how do strategic repositioning moves impact the ... · how do strategic repositioning moves impact...
Post on 16-May-2018
222 Views
Preview:
TRANSCRIPT
1
HOW DO STRATEGIC REPOSITIONING MOVES IMPACT THE EFFECTIVENESS
OF FIRM’S IT GOVERNANCE, RISK, AND CONTROL MECHANISMS?
By
Hüseyin Tanriverdi
The University of Texas at Austin
Red McCombs School of Business
Information, Risk and Operations Management (IROM) Department
1 University Station, B6500, CBA 5.208
Austin, Texas 78712-0212
+1 (512) 232-9164
Huseyin.Tanriverdi@mccombs.utexas.edu
&
Kui (Andy) Du
College of Management
University of Massachusetts Boston
100 Morrissey Blvd
Boston, MA 02125
Kui.Du@umb.edu
October 19, 2016
Under Revision
Limited circulation for feedback
Please do not cite or circulate without the permission of authors
2
HOW DO STRATEGIC REPOSITIONING MOVES IMPACT THE EFFECTIVENESS
OF FIRM’S IT GOVERNANCE, RISK, AND CONTROL MECHANISMS?
ABSTRACT
In an increasingly digitized economy, undesired IT events such as data security and privacy
breaches, digital fraud, and operational IT glitches have emerged as wicked IT-related risks. Firms
institute IT governance, risk, and control (IT-GRC) mechanisms to defend against such IT-related
risks. However, the pervasiveness of the undesired IT events indicates that firms struggle to
maintain effective IT-GRC mechanisms. This study explains how and why a firm’s own strategic
repositioning moves could reduce the effectiveness of the firm’s IT-GRC mechanisms. A firm is
a complex adaptive system operating in a complex, and dynamically changing environment. To
seize emerging opportunities or cope with unexpected threats in the environment, a firm makes
adjustments to the strategic positions of its business portfolio. For example, it diversifies into new
product market positions in domestic and foreign markets; it engages in mergers and acquisitions;
it divests some of its existing businesses; and it internally restructures its business portfolio. We
hypothesize that such strategic repositioning moves could disrupt and reduce the effectiveness of
the firm’s current IT-GRC mechanisms and make it challenging to design and operate new IT-
GRC mechanisms effectively. We find empirical support for these ideas in a longitudinal study of
2,248 publicly traded U.S. firms. We discuss the implications of these findings for IS research and
practice.
Keywords: IT risks, IT Governance, Risk and Control, Diversification, Acquisition, Divestiture,
Restructuring, Complexity
3
HOW DO STRATEGIC REPOSITIONING MOVES IMPACT THE EFFECTIVENESS
OF FIRM’S IT GOVERNANCE, RISK, AND CONTROL MECHANISMS?
The very digital technologies that open up productivity, profitability, and growth opportunities
for firms also expose firms to major IT-related risks such as data security and privacy breaches,
digital fraud, deception, theft, and disruptions through operational IT glitches (IIA 2012). The year
2014 was dubbed as “the year of the data breach.” Cyberattacks compromised the security and
privacy of over a billion personal data records in publicly traded firms such as Target, Home Depot,
JPMorgan and eBay.1 As digital spend has increased, so has the digital fraud. For example, $1 out
of every $3 spent on digital ads is lost to ad fraud.2 Glitches in IT operations have also risen. In
2015, computer glitches forced the United, Southwest, and American Airlines to ground or delay
large percentages of their flights.3 Such IT-related risks also expose firms to strategic, financial,
operational, and regulatory compliance risks.
To defend against the IT-related risks, firms institute IT governance, risk, and control (IT-GRC)
mechanisms4 . IS practice classifies IT-GRC into: (i) IT general controls (ITGC) and (ii) IT
application controls, also known as automated process controls (APC). ITGC aims to mitigate risks
in the firm’s general computing environment. It includes the firm’s strategic IT plans, IT policies,
procedures, standards, and processes. ITGC governs and controls the firm’s IT infrastructures,
applications, computer operations, IT human resources, IT program development, IT change
management, and the segregation of IT duties. APC aims to mitigate risks in the IT applications
that automate business processes of the firm. It includes input controls, processing controls, output
controls, and segregation of duty controls embedded in the applications that support business
1 http://www.cnbc.com/2015/02/12/year-of-the-hack-a-billion-records-compromised-in-2014.html 2 http://adage.com/article/digital/ad-fraud-eating-digital-advertising-revenue/301017/ 3 http://money.cnn.com/2015/10/11/news/companies/southwest-technical-issues-flight-delay/ 4 Appendix A provides a list of common IT-GRC mechanisms used by firms and external audit firms.
4
processes. These IT-GRC mechanisms seek to ensure the confidentiality, integrity, accessibility,
and privacy of the firm’s data. They also seek to ensure the continuity of the firm’s business.
Ultimately, the IT-GRC mechanisms seek to minimize the probability of loss and the magnitude
of loss associated with IT-related risks of the firm.
However, firms struggle to maintain effective IT-GRC mechanisms. The proliferation and
increasing frequency of data security and privacy breaches, digital fraud, digital deception, digital
theft, and operational IT glitches all point to weaknesses in IT-GRC mechanisms of firms. This
paper seeks to explain why firms struggle to maintain effective IT-GRC mechanisms.
An obvious explanation could be that firms may not be instituting IT-GRC mechanisms. While
this explanation was partially valid until early 2000s, it is no longer valid. Due to increasing IT-
related risks in the environment, a multitude of laws, regulations, and industry standards have been
instituted to require firms in general, and publicly traded firms in particular, to institute IT-GRC
mechanisms. For example, the Sarbanes-Oxley (SOX) Act of 2002 mandates that the CEO and
CFO of public firms be held personally accountable for instituting and effectively operating
internal controls over financial reporting including IT-GRC (Li et al. 2012; Li et al. 2010; Masli
et al. 2016). Periodically, executives as well as the independent external auditors of the firms assess
the design and operating effectiveness of the firms’ IT-GRC mechanisms for compliance with a
multitude of relevant laws, regulations, and industry standards (e.g., SOX, HIPAA, GLB,
PCI/DSS, etc.).5
In SOX audits, the finding of a material weakness, the most severe type of control deficiency,
in internal controls of a firm, including the IT-GRC, could have serious consequences for the firm,
its investors, and it top executives. After the enactment of SOX, the quality of Internal Controls
5 SOX: The Sarbanes–Oxley Act; HIPAA: The Health Insurance Portability and Accountability Act; GLB: The Gramm-Leach-
Bliley Act; PCI/DSS: The Payment Card Industry Data Security Standard.
5
over Financial Reporting (ICFR) became highly visible to capital markets. Failing to maintain an
effective ICFR, including an effective IT-GRC, elicits negative reactions from the capital markets
(Beneish et al. 2008; Hammersley et al. 2008); increases noise in accounting information of the
firm and causes unintentional accounting and forecasting errors (Ashbaugh-Skaife et al. 2008;
Feng et al. 2009); increase firm’s compliance costs (Hogan and Wilkins 2008; Krishnan et al. 2008;
Raghunandan and Rama 2006); increase firm’s cost of capital (Ashbaugh-Skaife et al. 2009); and
leads to more frequent executive turnover (Johnstone et al. 2011; Li et al. 2010; Masli et al. 2016).
Under certain circumstances, it can also lead to the de-listing of the firm from the stock exchange.
The CEO and CFO of the firm could be fined up to $5 Million and sent to jail for up to 20 years.
IS researchers who focus on consequences of ineffective IT-GRC mechanisms find that firms
that have material weaknesses in their IT-GRC mechanisms: (1) are not able to make accurate
management forecasts (Li et al. 2012); (2) are more likely to terminate the employments of their
CEOs and CFOs (Masli et al. 2016) who in turn have a hard time in finding comparable jobs
(Haislip et al. 2015); (3) report lower accounting earnings and lower market valuations (Stoel and
Muhanna 2011); (4) have less ability to pay their debts (Kuhn et al. 2013); and (5) and end up
reporting more material weaknesses and misstatements than firms which do not have material
weaknesses in their IT controls (Klamm and Watson 2009).
Given what is at stake for the firm and the executives, a more plausible explanation could be
that firm institutes the IT-GRC mechanisms required by the relevant laws, regulations, and
industry standards, but that the mechanisms become ineffective over time. If the firm’s business
is changing dynamically to adapt to the changes in the environment, the IT-GRC mechanisms can
fail to catch up with the changing business objectives, risk profile, and the new IT-GRC needs of
the firm. In this study, we focus on this explanation. We seek to identify strategic repositioning
6
moves of the firm that have unintended negative impacts on the effectiveness of the firm’s IT-
GRC mechanisms.
We ground our theoretical development in complexity science. We view both firms and their
competitive environments as complex adaptive systems (CAS). As the complexity level in the
external CAS increases, firms face adaptive tension (Boisot and McKelvey 2011). They address
the adaptive tension by adjusting the variety and complexity levels within their internal CAS
(Ashby 1956). They make strategic repositioning moves that add new businesses to their business
portfolio or delete some of the existing ones. An unintended consequence of such strategic
repositioning moves is that they change the business objectives and the risk profile of the firm.
Accordingly, they also change the IT-GRC requirements of the firm. Thus, we expect strategic
repositioning moves to significantly disrupt and reduce the effectiveness of the firm’s IT-GRC
mechanisms.
In complex dynamically changing environments, firms make diversification and merger and
acquisition (M&A) moves to add new businesses to adjust the internal variety and complexity of
their business their portfolios. Such moves have significant implications for IT integrations across
the old and the newly added businesses, which could disrupt the existing IT-GRC mechanisms of
the firm (Tanriverdi 2005; Tanriverdi and Uysal 2011; Tanriverdi and Uysal 2015). Firms also
make divestiture moves to sell off some of their businesses and focus their business portfolios.
However, carving out and separating previously integrated IT systems of the divested unit often
proves problematic to the remaining businesses, and hence, it could disrupt the effectiveness of
IT-GRC mechanisms (Tanriverdi and Du 2009). Firms also make internal restructuring moves to
redefine the relationships among their businesses in ways to match the changing complexity level
in the environment (Eisenhardt and Brown 1999). Such restructuring initiatives could also disrupt
7
and reduce the effectiveness of IT-GRC mechanisms.
In section II, we review the theoretical foundations in which the proposed theory will be
grounded. In section III, we develop hypotheses to explain how and why strategic repositioning
moves impact the effectiveness of the IT-GRC mechanisms. In section IV, we present the sample,
data, and procedures used for testing the hypotheses, and present the results. In section V, we
discusses the contributions and implications of the proposed theory for IS research and practice.
THEORETICAL FOUNDATIONS
Management control theory provides the theoretical underpinnings of our dependent construct,
IT-GRC mechanisms. IS literatures on governance, control and risks provide the foundations for
different types of IT-GRC mechanisms. Complexity science provides the theoretical foundations
for developing the nomological links between our independent constructs, strategic repositioning
moves of firms, and our dependent construct, the effectiveness of IT-GRC mechanisms.
Management Control Theory
Firms have business objectives such as profitability, growth, and shareholder wealth creation.
However, there is a multitude of hurdles that could inhibit the achievement of those business
objectives: e.g., technical risk, financial risk, operational risk, regulatory compliance risk, etc. Risk
is defined as the probability of loss and the magnitude of loss (Tanriverdi and Ruefli 2004).
Management control systems aim to avoid or minimize such hurdles, and enable the firm to achieve
its business objectives.
Management control systems refer to a wide range of formal and informal governance and
control mechanisms (Simons 1991). Informal mechanisms include leadership, culture, values, and
norms (Macintosh 1994). Formal mechanisms include agreements and assumptions about firm’s
business objectives and the risks that could potentially inhibit their achievement (Goold and Quinn
8
1990). Then, managers institute formal GRC or internal control mechanisms to provide reasonable
assurance (not absolute assurance) for the achievement of the business objectives and the
minimization of the risks. The scope of the GRC mechanisms usually covers: (i) effectiveness and
efficiency of operations, (ii) reliability of financial reporting, and (iii) compliance with applicable
laws and regulations (COSO 1992). After designing and implementing the GRC mechanisms,
managers also continuously monitor their operating effectiveness (Eisenhardt 1985; Ouchi and
Maguire 1975). If there are deviations from the desired business objectives, managers intervene
by imposing sanctions, redesigning the GRC mechanisms, changing the objectives, etc. (Goold
and Quinn 1990).
Information Systems Literature on IT-GRC Mechanisms
In an increasingly digital world, firms digitize their products, services, business processes, and
relationships with their customers and business partners. While digitization offers many business
benefits and opportunities, it also increases IT-related risks such as data security and privacy
breaches, digital fraud, and operational IT glitches (IIA 2012). Hence, IT becomes an increasingly
critical component of a firm’s management control systems (Weidenmier and Ramamoorti 2006).
Consistent with the management control theory, IS research and practice recommend IT-GRC
mechanisms for mitigating IT-related risks of firms in: (i) the general computing infrastructure of
the firm, and (ii) the IT applications that automate and support the firm’s business processes (IIA
2008; IIA 2009; IIA 2012).
IT general controls (ITGC). In the general computing infrastructure of the firm, the firm
faces many risks in: (i) planning and organizing its IT assets, (ii) acquiring and implementing the
IT assets, (iii) delivering and servicing the IT solutions, and (iv) monitoring if the general
computing infrastructure of the firm operate as intended on an ongoing bases (ITGI 2007).
