1

IT Control Weaknesses, IT Governance

and Firm Performance

Efrim BoritzJee-Hae Lim

University of WaterlooUWCISA: October 11-13, 2007, Toronto

2

Current Trends in Industry• IT Control Environment

…Because of the pervasive effect of the control environment on the reliability of financial reporting, the auditor’s preliminary judgment about its effectiveness often influences the nature, timing, and extent of the tests of operating effectiveness considered necessary. Weaknesses in the control environment should cause the auditor to alter the nature, timing, or extent of tests of operating effectiveness that otherwise should have been performed in the absence of the weaknesses…….

PCAOB Auditing Standard No. 2

– Controls, including information technology general controls, on which other controls are dependent.

– The extent of information technology involvement in each period-end financial reporting process element…

3

Current Trends in Academics• Differences between firms reporting internal control

deficiencies and other firms – Ge and McVary 2005; Doyle et al. (forthcoming); Ashbaugh et al.

(forthcoming)

• Components of internal controls, focusing on security, application development and organizational governance– Nidumolu and Subramani 2003; Lainhart 2000; Straub 1990

• Stock price reactions– Beneish et al. 2005; De Franco et al. 2005; Hammersley et al.

2005; Ogneva et al. 2005

4

Purpose of This Study• Examine whether companies that report internal control

weaknesses over two years will have weaker financial performance (ITWEAK vs. NOWEAK)

• Examine how financial performance changes with different categories of internal control weaknesses (ITWEAK vs. ICWEAK)

• Examine the impact of IT governance mechanisms on:– ITWEAK reporting frequency– Documentation of the significant association between effective IT

governance and the effectiveness of IT controls in the financial reporting process

– Superior financial performance

5

ITWEAK vs. NOWEAK vs. ICWEAK

• H1: Firms with material IT control weaknesses have lower levels of financial performance (i.e., return on assets, return on sales, and growth rate) than firms without IT control material weakness.

• H2: Firms with material general IT control weaknesses have lower levels of financial performance (i.e., return on assets, return on sales, and growth rate) than firms with other material control weaknesses.

6

IT Governance• H3: Firms with better IT governance have fewer material IT

control weaknesses than firms with less effective IT governance.

• H4: Firms with better IT governance have higher levels of financial performance (i.e., return on assets, return on sales, and growth rate) than firms with less effective IT governance.

7

IT Knowledge

• H5: Firms with more IT knowledge in their top management ranks have higher levels of financial performance (i.e., return on assets, return on sales, and growth rate) than firms with lower levels of such IT knowledge.

• H6: Firms with IT governance mechanisms (IT strategy committee, CIO) have higher levels of financial performance (i.e., return on assets, return on sales, and growth rate) than firms without such mechanisms.

8

IT Governance Mechanism• IT Knowledge:

– MGMTIT: The percentage of top executives (i.e., CEO, CFO, COO, and other top-management team members) who have IT in their backgrounds/experiences

– BOARDIT: The percentage of board members who have IT in their backgrounds

• IT Governance – ITSTRAT: The presence of an IT strategy committee– CIOYR: The length of the CIO’s tenure

9

Control VariablesBIG4 - 1 if auditor is a Big 4, 0 otherwise.

CEOCHAIR ? 1 if the CEO also chairs the board of directors.

LEVERAGE + Total liabilities divided by total assets.

LOSS + 1 if net income is negative; 0 otherwise.

GROWTH + Percent change in sales, from fiscal year 2002 to 2003.

AUDCHG + 1 if the client changed auditor in 2003; 0 otherwise.

AUDFEE + Natural logarithm of audit fees divided by natural logarithm of total assets.

ARINVEN + Total accounts receivables and total inventories divided by total assets.

SEGMENT + Natural logarithm of the number of firms’ reportable segments.

RESTRUCTURE + 1 if the client restructured from 2002 to 2003; 0 otherwise.

10

Methods• Sample (the Audit Analytics database)

– ITWEAK: 211 (109 in 2004 & 102 in 2005): 21.45% of all client firms reporting material weaknesses

– ICWEAK: 937 (474 IN 2004 & 463 IN 2005). • Matched with a control group company on both industry

(SIC code) and size (revenue) at the year preceding the SOX404.

• The proxy statements (def, 6k, &10k) that are filed with SEC.

• Additional governance data: Lexis-Nexis Database

• Financial Data -- Compustat

11

Univariate Analysis Results

12

Logistic Regression Results

13

Regression Results (2004)

14

Regression Results (2005)

15

Limitations and Future Research Implications

+ Timely (SOX404)

+ Critical Issue

- Not extend to the market value impact of the financial performance effects due to ITWEAK

- IT Control Governance: Control governance should not be a dichotomy (have vs. do not have) but as a continuum.

16

Contributions and Conclusions• The first empirical study

– investigate the impact of material IT control weaknesses on financial performance and the impact of IT governance mechanisms on both the incidence of IT control weakness and financial performance.

• + (Academic): Adds to the current literature on the role of IT governance in financial reporting by providing a clear relationship between effective IT governance, financial reporting weaknesses and financial performance.

• + (Practice): Makes a compelling case for improving IT governance in order to reduce or eliminate material IT control weaknesses and improve financial performance.

17

Any Question or Comment?