The Impact of Enterprise Resource Planning 1

8/2/2019 The Impact of Enterprise Resource Planning 1

1/30

The Impact of Enterprise Resource Planning

(ERP) Systems on the Effectiveness of

Internal Controls over Financial Reporting

John J. Morris

Kansas State University

ABSTRACT: Software vendors that market enterprise resource planning ERP sys-

tems have taken advantage of the increased focus on internal controls that grew out of

the Sarbanes-Oxley SOX legislation by emphasizing that a key feature of ERP sys-

tems is the use of built-in controls that mirror a firms infrastructure. They argue that

these built-in controls and other features will help firms improve their internal control

over financial reporting as required by SOX. This study tests that assertion by examin-

ing SOX Section 404 compliance data for a sample of firms that implemented ERP

systems between 1994 and 2003. The results suggest that ERP-implementing firms are

less likely to report internal control weaknesses ICW than a matched control sample

of non-ERP-implementing firms. It also finds that this difference exists for both general

entity-wide, and individual account-level controls.

Keywords: enterprise resource planning; ERP; Sarbanes-Oxley; SOX; Section 404;

internal control.

Data Availability: The author will make available the list of firms used in the study. Allother data are available from public sources.

I. INTRODUCTION

The Sarbanes-Oxley Act of 2002 SOX requires companies to report on the effectiveness of

their internal controls over financial reporting as part of an overall effort to reduce fraud

and restore integrity to the financial reporting process. Software vendors that market en-

terprise resource planning ERP systems have taken advantage of this new focus on internal

controls by emphasizing that a key feature of ERP systems is the use of built-in controls that

mirror a firms infrastructure. They emphasize these features in their marketing literature, asserting

I thank the JIS editor, Paul John Steinbart, the anonymous associate editor, and two anonymous reviewers for theircomments and suggestions that have strengthened this paper. I also thank participants at the 2009 Midyear Meeting of theAAA-IS Section, a Kansas State University Faculty Research Seminar, and members of my dissertation committee at KentState University for comments and suggestions on earlier versions of this paper.

JOURNAL OF INFORMATION SYSTEMS American Accounting AssociationVol. 25, No. 1 DOI: 10.2308/jis.2011.25.1.129Spring 2011pp. 129157

Published Online: March 2011

129


2/30

that these systems will help firms improve the effectiveness of their internal controls as required

by SOX.1

These vendor statements motivate an interesting empirical research question about the impact

of ERP systems on internal control. Specifically, are firms that implement ERP systems more or

less likely to report internal control weaknesses in their annual reports than firms that do not?Relatively little empirical/archival research has been conducted in this specific area, because prior

to SOX, internal control data did not have to be publicly reported. This study addresses that gap

in the literature by examining internal control data that is now available for a sample of firms that

have announced implementation of ERP systems and a control sample of similar firms that have

not.

Internal control is one of many mechanisms used in business to address the agency problem.

Others include financial reporting, budgeting, audit committees, and external audits Jensen and

Payne 2003. Studies have shown that internal control reduces agency costs Abdel-khalik 1993;

Barefield et al. 1993, with some even arguing that firms have an economic incentive to report on

internal control, even without the requirements of SOX Deumes and Knechel 2008. Their argu-

ment assumes that providing this additional information to the principal shareholder about the

behavior of the agent management reduces information asymmetry and lowers investor risk and,

therefore, the cost of equity capital. Other research has found that weaknesses in internal controls

are associated with increased levels of earnings management Chan et al. 2008; Ashbaugh-Skaife

et al. 2008. Earnings management is the agency problem that motivated SOX legislation in the

first place, specifically earnings manipulation by Enron, WorldCom, etc. ERP systems provide a

mechanism to deliver fast, accurate financial reporting with built-in controls that are designed to

ensure the accuracy and reliability of the financial information being reported to shareholders.

