The Effect of Internal Control Deficiencies on Firm Risk and Cost of Equity Capital

Hollis Ashbaugh-Skaife University of Wisconsin-Madison

hashbaugh@bus.wisc.edu

Daniel W. Collins* University of Iowa

daniel-collins@uiowa.edu

William R. Kinney, Jr. University of Texas-Austin

william.kinney@mccombs.utexas.edu

Ryan LaFond MIT-Sloan School of Management

rzlafond@mit.edu

February 2006

The Effect of Internal Control Deficiencies on Firm Risk and Cost of Equity Capital

Abstract

Theoretically, internal control quality is related to the cost of capital through its effect on idiosyncratic and systematic risk. The Sarbanes-Oxley Act (SOX) mandates audits of internal control and disclosure of material internal control weaknesses, but do individual firms potentially benefit from the resulting disclosures? The answer is important because SOX requirements are costly to implement and may be a deadweight loss to firms. In this paper, we use unaudited section 302 and audited section 404 disclosures to estimate internal control deficiency (ICD) effects on idiosyncratic risk, systematic risk, and ultimately, the cost of capital. We find that after including other risk factors the ICDs are significantly positively related to idiosyncratic risk, systematic risk, and cost of capital, and that the median market adjusted cost of capital increase following initial ICD disclosure is economically important at 104 basis points. Furthermore, we observe that the remediation ICDs is followed by significant cost of capital reductions. Overall, the results of our cross-sectional and change analysis tests are consistent with strong internal controls being valued by the capital market.

The Effect of Internal Control Deficiencies on Firm Risk and Cost of Equity Capital

I. Introduction

In this study we investigate whether firms with internal control deficiencies (ICDs)

exhibit higher systematic risk, higher idiosyncratic risk and higher cost of capital relative

to firms with strong internal controls. Further, we investigate whether the existence of

ICDs and the changes in internal control systems as evidenced by auditor opinions on

internal controls that are required by the Sarbanes-Oxley Act of 2002 (SOX) are causally

related to changes in firms’ cost of equity capital. Much of the prior research that

investigates the impact of SOX has focused on the costs of SOX internal control auditing

and reporting. This study is the first to document potential benefits to firms of having

strong internal controls in terms of cost of capital consequences.

Ashbaugh-Skaife, Collins and Kinney (2005) and Doyle, Ge and McVay (2005) posit

that weak internal controls introduce both intentional and unintentional errors into the

financial reporting process that lead to lower quality earnings signals. Consistent with

this conjecture, these studies find that firms that report weak internal controls exhibit

greater noise in accruals and larger abnormal accruals relative to firms not reporting

internal control deficiencies. We posit that poor internal controls that allow increased

noise in the financial reporting process increase the information risk faced by investors

that manifests in higher cost of capital.

Recent theoretical work by Lambert, Leuz and Verrecchia (2005) investigates the

direct and indirect effects of information quality on cost of capital in a multi-security

CAPM setting. With respect to the direct effects, they show that higher quality

information reduces market participants’ assessed variances of a firm’s cash flows and

the assessed covariances with other firms’ cash flows leading to a lower cost of capital.

Moreover, they show that the quality of accounting systems, which includes not only the

financial disclosures that firms make to outsiders, but also internal control systems, has

an effect on firms’ real decisions including the assets appropriated by management that

reduces the expected value of cash flows to investors, thus contributing to an indirect

effect on firms’ cost of capital.

Building on the theoretical work in Lambert et al. (2005), we find that firms that

disclose ICDs exhibit significantly higher betas, idiosyncratic risk and cost of capital

during the period from 2002 to 2004 relative to firms not reporting internal control

deficiencies. These differences persist after controlling for other factors that prior

research has shown to be related to these variables. Our finding that risk and cost of

capital differences pre-date the first disclosures of ICDs suggests that market

participants’ assessment of non-diversifiable market risk (beta), idiosyncratic risk and

implied cost of capital incorporated expectations about internal control risks based on

observable firm characteristics. This conjecture is consistent with Ashbaugh-Skaife et al.

(2006) and Doyle et al. (2006) who demonstrate that firms with more complex

operations, recent changes in organization structure, greater accounting risk exposure and

less investment in internal control systems are more likely to disclose internal control

deficiencies.

We use the initial disclosure of an ICD by management under SOX 302 or SOX 404

auditor opinions on internal controls along with prior evidence on the determinants of

ICD disclosure to structure change analysis tests designed to investigate whether initial

2

ICD disclosures caused predictable changes in firms’ cost of capital. Our change analysis

reveals that firms that disclose an ICD experience a significant increase in market-

adjusted cost of capital of roughly 93 basis points around the first disclosure of an ICD.

Moreover, we find that ICD firms with the lowest probability of reporting an ICD exhibit

a greater cost of capital change (104 basis points on average) relative to those ICD firms

with the highest likelihood of reporting an ICD based on observable firm characteristics

(62 basis points). This result is consistent with the market incorporating incomplete

adjustments for internal control risks into firms’ cost of capital assessments prior to

learning about which firms have ICDs, and then updating these risk assessments after

ICDs are revealed.

To further substantiate causality between internal control weaknesses and cost of

capital, we conduct two additional change analyses. First, we examine cost of capital

changes around SOX 404 audit opinions on internal controls for those firms that

previously disclosed ICDs under SOX 302 but rectified their control problems. If

revelation of internal control problems contributes to an increase in firms’ cost of capital

as our first set of change results suggest, then successful remediation of those problems

should lead to a decrease in cost of capital. Consistent with this prediction, we find that

ICD firms that subsequently receive an unqualified SOX 404 opinion exhibit an average

decrease in market-adjusted cost of capital of 152 basis points around the disclosure of

the opinion. In contrast, we find that ICD firms that previously disclosed internal control

problems that received adverse SOX 404 opinions exhibit no change in cost of capital

around the opinion.

3

Finally, we conduct a cost of capital change analysis on those firms that received

unqualified SOX 404 opinions that had no prior disclosure of internal control

weaknesses. Consistent with the market forming prior probability assessments of likely

internal control problems based on observable firm characteristics, we find a significant

decrease in the average market-adjusted cost of capital of 77 basis points around the

disclosure of an unqualified SOX 404 opinion for those firms that were most likely to

report ICDs. In contrast, we find no cost of capital change for those firms that received an

unqualified SOX 404 opinion that were least likely to report an ICD.

Collectively our cross-sectional and inter-temporal tests paint a very consistent

picture that internal control risk is an important determinant of both idiosyncratic risk and

systematic market risk that impacts the market’s assessment of firms’ cost of capital.

Firms that have strong internal controls or firms that remediate prior internal control

weaknesses are rewarded with significantly and economically significant lower cost of

capital. Our findings are consistent with assertions made by Congress and regulators that

the internal control reporting requirements of Sarbanes-Oxley will result in higher quality

financial reporting, which in turn will lead to lower cost of capital (U. S. House of

Representatives, 2003; U.S. Senate, 2002 and 2004; Donaldson, 2005). Thus, our study

represents one of the first to document potential benefits of a systematic reporting

structure to communicate information about internal controls in terms of cost of capital

consequences.

Our study makes several contributions to the extant literature. First, we contribute to

the literature that seeks to examine the effects of information quality on investors’ risk

assessments and equity cost of capital using a setting, internal control weaknesses and

4

their remediation, that arguably provides a cleaner partitioning of firms in terms of

information quality than in prior studies (Botosan, 1996; Botosan and Plumlee, 2002;

Bhattacharya, Daouk and Welker, 2003). Moreover, the combination of cross-sectional

and inter-temporal change tests afforded by the unique regulatory setting surrounding

SOX 404 internal control reporting provides an opportunity to triangulate our assessment

of information quality in ways that minimize competing explanations for our results.

Our study also contributes to the growing literature designed to assess the economic

consequences of the SOX legislation. Much of the prior literature focuses on the costs of

implementing SOX requirements and internal control auditing and reporting in particular

(Li, Pincus and Rego, 2005; Zhang, 2005; Berger, Li and Wong, 2005; Solomon and

Bryan-Low, 2004). This paper along with a concurrent study by Ogneva, Raghunandan

and Subramanyam (2005) are among the first to provide evidence on potential benefits of

SOX in terms of cost of capital effects. In contrast to the Ogneva, et al. (2005) study,

however, that finds no association between internal control weaknesses and implied cost

of capital, we find clear evidence that internal control risk matters to investors and that

firms reporting strong internal controls or firms that correct prior internal control

problems benefit from lower cost of capital.1

The remainder of our paper is organized as follows. Section II summarizes the

theoretical underpinnings of our analysis and sets forth our predictions about internal

control weaknesses and remediation, market and idiosyncratic risk and cost of capital.

Section III provides institutional background and summarizes related work. Section IV

1 See later discussion for sample, design choices and cost of capital proxy differences between our study and the Ogneva, et al. (2005) study that contribute to the differences in results.

5

describes our sample, data sources, variable measurements and provides descriptive

statistics. Section V presents our empirical findings and Section VI concludes.

