to insignificant in model 2 of Table III.
10. As displayed in Table III, the sample size (n) is significantly reduced by including the
CFOQUAL and INST_CON variables (from 519 to 351).
11. Using a city-specific leadership variable measured the same way as the national measure but
within a metropolitan statistical area (MSA) defined by the US Census Bureau yields an
insignificant coefficient on the LEADER variable in multivariate tests, and marginally

External auditor
characteristics

127

MAJ
26,2

128

significant results in univariate tests ( p , 0.1). This may indicate that the additional internal
control discovery ability derived from being an industry leader comes from specializing
nationally and not just within a particular metropolitan area.
References
Ashbaugh-Skaife, H., Collins, D.W. and Kinney, W.R. Jr (2007a), The discovery and reporting of
internal control deficiencies prior to SOX-mandated audits, Journal of Accounting and
Economics, Vol. 44, pp. 166-92.
Ashbaugh-Skaife, H., Collins, D.W., Kinney, W.R. Jr and LaFond, R. (2007b), The effect of SOX
internal control deficiencies and their remediation on accrual quality, available at SSRN:
http://ssrn.com/abstract906474 (accessed July 23, 2007).
Balsam, S., Krishnan, J. and Yang, J.S. (2003), Auditor industry specialization and earnings
quality, Auditing: A Journal of Practice & Theory, Vol. 22 No. 2, pp. 71-97.
Bronson, S.N., Carcello, J.V. and Raghunandan, K. (2006), Firm characteristics and voluntary
management reports on internal control, Auditing: A Journal of Practice & Theory, Vol. 25
No. 2, pp. 25-39.
Craswell, A.T., Francis, J.R. and Taylor, S.L. (1995), Auditor brand name reputations and
industry specializations, Journal of Accounting and Economics, Vol. 20, pp. 297-322.
DeAngelo, L.E. (1981), Auditor size and audit quality, Journal of Accounting and Economics,
Vol. 3, pp. 183-99.
Defond, M.L., Hann, R.N. and Hu, X. (2005), Does the market value financial expertise on audit
committees of boards of directors?, Journal of Accounting Research, Vol. 43 No. 2, pp. 153-204.
Doyle, J., Ge, W. and McVay, S. (2007a), Accruals quality and internal control over financial
reporting, The Accounting Review, Vol. 85 No. 5, pp. 1141-70.
Doyle, J., Ge, W. and McVay, S. (2007b), Determinants of weaknesses in internal control over
financial reporting, Journal of Accounting and Economics, Vol. 44, pp. 193-223.
Francis, J.R., Reichelt, K. and Wang, D. (2005), The pricing of national and city-specific reputations
for industry expertise in the US audit market, The Accounting Review, Vol. 80 No. 1, pp. 113-36.
Ge, W. and McVay, S. (2005), The disclosure of material weaknesses in internal control after the
Sarbanes-Oxley Act, Accounting Horizons, Vol. 19, pp. 137-58.
Geiger, M.A. and Raghunandan, K. (2002), Auditor tenure and audit reporting failures,
Auditing: A Journal of Practice & Theory, Vol. 21 No. 1, pp. 67-78.
Glass Lewis & Company (2005), Letter to Mr. Jonathan G. Katz, Secretary of the US Securities
and Exchange Commission, April 12, File Number 4-497.
Hammersley, J.S., Myers, L.A. and Shakespeare, C. (2007), Market reactions to the disclosure of
internal control weaknesses and to the characteristics of those weaknesses under section 302
of the Sarbanes Oxley Act of 2002, Review of Accounting Studies, Vol. 13 No. 1, pp. 141-65.
Hermanson, D.R. and Ye, Z. (2009), Why do some accelerated filers with SOX 404 material
weaknesses provide early warning under section 302?, Auditing: A Journal of Practice &
Theory, Vol. 28 No. 2, pp. 247-71.
Hoitash, U., Hoitash, R. and Bedard, J.C. (2009), Corporate governance and internal control over
financial reporting: a comparison of regulatory regimes, The Accounting Review, Vol. 84
No. 3, pp. 839-67.
Krishnan, G.V. and Visvanathan, G. (2007), Reporting internal control deficiencies in the
post-Sarbanes-Oxley era: the role of auditors and corporate governance, International
Journal of Auditing, Vol. 11 No. 2, pp. 73-90.

Krishnan, G.V. and Visvanathan, G. (2008), Does the SOX definition of accounting expert
matter? The association between audit committee directors accounting expertise and
accounting conservatism, Contemporary Accounting Research, Vol. 25 No. 3, pp. 827-58.
Krishnan, J. (2005), Audit committee quality and internal control: an empirical analysis,
The Accounting Review, Vol. 80 No. 2, pp. 649-75.
Li, C., Sun, L. and Ettredge, M. (2008), Financial executive qualifications, financial executive
turnover, and adverse SOX 404 opinions, University of Kansas working paper, available at:
http://ssrn.com/abstract959215
Myers, J.N., Myers, L.A. and Omer, T.C. (2003), Exploring the term of the auditor-client
relationship and the quality of earnings: a case for mandatory auditor rotation?,
The Accounting Review, Vol. 78 No. 3, pp. 779-99.
Ogneva, M., Subramanyam, K.R. and Raghunandan, K. (2007), Internal control weakness and
cost of equity: evidence from SOX section 404 disclosures, The Accounting Review, Vol. 82
No. 5, pp. 1255-97.
PCAOB (2004), Auditing Standard No. 2 An Audit of Internal Control over Financial Reporting
Performed in Conjunction with an Audit of Financial Statements, Public Company
Accounting Oversight Board, Washington, DC.
PCAOB (2007), Auditing Standard No. 5 An Audit of Internal Control over Financial Reporting
That is Integrated with an Audit of Financial Statements, Public Company Accounting
Oversight Board, Washington, DC.
SEC (2004), Managements Reports on Internal Control Over Financial Reporting and
Certification of Disclosure in Exchange Act Periodic Reports Frequently Asked Questions,
SEC, Washington, DC, October 6.
Solomon, I. and Peecher, M.E. (2004), SOX 404 A billion here, a billion there. . ., The Wall
Street Journal, November 9.
United States Congress (2002), The Sarbanes-Oxley Act of 2002. 107th Congress of the
United States of America. H.R. 3763, Government Printing Office, Washington, DC.
Zhang, Y., Zhou, J. and Zhou, N. (2007), Audit committee quality, auditor independence, and
internal control weaknesses, Journal of Accounting & Public Policy, Vol. 26 No. 3, pp. 300-27.
Further reading
SEC (2005), Preliminary Report of the Internal Controls Sub-Committee to the Advisory
Committee on Smaller Public Companies, SEC, Washington, DC, December 7.
SEC (2008), Internal Control over Financial Reporting in Exchange Act Periodic Reports of
Non-accelerated Filers, SEC, Washington, DC, June 26.
About the author
Nathaniel M. Stephens, CPA, earned a PhD in Accounting from the University of Arizona, USA.
He is an Assistant Professor of Accounting at Utah State University. His primary research
interests are in corporate governance, internal control, and audit quality. Nathaniel M. Stephens
can be contacted at: nate.stephens@usu.edu

To purchase reprints of this article please e-mail: reprints@emeraldinsight.com

Or visit our web site for further details: www.emeraldinsight.com/reprints

External auditor
characteristics

129