In addition to the increased assurances provided to the external principals shareholders

about the behavior of the agents management, ERP systems should also help mitigate the agency

problem between various levels of management in large corporations. The added transparency

combined with the use of built-in controls should make it more difficult for agents at all levels to

benefit from unobservable behavior. It is possible, however, that firms implementing ERP systems

may not take advantage of all the built-in control features, either for legitimate business reasons or

because management wants to avoid the added transparency in order to manage manipulateearnings. By examining the effectiveness of these controls, this study not only extends the agency

theory stream of research, it also examines this tension between earnings management and internal

control with testable hypotheses related to overall internal controls, general entity-wide controls,

and specific account-level controls.

The study uses a sample of 108 firms that announced implementation of ERP systems be-

tween 1994 and 2003, and an equal number of control firms, matched by industry and size. The

results provide evidence that ERP-implementing firms are less likely to report internal control

weaknesses ICW than the non-ERP control firms. This study further examines factors contrib-

uting to ICW and finds that those related to general entity-wide controls and specific account-

1SAP AG, the largest provider of ERP software in the world Eschinger 2006, states the following in one of its

brochures: Embedded system controls within mySAP ERP financials include edit checks and tolerances for documentaccuracy, required and system-populated fields for document completeness, and checks to prevent duplication of ac-counting postings mySAP ERP Financials can help you reduce risk related to compliance with the U.S. Sarbanes-Oxley Act SAP 2005. Also, Oracle Corporation, the worlds second-largest provider of ERP software Brunelli 2006,in one of its brochures, states the following: Each application in the Oracle Financials product family uses embeddedcontrols to automate process flows and enforce compliance across the organization, such as cross-validation rules formaster data, 2-, 3-, and 4-way purchase-order matching, sequential numbering, and the ability to centrally set quantityand price-tolerance limits during invoice processing. This automated approach reduces risk by enforcing business rulesand simplifies auditing activities by making it easier to test controls Oracle 2005.

130 Morris

Journal of Information Systems Spring 2011AmericanAccountingAssociation
http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


3/30

level controls are both less likely to contribute to ICW in ERP firms than in non-ERP control

firms. This study also finds evidence that the advantage for ERP firms strengthened over time,

which suggests that firms may be implementing more of the built-in controls provided by ERP

systems as they gain experience with the system.

These findings are important because both SOX and ERP have been the subject of muchdiscussion and research in the academic and professional communities in recent years. Cost is

often the common denominator, with the high cost of SOX compliance and the high cost of

implementing ERP systems used as the basis for many research questions. These findings provide

evidence that ERP systems may contribute to improved internal controls, which is one of many

arguments used in justifying the high cost of ERP systems. This study is believed to be the first

empirical/archival test of those claims, and provides information about the factors that contribute

to internal control weaknesses ICW that both the academic and professional communities should

find interesting. For instance, the most often cited factor is accounting documentation, policy,

and/or procedures. As expected, this factor is found less frequently for ERP firms than for the

control firms, perhaps justifying the effort needed to document systems during the implementation

process. This study also extends the research stream on the relationship between IT and agency

theory, in particular the link between the signaling effect of internal control reporting to the

financial markets and the use of ERP systems to facilitate that process.

The remainder of this paper is organized as follows: Section II summarizes prior research and

develops the hypotheses, Section III describes the data selection process and the research meth-

odology, Section IV presents empirical results, and Section V concludes.

II. PRIOR RESEARCH AND HYPOTHESES DEVELOPMENT

Internal Control Background

Internal control has played a major role in moderating the agency problem in corporations for

many years. Samson et al. 2006 document several internal control procedures used by the

Baltimore and Ohio Railroad as early as 1831. In more recent times, internal control has been a

subject of discussion whenever there is a prominent scandal in the corporate world. For instance,

during the 1970s more than 400 corporations admitted making questionable or illegal payments to

foreign government officials, politicians, and political parties, which led to enactment of theForeign Corrupt Practices Act FCPA of 1977 Staggers 1977. Among other things, the FCPA

requires publicly traded companies to devise and maintain a system of internal accounting controls

USC 1998.