II. Linkages between Internal Control Weaknesses, Firm Risk and Cost of Equity Capital

Lambert et al. (2005) develop a model in a multi-security CAPM setting that links the

quality of accounting disclosures and information systems to firm risk and cost of equity

capital. In the Lambert, et al. framework, accounting information system quality is

broadly defined to include not only the disclosures the firm makes to outsiders, but also

the internal control systems that a firm has in place. A key insight from their analysis is

that the quality of accounting information and the systems that produce that information

influence a firm’s cost of capital in two ways: (1) direct effects—where higher quality

accounting information does not affect firm cash flows, per se, but does affect market

participants’ assessments of the variance of a firm’s cash flows and the covariance of the

firm’s cash flows with aggregate market cash flows; and (2) indirect effects—where

higher quality information and better internal controls affect real decisions within the

firm, including the amount of firm resources that managers appropriate for themselves.

The expression they derive for the expected return for a firm, i.e., cost of equity

capital, reduces to—

)R~(E j =Φ ,1)(

1)(−Φ

+Φ

HHR f .

~,~1)V~E(

)H( where

1

j

⎟⎠

⎞⎜⎝

⎛Φ

Φ=Φ

∑=

J

kkj VVCov

Nτ

(1)

Where is the risk free rate, is the information available to investors to make their

assessments regarding the distribution of future cash flows for firm j,

fR Φ

jV~ is a random

6

vector of future cash flows for firm j, and τN is the aggregate risk tolerance of the

market. Notice that the covariance term can be decomposed into two components: the

firms’ own variance (idiosyncratic risk) plus the covariance with all other firms’ cash

flows in the market (beta risk) as follows:

.~,~)~,~(~,~1

⎟⎟⎠

⎞⎜⎜⎝

⎛Φ+Φ=⎟

⎠

⎞⎜⎝

⎛Φ ∑∑

≠=

J

jkkjjj

J

kkj VVCovVVCovVVCov

(2)

Lambert et al. (2005) analyze the direct effects of information system quality by

introducing an accounting information signal, jZ~ (e.g., earnings), that provides a noisy

signal about the (future) end-of-period cash flows of the firm, jV~ . That is, jZ~ = jV~ + jε~

where jε~ is the noise or measurement error in the information signal. Because the

(future) end-of-period firm cash flows are unobservable, the market’s assessment of the

covariance structure of firm j’s future cash flows with all other firms in the market is

conditioned by the quality or precision of firm j’s accounting signal. Specifically,

=∑=

)ZV~,V~(CovJ

1kjkj

.~,~)~,~()~()~(

),~()~()~(

11⎟⎟⎠

⎞⎜⎜⎝

⎛⎟⎟⎠

⎞⎜⎜⎝

⎛+= ∑∑

≠= kkjjj

j

jkj

J

k j

j VVCovVVCovZVar

VarVVCov

ZVarVar εε

(3)

As equation (3) shows, investors’ assessment of the variance of firm j’s cash flows and

covariance of firm j’s cash flows with the cash flows of all other firms in the market is

proportional to the measurement error or noise in the information signal about firm j’s

future cash flows. Importantly, the effect of measurement error in the information signal

7

does not diversify away as the number of securities grows large--the effect is present for

each and every covariance term with firm j.

Substituting equation (3) for the covariance term in the expression for in

equation (1) and recognizing that

)H(Φ

jZ~ is a noisy signal from information set that is

available to investors yields the following expression for expected return (cost of capital):

Φ

)R~(E j =Φ ,1)(

1)(−Φ

+Φ

HHR f

.

V~,V~Cov)V~,V~(Cov)Z~(Var)~(Var

N1

)V~E()H( where

1kkjjj

j

j

j

⎥⎥⎦

⎤

⎢⎢⎣

⎡⎟⎟⎠

⎞⎜⎜⎝

⎛⎟⎟⎠

⎞⎜⎜⎝

⎛+

ε=

τ

Φ=Φ

∑≠

(4)

Thus, as the noise in a firm’s accounting signals [ )~( jVar ε ] increases, the firm’s cost

of equity capital increases. Moreover, they show that the quality of a firm’s information

system, which includes its internal controls, has an effect on a firm’s real decisions,

including the amount of firm cash flows that managers appropriate for themselves.

Weaker internal controls increase managers’ appropriation of firm resources, which

decreases the ratio of expected cash flows available to investors relative to the covariance

of firm cash flows as shown in equation (4). This translates into a higher cost of equity

capital.

In sum, we posit that the quality of a firm’s internal controls affects investors’

assessments of firm risk and cost of capital through (1) the precision of the signals

produced by the accounting system; and (2) by the amount of resources that managers

can appropriate for themselves. If a firm’s internal controls are weak, then the quality or

precision of its accounting signals is impaired. Consistent with this conjecture,

8

Ashbaugh-Skaife et al. (2005) and Doyle et al. (2005) find that firms reporting internal

control deficiencies (ICDs) exhibit noisier accruals after controlling for other firm

characteristics that affect accrual quality. Combining these empirical findings with the

theory in Lambert et al. (2005), we develop both cross-sectional and inter-temporal

predictions. In the cross-section, we predict that firms with ICDs will exhibit higher

idiosyncratic risk, higher systematic (beta) risk and higher cost of capital relative to firms

with strong internal controls. Moreover, we expect firms’ costs of capital will increase

when the first revelation of internal control problems is made public under SOX 302 or

404 reporting provisions, and will decrease when external auditor SOX 404 opinions

affirm that the firm’s internal control weaknesses have been fully remedied.

In formulating our inter-temporal tests, we recognize that investors hold priors on the

likelihood that firms will face internal control problems based on observable firm

characteristics (Ashbaugh-Skaife et al. 2006; Doyle et al. 2006). Thus, we predict that the

effect of negative or positive signals about firms’ internal control quality will have a

greater (smaller) effect on cost of capital the smaller (the greater) the probability of a firm

reporting an internal control weakness. The unique regulatory setting surrounding

disclosures on internal control weaknesses and remediation allows us to triangulate our

research question in ways that mitigate competing explanations for our results.

III. Institutional Background and Reporting Environment

Prior to passage of the Sarbanes-Oxley Act (SOX) in July 2002, public companies in

the U.S. were required to maintain books and records that would protect corporate assets

and provide GAAP-based financial reporting (e.g., FCPA 1977). However, pre-SOX

9

statutes did not require management evaluations of internal control or public assertions

about control adequacy (although some publicly disclosed internal control assertions

voluntarily (see McMullen et al. 1996)) and the statutes did not require independent

audits of internal control.2 SOX changed the public assertion, audit, and audit reporting

landscape in two steps.

Section 302 of SOX mandates that a firm’s CEO and CFO certify in periodic (interim

and annual) SEC filings that the signing officers have “evaluated . . . and have presented

in the report their conclusions about the effectiveness of their internal controls based on

their evaluation” (302 (a) (4) (C) and (D)). However, neither section 302 of SOX nor

SEC interpretations describe procedures for evaluating controls and do not require

independent audits of internal control or management’s certifications.3

Section 302 requirements became effective in 2002, and management certifications,

including exceptions indicating internal control deficiencies (ICDs) began appearing in

2003 (e.g., see Klein 2003). The lack of required management review and evaluation

procedures and the lack of independent audit requirements for internal control probably

lowers the likelihood of ICD detection and increases the variance of outcomes, as does

the fact that changes in control deficiencies that are judged “material weaknesses” do not

necessarily require disclosure prior to the effective date of section 404 (see SEC 2004

question 9).

2 The FCPA did require external auditors to report to the board of directors material weaknesses in the firm’s internal control over financial reporting noted during conduct of the financial statement audit. 3 In particular, the SEC staff states “. . . we are not requiring any particular procedures for conducting the required review and evaluation. Instead, we expect each issuer to develop a process that is consistent with its business and internal management and supervisory practices” (SEC 2002).

10

Section 404, which became effective for fiscal years ending on or after November 15,

2004, required a formal basis for management assertions about internal control over

financial reporting and independent audits of the assertion by the registrant’s financial

statement audit firm as well as the auditor’s own opinion about internal control

effectiveness. In the empirical work to follow, we combine material weakness ICDs

made under SOX sections 302 and 404 and also disclosure of deficiencies and significant

deficiencies that are not required to be disclosed (see AS No. 2 2002). We do this for

three reasons.

First, while the necessary investigation to discover and requirements to disclose

deficiencies differ across disclosure and audit regimes, all disclosures are likely to reflect

important weaknesses in internal controls.4 Second, sequencing 302 and 404 disclosures

for specific firms allows within sample testing of the effects of new information about

internal control through audit or management review discovery under section 404.

Disclosure of an ICD under 404 that was not preceded by a 302 disclosure could indicate

management’s lack of knowledge, inadequate review, or even intent to mislead. Further,

audited 404 disclosures may reflect remediation of prior internal control deficiencies

disclosed under 302. Our third reason for combining the disclosures is statistical in

nature. Because of the short history of mandated internal control reporting, the number of

ICD disclosures is small and the available empirical measures of risk and cost of capital

are relatively noisy. Combing regulatory regimes and voluntary disclosures increases the

power of our tests.

4 For example, voluntary disclosure of a deficiency or significant deficiency may reflect management or auditor uncertainty about whether a deficiency might be judged a material weakness, a belief that voluntary disclosure may facilitate a reputation for diligence and transparency or a legal defense, or perhaps a signal that a rumored deficiency is not a material weakness.