9
The IS literature on IT governance, control, and security focus on such ITGC risks: e.g., IT
investment risks, IT application development risks, IT implementation risks, IT operational failure
risks, IT security risks, IT outsourcing risks, etc. (e.g., Barki et al. 2001; Keil et al. 1998; Lyytinen
et al. 1998; Weill and Broadbent 1998). To mitigate the ITGC risks, IS researchers suggest various
IT-GRC mechanisms such as aligning business and IT strategies and investment objectives
(Henderson and Venkatraman 1993); setting up IT governance structures (Sambamurthy and
Zmud 1999; Weill and Ross 2005); choosing proper control modes to regulate individual behaviors
and obtain desired behaviors in software development projects and IT implementation projects
(e.g., Kirsch 1996; Kirsch 1997); establishing IT security policies, training users for IT security
awareness, and establishing security countermeasures (e.g., D'Arcy et al. 2009; Ransbotham and
Mitra 2009; Straub 1990). IS practice also suggests IT-GRC mechanisms for IT human resource
management, IT documentation, IT program change management, segregation of IT duties, backup
and recovery, and business continuity (ITGI 2007).
Automated process controls (APC). Firms also face IT-related risks in IT applications that
automate their business processes. For example, input data going into an IT application might be
at risk of being invalid, incorrect, incomplete or unauthorized. The processing logic embedded in
the IT application might be at risk of not following the most up-to-date business rules and look-up
tables, not handling the exceptions, and hence, not being valid. The outputs coming out of the IT
application might be at risk of not being valid, not displaying the relevant outputs, or not being
accurate (IIA 2009). In addition, if the duties of users who have access rights to the IT applications
are not segregated properly, opportunities for fraud could be created. For example, if a user, who
has access rights to create vendors in the system, is also mistakenly given access rights to pay
vendors, opportunity is created for fraud. The user can create fake vendors and pay himself. To
10
mitigate such risks, firms embed automated process controls (APC) into the IT applications. APC
cover input controls, processing controls, outcome controls, and segregation of duty controls (IIA,
2009).
Managers inject explicit business rules, norms, roles, process prescriptions, and APCs into IT
applications (Gosain 2004). Then, the IT applications monitor and regulate the inputs, outputs, and
processing integrity of the business processes in real time. Automating the process controls offer
many benefits such as continuous auditing, remote monitoring, real-time alerts on errors and
glitches, and automatic match, validation, and reconciliation of different data sources (Hansen and
Hill 1989). For example, one IT application can automatically validate a payment transaction prior
to the actual payment by matching the purchase order, the receiving report, and the invoice from
vendors, raise a flag and alert management if exceptions are identified. In addition to automating
preventive controls, APC also increases the effectiveness of detective and corrective controls by
increasing the traceability of business transactions through recording of audit trails or logs along
with the execution of each business transaction (Weber 1982). To automate business processes,
managers standardize and document the inner workings of, and the interfaces among, processes,
which further increase the transparency and thus the auditability of business processes (Chapman
and Kihn 2009).
Complexity Science
Complexity is a property of a system that is made up of a large number of parts that interact
with each other in non-linear ways (Maguire 2011). The focal complex system of interest in this
study is a firm, which is made up of businesses. The parts of this complex system are the business
units. Relationships among the business units (e.g., resource sharing) are the interactions among
the parts (Eisenhardt and Piezunka 2011). Business units are heterogeneous, intelligent, and
11
adaptive parts. They can observe and interpret stimuli from each other and from the environment.
They can learn, change their behaviors, and adapt to the changes in the environment intelligently
(Casti 1997; Holland 1995). Business units can also have agency. They can pursue their own self-
interests rather than the strategies, objectives, and prescribed behaviors of the corporate center of
the firm. While the corporate center emphasizes cross-business synergies to maximize the overall
performance of the corporation (Tanriverdi 2005), individual business units can forego the
synergies and seek to maximize their own performance, which is suboptimal for the performance
of the corporation (Campbell et al. 2014). Thus, there is constant tension between the business
units and the corporate center as to which objectives the business units ought to pursue. This is
important for our theory because the changing business objectives change the risk profile of the
firm, which in turn changes the IT-GRC needs of the firm.
The competitive environment in which the firm operates is also a complex adaptive system
(CAS). The parts of the external CAS are customers, markets, rival firms, regulators, etc.
Competitive actions and reactions of rival firms, changing customer needs, market conditions, and
regulations are the interactions among the parts of the external CAS. As the complexity in the
external CAS changes, firms face adaptive tension (Boisot and McKelvey 2011). Ashby (1956)
law of requisite variety suggests that firms can address the adaptive tension by adjusting their
internal complexity. Indeed, managers adjust internal structures of their firms based on the
complexity and uncertainty levels in the external environment (Davis et al. 2009). Managers
strategically reposition their business portfolios. They reconfigure the composition of the
businesses in the portfolio (parts) and the nature of the relationships (interactions) among them in
order to adjust the variety and complexity levels of their internal CAS in ways to match the external
CAS. Such strategic repositioning moves are likely to change the business objectives, risk profiles,
12
and hence, IT-GRC needs of the firm.
In this study, we build on the corporate strategy literature to identify the strategic repositioning
moves that enable managers to adjust the complexity level of their internal CAS (Campbell et al.
2014; Eisenhardt and Brown 1999; Ramanujam and Varadarajan 1989). First, firms increase their
internal variety and complexity by adding new businesses (new parts) to their business portfolios.
They do so through organic diversification moves or mergers and acquisitions. Further, firms can
diversify within domestic markets or foreign (international) markets. Second, firms strategically
decide on the nature of the relationships (interactions) among the businesses in their portfolio.
They either create related, synergistic business portfolios (tight interactions) or diverse, unrelated
business portfolios (loose interactions). Third, firms decrease their internal variety and complexity
by exiting some of their businesses (parts) through divestiture moves. They cut the relationships
(interactions) between the divested business and the rest of the business portfolio. Fourth, firms
make internal restructuring moves to patch and restitch a continually shifting mix of businesses in
their portfolios to match the changing complexity in the external environment (Eisenhardt and
Brown 1999). In the next section, we explain how and why these strategic repositioning moves are
likely to impact the effectiveness of IT-GRC mechanisms.
HYPOTHESES DEVELOPMENT
Corporate Diversification and the Effectiveness of IT-GRC Mechanisms
A key element of a firm’s corporate strategy choices is where to position and play. Some
firms choose to focus on one industry position or a limited number of industry positions while
others diversify across multiple industry positions (Campbell et al. 2014). Diversification is
defined as the entry of a firm into new lines of businesses that entail changes in the firm’s
administrative structures, systems, and other management processes (Ramanujam and Varadarajan
13
1989). Firms diversify for both proactive and defensive reasons. Diversification can enable a firm
to seize emerging new opportunities in a dynamically changing environment. Diversification can
also enable the firm to diversify its cash flow risks. While cash flows from some businesses can
decline, cash flows from other businesses can increase and smooth out the overall cash flows of a
diversified firm. The firm can strategically adjust its diversification level up or down over time to
adapt to the changing variety and complexity levels in the external CAS.
Increasing diversification level increases the variety and complexity of a firm’s internal CAS
by adding more parts (businesses) to it. While it helps to match the variety and complexity of the
external CAS, increasing diversification level also increases the scope and diversity of the
businesses in the firm’s business portfolio and puts strains on the firm’s administrative structures,
managerial systems, processes, and controls (Chandler 1962). In response, the firm seeks to expand
the scope of its IT environment to accommodate the increased communication, coordination, and
knowledge management needs of its business portfolio (Tanriverdi 2005; Tanriverdi 2006).
Accordingly, the IT-GRC mechanisms need to be revised or redesigned to accommodate the new
business objectives, the new risk profile, and the new IT-GRC needs of an expanded portfolio of
businesses. Such changes are likely to disrupt the firm’s IT-GRC mechanisms.
H1: Firms that have higher diversification levels are more likely to reduce the effectiveness of
their IT-GRC mechanisms.
Foreign (international) Operations and the Effectiveness of IT-GRC Mechanisms
The “direction of diversification” is another key element of a firm’s corporate strategy choices:
e.g., which customers and geographic markets to enter (Ramanujam and Varadarajan 1989). In an
increasingly global economy, boundaries of the firm’s external environment are no longer confined
to the domestic economy. Firms make strategic moves to take advantage of opportunities emerging
in foreign (international) economies as well. According to Goldman Sachs, S&P 500 firms
14
generated 33% of their aggregate revenues from foreign operations in 2014.6 Such statistics attest
to the pervasiveness and the importance of firms’ strategic repositioning moves to foreign markets.
Entry into foreign operations not only adds more parts (businesses and markets) to the internal
CAS of the firm, but it also increases the diversity of the parts and the interactions among the parts.
Diversity of the parts increases due to the differences in the institutional environments (e.g., laws,
regulations, intellectual property regimes, currencies), cultural environments (e.g., norms, beliefs,
language), and geographies (e.g., time zones) of the firm’s businesses and markets across the globe.
Diversity of the interactions among the parts also increases due to increasing resource flows and
arbitrage opportunities. For example, recent policy debates stemming from currency fluctuations
and tax differentials across world economies affect the strategic decisions and performance of not
only the foreign subsidiaries of a firm but also the entire firm. The increasing diversity of the parts
and the interactions within the firm’s CAS has significant implications for the IT environment and
IT-GRC mechanisms of the firm. IS researchers coined the term, “digitally-enabled, globally
extended enterprise” to emphasize the central role that IT plays in enabling foreign operations
(Krishnan et al. 2007). IT-GRC mechanisms which used to be optimized for the domestic
operations of the firm will need to take into account the new business objectives, new risk profiles,
and new IT-GRC needs of the newly added foreign operations. Such changes are likely to disrupt
the firm’s IT-GRC mechanisms.
H2: Firms that operate in foreign markets are more likely to reduce the effectiveness of their
IT-GRC mechanisms.
Corporate Acquisitions and the Effectiveness of IT-GRC Mechanisms
The “mode of diversification” is also a key element of the firm’s corporate strategy choices
(Ramanujam and Varadarajan 1989). In diversifying into a new market, the firm can either use the
6 http://www.businessinsider.com/foreign-revenues-by-region-2015-7
15
processes of internal business development or acquire an existing firm in that market. Increasing
costs of internal business development coupled with rapidly changing market conditions motivate
firms to rely more on corporate acquisitions as the mode of diversification (Ramanujam and
Varadarajan 1989). In acquisition transactions, acquirers often aim to integrate targets to achieve
synergy benefits. Most of the synergies are IT-dependent because administrative structures,
managerial systems, processes, and controls of modern firms are implemented in IT (e.g., Mehta
and Hirschheim 2007; Tanriverdi and Uysal 2011).
From a complexity perspective, the post-acquisition IT integrations are very challenging and
disruptive to both acquirers and targets (Tanriverdi and Uysal 2015). To start with, each firm is a
CAS. Bringing the two CAS together means that there will be disruptions to both (Allen et al.
2002). Even if the strategies, structures, processes, control systems, cultures, human resources, and
information systems of the two CAS were very similar, during the integration process there are
two competing parts for each new part of the integrated CAS. For example, there are two CIOs,
two sets of IT infrastructures, two sets of IT applications, etc. One of them will survive, the other
one will have to go; or both will have to go; or both will survive but will assume new roles and
functions. This is a highly political and emotional change management process in which both CAS
experience disruptions in creating the new CAS (Allen et al. 2002). The implication for IT-GRC
mechanisms is that the IT-GRC mechanisms of the acquirer and the target will also be disrupted,
but that the requirements of the new IT-GRC mechanisms of the merged CAS will not be clear
until after the rational, political, and emotional dynamics of the integration unfold and stabilize.
Thus:
H3: Firms that have higher M&A intensity levels are more likely to reduce the effectiveness of
their IT-GRC mechanisms.
Corporate Divestitures and the Effectiveness of IT-GRC Mechanisms
16
Corporate divestiture is the opposite “mode of diversification” in which a firm reduces the
scope and the diversification level of its business portfolio by selling some of its business positions
or assets to another firm (Brauer 2006). Firms often use divestitures to exit positions whose
profitability levels decline over time due to changes in the environment. By reducing the number
of parts in the firm’s internal CAS, divestiture can reduce the internal variety of the firm. However,
divestiture does not necessarily reduce the complexity level of the firm’s internal CAS.
Prior to the divestiture, the seller and the to-be-divested unit were in a parent-subsidiary
relationship. To be able to comply with the relevant laws and regulations, parent firms integrate
mundane support functions such as accounting, finance, HR, payroll, treasury, tax, etc., even
though the businesses in their portfolios are unrelated in terms of customers and products
(Tanriverdi 2005). Since the mundane support functions are implemented in IT systems and
applications, there is also IT integration between parents and business units. After the divestiture
transaction, the divested unit needs to be legally separated from the parent. Thus, the parent needs
to carve out and separate it from the shared support and IT services environment of the corporation.
Carving out and separating one of the parts of the firm’s internal CAS means that some of the
connections and interactions of the remaining parts need to be terminated, or rewired and redefined.
As the IT carve-out and separation process severs the previous connections and interactions, it
causes disruptions to both the parent and the divested unit (Tanriverdi and Du 2009). The previous
IT-GRC mechanisms, which were designed for a larger scope and diversity of businesses, also
need to be redesigned. The changing business objectives, risk profiles, and the IT-GRC needs of
the smaller, more focused portfolio of businesses is likely to disrupt the IT-GRC mechanisms.
H4: Firms that have higher divestiture intensity levels are more likely to reduce the
effectiveness of their IT-GRC mechanisms.