During the 1980s, several high-profile audit failures led to creation of the Committee of

Sponsoring Organizations of the Treadway Commission COSO, organized for the purpose of

redefining internal control and the criteria for determining the effectiveness of an internal control

system Simmons 1997. They studied the causal factors that can lead to fraudulent financial

reporting and developed recommendations for public companies, independent auditors, educa-

tional institutions, the SEC, and other regulators COSO 1985. The product of their work is

known as the COSO Internal ControlIntegrated Framework Simmons 1997. The COSO frame-

work broadly defines internal control as a process, effected by an entitys board of directors,

management and other personnel, designed to provide reasonable assurance regarding the achieve-

ment of objectives in the following categories: effectiveness and efficiency of operations, reliabil-ity of financial reporting, and compliance with applicable laws and regulations COSO 1992, 1.

It states that there is synergy and linkage among these components, forming an integrated system

that reacts dynamically to changing conditions COSO 1992, 1. The framework also points out

that controls are most effective when they are built into the entitys infrastructure COSO 1992,

1 and further states that built in controls support quality and empowerment initiatives, avoid

unnecessary costs and enable quick response to changing conditions COSO 1992, 1.

The Impact of Enterprise Resource Planning (ERP) Systems 131

http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


4/30

At the turn of the century, another group of corporate scandals resulted in enactment of the

Sarbanes-Oxley Act of 2002 SOX which, among other things, requires a formal report on the

effectiveness of internal controls. The COSO framework plays a key role in compliance because

Section 404 of the Act requires companies to include in their annual report Form 10-K, a

separate management report on the companys internal control over financial reporting and anattestation report issued by a registered public accounting firm.

2Although other frameworks may

be accepted, the SEC has specifically stated that the COSO Framework satisfies SEC criteria and

may be used as an evaluation framework for purposes of managements annual internal control

evaluation and disclosure requirement by companies listed on U.S. stock exchanges Gupta and

Thomson 2006, 28.

Prior Internal Control Research

Although internal controls have played a major role in corporate governance for many years,

empirical/archival research on internal controls was limited prior to SOX, mostly due to a lack of

public data. Internal control was considered an internal issue and public companies were not

required to disclose information about their internal control procedures.3

Following enactment of

SOX, internal control-related empirical/archival research has significantly increased. The addedreporting requirements of Sections 302 and 404 have placed information in the public domain that

researchers are using to examine numerous issues related to internal control and corporate gover-

nance. Section 302, which became effective in 2002, provided initial data that were used to test the

relationship between internal control weaknesses and other firm characteristics Ge and McVay

2005; Ashbaugh-Skaife et al. 2007; Doyle et al. 2007.4

Section 404, which requires a much more

extensive review of internal controls, became effective in 2004 under a two- phase schedule. In the

first phase, compliance is required for companies known as accelerated filers5

in annual reports for

fiscal years ending on or after November 15, 2004 SEC 2003. The second phase, which includes

compliance for all other companies, has been extended several times and is now effective for fiscal

years ending on or after December 15, 2007, for the management report and June 15, 2010, for the

auditor attestation report SEC 2009.6

Although the exact form and language of the management

report on internal controls may vary from one firm to another, the report must disclose if there are

any material weaknesses in the internal controls over financial reporting. Therefore, it is nowpossible to measure the effectiveness of internal controls by analyzing the material weaknesses

disclosed in these reports. Section 404 has been used by researchers to examine such issues as the

increased cost of audits Raghunandan and Rama 2006, delays in audits Ettredge et al. 2006,

2The internal control report requires specific language including: 1 a statement of managements assessment of theeffectiveness of the companys internal control over financial reporting, 2 a statement identifying the framework usedby management to evaluate the effectiveness, and 3 a statement that the registered public accounting firm that auditedthe companys financial statements included in the annual report has issued an attestation report on managementsassessment of the companys internal control over financial reporting SEC 2003.