11

IV. Sample, Variables, and Descriptive Statistics

The data for this study are compiled from the following sources:

• Internal control deficiency disclosures and SOX 404 audit opinions–Compliance Week, Glass-Lewis and SEC filings on Edgar

• Accounting variables – Standard and Poor’s Compustat

• Stock return data – CRSP and Datastream

• Expected returns (implied cost of capital estimates) – Value Line

Our initial sample of firms providing disclosure of ICDs is obtained from

compilations of SEC filings reported in Compliance Week, a weekly electronic newsletter

published by Boston’s Financial Media Holdings Group, and Glass-Lewis & Co., LLC, a

leading investment research and proxy advisory firm. The sample period spans filings

made from November 2003 to September 2005. In addition we supplement these two

databases with additional hand collected data from SEC filings.5 This results in an initial

sample of 1,053 firms disclosing at least one internal control deficiency in either the SOX

302 or 404 reporting regimes.

Panel A of Table 1 partitions the sample of 1,053 ICD firms based on their SOX 404

audit reports. For the sample of firms disclosing control deficiencies and having 404

reports, 380 firms received adverse 404 opinions, 13 firms received disclaimers while

133 firms received an unqualified 404 opinion from their auditor. Of the 380 firms that

received an adverse 404 opinion, 186 firms had previously disclosed control deficiencies

under the 302 regime, while the adverse 404 opinion represents the first disclosure of a

control deficiency for 194 firms. Of the 13 firms receiving disclaimers under 404, four 5 The additional hand collection was used to supplement the initial database in instances where firms had delayed their filings yet indicated that they were expecting an adverse opinion or filed their 10-K after sample periods covered by the Glass Lewis and Compliance Week database.

12

did not disclose a control deficiency under the 302 regime. The largest sub-sample

consists of 527 firms not having a SOX 404 opinion, indicating that these firms reported

an internal control problem under 302, but have not provided an auditor’s opinion on

internal controls because they are either non-accelerated filers or had not yet filed a 10-K

in the SOX 404 reporting period by the sample cut-off date of September 2005. In

conducting our empirical tests, we allow the samples to vary depending on the data

required to conduct the particular analysis drawing each sample from the initial

population of 1,053 internal control deficiencies reported in Panel A.

Panel B of Table 1 investigates the market reaction to the first ICD disclosure for

sample firms having the necessary data to conduct the analysis. Specifically, we collect

daily returns over the three day window centered on the first ICD disclosure date from

DataStream. In addition, we further restrict the sample by requiring firms to have

sufficient data to estimate the ICD determinant model of Ashbaugh-Skaife et al. (2006),

that is used to form an expectation on whether a firm is incurring internal control

problems (see Appendix 2 for details).

The results reported in Panel B of Table 1 indicate that both the mean (-1.65%) and

median (-0.71%) buy and hold three day market-adjusted return (BHAR) around the first

disclosure of an ICD for the sample of firms reporting control deficiencies and having the

necessary return data (n=641) are negative and significant. These results indicate that at

least a portion of the information contained in the initial ICD disclosure was not expected

by investors. The second and third rows of Panel B report the market reaction for the

least (most) likely groups, where the groups are formed based on the predicted

probability of an ICD using a logit prediction model based on the work by Ashbaugh-

13

Skaife, et al. (2006). For both the least and most likely groups, the mean and median

market reactions are negative and significant at the 0.09 level or better. The magnitude

of the market reaction is largest for the most likely group (top 30% of the ICD sample

based on the predicted probability) where stock price fell, on average, -2.97% at the

announcement of an ICD. Overall, the descriptive statistics on the market reaction to the

ICD indicate that ICD reports resulted in a revision in investors risk assessments,

expectations of future cash flows or both and that these revisions were greatest for the

sample of firms most likely to receive an ICD report.

Panel C of Table 1 reports the descriptive statistics for the sample of firms used in the

first analysis examining the association between internal control deficiencies and two

types of risk, idiosyncratic and systematic risk. To be included in this analysis we require

firms to have daily and monthly stock returns on CRSP to estimate the idiosyncratic and

systematic risk measures. Idiosyncratic risk (I_RISK) is the standard deviation of the

residuals from the following model estimated over the fiscal year using daily returns:

titti RMRFEXRET ,10, εββ ++= (5)

where EXRET is firm i’s return on day t minus the risk free rate, RMRF is the day t

excess return on the market obtained from

http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html).

Systematic risk (BETA) is measured as the coefficient on the RMRF term from the

following model:

τττ εββ ,10, ii RMRFEXRET ++= (6)

14

where EXRET is firm i’s return for month τ minus the risk free rate, RMRF is the month

m excess return on the market obtained from

http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html).

Equation (6) is estimated using monthly returns requiring a minimum of 24 and

maximum of 60 observations over the current and prior fiscal years. In addition, we

require sufficient accounting data on Compustat to calculate control variables included in

our analysis of I_RISK and BETA -

• STD_CFO (Standard deviation of Cash flow from operations (Compustat #308) divided by total assets (Compustat #6) calculated using the prior five fiscal years, requiring a minimum of three years of data)

• LEV (Total debt (Compustat #9 plus Compustat #34) divided by total assets

(Compustat #6)

• CFO (Cash flow from operations (Compustat #308) divided by total assets (Compustat #6)

• BM (Book value of equity (Compustat #60) divided by market value of equity

(Compustat #199* Compustat #25)

• SIZE (Natural log of fiscal year end market value of equity (Compustat #25 * Compustat #199)

• DIVPAYER (One if the firm pays dividends (Compustat # 21), zero otherwise).

Finally, for comparative purposes we require firms to have data for fiscal years 2002,

2003 and 2004.6

The upper half of panel C of Table 1 reports the descriptive statistics for the sample

of firms disclosing control deficiencies (ICD=1) and having sufficient data to be included

in the analysis (610 firms representing 1,830 firm-year observations). The lower half of

panel C of Table 1 displays the descriptive statistics for the control sample (ICD=0),

6 Our inferences our unchanged if we do not impose this requirement.

15

representing all firms with sufficient data on both CRSP and Compustat that did not

disclose an internal control deficiency in either the 302 or 404 reporting regimes (3,208

firms representing 9,624 firm-year observations). On average, firms disclosing internal

control deficiencies tend to have more volatile cash flows (mean value of

STD_CFO=0.092) than the control firms (mean value of STD_CFO=0.085). In addition,

ICD firms compared to non-ICD firms tend to be smaller (mean SIZE $5.640 billion

versus $5.955 billion), have less leverage (mean LEV 0.214 versus 0.220), have lower

cash flow from operations (mean CFO 0.017 versus 0.032), have higher book-to-market

ratios (mean BM 0.585 versus 0.570) and are less likely to pay dividends (mean

DIVPAYER 0.226 versus 0.342).

Panel D of Table 1 provides correlations among the control variables and the ICD

indicator variable. The upper right hand portion of the panel presents Pearson product-

moment correlations, while the lower left hand portion presents the Spearman rank-order

correlations. To facilitate discussion, we focus on the Pearson correlations, but note that

the Spearman rank order correlations are generally consistent with the Pearson results.

Consistent with expectations, the ICD variable is positively correlated with both I_RISK

(0.072) and BETA (0.072). In addition, the ICD variable is positively correlated with

STD_CFO (0.026) and negatively correlated with CFO (-0.027), SIZE (-0.055), and

DIVPAYER (-0.091). As expected, I_RISK and BETA exhibit a relatively large positive

correlation, 0.446. However, in terms of magnitude, the correlation between I_RISK and

SIZE, -0.618, is the largest.

IV. Results

16

IV.1 Cross-Sectional Results

We begin our empirical tests by investigating the relation between the presence of

internal control weaknesses and idiosyncratic risk (I_RISK). Panel A of Table 2

compares the mean and median I_RISK between ICD and control firms. For all three

years of our sample period, the mean and median I_RISK of ICD firms is significantly

higher than that of the non-ICD firms.

We next investigate the relation between internal control deficiencies and

idiosyncratic risk by estimating a multivariate OLS regression that controls for other

factors that prior research has shown to be related to idiosyncratic risk (Rajgopal and

Venkatachalam 2005). Specifically, we estimate the following model:

εβ

βββββββ

+

+++++++=

DIVPAYER

SIZEBMCFOLEVCFOSTDICDRISKI

7

6543210 __ (7)

where all variables are as previously defined.

Panel B of Table 2 displays the results of estimating equation (7) for each year of our

sample period.7 As expected, we find that smaller firms that less often pay dividends and

report lower levels and greater volatility of cash flows from operations exhibit greater

idiosyncratic risk. We find a significantly negative coefficient on BM for two of the

three years. The analysis using the complete sample of ICD and control firms finds a

significant negative coefficient on LEV for two of the three years, which is contrary to

expectations. However, when we eliminate firms from the sample that do not have debt

(or trivial amounts of debt), the results indicate, as expected, that firms with more debt

7 We conduct yearly regressions because of the changes in market conditions over 2002-2004, and require sample firms to have data in all three years. Allowing the sample to vary by year conditional on firms have data does not change our results.

17

exhibit more idiosyncratic risk.8 Turning to the primary variable of interest, we find a

positive and significant coefficient on ICD for each of the three years of our analysis

period. This result indicates that firms that have internal control problems have greater

idiosyncratic risk than firms that do not report internal control deficiencies.