Corporate Restructuring and the Effectiveness of IT-GRC Mechanisms
17
Corporate restructuring refers to changes in administrative structures, management
systems, processes, and workforce reconfiguration moves of corporations (Brauer 2006; McKinley
and Scherer 2000). After a period of strategic repositioning moves such as the diversification,
foreign entry, M&A, and divestiture moves discussed above, the firm’s internal administrative
structures, systems, processes, and workforce skills are likely to lose coherence. Firm makes
corporate restructuring moves to patch and restitch the continually shifting mix of businesses to
better match its internal CAS better with the external CAS (Eisenhardt and Brown 1999). The
scope of changes in structuring is very large since the administrative structures, management
systems, processes, and workforce skills of the corporation are affected. Those changes also imply
major changes in the IT-GRC mechanisms. Thus, the risk of disruption to the IT-GRC mechanisms
is high.
H5: Firms that engage in corporate restructuring are more likely to reduce the effectiveness
of their IT-GRC mechanisms.
METHODS
Data and Research Context
The test of the proposed theory requires a longitudinal data set in which strategic repositioning
moves and IT-GRC effectiveness of firms could be measured. Data for measuring strategic
repositioning moves are available from Compustat, SDC platinum, and SEC’s EDGAR databases.
Longitudinal data on the effectiveness of IT-GRC mechanisms is available for publicly traded
firms in the US that are subject to the Sarbanes–Oxley (SOX) Act. Section 404 of SOX requires
publicly traded firms to design and effectively operate IT-GRC mechanisms, as part of their
internal controls, to ensure the accuracy and reliability of financial information generated through
the IT systems of the firm.
In SOX 404 compliance audits, external auditors evaluate hundreds of IT controls that
18
constitute a firm’s IT-GRC mechanisms, and issue an opinion about their overall effectiveness (Li
et al. 2012; Masli et al. 2016). They classify the severity of any IT control deficiencies into: (i)
lowest severity: ordinary deficiency (D); (ii) moderate severity: significant deficiency (SD); or (iii)
highest severity: material weakness (MW). If the IT control deficiencies remain at low (D) or
moderate (SD) severity levels, auditors conclude that the IT-GRC mechanism of the firm is
effective. They report the D and SD types of IT control deficiencies only to the management of
the firm. Thus, our dataset indicates that the firm’s IT-GRC mechanism is effective even when the
firm may have D and SD types of IT control deficiencies. If the auditors elevate the severity level
of IT control deficiencies to MW, they conclude that the IT-GRC mechanism of the firm is
ineffective. This means that the financial information that goes into the financial statements of the
firm is not reliable. This conclusion as well as the detail of the IT control deficiencies are reported
to the SEC and the investing public. Our dataset captures the MW type of IT control deficiencies.
Strategic repositioning moves of firm could potentially create D (low), SD (moderate), or MW
(high) types of deficiencies in the firm’s IT-GRC mechanisms. By capturing whether or not there
is any MW type of IT control deficiency in firms, our data allows the strongest possible test of the
proposed theory. If this dataset shows that the hypothesized strategic repositioning moves create
MW in IT-GRC mechanisms, it would imply that the hypothesized relationships are so strong that
they are detected with even the most severe type of IT control deficiencies.
Sample
Our sampling frame is the list of publicly traded firms in the U.S. stock markets. SOX 404
audit results of these firms are available in Audit Analytics, a premium public company
intelligence database. Our study timeframe ranges from firms’ fiscal year 2004, the first SOX
compliance year, to their fiscal year 2009. We use the “SOX 404 Internal Controls” section of the
19
database and rely on the independent auditor’s opinion rather than the management’s own opinion.
If a firm restates its SOX auditing reports several times for a particular year, we use the latest
available restatement.
We selected our sample based on three criteria. First, following previous studies in the SOX
context (e.g., Feng et al. 2015), we selected only those firms known as “accelerated filers,” which
are defined by the SEC based on the size of firms’ public shares.7 Second, we excluded foreign
firms that were listed in the U.S. stock markets. This criterion ensures that all firms in our sample
are U.S firms and that they are subject to the same regulatory environment.8 Third, following
previous studies (e.g., Iliev 2010), we exclude firms from the financial industry because they had
long been under other regulations similar to SOX.
We then collected further data from a variety of data sources for the computation of
independent and control variables, including Compustat, SDC platinum, SEC’s EDGAR, Bureau
of Economic Analysis’s industrial IT investment database, and the Information Week 500 annual
rankings. The final estimation sample consists of 2,475 firms with 10,938 observations across six
years (2004-2009).
Dependent Variables
Internal Control MW, Non-IT Control MW, and IT-GRC MW. While our primary
research interest is to develop and test the relationships between strategic moves and the
effectiveness of IT GRC mechanisms, our empirical investigation started by analyzing the
7 After the SOX Act was enacted in 2002, the regulator required publicly-traded firms with a public float of at least $75 million,
known as accelerated filers, to comply with the regulation in 2004, while non-accelerated filers did not have to comply before
2007. In addition, accelerated filers need to comply with both Section 404(a) and 404(b) of the SOX Act, while non-accelerated
filers only need to comply with 404(a). Thus, excluding non-accelerated filers can ensure the comparability of firms in our
sample. In addition, because we are theoretically interested in complexity, accelerated filers, which by definition are larger in size
than non-accelerated filers, provide a better empirical context for our hypothesis testing. 8 Foreign firms listed in the U.S. stock markets are also subject to the SOX rules but with a different deadline. While U.S.
accelerated filers need to comply with the regulation in 2004, foreign firms only need to submit their SOX 404 audit reports for
the fiscal year ending on or after 15 July 2006 (Piotroski and Srinivasan 2008).
20
influence of these moves on the overall internal control effectiveness. The relationships between
some of the strategic moves (diversification, foreign operation, acquisitions, and restructuring) and
the overall internal control systems have been empirically investigated in the accounting literature
(e.g., Ashbaugh-Skaife et al. 2007; Doyle et al. 2007; Ge and McVay 2005). We started by trying
to replicate the previous findings by using new datasets and new estimation techniques. In addition,
because divestiture has not been emphasized in the literature, we also aim to add to the general
accounting literature by testing the influence of divestiture on the overall internal control systems.
Thus, our first dependent variable is the presence [1] or absence [0] of material weaknesses (MWs)
in a firm’s overall internal control systems in a given year.
A firm reporting MWs in its internal control systems could have both IT-related and non-IT-
related MWs. To better understand the specific control mechanisms that could be disrupted by
various strategic moves, we use the presence [1] or absence [0] of only non-IT control MWs and
IT GRC MWs in a firm in a given year as our second and third dependent variables respectively.
For a firm with MWs identified, the Audit Analytics database will also record the nature of the
MWs by coding them into a list of predefined categories. IT-related MWs are coded as #22, and
we treat all the other types of MWs as non-IT MWs. However, prior studies report that Audit
Analytics make occasional classification mistakes by labeling some non-IT weaknesses as IT
weaknesses (Canada et al. 2009). Thus, following prior studies (Canada et al. 2009; Masli et al.
2016), we read the original SEC annual filings (usually forms 10-K or 10-KSB) of firms that
reportedly had MW in their IT-GRC. We identified that in 14 cases Audit Analytics misclassified
non-IT MW as IT MWs. We corrected them accordingly. After this correction, 163 unique firms
in our sample had reported IT GRC MW in our study timeframe.
Categorizing IT-GRC Mechanism MWs. While our primary dependent variable (IT GRC
21
MW) appears to be a binary variable capturing whether the external auditor found material
weaknesses in the IT GRC mechanisms of the firm or not, this opinion is the result of an extensive
review and evaluation of the design and the operating effectiveness of hundreds of IT general
controls (ITGC) and IT application controls, or automated process controls (APC) as we label
them in this study. The auditors’ evaluation also covers both the design and the operation
effectiveness of IT GRC mechanisms. If a firm’s external auditors conclude that its IT GRC is free
of MWs, the firm does not need to disclose any further detailed information. However, if MWs in
IT-GRC exist in either its design or its operation, the firm will disclose the specific IT controls and
the nature of their MWs in its regulatory filings. This allows us to conduct additional analyses as
to whether the hypothesized strategic repositioning moves affect (1) the ITGC and APC, and (2)
IT GRC design and operation in similar or different ways. To be able to conduct such analyses,
we manually coded the IT-GRC MW disclosures along two dimensions: ITGC MW versus APC
MW; and design MWs versus operation MWs.
To code IT GRC MWs, we followed the similar procedures used in previous studies from the
same research context (e.g., Li et al. 2012; Masli et al. 2016). We started with developing a coding
scheme that classifies IT controls into ITGC/APC and design/operation by synthesizing the
academic and practitioner literatures on ITGC audits and IT application audits (AICPA 2004; IIA
2009; IIA 2012; ITGI 2006; ITGI 2007). The coding scheme was then refined based on our
intensive discussion with partners and senior managers from big public accounting firms. The final
coding scheme used is presented in Appendix A. As shown in the coding scheme, ITGC controls
include IT governance controls, IT human resource controls, IT documentation controls, IT access
controls, IT computer operations controls, IT program development controls, IT change
management controls, and IT segregation of duty controls. Automated process controls (APC)
22
include controls embedded in IT applications such as input controls, processing controls, output
controls, and segregation of duty controls in business roles. The design of IT GRC mechanisms is
concerned with whether necessary mechanisms are present, adequate, and effective to mitigate
various IT-related risks at least on paper, and the operation of IT GRC mechanism is concerned
with whether the mechanisms are actually carried out consistently and effectively as designed.
From the SEC’s EDGAR database, we collected the annual filings of the firms that experienced
material weaknesses in their IT-GRC and excerpted the contents disclosing the nature of these
weaknesses. We then had two independent coders follow the coding scheme to classify whether
the IT material weaknesses were in ITGC/APC and design/operation categories. The concordance
rates between the classifications of the two coders, measured as Cohen’s Kappa (Cohen 1960),
were well over 90%. Remaining discrepancies, mostly caused by the ambiguity of the original
disclosure wording, were discussed by the authors to make final coding decisions.
Independent Variables
Diversification Level. As in prior studies, we use Palepu’s (1985) entropy measure of total
diversification to compute the total diversification level of a firm’s business portfolio across
different business segments in a given year. Specifically, Palepu computes the total diversification
with: ∑ 𝑃𝑖ln(1
𝑃𝑖)𝑁
𝑖=1 , where Pi is the share of the sales in segment i to the total sales of the firm; N
is the number of business segments the firm operates in. The data is obtained from Compustat
segment database.
Foreign Operations. As in prior SOX studies (e.g., Ashbaugh-Skaife et al. 2007; Doyle et al.
2007), we measure if a firm has foreign operations or not by examining if the firm reported [1]
foreign currency translation gain/loss [Compustat item FCA] in its firm’s financial statements or
not [0]. Because financially immaterial items are not reported separately, the presence of foreign
23
currency transaction gain/loss in a financial statement is a reliable indicator of the firm’s foreign
operations (Doyle et al. 2007; Masli et al. 2010).
Acquisition Intensity. We build on Moeller et al. (2004) in computing the acquisition intensity
of a firm in a given year. We compute the ratio of the total value of the firm’s acquisition
transactions completed during that year to the market value of the firm’s invested capital at the
end of that year. This measure captures what percentage of the firm’s year-end market value came
through the acquisitions during the year. We first select all acquisition transactions of the firm in
a given year from the SDC Platinum database and sum their transaction values. Then, we follow
previous finance studies (e.g., Hitchner 2006; Moeller et al. 2004) to compute the market value of
the firm’s invested capital as the sum of the market value of the firm's outstanding shares
[Compustat item CSHO multiplied by item PRCC_F], the liquidating value of preferred stock
[Compustat item PSTKL], the book value of long-term debt [Compustat item DLTT], and the book
value of debt in current liabilities [Compustat item DLC]. The specific fiscal year ending date of
each firm had been taken into account to formulate the correct one-year time window to select
acquisition transactions. There were five observations in which the total transaction value of the
firms’ acquisitions in a particular year exceeded the firms’ year-end market value. We excluded
those observations to avoid extreme acquisition cases.
Divestiture Intensity. We build on Klein (1986) in computing the divestiture intensity of the
firm as the total value of a firm’s divestiture transactions completed during a year divided by the
firm’s market value of invested capital at the beginning of that year. This measure captures what
percentage of the firm’s market value at the beginning of the year was divested during the
divestiture transactions that year. The value of divestiture transactions was obtained from the SDC
database. The market value of the firm’s invested capital was calculated with the same formula as
24
in the acquisition intensity. We dropped one observation where the firm’s divestiture intensity in
a particular year exceeded 100% of the firm’s market value of invested capital.
Corporate Restructuring. As in prior studies, we examine the presence [1] or absence [0] of
restructuring costs [CompuStat item RCP] in the firm’s financial statement to measure if the firm
engaged in significant corporate restructuring in that year (Masli et al. 2010). The generally
accepted accounting principles mandate that, to be reported as a separate item in financial
statements, a restructuring cost needs to be significant enough.
Control Variables
There are potential alternative explanations at the industry and firm levels as to why a firm’s
IT-GRC mechanism could become ineffective. At the industry level, industries that change
dynamically and digitize more intensively could increase disruptions to IT-GRC mechanisms. At
the firm level, if the overall governance and internal control environment of the firm is weak, if
the firm is financially distressed, or if the firm has poor IT capabilities, IT-GRC mechanisms could
also be weak. We control for these factors to be able to rule out the alternative explanations and
minimize endogeneity concerns. We also control for year effects.