3 The only exception was the required disclosure in Form 8-K of any internal control problems pointed out by predecessorauditors when companies changed auditors. Some researchers have used this source of data to examine the relationshipbetween internal controls and other corporate governance measures. For instance, Krishnan 2005 uses these disclo-sures as a data source to compare internal control quality to audit committee quality.

4 Section 302 requires the CEO and CFO to certify that their financial statements present fairly, in all material respects,the financial condition of their company, and that they have evaluated the effectiveness of their internal controls anddisclosed any material weakness and any significant changes in internal control procedures Ge and McVay 2005.

5Accelerated filers are firms that have at least $75 million in market capitalization, have been subject to SEC reportingrequirements for at least 12 calendar months, that previously have filed at least one annual report, and that are noteligible to file its quarterly and annual reports on Form 10-QSB and 10-KSB. Also excluded are mutual funds andforeign firms that file Form 20-F.

6 The AICPA reports that language was added to the Investor Protection Act of 2010, which was recently signed by thePresident, that would permanently exempt these nonaccelerated filers from the attestation report AICPA 2010.

132 Morris

http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


5/30

percent of filers reporting deficiencies Grant et al. 2008, the relationship between internal control

weaknesses ICW and the cost of equity Ogneva et al. 2007; Ashbaugh-Skaife et al. 2009, and

the relationship between ICW and earnings management Ashbaugh-Skaife et al. 2008; Chan et al.

2008.

Although internal control-related empirical/archival research is relatively new, there is a con-siderable body of prior literature related to corporate governance, most of it using an agency

theory foundation Brennan and Soloman 2008. Eisenhardt 1989 provides the theoretical basis

for the use of monitoring mechanisms such as financial reporting and audits to provide information

to the principal about the behavior of the agent.7

ERP systems facilitate this monitoring process in

two ways. First, they enable fast, accurate reporting of financial information to the principal, but

more importantly, they include features that facilitate implementation and enforcement of internal

controls that are used to ensure the accuracy of financial information being reported. One would

expect firms that implement ERP systems to maximize use of these built-in control features to not

only reduce agency costs, but to minimize the number of internal control weaknesses reported

under SOX Section 404.

These built-in controls are made possible in part because the systems are designed around the

concept of a single, integrated system that captures data in a common database for use throughout

the company. By contrast, most legacy systems, which evolved around the needs of individual

functional areas, have information spread across dozens or even hundreds of separate computer

systems Davenport 1998. Although legacy systems may include some built-in controls, one

would not expect these controls to be as effective as those that are designed into an integrated ERP

system. For instance, a typical ERP system will include built-in controls for matching purchase

orders, receiving documents, and invoices three-way match, taking advantage of the integrated

nature of all three functional areas. Legacy systems, on the other hand, may have different appli-

cations for purchasing, receiving, and accounts payable that have some built-in control features,

but do not communicate with each other. Consequently, manual controls would have to be used to

supplement the built-in controls and physically, rather than electronically, match the documents

prior to authorizing payment.

Auditing Standard No. 5 AS No. 5, issued by the Public Company Accounting Oversight

Board PCAOB, provides some insight into the perceived relationship between information tech-nology and internal controls. For instance, in Appendix B of AS No. 5, it states that entirely

automated application controls are generally not subject to breakdowns due to human failure. This

feature allows the auditor to use a benchmarking strategy benchmarking automated applica-

tion controls can be especially effective for companies using purchased software when the possi-

bility of program changes is remotee.g., when the vendor does not allow access or modification

to the source code PCAOB 2007, B28, B32. Since ERP systems are purchased software, in

contrast to legacy systems, which are developed and maintained internally, company employees

would most likely have access to the source code for legacy systems, but not for ERP systems.

Given all of these factors, one would expect ERP systems to have a positive impact on the

effectiveness of internal controls over financial reporting.