The purpose of internal controls is to generate reliable, high quality financial

information. There is some evidence to suggest that firms with weak internal controls

have low quality financial information relative to firms operating with adequate internal

controls (e.g. Hogan and Wilkins 2005 and Ashbaugh-Skaife, et. al. 2005). Prior

research suggests that firms reporting low quality information present greater information

risk that manifests in higher costs of capital. Thus, it could be that our model of I_RISK

suffers from a correlated omitted variable problem in that ICD could be proxying for low

information quality. To assess whether the presence of an ICD results in greater risk

beyond that of poor quality financial information, we re-estimate equation (3) including

two variables that capture firms’ information quality: abnormal accruals and noise in

working capital accruals. Abnormal accruals (AA) are defined as the absolute value of

performance adjusted abnormal accruals as estimated by the modified Jones model. The

noise in working capital accruals (DD_NOISE) is defined as in Dechow and Dichev

(2002) (see Appendix 1 for details).

Panel C of Table 2 displays the results of estimating equation (3) including AA and

DD_NOISE. As expected, we find positive coefficients on AA and DD_NOISE

8 The tabled result that LEV is negatively associated with I_RISK is consistent with the findings of Duffee (1995). Duffee (1995) reports that the positive relation between leverage and risk measures documented in prior work is due to the samples used in the empirical analysis. When Duffee (1995) requires firms to have debt, he finds a positive relation between leverage and risk. Relaxing this requirement results in either insignificant results or in some instances the opposite result. Following Duffee’s (1995) work, we delete firms that have leverage less than 0.10 and find that a positive association between leverage and I_RISK.

18

indicating that poor quality financial information is positively related to idiosyncratic

risk. More importantly, after controlling for the quality of firms’ financial information,

we still find a significantly positive coefficient on ICD for 2002, 2003, and 2004. Thus,

it appears that weaknesses in internal controls manifest in more idiosyncratic risk beyond

that of poor quality financial information.

Our second empirical test examines the relation between systematic risk, i.e., BETA,

and internal control deficiencies. Panel A of Table 3 displays the mean and median

values of BETA for ICD and non-ICD firms for each sample year. Univariate tests

indicate that the mean and median values of BETA for ICD firms are significantly larger

than that for non-ICD firms across all years in our sample period.

Panel B of Table 3 reports the results of the following OLS regression:

εβ

βββββββ

+

+++++++=

DIVPAYER

SIZEBMCFOLEVCFOSTDICDBETA

7

6543210 _ (8)

where all variables are as previously defined. After controlling for known risk factors,

we find a significantly positive coefficient on ICD for each of the sample years. As in

our idiosyncratic risk analysis, we assess the robustness of our results by adding the two

information quality measures to equation (8). The results displayed in Panel C of Table 3

indicate that firms that have problems with their internal controls exhibit greater market

risk even after controlling for the quality of their financial information.

Our third set of tests focuses on firms’ cost of equity capital. As suggested by the

analytical results in Lambert et al. (2005), our general hypothesis is that firms with

internal control deficiencies will exhibit higher cost of equity capital relative to firms

with strong internal controls. Based on prior research (Francis, et. al. 2004 and

19

Ashbaugh-Skaife, Collins and DeFond 2006), we elect to use firms’ expected rate of

return, as reported in Value Line, as our measure of cost of equity capital.9

To benchmark our cost of capital measure to prior research, we report in Panel A of

Table 4 the descriptive statistics for the cost of capital estimates (CC) and the risk

measures that serve as control variables in our cost of capital tests; BETA, SIZE, BM,

and I_RISK. The mean (median) CC value for ICD firms is 17.492 (15.563) whereas the

mean (median) CC value for the control firms is substantially less (14.823 and 13.625,

respectively). Panel B of Table 4 displays the CC estimates by year for ICD and control

firms. The univariate tests indicate that both the mean and median CC values for ICD

firms are larger than that of the control firms. 9 Theoretical and empirical research indicates that a “good” measure of expected return will be positively related to beta and the book-to-market ratio and negatively related to size (Sharpe 1964; Linter 1965; Black 1972; Berk 1995; Fama and French 2004; Botosan and Plumlee 2004). Guay, Kothari, and Shu (2003) suggest evaluating cost of equity capital measures based on the association between measures of expected returns and realized returns. They posit that expected returns, on average, should equal realized returns if investors expected returns reflect rational expectations. We consider two cost of capital measures. The first is from Value Line and the other is derived using IBES forecast as inputs to Easton’s [2004] PEG ratio. While Botosan and Plumlee conclude that these two measures are the most defensible, the PEG ratio estimates potentially have additional drawbacks in our setting. Specifically, to derive a cost of capital estimate the PEG ratio requires positive and increasing earnings forecasts. This introduces a potentially serious sample selection bias against ICD firms as Ashbaugh-Skaife, et al. (2005) and Doyle et al. (2005) find that ICD firms have a much higher incidence of losses that non-ICD firms. In assessing the validity of the two cost of capital estimates, we find that in each year ( 2002, 2003 and 2004) both the Value Line and PEG ratio cost of capital measures exhibits a positive (negative) and significant association with beta and the book-to-market ratio (size), as expected. However, when validating the two estimates of the cost of capital we find that the Value Line implied cost of capital measure meets the Guay et al. (2003) rational expectations test, while the PEG ratio cost of capital measure fails this test. As a final means of comparison between the two measures, we examine the implications of the PEG ratio’s positive earnings and positive earnings growth requirements for the ICD firms. Ashbaugh-Skaife et al. (2005) and Doyle et al (2005) find that firms reporting losses and firms in financial distress are more likely to report control weaknesses, indicating that the PEG ratios requirements potentially restrict the ICD sample. For fiscal 2004 we are able to calculate Value Line cost of capital estimates for 220 ICD firms, while only 175 ICD firms have PEG ratio estimates. Thus, requiring firms to have positive forecasted earnings and positive growth in forecasted earnings results in a loss of over 20 percent of the ICD observations. In addition, the Value Line cost of capital estimates indicate that the sample of ICD firms not meeting the PEG ratio requirements are potentially more risky than the ICD firms meeting the PEG ratio requirements (median Value Line cost of capital of 13.83 vs. 12.25). Based on the results of these analyses to evaluate the properties of the two alternative cost of capital measures, we conclude that the Value Line measure is superior to the PEG ratio measure and is a reasonably good proxy for firms’ cost of equity capital. A limitation of Value Line is that it covers a limited number of publicly traded firms. Thus, the sample of ICD and control firms used for our cost tests is smaller than the samples used in our idiosyncratic and market risk assessments.

20

We test our predictions regarding the effects of internal control deficiencies on the

cost of equity capital using the following model:

εββββββ ++++++= RISKIDOBMSIZEBETAICDCC _543210 (9)

where all variables are as previously defined. Panel C of Table 4 reports the results of

estimating equation (9) for 2002, 2003, and 2004. The signs of the coefficients on the

risk factors are as expected in that we find that BETA, BM, and I_RISK are positively

related to firms’ cost of equity capital. The results also indicate that SIZE is positively

related to the cost of capital in two of the three years, inconsistent with expectations. In

untabulated analyses, we drop I_RISK from equation (9) and findthat the coefficient on

SIZE is negative and significant as expected. Turning to the primary variable of interest,

we find a significantly positive coefficient on ICD in each of the three years.

Furthermore, as shown in Panel D of Table 4, this result holds after controlling for the

quality of firms’ financial information. These results indicate that firms with internal

control problems incur higher costs of equity capital than firms that do not suffer from

internal control weaknesses. This finding provides empirical evidence supporting the

theoretical work of Lambert et al. (2005) who predict that firms with stronger internal

and higher quality financial information will exhibit a lower cost of capital.

IV.2 Change Analysis

The results reported above suggest that weak internal controls are associated with

higher cost of equity capital, but these cross-sectional results do not provide a sufficient

basis for inferring causality. To further substantiate a causal relation between internal

control deficiencies and cost of equity capital, we conduct five additional change

analyses tests. The first analysis investigates whether there is a change in the cost of

21

equity capital when a firm first reports a control problem and whether the magnitude of

change in cost of capital is inversely related to the market’s assessed likelihood that a

firm will report an ICD. We start by identifying the first ICD report date for 162 sample

firms for which we have Value Line cost of capital estimates both before and after the

ICD report date and data necessary to estimated the ICD determinant model in Appendix

2. We then compare the CC estimate pre-disclosure to the CC estimate post-disclosure.10

Because it is argued that the market can set expectations for whether a firm has an

internal control problems based on observable events (see Ashbaugh-Skaife et al. 2005

and Doyle, et. al. 2005), we divide the 162 firms into deciles based on the likelihood of

reporting an internal control problem.

Panel A of Table 5 reports the mean and median change in the cost of capital for all

162 firms as well as the bottom three and top three deciles. For the full sample we find

that the cost of capital increased significantly after firms’ first disclosure of an internal

control problem. In addition, we find that the cost of capital increase following the ICD

report appears more severe for the firms that were the least likely to report and ICD.