Environmental Turbulence and Munificence levels of the firm’s businesses. Environmental
turbulence refers to the extent which the environment changes frequently and unpredictably, and
environmental munificence refers to the extent to which the environment can provide abundant
resources and opportunities to support a firm’s sustained growth (Dess and Beard 1984). As our
theory implies, firms operating in more turbulent environments face more adaptive tension, and
hence they may make more strategic repositioning moves and increase the likelihood of disruption
to their IT-GRC mechanisms. In contrast, firms operating in munificent environments often
accumulate more slack resources internally, and thus, they may be buffered from immediate
25
environmental disruptions.
We follow Dess and Beard (1984) to compute environmental turbulence and munificence. First,
we measure the two constructs at the level of an industry sector, defined based on NAICS (North
American Industry Classification System). Then, we compute the measures at the firm level by
taking a revenue-weighted average of the industry level measures based on the industry sectors
from which the firm generates revenues. In specific, for an industry sector i at year t, we calculate
the average revenue of all the firms in that sector, denoted as yit. Then, for each industry sector i
and year t, we regress the sector-average revenue on time in a five-year time window by estimating
equations yit = βit+ βitT+εit, where T takes values of t, t-1, t-2, t-3, t-4, and t-5 and εit is the residual.
Then, the environmental turbulence of the industry segment i at year t is computed as the standard
error of estimated βit divided by the average of yit in the past five years; while the environmental
munificence is computed as the estimated value of βit divided by the average of yit in the past five
years (Dess and Beard 1984). Second, we calculate turbulence and munificence for a given firm
by analyzing the industry sector(s) in which the firm operates. For a firm operating in only one
industry sector, we apply the turbulence and munificence measures of the same industry sector to
the firm. For a firm operating in multiple industry sectors, we measure environmental turbulence
and munificence as the revenue weighted average of all industry-level turbulence and munificence
scores of the industry sectors in which the firm operates. The weight of a sector is the percentage
of revenue the firm generates from that sector (Carpenter and Fredrickson 2001).
Environmental IT intensity of the firm’s businesses. We also argued that industries in which
digitization levels are higher could be subject to more disruptions in IT GRC. Thus, we need to
control for the environmental IT intensity of a firm’s businesses. We first computed the IT intensity
of every industry sector as the ratio of the software and hardware stock value to the total equipment
26
stock value in that segment (McAfee and Brynjolfsson 2008). Bureau of Economic Analysis (BEA)
provided these industry-level IT data needed for this calculation. Then, we computed firm-level
IT intensity as the revenue-weighted average of the IT intensity levels of all industry sectors in
which the firm operates in a particular year.
Following previous studies (e.g., Ashbaugh-Skaife et al. 2007; Doyle et al. 2007; Masli et al.
2010), we also control for firms’ size, profitability, and financial leverage ratios.
Firm size. We measure firm size as the book value of the firm's total assets [CompuStat item
AT]. We log-transform this measure to reduce its skewness.
Firm profitability. We measure a firm’s profitability with the firm’s return on equity (ROE),
calculated as Earnings Before Interest and Taxes / (Total Assets – Total Liabilities) [CompuStat
items EBIT / (AT - LT)]. Following previous studies (e.g., Doyle et al. 2007), we winsorized the
ROE variable at the 1th and 99th percentiles to limit extreme values.
Firm’s financial leverage. We measure a firm’s financial leverage as the ratio of the firm’s
total liability [CompuStat item LT] to total assets [CompuStat item AT].
Corporate Governance Weaknesses. If the overall corporate governance environment of the
firm is weak, IT-GRC mechanisms could by negatively influenced by the “tone at the top” and
also become weak. Thus, we control for weaknesses in the firm’s overall corporate governance.
As part of the SOX audit, independent external auditors assess a variety of corporate governance
mechanisms. We use three of them to measure this control. First, auditors assess whether the Board
of Directors (BoD) has an effective, adequately staffed Audit Committee. An Audit Committee
that has adequate experience and expertise can constantly engage in overseeing internal controls
and communicating with auditors about potential control deficiencies and remediation (Hoitash et
al. 2009; Krishnan 2005; Zhang et al. 2007). Second, auditors assess whether the Top Management
27
Team (TMT) is competent, whether the TMT sets an appropriate, ethical tone at the top for the
organization, and whether the TMT is reliable. TMT and CFOs in particular are immediately
responsible for the effectiveness of internal control systems. Their qualification and experiences
will influence the quality of internal control systems. Similarly, CIO experience and IT experiences
of other senior executives will influence the IT aspect of SOX compliance (Li et al. 2007; Li et al.
2010). Finally, auditors assess whether the firm has a sufficient internal audit function.9 If there is
an MW in any of these governance mechanisms, it would indicate that the firm has weak
governance structures. We count the MWs in these three categories to measure the weakness of
the firm’s overall corporate governance.
Auditor Status. The quality of a public firm’s external auditors could signal the firm’s
confidence on its financial reporting and internal control effectiveness. Thus, following previous
studies (e.g., Masli et al. 2010), we control for a firm's auditor status by including a binary variable
indicating whether [1] or not [0] the firm was audited by one of the prestigious “Big Four”
accounting firms (i.e., KMPG, PricewaterhouseCoopers, Ernst & Young, and Deloitte).
IT Capability of firm. There are differences in firms’ IT capabilities, i.e., how they use IT
resources to develop technological, procedural, and organizational innovations. The differences in
IT capabilities could affect IT-GRC mechanisms as well. Thus, we control for firms’ IT
capabilities. Every year, Information Week (IW) magazine invites firms to submit application
packages for listing consideration in the annual IW500 list. IW asks a panel of IW experts and
industry peers of the applicants to assess whether IT capabilities of the applicant firms are above
average in their respective industries. This assessment is not simply about IT investments of firms
9 In the Audit Analytics database, material weaknesses in corporate governance are reported as categories #11
(“Ineffective, non-existent, or understaffed audit committee”), #13 (“Senior management competency, tone, reliability
issues”), and #18 (“Insufficient or non-existent internal audit function”).
28
into generic IT applications and services provided by IT vendors. It is about how the firm
configures and customizes those generic IT resources to its specific business, and how the firm
achieves technological, procedural, and organizational innovations with those IT resources. If a
firm is selected into the IW500 list, it is considered to have strong IT capabilities. Thus, following
previous studies (e.g., Bharadwaj 2000), we measure IT capability of a firm by assessing whether
or not the firm was listed [1=strong IT capability] in the IW500 list [0=weak IT capability] in a
year.
Year Effects. We include dummy variables to control for unobserved year fixed effects.
To mitigate the risk of reverse causality, we lagged all our explanatory covariates, except for
environmental variables and auditor status, for one year. Table 1 presents descriptive statistics and
correlations among the study variables.
---Insert Table 1 about Here---
Model Specification
We adopt survival analysis (Allison 2010) as our primary estimation method. In our research
context, when the SOX Act turned effective in 2004, big public firms in the U.S. entered a “risk
set” such that they started to face the hazard of having their IT-GRC MWs, if exist, disclosed to
the public. Survival analysis techniques allow us to directly estimate the influence of various
factors on the hazards of a firm reporting MWs in its internal control systems in general or in its
IT or non-IT controls in specific.
One of the major advantages of using survival analysis in this research context is to account
for the issue of right censoring in our observations. Right censoring happens when the event of
interest (i.e., reporting IT GRC MWs) had not occurred for some firms in our sample at the end of
our study time window. Instead of disregarding these observations, we adopted survival analyses
29
that can leverage the information of all the firms in our sample despite of whether or not the event
of interest had happened to them. Another advantage of using survival analyses is to minimize the
assumption we need to make when specifying statistical models. To achieve this, we employ Cox
proportional hazards (PH) models (Cox 1972) that are semi-parametric and do not require us to
specify the exact form of the link function between our independent variables and the dependent
variable. Instead, Cox models allow us to model an individual firm’s hazard function as
proportional to an unknown baseline hazard function. Because we do not have a priori theory or
previous empirical studies to specify the exact distribution of the hazards of a firm reporting IT-
GRC material weakness, using semi-parametric models such as Cox models help reduce the
potential biases associated with the misspecification of statistical models. Lastly, we adopted
discrete-time Cox models by treating each year as one spell, or one unit of time, in our analyses.
Discrete-time models allow the inclusion of time-varying factors in hazard functions and hence
they accommodate the time-varying nature of our independent and control variables.
We specify the hazard of an individual firm i reporting an IT-GRC material weakness at time
t with the following Cox PH model:
𝜆(𝑡|𝑋𝑖) = 𝜆0(𝑡)exp(𝛽1𝐷𝑖𝑣𝑒𝑟𝑠𝑓𝑖𝑐𝑎𝑡𝑖𝑜𝑛𝑖,𝑡−1 + 𝛽2𝐹𝑜𝑟𝑒𝑖𝑔𝑛𝑂𝑝𝑒𝑟𝑎𝑡𝑖𝑜𝑛𝑖,𝑡−1 ++𝛽3𝐴𝑐𝑞𝑢𝑖𝑠𝑖𝑡𝑖𝑜𝑛𝑖,𝑡−1 + 𝛽4𝐷𝑖𝑣𝑒𝑠𝑡𝑖𝑡𝑢𝑟𝑒𝑖,𝑡−1 + 𝛽5𝑅𝑒𝑠𝑡𝑟𝑢𝑐𝑢𝑟𝑖𝑛𝑔𝑖,𝑡−1 +Controls𝑖,𝑡−1 + Year𝑡)
where the subscript i denotes the individual firm, t denotes a specific year, 𝜆0(𝑡) is the
unknown baseline hazard of the event of interest (reporting IT-GRC MWs) at time t, and 𝜆(𝑡|𝑋𝑖)
as the hazard of the event conditional on a set of explanatory variables (𝑋𝑖)describing the firm i,
including its Diversification, Foreign Operation, Acquisition, Divestiture, Restructuring, and other
control variables (Controls) as well as the year effects. As noted above, the Cox model has a major
advantage as a semi-parametric model that does not need to make assumptions about the specific
30
form of the baseline hazard function 𝜆0(𝑡). Instead, it assumes only that the hazard of an event for
firm i at time t is proportional to the baseline hazard, and then it directly models how the hazard
of the event per time unit varies in response to a set of time varying explanatory covariates (Cox
1972; Hosmer et al. 2008).
About 26% of the firms in our sample repeatedly reports IT GRC MWs in multiple years.
However, MWs in a firm sometimes persist for a couple of years, or one MW in a previous year
may morph into or trigger a different one in the consequent year (Klamm et al. 2012). Thus, a firm
that repeatedly reports MWs in multiple years does not necessarily have new MWs in each of those
years. By checking the original disclosure documents, we concluded that the majority of the firms
with multiple-year IT-GRC MW disclosures in our sample actually experienced the same MWs
that persisted for multiple years.10 Thus, we removed a firm from the risk set after it reports an IT-
GRC material weakness for the first time to avoid modeling multiple MW disclosures as new
events.
Diagnostic Analyses
The proportionality of hazards is the key assumption underlying Cox models. We followed
the recommendations of Cleves et al. (2010, ch.11) and conducted three diagnostic tests on this
proportionality assumption. First, we conducted the link test as a general specification test. After
estimating our primary Cox model and obtaining the estimated vector of coefficients �̂�, the link
test re-estimates the hazard model by using the linear predictor 𝑋�̂� and its squared term (𝑋�̂�)2 as
independent variables. Under the assumption that 𝑋𝛽 is the correct specification, the estimated
10 We manually checked all the IT GRC MW disclosure documents of the firms with multiple-year disclosures. In our
study time window (2004 – 2009), out of the 317 pubic firms that had ever reported IT GRC weaknesses in at least
one year, 83 (26%) reported IT GRC weaknesses in multiple years. Among them, in only 13 firms, IT GRC MWs
originally reported in an earlier year were fully remedied but new IT GRC weaknesses were found in subsequent
years. Dropping these 13 firms with multiple IT GRC MW occurrences, or dropping all the 83 firms with IT GRC
MW disclosures, will not qualitatively change our conclusions.
31
coefficient of 𝑋�̂� should be significant while the estimated coefficient of (𝑋�̂�)2 should be
insignificant, which we confirmed in our diagnostic test.
The second test is to directly check the proportional-hazard assumption of Cox models by
including interactions between all the time-varying independent variables and the logarithm of
survival time (Hosmer et al. 2008). Under the proportional-hazard assumption, the estimated
coefficient of these interaction items should not be significant. Following the recommendations of
Cleves et al. (2010) and Hosmer et al. (2008), we interact our five primary independent variables
with ln(t) and re-estimate the Cox models after including the interaction items. None of the
estimated coefficients of the interaction items are significant, thus supporting the use of Cox Model.
The third test is to check proportional-hazard assumption based on the analyses of residuals,
as discussed by Therneau and Grambsch (2000) and Cleves et al. (2010). We conducted the
proportionality test, and the results again failed to reject the proportionality assumption, and
provided support for the use of Cox model.
Alternative Statistical Methods
We also considered panel data models as alternative statistical methods to check the
robustness of our results. In selecting the most appropriate panel data model, we need to address
the same issue as discussed above that IT GRC weaknesses reported in different years are most
likely the same, persisting weaknesses instead of new ones. Thus, when organizing our data as a
cross-sectional, time-series data set, there would be high serial correlations among observations
from the same subject across years. We ran the serial correlation test, as discussed by Wooldridge
(2010) and implemented by Drukker (2003). The test result confirmed the existence of significant
serial correlation (F-value = 39.727, p-value < .001).