However, a counter argument could be made that just because companies implement ERP

systems, they may not take advantage of all the built-in control features. It is possible, for instance,

that during implementation, some of the control features might not be activated. Or, in a moresinister view, senior management may opt to override control features in order to manipulate data

to manage earnings. This argument would be more consistent with Brazel and Dang 2008, who

7Eisenhardts 1989 second proposition states that when the principal has information to verify agent behavior, theagent is more likely to behave in the interest of the principal.


http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


6/30

argue that increased control by senior management over financial data in a centralized ERP system

will lead to an increase in earnings management. In support of their argument, they cite prior

research that finds reductions in audit and internal control quality following ERP adoption

Bagranoff and Vendrzk 2000; Wright and Wright 2002; Hunton et al. 2004; Janvrin et al. 2004;

Brazel and Agoglia 2007. But Brazel and Dang 2008 also point out that most of this research,including theirs, relates to implementations that took place during the early years of ERP adoption,

prior to Sarbanes-Oxley, and argue that it is possible that these safeguards have since improved.

Indeed, the increased emphasis on internal controls following SOX makes it likely that firms that

adopted ERP systems early in the cycle have since taken advantage of the built-in features to

improve their internal controls, which leads to the following hypothesis stated in the alternate

form:

H1: Firms that have implemented ERP systems will be less likely to report material weak-

nesses in their internal controls than nonimplementers.

Looking only at total ICW may mask possible differences in subsets of controls. For instance,

it is possible that even if H1 is supported from an overall internal control perspective, the coun-

terintuitive behavior described above could still be taking place. If so, it may be uncovered by

segregating the internal controls into those that are general entity-wide controls from those that

are specific account-level controls. If management was overriding control features in order to

manage earnings, then one would expect to find more ICW related to general controls, even if the

specific account-level controls are effective. This type of behavior should be uncovered during

the audit process since this is an area of concern specifically identified in AS No. 5, Paragraph 24,

which states that entity-level controls include controls over management override. On the

other hand, a stronger argument could be made that if general controls are in place and working,

then one would expect to find less ICW related to general controls. This would be more consistent

with Chan et al. 2008, who find an association between internal control weaknesses and positive

absolute discretionary accruals, and Ashbaugh-Skaife et al. 2008, who find that firms reporting

internal control deficiencies have lower quality accruals. This leads to the following hypothesis

stated in the alternate form:

H2: Firms that have implemented ERP systems will be less likely to report material weak-nesses related to general entity-wide internal controls than nonimplementers.

Another explanation could be that firms have just not taken full advantage of the built-in

controls that are available. For instance, if the firms had opted not to activate certain control

features during implementation, then one might expect to find more ICW related to specific

account-level controls, even if the general entity-wide controls are effective. However, if the

controls are in place and implemented, then one would expect to see less ICW in these types of

controls. Although a case could be made for either side of this argument given the pressures of

SOX, it is more likely that firms will take advantage of these built-in controls, which leads to the

following hypothesis stated in the alternate form:

H3: Firms that have implemented ERP systems will be less likely to report material weak-

nesses related to specific account-level internal controls than nonimplementers.

III. DATA SELECTION AND RESEARCH METHODOLOGY

Sample Data Selection

An empirical/archival methodology is used to test these hypotheses by examining manage-

ment reports on the effectiveness of internal controls over financial reporting, included in Form

10-K annual reports, compiled by Audit Analytics. The sample data are based on 108 ERP-

134 Morris

http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


7/30

implementing firms from 27 industry groups that announced implementation of ERP systems

between 1994 and 2003. Panel A of Table 1 provides a summary of the sample selection process

for these ERP-implementing firms. The process starts with the list of 91 ERP announcements

made between 1994 and 1998 from Hayes et al. 2001,8

from which 36 firms were eliminated

because they are no longer listed or data were otherwise not available. The second step in theprocess involves a search of all available newswire services using the LexisNexis service for years

after 1998, searching on key phrases such as: ERP, Enterprise Resource Planning, and En-

terprise Systems. This search found an additional 92 firm announcements yielding a total of 147

firms. This study examines the first five years that SOX 404 reporting was required, 20042008.