Specifically for the least likely group the mean change in the cost of capital is 1.036,

significant at the 0.07 level one-sided. For the sample of firms that were most likely to

report ICD problems, both the mean and median values are positive, consistent with

investors assessing a higher cost of capital after the ICD report. However, neither of these

values is significantly different from zero. Based on the results reported in Panel B of

Table 5, we conclude that the initial revelation of the ICD results in investors assessing a

10 In Tables 5, 6, and 7, we report the results using market adjusted cost of capital measures, where market adjustments are made using all firm not reporting and ICD over the same time period. We also examine the change in the cost of capital using unadjusted and industry adjusted cost of capital measures (untabled) and find similar results.

22

higher cost of equity capital and this revision in cost of capital is greater for firms that

were least likely to report an ICD based on observable firm characteristics. These

findings are consistent with at least a portion of the initial market reaction to the ICD

being due to investor assessing greater information risk to firms initially reporting ICDs.

As a further test of causality, we examine the change in the cost of capital

surrounding the remediation of prior disclosed control deficiencies. Specifically, we

examine the change in the cost of capital surrounding the release of the unqualified SOX

404 opinion for the sample of firms that previously disclosed a control deficiency under

section 302 of SOX. In conducting our analysis we require firms have at least two

months between the release of the SOX 302 control deficiency and the unqualified SOX

404 auditor opinion to ensure that investors had sufficient time to revise their cost of

capital estimates. Panel A of Table 6 reports the descriptive statistics on cost of capital

pre and post SOX 404 opinion for the firms that remedied their internal control problems

and received a clean SOX 404 opinion form their external auditors. For the 38 firms that

disclosed an ICD under 302 and received an unqualified 404 opinion, we find a

significant reduction in the cost of capital following the release of the 404 report.

Specifically, in Panel B of Table 6 the mean (median) change in the market-adjusted cost

of equity capital following the release of the clean SOX 404 opinion is -1.513 (-1.313),

both of which are significantly different from zero at the 0.04 level or better.

In contrast to firms that remedied their internal control problems, there were firms

that voluntarily disclosed ICDs during the SOX 302 regime and failed to remedy these

problems as evidenced by a qualified SOX 404 audit report. For these firms, we expect

to observe no significant change in cost of capital at the time of receiving an adverse

23

opinion since the market had already adjusted its cost of capital assessments upward on

the initial disclosure (see Table 5). In Panel A of Table 7, we report the descriptive

statistics on the CC for the 119 firms that failed to correct their control problems prior to

the SOX 404 audit.11 Panel B of Table 7 reports the mean and median change in CC

around the SOX 404 audit opinion for these firms. As expected, we find no significant

change in cost of capital around the reporting of the qualified 404 opinion (mean=-0.161,

median=-0.375).

We conduct one additional cost of capital change analysis surrounding the release of

the 2004 10-K for the sample of firms that received unqualified 404 opinions and did not

disclose a control deficiency under the 302 regime. These firms are deemed to have

strong internal controls.12 Similar to the analysis in Table 5, we use the model from

Ashbaugh-Skaife et al (2006) to determine the likelihood of a firm reporting an ICD. We

first examine the changes in the cost of capital for the full sample of 685 firms meeting

the data requirements. Both mean and median values of the market-adjusted change in

cost of capital measures are not significantly different from zero. After partitioning firms

based on the probability of receiving a control deficiency, we find that the sample of

firms receiving a unqualified 404 that were most likely to report a control weakness have

a cost of capital decline following the release of the 404 report. Specifically, the mean

change in the market- adjusted cost of capital is -0.77% which is significant at the 0.01

level. The median change in cost of capitalof -0.25 is directionally consistent with the

11 The total number of firms used in Tables 6 and 7 is 157, whereas the sample used in Table 5 is 162. The difference in sample size is due to the requirement that firms have 404 reports combined with requiring data to estimate the determinant model. 12 We identify the 404 opinions for this sample of firms using a combination of Compliance Week and hand collection.

24

mean, but is not significantly different from zero. The results for the least likely group

are similar to those for the overall sample in that there is no evidence of a cost of capital

change. Thus, as expected, there is no significant change in cost of capital for those firms

that were least likely to report an ICD and did, in fact, receive an unqualified SOX 404

opinion on their internal controls.

In summary, the results presented in Tables 5-8 provide evidence consistent with the

revelation of internal control deficiencies causing significant revisions to investors’

assessment of information risk. In addition, these results provide evidence consistent

with poor internal controls causing investor to assess higher information risk and a higher

cost of capital.

IV.3 Effects on Risk after Controlling for the Likelihood of Reporting an ICD

Our last analysis examines the effect of internal control deficiencies on risk after

controlling for the firm-specific characteristics that are associated with poor internal

controls. Ogneva, Raghunandan and Subramanyam (2005) examine the implications of

section 404 certifications for cost of capital, concluding that internal control weaknesses

do not have a direct effect on the cost of capital after controlling for firm characteristics

that are associated with ICDs. Ogneva et al. (2005) view internal control deficiencies as

having two potential effects on the cost of capital. The first effect arises from

information risk associated with poor internal controls and the second effect arises from

internal control problems being inherently more likely for firms facing greater operating

risk. Ogneva et al. (2005) find that the cost of capital effect of internal control

disclosures disappear after controlling for factors associated with an increased likelihood

of reporting internal control deficiencies. Based on this finding Ogneva et al. (2005)

25

conclude that internal control deficiencies do not have a direct effect on the cost of

capital.

The results of our change-analysis provide evidence inconsistent with the findings of

Ogneva et al. (2005). By examining the firm-specific change in the cost of capital, we

are able to control for other factors that are correlated with the reporting of internal

control deficiencies as well as correlated with the cost of capital. However, to provide a

more direct comparison to Ogneva et al. (2005), we re-estimate our cross-sectional

I_RISK, BETA, and CC models including the variables from the Ashbaugh-Skaife et al.

(2006) model using all firms with available data for fiscal 2004.

The first column of Panel A in Table 9 displays the association between I_RISK and

ICD including the factors affecting the likelihood of firms reporting an ICD. After

including the additional variables in the model, we continue to find a positive and

significant coefficient on ICD. The second column of Panel A of Table 9 reports the

association between ICD and BETA after controlling for the firm-specific characteristics

associated with internal control deficiency disclosures. Similar to the results reported in

Table 3 we continue to find a positive and significant association between ICD and

BETA. Finally, Panel B of Table 9 presents the results of the cross-sectional cost of

capital model including the additional control variables. While the magnitude of the

coefficient and significance is reduced relative to the results presented in Table 5, we

continue to find a positive and significant association between the cost of capital and the

ICD dummy.

Our research design examines the implications of internal control weaknesses on the

cost of capital over multiple years because the required reporting of internal control

26

problems is a new phenomena yet the existence of internal control problems in all

likelihood existed prior to the disclosure. Indeed, our results indicate that investors

viewed firms reporting internal control weaknesses to be more risky prior to the first

disclosure of an internal control weakness. Based on this result, we examine the change

in investors’ assessment of firms’ cost of capital surrounding changes in internal control

reporting. Our results indicate that investors updated their cost of capital assessments

when new information related to internal controls was released. Differences in our

research design related to the measurement of the cost of capital and samples sizes

contribute to differences in the inferences drawn from our analysis relative to the

conclusions of Ogneva et al. (2005).

V. Conclusion

The recent theoretical work of Lambert, Leuz and Verrecchia (2005) suggests that

information and information system quality have both an indirect and direct effect on the

cost of equity capital. Strong internal controls are fundamental to a high quality

information system and high quality financial information. We use the unique setting

provided by the enactment of the Sarbanes-Oxley Act of 2002 (SOX) that requires firms

to disclose internal control problems to empirically test whether the quality of firms’

internal control systems affect idiosyncratic risk, beta risk, and costs of equity capital.

In cross-sectional tests, we find that firms that disclose problems with their internal

controls exhibit significantly higher betas, idiosyncratic risk and cost of capital during the

period from 2002 to 2004 relative to firms not reporting internal control deficiencies.

These differences persist after controlling for other factors that prior research has shown

27

to be related to these variables. We also structure change analysis tests designed to

investigate whether initial disclosure of internal control problems, repeated disclosure of

internal control problems, or remediation of internal control problems caused predictable

changes in firms’ cost of capital. In general, our findings indicate that firms that disclose

an internal control problem experience a significant increase in market-adjusted cost of

capital, firms that have persistent internal control problems have no change in their cost

of capital, and firms that improve their internal control systems as evidenced by receiving

an unqualified SOX 404 opinion exhibit an average decrease their market-adjusted cost

of capital of 152 basis points. Our study provides clear evidence that internal control risk

matters to investors and that firms reporting strong internal controls or firms that correct

prior internal control problems benefit from lower costs of equity capital.

28

Appendix 1 Variable Definitions

AA Abnormal accruals measured by the absolute value of performance adjusted

abnormal accruals (see Ashbaugh et al. 2003) BETA Beta measured as the coefficient on RMRF from the following model:

εββ ++= RMRFEXRET 10 estimated over the 60 months prior to a firm-year observation fiscal year end, requiring minimum of 18 months. EXRET is the firm’s monthly return minus the risk free rate, RMRF is the excess return on the market (source http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html).

BM Book to market measured as book value of equity (Compustat #60) divided by market value of equity (Compustat #199* Compustat #25).