We then chose to use Generalized Estimating Equation (GEE) models, which allow us to
32
directly model the possible serial correlation among the outcomes from the same subject in
multiple years. GEE is a specific type of generalized linear models that apply to longitudinal data
analyses (Hardin and Hilbe 2003). It utilizes both cross-sectional and time-series information of a
panel data and directly accounts for the correlation structure of observations from the same subject
by estimating a parameterized correlation matrix (Zeger and Liang 1986). Our primary conclusions
are qualitatively unchanged based on GEE models.
RESULTS
We report our primary results in Table 2 below. In Model 1 of Table 2, we used the presence
[1] or absence [0] of overall internal control MWs as the dependent variable and estimated the
hazard of its presence based on a firm’s audit report. In Model 2, we used the presence [1] or
absence [0] of only non-IT control MWs as the dependent variable. In Model 3, we used the
presence [1] or absence [0] of IT-GRC MWs as the dependent variable. Then, we moved further
to investigate the different types of IT-GRC MWs. In Model 4 and Model 5, we estimated the
hazards of reporting CoIT MWs and APC MWs respectively. In Model 6 and Model 7, we
estimated the hazards of reporting IT-GRC design MWs and IT-GRC operation MWs. All the
models were estimated based on Cox models as specified above.
--Insert Table 2 about Here--
The Impact of Strategic Repositioning Moves on Overall and Non-IT Controls
The results of Model 1 in Table 2 show that foreign operation, intensive acquisition and
divestiture, and restructuring all increase the hazard that a firm experiences MWs in its overall
internal control system. For the roles of foreign operation, acquisition, and restructuring, previous
studies in the accounting literature have reported largely similar results (e.g., Ashbaugh-Skaife et
al. 2007; Doyle et al. 2007; Ge and McVay 2005; Krishnan and Visvanathan 2007; Zhang et al.
33
2007). They have reported mixed results in the role of diversification, while in our analyses,
diversification has no significant impact. Most of these previous studies used cross-sectional data,
relatively simplified measures, and logistic regression techniques. Thus, first, our study provided
further confirmation to the previous findings in the accounting literature by using different dataset,
measurements, and statistical methods. We also added to the literature by introducing the
disruptive role of divestiture to overall internal controls.
When we separated the disruption to an internal control system into non-IT and IT-related
areas, as in Model 2 and Model 3, it becomes evident that IT-GRC mechanisms are more prone to
be disrupted during strategic repositioning moves. According to the results of Model 2, non-IT
control mechanisms are significantly disrupted by divestiture and marginally so by foreign
operation and restructuring, but IT-GRC mechanisms are disrupted by all the five types of moves.
The Impact of Strategic Repositioning Moves on IT-GRC
Our hypotheses were validated based primarily on the results of Model 3. According to them,
the hazard of experiencing a material weakness in IT-GRC mechanisms increases significantly
with: (H1): diversification level (β = .377, p-value <.05); (H2): presence in foreign operations (β
= .374, p-value < .05); (H3): acquisition intensity (β = 1.884, p-value <.05); (H4): divestiture
intensity (β = 2.593, p-value < .01; and (H5): engagement in corporate restructuring (β = .507, p-
value < .01). These results provide empirical support for our theory that corporate strategy
repositioning moves of firms significantly disrupt and reduce the effectiveness of the IT-GRC
mechanisms, over and beyond the effects of alternative explanations discussed in the prior
literature and in practice.
The Impact of Strategic Repositioning Moves on ITGC and APC
As discussed earlier, we categorized whether the IT-GRC MWs were in the IT general controls
34
(ITGC) and or in the automated process controls (APC). Models 4 and 5 of Table 2 respectively
report how the hypothesized strategic repositioning moves affect the ITGC and APC.
The results indicate that the diversification level significantly increases the hazard of MW in
ITGC, but not in APC. Foreign operation increases the hazard of MW in APC marginally, but not
in ITGC. Corporate restructuring, acquisition, and divestiture all increase the hazard of MW in
both ITGC and APC in similar ways. Overall, we noticed some but not dramatic differences in the
disruptive effects of strategic moves on ITGC and APC.
The Impact of Strategic Repositioning Moves on IT-GRC Design and Operation
As discussed earlier, we also categorized whether the IT-GRC MWs were related to the design
or the operation of IT-GRC mechanisms. Models 6 and 7 of Table 2 respectively report how the
hypothesized strategic repositioning moves affect the design and operation of IT-GRC
mechanisms.
The results indicate that all the five types of strategic repositioning moves increases the hazard
of MW in the design of IT-GRC mechanisms, but only acquisition marginally increases the hazard
of MW in their operation. The contrast suggests show evidence that IT-GRC mechanisms appear
disrupted during strategic repositioning moves mostly because they become at least temporarily
obsolete. The design of IT-GRC mechanism, which were likely optimized based on the old
business environments, cannot be updated timely during the turmoil periods of strategic
repositioning moves.
The Impact of Strategic Repositioning Moves on Detailed Categories of IT-GRC
When categorizing IT-GRC mechanisms into ITGC and APC, we used a finer-grained coding
scheme that includes eight subcategories of ITGC and four subcategories of APC. We further
explored how the hypothesized strategic repositioning moves affect these twelve subcategories of
35
IT-GRC mechanisms. The results are reported in Table 3 below.
--Insert Table 3 about Here--
The results indicate that access controls, or the controls that ensure authorized access to
various IT resources such as hardware, network, databases and applications, are most prone to be
disrupted during all types of strategic repositioning moves. One commonality among the five
hypothesized strategic moves in our study is the implication on personnel turnover and
organizational redesign. Layoffs and reorganization are common during these strategic moves, but
updating user profiles and access privileges in a complex IT environment is often a daunting task
and may not be done timely or completely.
Probably due to the same effects of personnel turnover and organizational redesign, MWs
associated with IT human resources and the input controls to various IT applications also appear
to be associated with more types of strategic moves according to Table 3. After a major strategic
move, the IT department of the firm often also experiences major changes, including personnel
turnover. Even The retained IT employees are also likely to experience the “survivor’s syndrome”
(Cascio 1993) under which employees exhibit low morale, resist change, withdraw, and become
paralyzed after their peers are eliminated and their workloads increase (Ranganathan and Outlay
2009). Similarly, because of the organizational redesign, many previously integrated IT systems
need to be rewired, and the interfaces among them need to be updated or replaced. The input
controls embedded in these systems need to reflect the new business rules, processing logic, and
the roles of end users, which themselves are often in flux during a strategic move (Du and
Tanriverdi 2014).
DISCUSSION AND CONCLUSION
In an increasingly digital world, IT-related risks of firms are on the rise. The main defense
36
mechanism against the IT-related risks has been IT governance, risk, and control (IT-GRC)
mechanisms. IT-related risks impact not only firms but also investors and customers. Thus, a
multitude of laws, regulations, and industry standards are instituted to require firms to design and
effectively operate IT-GRC mechanisms to minimize the probability of loss and magnitude of loss
associated with the IT-related risks. Despite these efforts, the frequency and pervasiveness of data
privacy and security breaches, operational IT glitches, and digital fraud and theft incidents indicate
that even well governed firms that institute state-of-the-art IT-GRC mechanisms struggle to main
the effectiveness of their IT-GRC mechanisms over time and become vulnerable to IT-related risks.
This study contributes to IS research and practice by explaining how and why a firm’s own
strategic repositioning moves play a significant role in this problem.
Contributions to IS research
One potential contribution of this research is to the IS research stream on IT risks and the
management control theory. The findings indicate that the current theory is too static to address
the dynamically changing IT risks and IT-GRC needs of firms in an increasingly complex digital
world.
The predominant theory that informs the design of IT-GRC mechanisms for mitigating IT-
related risks of the firm is the management control theory. This theory assumes that business
objectives and risks of firms are understood well and that they remain relatively stable during the
planning cycle of firms, typically an annual cycle. Accordingly, the theory also assumes that the
IT-GRC mechanisms that are designed based on the business objectives and risk profiles of firms
can also remain effective during the planning cycle. This research challenges these assumptions
on the grounds that the business objectives, risk profiles, and hence, IT-GRC needs of firms change
dynamically. The external environment is a complex adaptive system (CAS) that continuously
37
produces new opportunities and threats. In response, firms adjust their internal CAS, through
strategic repositioning moves, to match the external CAS in ways to seize the emerging
opportunities and cope with the emerging threats. The repositioning moves change the business
objectives of firms, which in turn change the risk profiles of firms, which in turn render the existing
IT-GRC mechanisms of firms less relevant. Accordingly, IT-GRC mechanisms become less
effective or ineffective. The findings imply the need for a more dynamic management control
theory that can enable firms to realign their IT-GRC mechanisms dynamically with changing IT-
related risks of their businesses.
Complexity science provides some guidance for the development of more dynamic IT-GRC
mechanisms in the firm. First, complexity science cautions that the wicked problems produced by
complex adaptive systems such as the dynamically changing IT risks of firms cannot be “solved”
fully, but that they can be “tamed.” Second, complexity science recommends four interrelated
capabilities for “taming” the wicked problems (McDaniel 2007): (a) sensing, (b) sense making, (c)
improvising, and (d) learning on the fly. Sensing capability can spot the changes in business
objectives and risk profiles created by strategic repositioning moves of the firm. Sense making
capability can focus on human cognitions and social interactions of IT and business managers for
interpreting the changes, giving meaning to them, and understanding what they might imply for
the IT-GRC mechanisms of the firm. Improvising capability focuses on inventing novel actions in
response to the changes: e.g., novel IT-GRC mechanisms that could align well with the new risk
profile of the firm. Learning capability focuses on understanding how and why the improvisational
actions perform. It can enable IT managers to learn how the new IT-GRC mechanisms perform
after the implementation of the strategic repositioning moves.
Another potential contribution of this research is to IS research stream on IT strategy, IT
38
capabilities, and business value. The findings of this study imply that the very IS strategies and
capabilities that are proposed to address the return and performance challenges of a complex,
dynamically changing environment could also be reducing the effectiveness of IT-GRC
mechanisms and exposing firms to more IT-related risks.
To address the return and performance challenges of the dynamically changing external CAS,
IS research proposes dynamic alignment of business and IT strategies (Benbya and McKelvey
2006; Sabherwal and Chan 2001; Tanriverdi et al. 2010; Vessey and Ward 2013). It recommends
the creation of digital platforms and the digitization of resources to create digital options that can
confer firms with business agility and flexibility (Sambamurthy et al. 2003), and the ability to
generatively develop new innovations (Yoo et al. 2012; Yoo et al. 2010). IS research also explains
how information systems can provide firms with dynamic sensing and responding capabilities
(Houghton et al. 2004). Further, IS research proposes reconfigurational IS capabilities (Tanriverdi
et al. 2010), improvisational IS capabilities (Pavlou and El Sawy 2010), and IS-enabled strategic
improvisation (Levallet and Chan 2015) that could enable firms to spontaneously reconfigure their
resources to build brand new capabilities and respond to dynamically emerging, unpredictable,
and novel situations in the external CAS. Clearly, these IT strategies and capabilities increase
firm’s ability to dynamically make strategic repositioning moves to seize the emerging return
opportunities and increase its performance in the external CAS. However, they also dynamically
change the business objectives and risk profiles of firms. Thus, they are also likely to render the
existing IT-GRC mechanisms of firms less effective or ineffective, and expose firms to more IT-
related risks as evidenced by increasing frequency and prevalence of IT-related risks. The findings
of this research imply that IS research on IS strategy and capabilities may need to address not only
the return implications but also the risk implications of the external CAS simultaneously.
39
Contributions to IS practice
This study informs managers that, as their firms diversify into different businesses, enter
international markets, acquire and divest businesses, and internally restructure their business units,
they significantly redefine the business objectives, risk profiles, and IT-GRC needs of their firms.
Thus, each of these strategic repositioning moves should alert IS managers that the IT-GRC
mechanisms are at risk of becoming less relevant and less effective. Thus, IS managers should
work closely with business managers to understand how IT-GRC mechanisms should be revised
or redesigned to realign with the changing business objectives and risk profile of the firm.
The key challenge for IS managers is to become involved in the early stages of the firm’s
strategic repositioning decisions so that they can inform business managers about the IT-GRC and
IT-risk implications of these decisions. Typically, strategic repositioning decisions such as mergers,
acquisitions, divestitures, etc. are made by the top executives of the firm (e.g., CEO and CFO)
under the veil of secrecy (Tanriverdi and Uysal 2011). Thus, many of the changes in the business
side may unfold over time without the knowledge and involvement of the IT unit. IT managers
may not even notice that the business objectives and risks of the firm have changed and deviated
from the original objectives and risks that were assumed during the design of the existing IT-GRC
mechanisms. The misalignment between the new risks and the existing risk mitigation mechanisms
of the IT-GRC is unlikely to be noticed until a risk realizes and causes losses. If IT managers are
involved in the early stages of the firm’s strategic repositioning moves, they can potentially see
how the moves change the business objectives and risks, and accordingly, proactively revise the
IT-GRC mechanisms to realign with them with the new risks, and hence, better mitigate the new
risks of the firm. Recent IS research indicates that the finding of MW in IT-GRC mechanisms of
a firm significantly increases the CEO and CFO turnover in the firm (Masli et al. 2016). By citing
40
this evidence along with the evidence of this study, IT managers might be able to convince their
CEOs and CFOs that the early involvement of IT executives in strategic repositioning moves of
the firm could minimize the MW in IT-GRC, and minimize the risks of not the firm, its investors
and customers, but also the job and career risks of the CEO and CFO.