Not all firms were required to file in all years for a number of reasons, including the fact that the

effective date was for years beginning after November 15, 2004; therefore, only firms with No-

vember and December year-ends would be included for 2004. Also, some of the sample firms were

not classified as accelerated filers due to market capitalization levels and/or filing status. Elimi-

nating these observations leaves 108 firms and 377 firm-year observations for which SOX 404

reporting data are available in the Audit Analytics database.

Following the recommendations ofBarber and Lyon 1997 and the method used by Nicolaou

2004, this study uses a matched pairs approach to select a control group. ERP-implementing

firms are first matched with other firms based on SIC code, then by total assets at the beginning of

the implementation year, then by the availability of Compustat accounting data and Audit Analyt-

ics SOX 404 reporting data. Once a match is identified, a further search of LexisNexis Newswires

is conducted for all available years using a combination of the firm name and several terms related

to ERP systems.9

If no newswire records are found, the firm is used as a match for this study. If

a record is found that indicates an ERP system may be in use, then the next closest firm in terms

of total assets is used, and the process repeated.10

Panel B of Table 1 provides a breakdown of the 108 ERP firms by two-digit SIC code and

implementation year. The sample is heavily concentrated around manufacturing firms that an-

nounced ERP system implementation from 19972000, consistent with the period of time that

firms were concerned about Y2K compliance.

Probit Regression ModelThis study uses a probit regression model adopted from Ogneva et al. 2007 with the number

of internal control weakness ICW as the dependent variable, and an indicator variable for ERP

implementers as the primary variable of interest. It includes control variables that prior research

indicates are associated with ICW Ge and McVay 2005; Ashbaugh-Skaife et al. 2008; Doyle et al.

2007 plus one control variable specific to ERP systems. The resulting model is as follows:

ProbCOUNT_WEAKit = f+ 1ERPit+ 2FOREIGNit+ 3M&A it+ 4RESTRit

+ 5LOSSit+ 6BIG4it+ 7LOGSEGit+ 8SALEGRWit

+ 9INVTATit+ 10LOGMKTVit+ 11ZSCOREit+ 12LOGAGEit

+ 13LOGERPAGEit 1

8I would like to thank David C. Hayes and Jacqueline L. Reck for providing this list of firms.

9Terms include: 1 ERP, 2 Enterprise Resource Planning, 3 Enterprise Systems, 4 SAP, 5 Oracle, 6 QAD, 7Baan, 8 Peoplesoft, 9 JD Edwards, and 10 Lawson. The specific vendors listed 410 represent the seven mostcommon ERP systems identified in Nicolaou 2004.

10If the record is an announcement, then the firm is added to the ERP sample set; however, if the document only impliesthat an ERP system is in use, it is rejected as a match, but not added to the ERP sample.


http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


8/30

TABLE 1

Summary of Sample Selection Process

Panel A: Sample Selection ProcessInitial ERP announcements from Hayes et al. 2001

Less firms no longer listed or data otherwise not available

Remaining firms from Hayes et al. 2001

Additional ERP announcements collected from Lexis-Nexis search

Total firms with ERP implementation announcements

Firms not required to file Section 404 or Section 404 data not available

Total firms announcing ERP implementations used in study

Panel B: Distribution ofERP Firms by Two-Digit SIC Code and Implementation Year

Two-Digit SIC Codes 94 95 96 97 98 99 00 01

13-Oil and Gas Extraction 1 2 2

20-Mfg: Food and Kindred Products 1 1 2 1

23-Mfg: Apparel 1 1 1

24-Mfg: Lumber and Wood Products 1

25-Mfg: Furniture and Fixtures 1 2 1

26-Mfg: Paper and Allied Products 1 1 1 1

27-Mfg: Printing and Publishing 1 1 1

28-Mfg: Chemicals 1 1 2 1 2 2

29-Mfg: Petroleum Refining 1

33-Mfg: Primary Metal Industries 1 1

34-Mfg: Fabricated Metal Products 1 1

35-Mfg: Ind. and Com. Machinery 1 4 7 2 4

36-Mfg: Electronic and Elect. Equip. 1 2 5 2 2

37-Mfg: Transportation Equipment 1

38-Mfg: Measuring and Control Instr. 1 2 1 1 1

39-Mfg: Misc. Manufacturing 1

42-Motor Freight Transportation 1

45-Transportation by Air 2

JournalofInformationSystems

Spring2011

AmericanAccountingAssociation
http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