CC Cost of capital defined as Value Line’s annual expected return. CFO Cash flow from operations measured as cash flow from operations

(Compustat #308) scaled by total assets (Compustat #6). DD_NOISE The Dechow and Dichev’s (2002) quality of accruals metric measured as

negative one times the standard deviation of the firm-specific residual from the prior three to five years. Residuals are from the following cross-sectional estimations of the following OLS model:

εββββ ++++= +− 132110 tttt CFOCFOCFOWCA where regressions are estimated by three, two, or one-digit SIC codes conditional on having at least 10 firms in each SIC group. WCA=working capital accruals (-(Compustat # 302+ Compustat # 303+ Compustat # 304+ Compustat # 305+ Compustat # 307)); CFO= cash flow from operations (Compustat # 308); all variables are scaled by average total assets (Compustat # 6).

DIVPAYER One if the firm pays dividends (Compustat # 21), zero otherwise. ICD One if firm disclosed an internal control problem, zero otherwise. I_RISK Idiosyncratic risk measured as the standard deviation of the residuals from the

following model estimated over the fiscal year using daily returns: εββ ++= RMRFEXRET 10 EXRET is the firm’s daily return minus the risk free rate, RMRF is the excess return on the market (source http://mba.tuck.dartmouth.edu/pages/faculty/ken.french/data_library.html).

LEV Leverage measured as total debt (Compustat #9 plus Compustat #34) divided by total assets (Compustat #6).

SIZE Natural log of fiscal year-end market value of equity (Compustat #25 * Compustate #199).

STDCFO Standard deviation of cash flow from operations defined as cash flows from operations (Compustat #308) divided by total assets (Compustat #6), where the standard deviation is calculated using the prior five fiscal years, requiring a minimum of three years of data.

STDNIBE Standard deviation of net income before extraordinary items defined as net income before extraordinary items (Compustat #18) divided by total assets (Compustat #6), where the standard deviation is calculated using the prior five fiscal years, requiring a minimum of three years of data.

29

Appendix 2: ACK Internal Control Model

Variables Predicted

Sign INTERCEPT -3.097*** SEGMENTS + 0.072*** FOREIGN_SALES + 0.536*** M&A + 0.173** RESTRUCTURE + 0.478*** RGROWTH + 0.065*** INVENTORY + 0.700** SIZE - -0.045*** %LOSS + 0.202* RZSCORE - 0.022 AUDITOR_RESIGN + 1.320*** RESTATEMENT + 0.543*** Likelihood ratio χ2 159.25*** Percent Concordant 62.3% Percent Discordant 35.9% n 4810

The dependent variable is set equal to one if the firm discloses an internal control deficiency, and zero otherwise. The independent variables are defined as follows: SEGMENTS is the number of reported business segments in 2003 (Compustat Segment file),FOREIGN_SALES is equal to one if a firm reports foreign sales in 2003, and zero otherwise(Compustat Segment file), M&A equals one if a firm is involved in a merger or acquisition from 2001 to 2003, and zero otherwise (Compustat AFNT #1), RESTRUCTURE equals one if a firm was involved in a restructuring from 2001 to 2003, and zero otherwise (this variable is coded one if any of the following Compustat data items are non-zero: 376, 377, 378 or 379), RGROWTH is the decile rank of average growth rate in sales from 2001 to 2003 (the percent change in Compustat #12), INVENTORY is the average inventory to total assets from 2001 to 2003 (Compustat #3/ Compustat #6), SIZE is the natural log of average market value of equity from 2001 to 2003 in $ millions (Compustat #199 * #25), %LOSS is the proportion of years from 2001 to 2003 that a firm reports negative earnings, RZSCORE is the decile rank of Altman (1980) z-score measure of distress risk, AUDITOR_RESIGN equals one if the auditor resigned from the client in 2003, zero otherwise (8-K filings), and RESTATEMENT equals one if a firm had a restatement or an SEC AAER from 2001 to 2003 and zero otherwise.

30

Table 1 Internal Control Deficiencies Samples and Descriptive Statistics

Panel A: Sample of Firms Reporting Internal Control Problems under 302 or 404 or Both

Adverse 404 but no ICD under 302 194 Adverse 404 and ICD under 302 186 Disclaimer under 404 but no ICD under 302 4 Disclaimer under 404 and ICD under 302 9 Unqualified 404 but disclosed an ICD under 302 133 No 404 report but disclosed an ICD under 302 527 Total 1,053

Panel B: Market Reaction to First Internal Control Deficiency Disclosure for Firms that have the Necessary Data to estimate the ICD Reporting Model of Ashbaugh-Skaife, Collins, and Kinney (2006)

Buy and Hold Market Adjusted

Return (BHAR)

Mean

3-day BHARMedian

3-day BHAR All firms having necessary data (n=641) -1.648 -0.708 p-value 0.01 0.01 Least likely group to report ICD (lower 30%) (n=192) -0.992 -0.598 p-value 0.09 0.02 Very likely group to report ICD (upper 30%) (n=192) -2.965 -1.259 p-value 0.01 0.01

31

Table 1 continued

Panel C: Descriptive Statistics for ICD and Control Firms that Comprise the Samples used in the Idiosyncratic Risk and Systematic Risk Analyses ICD=1 (610 firms, 1,830 firm year observations) Mean Median Q1 Q3 Std DevI_RISK 3.682 3.223 2.153 4.616 2.080 BETA 1.380 1.113 0.546 1.953 1.118 STD_CFO 0.092 0.060 0.033 0.106 0.109 LEV 0.214 0.153 0.011 0.342 0.227 CFO 0.017 0.053 -0.008 0.110 0.199 BM 0.585 0.514 0.288 0.822 0.885 SIZE 5.640 5.648 4.424 6.723 1.828 DIVPAYER 0.226 0.000 0.000 0.000 0.418 ICD=0 (3,208 firms, 9,624 firm year observations) Mean Median Q1 Q3 Std DevI_RISK 3.263 2.697 1.732 4.166 2.119 BETA 1.173 0.884 0.401 1.697 1.044 STD_CFO 0.085 0.054 0.028 0.100 0.104 LEV 0.220 0.175 0.014 0.349 0.220 CFO 0.032 0.072 0.013 0.127 0.203 BM 0.570 0.482 0.274 0.756 0.655 SIZE 5.955 5.965 4.353 7.429 2.163 DIVPAYER 0.342 0.000 0.000 1.000 0.474 Panel D: Correlations (Pearson (top) Spearman (bottom))

ICDI_

RISK

BETASTD_ CFO

LEV

CFO

BM

SIZE

DIV- PAYER

ICD 0.072 0.072 0.026 -0.009 -0.027 0.007 -0.055 -0.091 I_RISK 0.100 0.446 0.442 -0.080 -0.455 0.024 -0.618 -0.480 BETA 0.076 0.519 0.325 -0.191 -0.304 -0.093 -0.120 -0.411 STD_CFO 0.042 0.578 0.452 -0.174 -0.448 -0.094 -0.310 -0.299 LEV -0.014 -0.208 -0.261 -0.343 0.019 -0.123 0.083 0.132 CFO -0.065 -0.377 -0.283 -0.222 -0.009 0.052 0.322 0.230 BM 0.028 0.004 -0.154 -0.175 0.008 -0.103 -0.202 0.001 SIZE -0.057 -0.665 -0.122 -0.409 0.161 0.340 -0.257 0.434

DIVPAYER -0.091 -0.603 -0.448 -0.447 0.185 0.232 0.042 0.433

Bold text indicates significance at the 0.05 level or better two-tailed. See Appendix 1 for variable definitions. Differences in means (medians) are assessed using a t-test (one-sample median test).

32

Table 2 Internal Control Deficiencies and Idiosyncratic Risk

Panel A: Descriptive Statistics on Idiosyncratic Risk

Fiscal Year 2004 2003 2002 Mean Median Mean Median Mean Median ICD=1 (n=610) 3.103 2.753 3.638 3.177 4.306 3.856 ICD=0 (n=3,208) 2.724 2.282 3.258 2.641 3.808 3.262 p-value 0.01 0.01 0.01 0.01 0.01 0.01

Panel B: Idiosyncratic Risk OLS Regressions

εββββββββ

++++++++=

DIVPAYERSIZEBMCFOLEVCFOSTDICDRISKI

7

6543210 __

Predicted

Sign 2004 2003 2002 INTERCEPT 5.843*** 6.469*** 6.291*** ICD + 0.113*** 0.108** 0.193*** STD_CFO + 2.114*** 3.397*** 2.353*** LEV + -0.274*** -0.121 0.224** CFO - -1.564*** -2.878*** -2.118*** BM ? -0.767*** -0.604*** -0.035 SIZE - -0.412*** -0.458*** -0.411*** DIVPAYER - -0.644*** -0.879*** -1.172*** Adjusted R2 0.59 0.52 0.51 n 3,818 3,818 3,818

33

Table 2 Continued Panel C: Idiosyncratic Risk OLS Regressions Controlling for Information Quality

εββββββββββ

++++++++++=

NOISEDDAADIVPAYERSIZEBMCFOLEVCFOSTDICDRISKI

___

987

6543210

Predicted

Sign 2004 2003 2002 INTERCEPT 5.454*** 5.837*** 5.630*** ICD + 0.104** 0.108** 0.199*** STD_CFO + 1.259*** 1.997*** 1.742*** LEV + -0.141* 0.143 0.512*** CFO - -1.506*** -2.813*** -2.097*** BM ? -0.674*** -0.494*** -0.003 SIZE - -0.397*** -0.431*** -0.384*** DIVPAYER - -0.568*** -0.716*** -0.946*** AA + 1.649*** 1.734*** 2.064*** DD_NOISE + 2.468*** 5.191*** 4.554*** Adjusted R2 0.59 0.52 0.51 n 3,620 3,602 3,428

***, **, *, indicates significance at the 0.01, 0.05, 0.10 levels, respectively. See Appendix 1 for variable definitions. Differences in means (medians) in Panel A are assessed using a t-test (Wilcoxon rank sum test).