Limitations and future work
As noted, one limitation of the study is that firms are not mandated to disclose data on IT
control deficiencies that are deemed to be low (D) or moderate (SD) in severity. They disclose if
there is MW in IT-GRC, i.e., the most severe type of IT control deficiency. This limitation meant
that we could only test if the hypothesized strategic repositioning moves increase the hazard of
experiencing MW in IT controls. The findings indicate that the strategic repositioning moves
disrupt the existing IT-GRC mechanisms so much that they significantly increase the probability
of MW in the firm’s IT-GRC. This data limitation enabled us to conduct the strongest test of the
proposed theory. We infer from the findings that if strategic repositioning moves are causing MW,
they might also be causing D and SD types of IT control deficiencies. Thus, the negative effects
of strategic repositioning moves on IT-related risks of firms could be broader in scope. Future
research can collect new data on the entire spectrum of IT-GRC deficiencies from low through
moderate to severe to test and validate this inference.
REFERENCE
AICPA. 2004. A Framework for Evaluating Control Exceptions and Deficiencies. American Institute of Certified Public Accountants.
Allen, P., Ramlogan, R., and Randles, S. 2002. "Complex Systems and the Merger Process," Technology Analysis & Strategic Management (14:3), pp. 315-329.
Allison, P.D. 2010. Survival Analysis Using SAS: A Practical Guide, (Second ed.). Cary, NC: SAS Institute. Ashbaugh-Skaife, H., Collins, D.W., and Kinney Jr, W.R. 2007. "The Discovery and Reporting of Internal
Control Deficiencies Prior to SOX-Mandated Audits," Journal of Accounting and Economics (44:1-2), pp. 166-192.
Ashbaugh-Skaife, H., Collins, D.W., Kinney Jr, W.R., and Lafond, R. 2009. "The Effect of SOX Internal Control Deficiencies on Firm Risk and Cost of Equity," Journal of Accounting Research (47:1), pp. 1-43.
Ashbaugh-Skaife, H., Daniel, W.C., Kineney, W.R., and Lafond, R. 2008. "The Effect of SOX Internal Control
41
Deficiencies and Their Remediation on Accrual Quality," The Accounting Review (83:1), pp. 217-250.
Ashby, R.W. 1956. An Introduction to Cybernetics. London: Methuen. Barki, H., Rivard, S., and Talbot, J. 2001. "An Integrative Contingency Model of Software Project Risk
Management," Journal of Management Information Systems (17:4), pp. 37-69. Benbya, H., and McKelvey, B. 2006. "Using Coevolutionary and Complexity Theories to Improve IS
Alignment: A Multi-Level Approach," Journal of Information Technology (21:4), pp. 284-298. Beneish, M.D., Billings, M.B., and Hodder, L.D. 2008. "Internal Control Weeknesses and Information
Uncertainty," The Accounting Review (83:3), pp. 665-703. Bharadwaj, A.S. 2000. "A Resource-Based Perspective on Information Technology Capability and Firm
Performance: An Empirical Investigation.," MIS Quarterly (24:1), pp. 169-196. Boisot, M., and McKelvey, B. 2011. "Complexity and Organization – Environment Relations: Revisiting
Ashby's Law of Requisite Variety," in The Sage Handbook of Complexity and Management, P. Allen, S. Maguire and B. McKelvey (eds.). Thousand Oaks, CA: SAGE Publications.
Brauer, M. 2006. "What Have We Acquired and What Should We Acquire in Divestiture Research? A Review and Research Agenda," Journal of Management (32:6), pp. 751-785.
Campbell, A., Goold, M., Alexander, M., and Whitehead, J. 2014. Strategy for the Corporate Level: Where to Invest, What to Cut Back, and How to Grow Organisations with Multiple Divisions. San Francisco, CA: John Wiley & Sons.
Canada, J., Sutton, S.G., and Kuhn, R. 2009. "The Pervasive Nature of IT Controls: An Examination of Material Weaknesses in IT Controls and Audit Fees," International Journal of Accounting and Information Management (17:1), pp. 106-119.
Carpenter, M.A., and Fredrickson, J.W. 2001. "Top Management Teams, Global Strategic Posture, and the Moderating Role of Uncertainty," Academy of Management Journal (44:3), pp. 533-545.
Cascio, W.F. 1993. "Downsizing: What Do We Know? What Have We Learned?," Academy of Management Executive (7:1), pp. 95-104.
Casti, J.L. 1997. "Would-Be Worlds: Toward a Theory of Complex Systems," Artificial Life and Robotics (1:1), pp. 11–13.
Chandler, A.D. 1962. Strategy and Structure. Cambridge, MA: MIT Press. Chapman, C.S., and Kihn, L.-A. 2009. "Information System Integration, Enabling Control and Performance,"
Accounting, Organizations and Society (34:2), pp. 151-169. Cleves, M., Gould, W.W., and Marchenko, Y.V. 2010. An Introduction to Survival Analysis Using Stata, (3rd
ed.). College Station, TX: Stata Press. Cohen, J.A. 1960. "A Coefficient of Agreement for Nominal Scales," Educational and Psychological
Measurement (20), pp. 37-46. COSO. 1992. Internal Control - Integrated Framework. New York, NY: AICPA. Cox, D.R. 1972. "Regression Models and Life-Tables," Journal of the Royal Statistical Society. Series B
(Methodological) (34:2), pp. 187-220. D'Arcy, J., Hovav, A., and Galletta, D. 2009. "User Awareness of Security Countermeasures and Its Impact
on Information Systems Misuse: A Deterrence Approach," Information Systems Research (20:1), pp. 79-98.
Davis, J.P., Eisenhardt, K.M., and Bingham, C.B. 2009. "Optimal Structure, Market Dynamism, and the Strategy of Simple Rules," Administrative Science Quarterly (54:3), pp. 413-452.
Dess, G.G., and Beard, D.W. 1984. "Dimensions of Organizational Task Evnironments," Administrative Science Quarterly (29:1), pp. 52-73.
Doyle, J., Ge, W., and McVay, S. 2007. "Determinants of Weaknesses in Internal Control over Financial Reporting," Journal of Accounting and Economics (44:1-2), pp. 193-223.
Drukker, D.M. 2003. "Testing for Serial Correlation in Linear Panel-Data Models," Stata Journal (3:2), pp.
42
168-177. Du, K., and Tanriverdi, H. 2014. "Managing Information Technology under Extreme Organizational
Disequilibrium: The Case of Corporate Spinoffs," the Proceedings of the 35th International Conference on Information Systems, Auckland, New Zealand.
Eisenhardt, K., and Piezunka, H. 2011. "Complexity Theory and Corporate Strategy," in The Sage Handbook of Complexity and Management, P. Allen, S. Maguire and B. McKelvey (eds.). Thousand Oaks, CA: Sage Publications.
Eisenhardt, K.M. 1985. "Control: Organizational and Economic Approaches," Management Science (31:2), pp. 134-149.
Eisenhardt, K.M., and Brown, S.L. 1999. "Patching: Restitching Business Portfolios in Dynamic Markets," Harvard Business Review (77:3), pp. 72-82.
Feng, M., Li, C., and McVay, S. 2009. "Internal Control and Management Guidance," Journal of Accounting and Economics (48:2–3), pp. 190-209.
Feng, M., Li, C., McVay, S.E., and Skaife, H. 2015. "Does Ineffective Internal Control over Financial Reporting Affect a Firm's Operations? Evidence from Firms' Inventory Management," The Accounting Review (90:2), pp. 529-557.
Ge, W., and McVay, S. 2005. "The Disclosure of Material Weaknesses in Internal Control after the Sarbanes-Oxley Act," Accounting Horizons (19:3), pp. 137-158.
Goold, M., and Quinn, J.J. 1990. "The Paradox of Strategic Controls," Strategic Management Journal (11:1), pp. 43-57.
Gosain, S. 2004. "Enterprise Information Systems as Objects and Carriers of Institutional Forces: The New Iron Cage?," Journal of the Association for Information Systems (5:4), pp. 151-182.
Haislip, J.Z., Masli, A., Richardson, V.J., and Watson, M.W. 2015. "External Reputational Penalties for CEOs and CFOs Following Information Technology Material Weaknesses," International Journal of Accounting Information Systems (17), pp. 1-15.
Hammersley, J., Myers, L., and Shakespeare, C. 2008. "Market Reactions to the Disclosure of Internal Control Weaknesses and to the Characteristics of Those Weaknesses under Section 302 of the Sarbanes Oxley Act of 2002," Review of Accounting Studies (13:1), pp. 141-165.
Hansen, J.V., and Hill, N.C. 1989. "Control and Audit of Electronic Data Interchange.," MIS Quarterly (13:4), pp. 403-413.
Hardin, J., and Hilbe, J. 2003. Generalized Estimating Equations, (1st ed.). London, UK: Chapman and Hall. Henderson, J.C., and Venkatraman, N. 1993. "Strategic Alignment: Leveraging Information Technology for
Transforming Organizations," IBM Systems Journal (32:1), pp. 472-484. Hitchner, J.R. 2006. Financial Valuation: Applications and Models, (2nd ed.). Hoboken, NJ: John Wiley &
Sons, Inc. Hogan, C.E., and Wilkins, M.S. 2008. "Evidence on the Audit Risk Model: Do Auditors Increase Audit Fees
in the Presence of Internal Control Deficiencies?*," Contemporary Accounting Research (25:1), pp. 219-242.
Hoitash, U., Hoitash, R., and Bedard, J.C. 2009. "Corporate Governance and Internal Control over Financial Reporting: A Comparison of Regulatory Regimes," The Accounting Review (84:3), pp. 839-867.
Holland, J.H. 1995. Emergence: From Chaos to Order. Reading, MA: Addison-Wesley. Hosmer, D.W., Lemeshow, S., and May, S. 2008. Applied Survival Analysis: Regression Modeling of Time to
Event Data, (2nd ed.). Hoboken, NJ: Wiley. Houghton, R., El Sawy, O.A., Gray, P., Donegan, C., and Joshi, A. 2004. "Vigilant Information Systems for
Managing Enterprises in Dynamic Supply Chains: Real-Time Dashboards at Western Digital," MIS Quarterly Executive (3:1), pp. 19–35.
IIA. 2008. GAIT for IT General Control Deficiency Assessment: An Approach for Evaluating ITGC Deficiencies in Sarbanes-Oxley Section 404 Assessments of Internal Controls over Financial Reporting.
43
Altamonte Spring, FL.: The Institute of Internal Auditors. IIA. 2009. Global Technology Audit Guide (GTAG) 8: Auditing Application Controls. Altamonte Spring, FL:
The Institute of Internal Auditors. IIA. 2012. Global Technology Audit Guide (GTAG) 1: Information Technology Controls, (2nd ed.). Altamonte
Spring, FL: The Institute of Internal Auditors. Iliev, P. 2010. "The Effect of SOX Section 404: Costs, Earnings Quality, and Stock Prices," The Journal of
Finance (65:3), pp. 1163-1196. ITGI. 2006. IT Control Objectives for Sarbanes-Oxley: The Role of IT in the Design and Implementation of
Internal Control over Financial Reporting, (2nd ed.). Rolling Meadows, IL: IT Governance Institute. ITGI. 2007. COBIT 4.1. Rolling Meadows, IL: IT Governance Institute. Johnstone, K., Li, C., and Rupley, K.H. 2011. "Changes in Corporate Governance Associated with the
Revelation of Internal Control Material Weaknesses and Their Subsequent Remediation," Contemporary Accounting Research (28:1), pp. 331–383.
Keil, M., Cule, P.E., Lyytinen, K., and Schmidt, R.C. 1998. "A Framework for Identifying Software Project Risks," Communications of the ACM (41:11), pp. 76-83.
Kirsch, L.J. 1996. "The Management of Complex Tasks in Organizations: Controlling the Systems Development Process," Organization Science (7:1), pp. 1-21.
Kirsch, L.J. 1997. "Portfolios of Control Modes and IS Project Management," Information Systems Research (8:3), pp. 215-239.
Klamm, B.K., Kobelsky, K.W., and Watson, M.W. 2012. "Determinants of the Persistence of Internal Control Weaknesses," Accounting Horizons (26:2), pp. 307-333.
Klamm, B.K., and Watson, M.W. 2009. "SOX 404 Reported Internal Control Weaknesses: A Test of COSO Framework Components and Information Technology," Journal of Information Systems (23:2), pp. 1-23.
Klein, A. 1986. "The Timing and Substance of Divestiture Announcements: Individual, Simultaneous and Cumulative Effects," Journal of Finance (41:3), pp. 685-696.
Krishnan, G.V., and Visvanathan, G. 2007. "Reporting Internal Control Deficiencies in the Post-Sarbanes-Oxley Era: The Role of Auditors and Corporate Governance," International Journal of Auditing (11:2), pp. 73-90.
Krishnan, J. 2005. "Audit Committee Quality and Internal Control: An Empirical Analysis," The Accounting Review (80:2), pp. 649-675.
Krishnan, J., Rama, D.V., and Zhang, Y.Y. 2008. "Costs to Comply with SOX Section 404," Auditing: A Journal of Practice & Theory (27:1), pp. 169-186.
Krishnan, M.S., Rai, A., and Zmud, R.W. 2007. "The Digitally Enabled Extended Enterprise in a Global Economy," Information Systems Research (18:3), pp. 233 –236.