9/30

Panel B: Distribution ofERP Firms by Two-Digit SIC Code and Implementation Year

Two-Digit SIC Codes 94 95 96 97 98 99 00 01

48-Communications 1 1

50-Wholesale: Durable Goods 2

51-Wholesale: Non-Durable Goods 1

52-Retail: Bldg Materials, Hardware 1

54-Retail: Food Stores 1

59-Retail: Miscellaneous 1 2 1

67-Holding and Other Investment 1

73-Automotive Repair and Service 1 2 3

87-Engineering, Actg., R&D, Mgt

Totals 1 5 4 13 25 28 12 10

Journalof

InformationSystems

Spring2011



10/30

where:

COUNT_WEAK number of ICW reported;

ERP indicator variable equal to 1 for firms that have implemented ERP systems,

else 0;FOREIGN indicator variable equal to 1 if the firm has a nonzero foreign currency

translation Compustat mnemonic FCA-Foreign Exchange Income

Loss, else 0;

M&A indicator variable equal to 1 if acquisitions reported on the Statement of

Cash Flows Compustat mnemonic AQC-Acquisitions, else 0;

RESTR indicator variable equal to 1 if at least one of the following Compustat

mnemonics is not equal to zero: RCP-Restructuring Costs Pretax,

RCA-Restructuring Costs After-Tax, RCEPS-Restructuring Costs Basic EPS

Effect, RCD-Restructuring Costs Diluted EPS Effect, else 0;

LOSS indicator variable equal to 1 if earnings before extraordinary items

Compustat mnemonic IB-Income Before Extraordinary Items are less than

0, else 0;BIG4 indicator variable equal to 1 if the firms auditor is one of the Big 4 firms,

else 0;

LOGSEG natural log of number of business segments computed from Compustat

mnemonic SNAME-Segment Name in the Segment database;

SALEGRW percentage change in sales Compustat mnemonic SALE-Net Sales;11

INVTAT ratio of inventory over total assets Compustat mnemonic INVT-Inventories

Total/AT Assets-Total;

LOGMKTV natural log of market value of equity Compustat mnemonic MKVAL-Market

Value;

ZSCOREAltmans Z-score Computed from Compustat data;12

LOGAGE natural log of years the firm exists in the CRSP database;13

and

LOGERPAGE natural log of the number of years since the ERP system was implemented.14

The control variables from prior research that are hypothesized to be associated with ICW are

categorized as: 1 complexity of operations FOREIGN, LOGSEG; 2 organizational change

M&A, RESTR; 3 indicators of resource constraint LOSS, LOGMKTV; 4 accounting appli-

cations measurement risk SALEGRW, INVTAT; and 5 other factors including potential for

bankruptcy ZSCORE, age of the company LOGAGE, and size of the audit firm BIG4. One

additional control variable is added specific to ERP systems; LOGERPAGE is used to control for

11Ogneva et al. 2007 use an indicator variable if a firms sales growth is in the upper quintile of its industry, rather thanpercentage growth, which is the same approach used by Doyle et al. 2007, who report that their results are notsensitive to the use of percentage growth instead. The indicator method does not change the overall results of this studyeither, although it does not provide as strong of a model fit.

12 ZSCOREA 3.3 B 0.99 C 0.6 D 1.2 E 1.4; where A EBIT/Total Assets; B Net Sales/TotalAssets; C Market Value of Equity/Total Liabilities; D Working Capital/Total Assets; E Retained Earnings/TotalAssets. Ogneva et al. 2007 used a decreasing deciles rank rather than the actual Z-score, which also would not impactthe overall results of this study, only reduce the measure of model fit.

13If firm not found in CRSP database, then age was based on information from either Compustat or the companyswebsite.