34

Table 3 Internal Control Weakness and Systematic Risk (Beta)

Panel A: Descriptive Statistics on Systematic Risk (Beta)

Fiscal Year 2004 2003 2002 Mean Median Mean Median Mean Median ICD=1 (n=610) 1.434 1.181 1.370 1.108 1.338 1.038 ICD=0 (n=3,208) 1.217 0.940 1.167 0.870 1.134 0.845 p-value 0.01 0.01 0.01 0.01 0.01 0.01

Panel B: Systematic Risk (Beta) OLS Regressions

εββββββββ

++++++++=

DIVPAYERSIZEBMCFOLEVCFOSTDICDBETA

7

6543210 _

Predicted

Sign 2004 2003 2002 INTERCEPT 1.317*** 1.295*** 1.067*** ICD + 0.099*** 0.113*** 0.108*** STD_CFO + 1.438*** 1.202*** 1.427*** LEV + -0.634*** -0.679*** -0.628*** CFO - -0.967*** -1.315*** -0.860*** BM ? -0.264*** -0.351*** -0.013 SIZE - 0.063*** 0.068*** 0.065*** DIVPAYER - -0.845*** -0.808*** -0.782*** Adjusted R2 0.27 0.30 0.27 n 3,818 3,818 3,818

35

Table 3 Continued

Panel C: Systematic Risk (Beta) OLS Regression Controlling for Information Quality

εββββββββββ

++++++++++=

NOISEDDAADIVPAYERSIZEBMCFOLEVCFOSTDICDBETA

__

987

6543210

Predicted

Sign 2004 2003 2002 INTERCEPT 0.928*** 0.954*** 0.646*** ICD + 0.099*** 0.115*** 0.100*** STD_CFO + 0.995*** 0.919*** 1.346*** LEV + -0.494*** -0.565*** -0.549*** CFO - -0.959*** -1.348*** -0.878*** BM ? -0.187*** -0.291*** -0.002 SIZE - 0.083*** 0.084*** 0.088*** DIVPAYER - -0.788*** -0.744*** -0.683*** AA + 0.115 -0.171 0.644*** DD_NOISE + 3.659*** 3.588*** 3.375*** Adjusted R2 0.28 0.30 0.29 n 3,620 3,602 3,428

***, **, *, indicates significance at the 0.01, 0.05, 0.10 levels. See Appendix 1 for variable definitions. Differences in means (medians) in Panel A are assessed using a t-test (Wilcoxon rank sum test).

36

Table 4 Internal Control Weakness and Cost of Capital

Panel A: Descriptive Statistics on the Cost of Capital (CC)

Fiscal Year 2004 2003 2002 Mean Median Mean Median Mean Median ICD=1 (n=204) 15.101 13.833 18.239 16.938 19.137 16.938 ICD=0 (n=1,104) 12.515 11.500 15.520 14.500 16.433 14.875 p-value 0.01 0.01 0.01 0.01 0.01 0.01

Panel B: Descriptive Statistics on CC Samples ICD=1 (204 firms, 612 firm year observations) Mean Median Q1 Q3 Std Dev CC 17.492 15.563 11.563 21.625 8.816 BETA 1.311 1.021 0.537 1.808 1.029 SIZE 7.167 6.971 6.186 8.001 1.419 BM 0.577 0.488 0.316 0.729 0.470 I_RISK 2.651 2.362 1.714 3.274 1.368 ICD=0 (1,104 firms, 3,312 firm year observations) Mean Median Q1 Q3 Std Dev CC 14.823 13.625 10.000 17.875 7.260 BETA 1.004 0.755 0.369 1.396 0.897 SIZE 7.854 7.742 6.783 8.831 1.512 BM 0.480 0.436 0.273 0.626 0.324 I_RISK 2.088 1.796 1.341 2.499 1.114

37

Table 4 Continued Panel C: Cost of Capital OLS Regression

εββββββ ++++++= RISKIBMSIZEBETAICDCC _543210

Predicted

Sign 2004 2003 2002 INTERCEPT 2.445** 5.131*** 5.084*** ICD + 0.817** 1.234** 0.752** BETA + 1.278*** 0.246 1.814*** SIZE - 0.331*** 0.397*** 0.134 BM + 2.577*** 4.566*** 1.979*** I_RISK + 2.968*** 2.489*** 2.611*** Adjusted R2 0.31 0.16 0.40 n 1,308 1,308 1,308

Panel D: Cost of Capital OLS Regression Controlling for Information Quality

εβββββββββ

+++++++++=

STDNIBENOISEDDAARISKIBMSIZEBETAICDCC

87

6543210

__

Predicted

Sign 2004 2003 2002 INTERCEPT 3.330*** 4.700*** 4.936*** ICD + 0.762** 1.166** 0.747** BETA + 1.404*** 0.223 1.565*** SIZE - 0.252** 0.390** 0.153 BM + 2.321*** 4.652*** 2.036*** I_RISK + 3.076*** 2.589*** 2.557*** AA + -2.813 1.977 -1.171 DD_NOISE + -7.612 4.528 4.420 STDNIBE + -0.484 -2.085 4.214** Adjusted R2 0.32 0.16 0.40 n 1222 1225 1203

***, **, *, indicates significance at the 0.01, 0.05, 0.10 levels. See Appendix 1 for variable definitions. Differences in means (medians) in Panel B are assessed using a t-test (Wilcoxon rank sum test).

38

Table 5 Cost of Capital Change Pre-Post First ICD Disclosure

Panel A: Cost of Capital Pre and Post ICD Disclosure (n=162)

Mean Median Q1 Q3 Std Dev Pre ICD CC 15.878 14.750 11.000 18.250 7.391 Post ICD CC 16.990 15.000 11.750 19.750 8.289 Pre Period Market-Adjusted CC 4.042 2.917 -0.500 6.500 7.420 Post Period Market-Adjusted CC 4.969 2.979 0.000 7.750 8.272

Panel B: Firm Specific Change in the Market Adjusted Cost of Capital (Post-First ICD Disclosure minus Pre-First ICD Disclosure)

Mean

Change in the Cost of Capital

Median Change in the

Cost of Capital Full Sample n=162 0.927 1.042 p-value 0.02 0.02 Least Likely Group (lower 30%) n=48 1.036 0.750 p-value 0.07 0.24 Very Likely Group (upper 30%) n=48 0.615 0.688 p-value 0.24 0.15

Pre and Post Cost of Capital are calculated using a maximum of 180 days before and after the first ICD report. Least (Very Likely) Group represents the sub-samples of firms that are less (more) likely of receiving a ICD based on the Ashbaugh-Skaife, Collins, and Kinney (2006) ICD model. Differences in means (medians) are assessed using a t-test (one-sample median test).

39

Table 6 Remediation of Internal Control Weakness and the Cost of Capital

Panel A: Descriptive Statistics on Cost of Capital Pre and Post-404 Disclosure for Firms that Disclosed a ICD under 302 and Received a Clean 404 Opinion (n=38)

Mean Median Q1 Q3 Std Dev Pre-404 CC 15.836 13.750 10.500 19.000 8.500 Post-404 CC 14.503 12.750 9.000 16.000 8.593 Pre-404 Market Adjusted CC 4.096 2.125 -1.625 7.292 8.501 Post-404 Market Adjusted CC 2.583 0.792 -2.750 4.333 8.592

Panel B: Firm-Specific Change in Market-Adjusted Cost of Capital (Post-404 CC minus Pre-404 CC)

Mean Change in the Cost of Capital

Median Change in the Cost of Capital

Firms Previously Disclosing a weakness receiving and clean audit opinion (n=38) -1.513 -1.313 p-value 0.03 0.04

Pre and Post Cost of Capital are calculated using a maximum of 180 days before and after the 404 report. To be included in the sample, firms are required to have disclosed a 302 weakness at least two months prior to the 404 report, and their 404 reports indicate that they have corrected their internal control problem (n=38). Differences in means (medians) are assessed using a t-test (one-sample median test).