Kuhn, J.R., Ahuja, M., and Mueller, J. 2013. "An Examination of the Relationship of IT Control Weakness to Company Financial Performance and Health," International Journal of Accounting & Information Management (21:3), pp. 227-240.
Levallet, N., and Chan, Y. 2015. "Using IT to Unleash the Power of Strategic Improvisation," the Proceedings of the Thirty Sixth International Conference on Information Systems (ICIS) Fort Worth, TX.
Li, C., Lim, J.-H., and Wang, Q. 2007. "Internal and External Influences on IT Control Governance," International Journal of Accounting Information Systems (8:4), pp. 225-239.
Li, C., Peters, G.F., Richardson, V.J., and Watson, M.W. 2012. "The Consequences of Information Technology Control Weaknesses on Management Information Systems: The Case of Sarbanes-Oxley Internal Control Reports," MIS Quarterly (36:1), pp. 179-203.
Li, C., Sun, L., and Ettredge, M. 2010. "Financial Executive Qualifications, Financial Executive Turnover, and Adverse SOX 404 Opinions," Journal of Accounting and Economics (50:1), pp. 93-110.
Lyytinen, K., Mathiassen, L., and Ropponen, J. 1998. "Attention Shaping and Software Risk - a Categorical
44
Analysis of Four Classical Risk Management Approaches," Information Systems Research (9:3), pp. 233-255.
Macintosh, N.B. 1994. Management Accounting and Control Systems: An Organizational and Behavioral Approach. New York, NY: John Wiley.
Maguire, S. 2011. "Constructing and Appreciating Complexity," in The Sage Handbook of Complexity and Management, P. Allen, S. Maguire and B. McKelvey (eds.). Thousand Oaks, CA: Sage Publications.
Masli, A., Peters, G.F., Richardson, V.J., and Sanchez, J.M. 2010. "Examining the Potential Benefits of Internal Control Monitoring Technology," The Accounting Review (85:3), pp. 1001-1034.
Masli, A., Richardson, V.J., Watson, M.W., and Zmud, R.W. 2016. "Senior Executives’ IT Management Responsibilities: Serious IT-Related Deficiencies and CEO/CFO Turnover," MIS Quarterly (40:3), pp. 687-708.
McAfee, A., and Brynjolfsson, E. 2008. "Investing in the IT That Makes a Competitive Difference," Harvard Business Review (86:7/8), pp. 98-107.
McDaniel, R.R. 2007. "Management Strategies for Complex Adaptive Systems: Sensemaking, Learning, and Improvisation," Performance Improvement Quarterly (20:2), pp. 21-42.
McKinley, W., and Scherer, A.G. 2000. "Some Unanticipated Consequences of Organizational Restructuring," The Academy of Management Review (25:4), pp. 735-752.
Mehta, M., and Hirschheim, R. 2007. "Strategic Alignment in Mergers and Acquisitions: Theorizing IS Integration Decision Making," Journal of the Association for Information Systems (8:3), pp. 143-174.
Moeller, S.B., Schlingemann, F.P., and Stulz, R.M. 2004. "Firm Size and the Gains from Acquisitions," Journal of Financial Economics (73:2), pp. 201-228.
Ouchi, W.G., and Maguire, M.A. 1975. "Organizational Control: Two Functions," Administrative Science Quarterly (20:4), pp. 559-569.
Pavlou, P.A., and El Sawy, O.A. 2010. "The "Third Hand": IT-Enabled Competitive Advantage in Turbulence through Improvisational Capabilities," Information Systems Research (21:3), pp. 443-471.
Piotroski, J.D., and Srinivasan, S. 2008. "Regulation and Bonding: The Sarbanes-Oxley Act and the Flow of International Listings," Journal of Accounting Research (46:2), pp. 383-425.
Raghunandan, K., and Rama, D.V. 2006. "SOX Section 404 Material Weakness Disclosures and Audit Fees," Auditing: A Journal of Practice & Theory (25:1), pp. 99-114.
Ramanujam, V., and Varadarajan, P. 1989. "Research on Corporate Diversification - a Synthesis," Strategic Management Journal (10:6), pp. 523-551.
Ranganathan, C., and Outlay, C.N. 2009. "Life after IT Outsourcing: Lessons Learned from Resizing the IT Workforce," MIS Quarterly Executive (8:4), pp. 161-173.
Ransbotham, S., and Mitra, S. 2009. "Choice and Chance: A Conceptual Model of Paths to Information Security Compromise," Information Systems Research (20:1), pp. 121-139.
Sabherwal, R., and Chan, Y.E. 2001. "Alignment between Business and IS Strategies: A Study of Prospectors," Information Systems Research (12:1), pp. 11–33.
Sambamurthy, V., Bharadwaj, A., and Grover, V. 2003. "Shaping Agility through Digital Options: Reconceptualizing the Role of Information Technology in Contemporary Firms," MIS Quarterly (27:2), pp. 237-263.
Sambamurthy, V., and Zmud, R.W. 1999. "Arrangements for Information Technology Governance: A Theory of Multiple Contingencies," MIS Quarterly (23:2), pp. 261-290.
Simons, R. 1991. "Strategic Orientation and Top Management Attention to Control Systems," Strategic Management Journal (12:1), pp. 49-62.
Stoel, M.D., and Muhanna, W.A. 2011. "IT Internal Control Weaknesses and Firm Performance: An Organizational Liability Lens," International Journal of Accounting Information Systems (12:4), pp. 280-304.
45
Straub, D.W. 1990. "Effective IS Security: An Empirical Study," Information Systems Research (1:3), pp. 255-276.
Tanriverdi, H. 2005. "Information Technology Relatedness, Knowledge Management Capability, and Performance of Multibusiness Firms.," MIS Quarterly (29:2), pp. 311-334.
Tanriverdi, H. 2006. "Performance Effects of Information Technology Synergies in Multibusiness Firms," MIS Quarterly (30:1), pp. 57-77.
Tanriverdi, H., and Du, K. 2009. "Disintegrating Information Technology in Corporate Divestures: Implications for Regulatory Compliance Risks and Costs," the Proceedings of the 30th International Conference on Information Systems (ICIS), Phoenix, AZ.
Tanriverdi, H., Rai, A., and Venkatraman, N. 2010. "Reframing the Dominant Quests of Information Systems Strategy Research for Complex Adaptive Business Systems," Information Systems Research (21:4), pp. 822-834.
Tanriverdi, H., and Ruefli, T.W. 2004. "The Role of Information Technology in Risk/Return Relations of Firms," Journal of the Association for Information Systems (5), pp. 421-447.
Tanriverdi, H., and Uysal, V. 2011. "Cross-Business Information Technology Integration and Acquirer Value Creation in Corporate Mergers and Acquisitions," Information Systems Research (22:4), pp. 703-720.
Tanriverdi, H., and Uysal, V. 2015. "When IT Capabilities Are Not Scale-Free in Merger and Acquisition Integrations: How Do Capital Markets React to IT Capability Asymmetries between Acquirer and Target?," European Journal of Information Systems (24:2), pp. 145–158.
Therneau, T.M., and Grambsch, P.M. 2000. Modeling Survival Data: Extending the Cox Model. New York: Springer.
Vessey, I., and Ward, K. 2013. "The Dynamics of Sustainable IS Alignment: The Case for IS Adaptivity," Journal of the Association for Information Systems (14:6), pp. 283-311,.
Weber, R. 1982. "Audit Trail System Support in Advanced Computer-Based Accounting Systems," The Accounting Review (57:2), pp. 311-325.
Weidenmier, M.L., and Ramamoorti, S. 2006. "Research Opportunities in Information Technology and Internal Auditing," Journal of Information Systems (20:1), pp. 205-219.
Weill, P., and Broadbent, M. 1998. Leveraging the New Infrastructure: How Market Leaders Capitalize on Information Technology. Boston MA: Harvard Business School Press.
Weill, P., and Ross, J. 2005. "A Matrixed Approach to Designing IT Governance," MIT Sloan Management Review (46:2), pp. 26-34.
Wooldridge, J.M. 2010. Econometric Analysis of Cross Section and Panel Data, (2nd ed.). Cambridge, Massachusetts: The MIT Press.
Yoo, Y., Boland, R.J., Lyytinen, K., and Majchrzak, A. 2012. "Organizing for Innovation in the Digitized World," Organization Science (23:5), pp. 1398-1408.
Yoo, Y., Henfridsson, O., and Lyytinen, K. 2010. "The New Organizing Logic of Digital Innovation: An Agenda for Information Systems Research," Information Systems Research (21:4), pp. 724–735.
Zeger, S.L., and Liang, K.-Y. 1986. "Longitudinal Data Analysis for Discrete and Continuous Outcomes," Biometrics (42:1), pp. 121-130.
Zhang, Y., Zhou, J., and Zhou, N. 2007. "Audit Committee Quality, Auditor Independence, and Internal Control Weaknesses," Journal of Accounting and Public Policy (26:3), pp. 300-327.
46
Table 1 Descriptive Statistics and Pair-wise Pearson Correlations
Variables 1 2 3 4 5 6 7 8 9
1 Overall Internal Control Weakness
2 Only non-IT Control Weakness 0.865 ***
3 IT GRC Weakness 0.472 *** -0.034 ***
4 Environmental Turbulence -0.064 *** -0.055 *** -0.03 **
5 Environmental Munificence 0.023 * 0.019 * 0.012 -0.328 ***
6 Firm size (Total assets, log transformed) -0.114 *** -0.082 *** -0.083 *** 0.065 *** -0.069 ***
7 Return on Equity (ROE) -0.009 -0.008 -0.004 0.019 * -0.002 -0.049 ***
8 Financial Leverage Ratio 0.012 -0.000 0.024 ** 0.073 *** -0.048 *** 0.115 *** 0.013
9 Corporate Governance Weaknesses 0.293 *** 0.131 *** 0.353 *** -0.015 -0.002 -0.042 *** -0.004 0.03 ***
10 Auditor Status -0.065 *** -0.016 * -0.102 *** -0.034 *** 0.005 0.289 *** -0.030 *** 0.001 -0.039 ***
11 Environmental IT Intensity 0.031 *** 0.021 * 0.024 ** 0.206 *** -0.057 *** -0.056 *** 0.013 -0.019 * 0.028 **
12 IT Capability -0.038 *** -0.027 *** -0.027 ** 0.002 0.007 0.350 *** -0.006 0.032 *** -0.009
13 Diversification Level -0.011 -0.009 -0.006 0.015 -0.013 0.354 *** -0.017 + 0.042 *** -0.008
14 Foreign Operation 0.031 *** 0.025 ** 0.017 * 0.002 0.058 *** 0.036 *** -0.011 -0.035 *** 0.002
15 Acquisition Intensity -0.001 -0.010 0.015 + 0.006 0.023 * 0.032 *** -0.006 -0.004 0.002
16 Divestiture Intensity 0.022 ** 0.011 0.024 ** -0.001 0.009 0.048 *** -0.003 0.014 + -0.001
17 Restructuring 0.028 *** 0.021 * 0.019 * -0.036 *** 0.03 ** 0.132 *** -0.017 * 0.012 0.006
Observations 14,427 14,427 14,427 11,460 11,460 14,427 14,364 14,427 14,427
Mean 0.08 0.06 0.02 0.02 0.09 7.08 0.45 0.56 0.01
Standard Deviation — — — 0.01 0.03 1.84 12.81 0.73 0.11
Min 0 0 0 0.00 -0.03 0.36 -177.52 0.00 0
Max 1 1 1 0.05 0.17 14.60 855.87 74.93 3
Variables 10 11 12 13 14 15 16 17
10 Auditor Status
11 IT Intensity -0.045 ***
12 IT Capability 0.118 *** -0.018 +
13 Diversification Level 0.112 *** 0.016 + 0.203 ***
14 Foreign Operation 0.083 *** 0.03 ** 0.039 *** 0.106 ***
15 Acquisition Intensity 0.022 ** 0.015 -0.012 0.011 0.017 *
16 Divestiture Intensity 0.023 ** -0.016 + 0.023 ** 0.033 *** 0.012 0.069 ***
17 Restructuring 0.124 *** 0.009 0.162 *** 0.154 *** 0.21 *** 0.05 *** 0.067 ***
Observations 14,427 11,693 14,427 11,694 14,427 14,427 14,427 14,427
Mean 0.84 0.12 0.09 0.39 0.24 0.02 0.01 0.26
Standard Deviation — 0.09 — 0.47 — 0.08 0.04 —
Min 0 0.0 0 0 0 0 0 0
Max 1 0.5 1 2.14 1 0.99 0.84 1
Note: +: p<0.1; *: p<0.05; **: p<0.01; ***: p<0.001; two-tailed t-test; Standard deviations of binary variables are omitted.
47
Table 2 the Impact of Strategic Moves on IT-GRC Weaknesses
Variables
Model 1 Model 2 Model 3 Model 4 Model 5 Model 6 Model 7
DV: Overall
Internal
control MW
DV: Only
non-IT
control MW
DV: IT
GRC MW
DV: CoIT
MW
DV: APC
MW
DV: IT GRC
Design MW
DV: IT GRC
Operation
MW
Environmental Turbulence -12.756 * -6.747 -22.998 * -22.893 + -19.947 -25.544 * -42.211 * (5.487) (5.900) (11.433) (13.630) (12.458) (12.437) (21.509)
Environmental Munificence -0.168 0.020 1.414 3.572 0.741 1.565 3.369 (1.549) (1.709) (3.274) (3.775) (3.607) (3.545) (5.640)
Firm size -0.201 *** -0.187 *** -0.185 *** -0.181 *** -0.175 ** -0.169 ** -0.130 (0.028) (0.030) (0.049) (0.055) (0.055) (0.052) (0.086)
Return on Equity (ROE) -0.006 + -0.007 + -0.003 -0.003 -0.004 -0.003 -0.003 (0.004) (0.004) (0.002) (0.002) (0.003) (0.002) (0.003)
Financial Leverage Ratio 0.042 0.026 -0.012 -0.007 -0.053 -0.009 -0.037 (0.028) (0.048) (0.022) (0.022) (0.052) (0.022) (0.074)
Corporate Governance
Weaknesses
1.724 *** 1.719 *** 1.671 *** 1.744 *** 1.72 ***
(0.132) (0.170) (0.149) (0.136) (0.227)
Auditor Status -0.594 *** -0.152 -1.483 *** -1.72 *** -0.997 *** -1.547 *** -1.21 *** (0.106) (0.130) (0.192) (0.220) (0.227) (0.203) (0.342)
Environmental IT Intensity 0.654 + 0.423 -0.505 0.057 -1.619 -0.341 -1.263 (0.374) (0.434) (0.867) (0.950) (1.167) (0.892) (1.642)
IT Capabilities -0.200 -0.201 -0.441 -0.465 -0.261 -0.397 -0.313 (0.183) (0.196) (0.382) (0.434) (0.392) (0.385) (0.614)
Diversification Level H1 0.130 0.098 0.377 * 0.428 * 0.229 0.408 * 0.404 (0.094) (0.103) (0.177) (0.193) (0.198) (0.185) (0.270)
Foreign Operation H2 0.233 * 0.194 + 0.374 * 0.323 0.357 + 0.423 * 0.069 (0.093) (0.102) (0.186) (0.217) (0.206) (0.191) (0.344)
Acquisition Intensity H3 1.115 * 0.546 1.884 * 2.02 + 1.753 + 1.808 + 2.717 + (0.447) (0.568) (0.893) (1.137) (0.996) (0.950) (1.402)
Divestiture Intensity H4 1.796 ** 1.538 * 2.593 ** 2.555 * 2.79 ** 2.78 ** 2.422 (0.558) (0.708) (0.890) (1.065) (0.966) (0.882) (1.801)
Restructuring H5 0.266 ** 0.182 + 0.507 ** 0.576 ** 0.407 * 0.516 ** 0.330 (0.093) (0.103) (0.182) (0.207) (0.203) (0.186) (0.313)
# of Subjects 2,440 2,448 2,475 2,476 2,476 2,476 2,482
# of Events 601 509 163 123 131 151 57
# of Observations 9,353 9,640 10,938 11,017 11,009 10,971 11,209
Wald Chi-square test 195.88 *** 77.70 *** 501.82 *** 469.21 *** 280.89 *** 474.63 *** 167.10 ***
Notes:
+: p<0.1; *: p<0.05; **: p<0.01; ***: p<0.001; Robust standard errors reported in parentheses
Year dummy variables included in the models but results omitted in the table Corporate Governance Weaknesses are not included in Model 1 and Model 2 because it is measured based on the presence of
specific non-IT control material weaknesses
48
Table 3 the Impact of Strategic Moves on the Detailed Subtypes of IT-GRC Weaknesses
Variables
Model 1 Model 2 Model 3 Model 4 Model 5 Model 6 Model 7 Model 8 Model 9 Model 10 Model 11 Model 12
CoIT:
IT
Governance
MW
CoIT:
IT Human
Resource
MW
CoIT:
Documentation
MW
CoIT:
Computer
Operation
MW
CoIT:
Access
Control MW
CoIT:
Program
Development
MW
CoIT:
Change
Management
MW
CoIT:
Segregation
of IT Duty
MW
APC:
Input
Control MW
APC:
Processing
Control
MW
APC:
Output
Control MW
APC:
Segregation
of Duty MW
Environmental Turbulence -35.720 -18.775 -38.219 -4.180 -27.746 -35.232 -36.844 + -50.043 -14.824 -10.694 -39.815 -3.825
(32.927) (70.232) (28.579) (26.178) (17.577) (36.408) (19.577) (39.263) (20.180) (16.738) (31.334) (17.450)
Environmental Munificence 10.979 -3.178 15.824 2.829 7.356 10.538 * 13.744 ** -10.026 5.602 2.465 8.639 2.977
(9.926) (10.439) (9.662) (5.880) (4.632) (5.325) (4.626) (12.167) (6.545) (5.062) (7.541) (4.788)
Firm size -0.322 * -0.434 ** -0.311 ** -0.285 * -0.142 * -0.072 -0.233 ** -0.189 -0.168 * -0.302 *** -0.304 ** -0.119
(0.128) (0.157) (0.102) (0.111) (0.067) (0.124) (0.088) (0.139) (0.083) (0.079) (0.104) (0.077)
Return on Equity (ROE) -0.002 -0.003 -0.003 -0.007 -0.002 -0.000 -0.003 -0.011 -0.002 -0.004 -0.002 -0.003
(0.002) (0.004) (0.003) (0.004) (0.002) (0.002) (0.003) (0.007) (0.002) (0.003) (0.002) (0.003)
Financial Leverage Ratio -0.471 -0.106 -0.190 -0.004 -0.081 -0.070 -0.202 0.003 -0.012 -0.194 -0.053 -0.100
(0.383) (0.144) (0.198) (0.034) (0.057) (0.118) (0.172) (0.039) (0.058) (0.164) (0.063) (0.076)
Corporate Governance
Weaknesses
1.688 *** 1.828 * 1.16 *** 1.489 *** 1.874 *** 1.712 *** 1.34 *** 1.419 *** 1.911 *** 1.608 *** 1.999 *** 1.823 ***
(0.326) (0.738) (0.341) (0.335) (0.195) (0.475) (0.300) (0.363) (0.157) (0.229) (0.191) (0.208)
Auditor Status -1.449 ** -1.131 -2.262 *** -2.143 *** -2.032 *** -2.359 *** -2.01 *** -2.411 *** -0.949 ** -0.605 + -0.932 * -1.23 ***
(0.447) (0.843) (0.431) (0.411) (0.270) (0.564) (0.316) (0.647) (0.338) (0.313) (0.384) (0.348)
Environmental IT Intensity 0.653 0.152 -0.335 0.335 0.574 -2.664 -1.038 -1.392 -1.677 -2.144 -7.319 ** -0.501
(1.671) (4.416) (1.779) (1.403) (1.125) (3.521) (1.636) (1.647) (1.716) (1.431) (2.695) (1.490)
IT Capabilities -0.284 -40.419 *** — -0.195 -0.665 0.644 -0.355 0.283 -0.163 0.051 — -0.368
(0.948) (0.600) — (0.969) (0.531) (0.803) (0.737) (0.961) (0.501) (0.569) — (0.549)
Diversification Level 0.417 1.289 * -0.286 0.306 0.713 ** 0.470 0.487 0.235 0.579 + 0.338 0.432 0.322
(0.441) (0.585) (0.463) (0.367) (0.228) (0.484) (0.310) (0.484) (0.300) (0.303) (0.430) (0.262)
Foreign Operation -0.221 1.258 + -0.670 0.916 * 0.445 + 0.405 0.033 1.151 * 0.138 0.105 0.221 0.477
(0.514) (0.663) (0.632) (0.406) (0.269) (0.559) (0.347) (0.477) (0.311) (0.301) (0.419) (0.310)
Acquisition Intensity 2.933 * 4.595 * 1.144 2.480 3.204 ** 3.545 ** -0.207 -6.592 2.739 * 1.844 4.641 *** 3.436 **
(1.295) (1.869) (2.191) (1.784) (1.150) (1.260) (1.883) (5.831) (1.230) (1.463) (1.090) (1.083)
Divestiture Intensity 4.416 ** 1.549 -1.649 4.074 ** 3.426 ** -1.449 2.397 — 3.325 ** 3.174 * 2.825 2.344
(1.692) (2.669) (4.125) (1.415) (1.124) (3.876) (1.925) — (1.249) (1.262) (1.789) (1.557)
Restructuring 0.548 0.054 0.9 * 0.372 0.558 * 0.030 0.734 * 0.157 0.118 0.398 -0.286 0.309
(0.393) (0.755) (0.438) (0.390) (0.252) (0.531) (0.319) (0.558) (0.293) (0.295) (0.380) (0.293)
# of Subjects 2,483 2,483 2,483 2,482 2,476 2,484 2,481 2,483 2,482 2,481 2,482 2,478
# of Events 31 11 28 35 79 22 56 20 63 69 36 57
# of Observations 11,271 11,315 11,280 11,263 11,111 11,286 11,205 11,284 11,205 11,206 11,249 11,164
Wald Chi-square test 192.37 *** 15665.8 *** 136.47 *** 254.99 *** 261.19 *** 87.73 *** 137.54 *** 379.28 *** 282.12 *** 109.15 *** 216.38 *** 149.13 ***
Notes: *** p<0.001, ** p<0.01, * p<0.05, + p<0.1; robust standard errors reported in parentheses;
Year dummy variables included in the estimation models but results omitted;
IT Capabilities in Model 3 and Model 11 and Divestiture Intensity in Model 8 were dropped during model estimation iterations due to the lack of covariance with the dependent variable;
49
Appendix A: Coding Scheme for Categorizing IT-GRC weaknesses
Coding Scheme for Automated Process
Controls (APC) Weakness
Coding Scheme for IT General Control (ITGC) Weakness
APC-1: Input control
1. Firms do not have effective controls to
ensure that source data are correct,
complete, and collected timely.
2. Input is not performed in a timely manner
by authorized and qualified staff
3. Input form design is not effective to
prevent errors and omissions
4. Transaction data entered for processing
are not adequately checked for accuracy,
completeness and validity
ITGC-1: IT governance
1. Firms lack IT policies, procedures, standards, strategic plans and other governance
processes
2. IT governance structure of a firm is ineffective
3. Management of a firm does not effectively monitor IT activities, review IT
performance, or communicate IT risks
ITGC-2: IT human resource
1. Firms do not have adequate IT personnel to support effective IT controls
2. Firms experience significant, disruptive turnover of IT personnel
3. Firms lack knowledge to operate and maintain the IT systems
4. Employees of a firm lack sufficient IT training
5. Employees of a firm are unfamiliar with IT systems or they are incapable of
operating the IT applications effectively
ITGC-3: IT documentation
Firms lack documentation about:
1. Financially significant processes supported by IT, risks associated with them,
analyses of the probability of occurrence and impact of the risks
2. IT controls designed to reduce the risks
3. Testing of the existence and operational effectiveness of the IT controls
4. Conclusions reached about the design and operating effectiveness of the IT controls
5. Management’s responses and opinions about the conclusions
ITGC-4: Access control
1. Firms are under uncontrolled risks of unethical hackers, malicious software and
other intrusion threats
2. Employees’ access to network, operating system, databases, and applications are not
properly restricted
3. User profiles and access permits are not timely and frequently reviewed.
4. User ID and passwords of terminated employee are not immediately revoked
ITGC-5: Computer operations
1. Firms do not have effective physical and environmental security controls of IT
equipment and facilities
2. Firms do not have effective network security
3. Firms do not have effective data backup, recovery, storage, and other disaster
management functions
4. Firms do not have effective controls over IT routines regarding to operating systems,
databases, middleware, communication software, and other software components
which are not directly related to specific business processes
ITGC-6: Program development
1. Firms do not have an effective system development life cycle methodology of
requirements documentation, design, programming, testing, and approvals
2. System development is not conducted in a structured manner that users requirements
and design features are incorporated
3. Firms do not effectively assess, review, and control IT development project risks
4. Firms do not have effective quality control procedures over the finished IT systems
ITGC-7: Program change management
1. Firms are lack of structured change management policies and procedures
2. Change request is not properly documented, approved, and filed
3. Changes to IT systems are not properly authorized and reviewed
4. Changes to IT systems are not adequately tested, validated and approved
5. Migration of changes to production is not properly restricted and supervised
ITGC-8: Segregation of IT function
1. Firms’ IT department does not have sufficient separation of key IT functions such
as designing, developing, testing, implementing, and maintaining IT infrastructure and
applications;
2. IT employees have unrestricted access to business applications or data beyond their
job responsibility
APC-2: Processing control
1. Applications have deficiencies in
maintaining the integrity and validity of
data throughout the processing cycle
2. Applications do not process information
as designed; Formulas used in calculation
are incorrect; Exceptions are not adequately
addressed
3. Applications do not have processing
history which management can use to track
transactions from their source to their
output or backward
APC-3: Output control
1. Outputs from applications are not
completely or accurately presented
2. Outputs are not properly checked against
inputs or reconciled with other sources
3. Unreasonable, unusual, or unexpected
outputs are not properly highlighted for
investigation
4. Outputs delivery are not properly
constrained to only intended person
APC-4: Segregation of duty in
applications
1. The electronic identities of application
users are authorized to perform
incompatible and conflicting duties
2. Firms are lack of control policies,
procedures, and tools to monitor, prevent or
identify duty conflicts in IT applications
Coding Scheme for IT CRC Design
Weakness
1. Necessary IT controls are absent
2. Necessary IT controls are inadequate or
insufficient
3. IT controls are flawed such that
operational, financial, or regulatory risks
are not mitigated as desired
Coding Scheme for IT GRC Operation
Weakness
1. IT controls are not implemented as
designed
2. IT controls are not operating effectively
3. Misstatements, errors, or undesirable
behaviors are identified regardless the
preventive IT control design in place
top related