40

Table 7 No-Remediation of Internal Control Weakness and the Cost of Capital

Panel A: Descriptive Statistics on Cost of Capital Pre and Post-404 Disclosure for Firms that Disclosed a ICD under 302 and Received a ICD 404 Opinion (n=119)

Mean Median Q1 Q3 Std Dev Pre-404 CC 16.011 15.250 11.500 18.000 7.530 Post-404 CC 15.963 14.500 11.000 18.750 7.863 Pre-404 Market Adjusted CC 4.204 3.375 -0.292 5.833 7.520 Post-404 Market Adjusted CC 4.042 2.700 -0.875 6.750 7.878

Panel B: Firm Specific Change in the Market Adjusted Cost of Capital (Post-404 CC minus Pre-404 CC)

Mean Change in the Cost of Capital

Median Change in the Cost of Capital

Firms Previously Disclosing a ICD and Receiving a Clean 404 Opinion (n=119) -0.161 -0.375 p-value 0.37 0.36

Pre and Post Cost of Capital are calculated using a maximum of 180 days before and after the 404 report. Sample consist of all firms disclosing internal control problems under section 302 and receiving adverse 404 opinions having Value Line cost of capital estimates in both the pre and post periods (n=119). Differences in means (medians) are assessed using a t-test (one-sample median test).

41

Table 8 Cost of Capital Change Pre-Post Fiscal 2004 10-K

For Firms Receiving Unqualified 404 Opinions with No Prior Internal Control Weakness Disclosure

Panel A: Firm Specific Change in the Cost of Capital Post minus Pre 404 Opinions Disclosure

Mean Median Q1 Q3 Std Dev Post 404 CC 13.816 12.500 9.000 17.500 7.512 Pre 404 CC 13.612 12.000 9.000 16.250 6.628 Post Period Market Adjusted CC 1.622 0.333 -3.333 5.250 7.514 Pre Period Market Adjusted CC 1.612 0.167 -2.833 4.417 6.633

Panel B: Firm Specific Change in the Market Adjusted Cost of Capital (Post 404 Disclosure minus Pre 404 Disclosure)

Mean Change in the Cost of Capital

Median Change in the Cost of Capital

Full Sample (n=685) 0.010 0.250 p-value 0.48 0.11 Least Likely Group (lower 30%) n=205 0.040 0.250 p-value 0.45 0.18 Very Likely Group (lower 30%) n=205 -0.768 -0.250 p-value 0.01 0.26

Differences in means (medians) are assessed using a t-test (one-sample median test).

42

Table 9 Analysis Controlling for ICD Determinants Panel A: Idiosyncratic and Market Risk OLS Regressions Controlling for ICD Determinants

εββββ

βββββββ

βββββββ

++++

+++++++

+++++++=

TRESTATEMENRESIGNAUDITORRZSCORELOSS

INVENTORYRGROWTHERESTRUCTURAMSALESFOREIGNSEGMENTSDIVPAYER

SIZEBMCFOLEVCFOSTDICDRISK

17

161514

13121110

987

6543210

_%&

__

Risk Measure Predicted

Sign I_RISK

BETA INTERCEPT 5.962*** 0.898*** ICD + 0.104** 0.078** STD_CFO + 1.052*** 0.584*** LEV + -0.425*** -0.783*** CFO - -0.825*** -0.218** BM ? -0.593*** -0.085* SIZE - -0.445*** 0.076*** DIVPAYER - -0.280*** -0.461*** SEGMENTS -0.014 -0.076*** FOREIGN_SALES 0.020 0.124*** M&A 0.083* 0.166*** RESTRUCTURE -0.007 0.240*** RGROWTH 0.000 -0.012* INVENTORY 0.410** -0.280** %LOSS 0.790*** 1.018*** RZSCORE -0.069*** -0.029*** AUDITOR_RESIGN 0.730*** 0.163 RESTATEMENT -0.072 0.040

Adjusted R2 0.60 0.39 n 2,965 2,965

43

Table 9 Continued Panel B: Cost of Capital OLS Regression Controlling for ICD Determinants

εβββββ

βββββββββββ

++++++++++++++++=

TRESTATEMENRESIGNAUDITORRZSCORELOSSINVENTORY

RGROWTHERESTRUCTURAMSALESFOREIGNSEGMENTSRISKIBMSIZEBETAICDCC

15

14131211

10987

6543210

_%&_

_

Predicted

Sign 2004 INTERCEPT 5.592*** ICD + 0.542* BETA + 0.657*** SIZE - 0.172 BM + 3.720*** I_RISK + 2.276*** SEGMENTS -0.021 FOREIGN_SALES -0.946** M&A -0.641** RESTRUCTURE 0.046 RGROWTH 0.218*** INVENTORY 1.173 %LOSS 2.596*** RZSCORE -0.175** AUDITOR_RESIGN 0.337 RESTATEMENT -0.131 Adjusted R2 0.32 n 1,027

***, **, *, indicates significance at the 0.01, 0.05, 0.10 levels. See Appendix 1 and 2 for variable definitions.

44

References

Ashbaugh-Skaife, H., D. Collins and W. Kinney. 2005. “The Discovery and Consequences of Internal Control Deficiencies Prior to SOX-Mandated Audits,” Working paper. University of Iowa. September. Ashbaugh-Skaife, H., D. Collins and W. Kinney.2006. “The Discovery and Reporting of Internal Control Deficiencies Prior to SOX-Mandated Audits,” Working paper. University of Iowa. February. Ashbaugh-Skaife, H., D. Collins and R. LaFond. 2006. “Corporate Governance, Risk and Cost of Equity Capital,” Working paper. University of Wisconsin. Berger, P., F. Li and F. Wong. 2005. “The Impact of Sarbanes-Oxley on Cross-Listed Companies,” Working paper, University of Chicago. Bhattacharya, U., H. Daouk, and M. Welker. 2003. “The World Price of Earnings Opacity,” The Accounting Review 78: 641-678. Botosan, C. M. Plumlee, and Y. Xie. 2004. “The Role of Information Precision in Determining Cost-of-Equity Capital.” Review of Accounting Studies 9: 197-228. Diamond, D., R. Verrecchia. 1991. “Disclosure, Liquity, and the Cost of Capital.” Journal of Finance XX: 1325-1360. Donaldson, W. 2005. Testimony Conceerning the Impact of the Sarbanes-Oxley Act. House Committee on Financial Services. U.S. House of Representatives: Washington D.C. Doyle, J., W. Ge and S. McVay. 2005. “Determinants of Weaknesses in Internal Control over Financial Reporting and the Implications for Earnings Quality,” working paper, New York University. Easley, D., S. Hvidkar, and M. O’Hara.2002. “Is Information Risk a Determinant of Asset Returns?” Journal of Finance 57: 2185-2221. Easley, D., and M. O’Hara. 2004. Information and the Cost of Capital. Journal of Finance 59: 1553-1583. Foreign Corrupt Practices Act of 1977 (FCPA). 1977. Public Law No. 95-213. Washington, D.C.: Government Printing Office. Francis, J., R. LaFond, P. Olsson, and K. Schipper. 2004a. Costs of Equity and Earnings Attributes. The Accounting Review 79: 967-1010.

45

Klein, E. 2003. 11 Internal Control disclosures in November 2003. Compliance Week. (December 16). Lambert, R., C. Leuz and R. Verrecchia. 2005. “Accounting Information, Disclosure, and Cost of Capital,” Working paper. Wharton School, University of Pennsylvania. September. Merton, R.C., 1987. “A Simple Model of Capital Market Equilibrium with Incomplete Information”. The Journal of Finance 42, no. 3, 483-510. Public Company Accounting Oversight Board (PCAOB). 2004. Auditing Standard (AS) No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with An Audit of Financial Statements. PCAOB. March 9. Ogneva, M., K. Raghunandan and K.R. Subramanyam, 2005. “Internal Control Weakness and Cost of Equity: Evidence from SOX Section 404 Certifications.” Working Paper, University of Southern California. Rajgopal, S. and M. Venkatachalam. 2005. “Information Risk and Idiosyncratic Return Volatility Over the Last Four Decades.” Working Paper, Duke University. U.S. House of Representatives. 2005. The Impact of the Sarbanes_Oxley Act. Hearing before the Committee on Financial Services (April 21). Washington, D.C.: Government Printing Office. Securities and Exchange Commission (SEC). 2002. Certification of disclosure in companies’ quarterly and annual reports. Release Nos. 33-8124, 34-46427. Washington D.C.: SEC August 29. _____. 2004. Management’s reports on internal control over financial reporting and certification of disclosure in Exchange Act periodic reports – Frequently Asked Questions. Washington D.C.: SEC June 23. U.S. Senate. 2002. Oversight Hearing on “Accounting and Investor Protection Issues Raised by Enron and Other Public Companies. Hearings before the Committee on Banking, Housing, and Urban Affairs. S. 107-948. February 12, 14, 26, 27. Washington D.C.: Government Printing Office. U.S. Senate. 2004. Examining the Impact of the Sarbanes-Oxley Act and Developments Concerning International Commerce. Hearings before the Committee on Banking, Housing, and Urban Affairs. S. 108-850. September 9. Washington D. C.: Government Printing Office. Verdi, R. 2005. “Information Environment and the Cost of Equity Capital.” Working Paper, the Wharton School, University of Pennsylvania.

46

Veronesi, P., 2000. “How Does Information Quality Affect Stock Returns?” The Journal of Finance,Vol. 55, 807-837. Vuolteenaho, T., 2002, “What drives firm-level stock returns?,“, The Journal of Finance,Vol. 57, 233-265. Yee, K. 2005. “Earnings Quality and the Equity Risk Premium: A Benchmark Model.” Forthcoming, Contemporary Accounting Research. Zhang, X. F., 2004. “Information Uncertainty and Stock Returns.” Working Paper, University of Chicago.

47