14The implementation year is assumed to be the year before the announcement, the year of the announcement, or the yearafter the announcement, depending on whether the announcement is prospective or retrospective in nature and whetherit is made early or late in the year.

138 Morris

http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


11/30

the possibility that firms with ERP systems that have been in place longer are more likely to have

implemented more of the built-in internal control features.

IV. EMPIRICAL RESULTS

Univariate Analysis

Table 2 provides a summary of univariate statistics for the key dichotomous and continuous

variables used in this study, divided between the treatment firms ERP 1 and the control firms

ERP 0. The majority of firms that report material weaknesses in their internal controls only

report one weakness, although that weakness may be attributed to a number of factors identified in

the review process. Note, for instance, that the maximum number of reported weaknesses COUN-

T_WEAK is only six for control firms and eight for ERP firms, with mean values of only 0.212

and 0.148, and standard deviations of 0.650 and 0.664. Total assets for the ERP group are larger

on average than that of the control group 2.465 versus 1.536; t 2.696; however, the results are

not sensitive to this difference. Dropping 11 pairs with the largest absolute value differences in

total assets results in a sample that is not statistically different in size 1.446 versus 1.345; t

1.364 and does not change the overall conclusions of this study.

Table 3 is a correlation matrix of the variables used in the probit model. No significantmulticollinearity problems are indicated since all significant correlations p 0.05 among the

independent variables have r values less than 0.50, except for the Spearman correlation between

LOSS and ZSCORE 0.508. Additional diagnostic tests using variance inflation factors confirm no

significant multicollinearity in that all VIF values are below 2.0.

Table 4 summarizes the frequency of internal control weaknesses ICW reported by firms in

their 10-K annual reports for the years 20042008, extracted from the Audit Analytics database.

The first three columns report frequencies, and the next three, proportions of firms reporting no

ICW Weak 0 or at least one ICW Weak 1 for each year and in total for the five years. The

results shows that in total for all five years, 81 firm-years out of the 754 10.7 percent reported at

least one ICW, with 30 8 percent out of 377 ERP-implementing firm-years compared to 51 13.5

percent out of 377 of the control firm-years. The 5.5 percent proportional difference between ERP

implementers and control firms has a Z-statistic of 2.47, which indicates a significant difference at

the 0.01 level based on a one-tailed test.The results for individual years reflect significant differences between ERP implementers and

nonimplementers for 20062008, but no significant differences in 2004 or 2005. These numbers

compare to the following results for all filers reported by Audit Analytics during the first four years

that SOX Section 404 compliance was required: Year 1 16.9 percent; Year 2 10.3 percent;

Year 3 9.1 percent; and Year 4 7.0 percent15

Cheffers et al. 2008.

Probit Regression Analysis

Although the univariate results provide initial support for the first hypothesis H1 in that a

higher proportion of control firms reported internal control weaknesses than ERP-implementing

firms, other variables may be contributing to the differences. To control for this, a probit regres-

sion analysis is run using the model described in the prior section that includes control variables

that prior research has found to be associated with internal control weaknesses. The results are

presented in Table 5. The probit procedure models the probability that levels ofCOUNT_WEAKhave lower ordered values, which enables interpretation of parameter estimates based on the

likelihood that they are associated with lower levels of weaknesses. Positive estimates indicate that

15Audit Analytics defines Years 1 through 4 as November 15, 2004, through November 14, 2008, which corresponds to theeffective date of the SOX Section 404 reporting requirements.


http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


12/30

TABLE 2

Firm Characteristics (Univariate Statistics)

ERP 0 (n 377) ERP 1 (n 377)

MeanStd.Dev. Min Med Max Mean

Std.Dev. Min Med Max

Dichotomous

WEAK 0.135 0.342 0 0 1.000 0.079 0.271 0 0 1.000

SPE 0.135 0.342 0 0 1.000 0.079 0.271 0 0 1.000

GEN 0.129 0.337 0 0 1.000 0.077 0.267 0 0 1.000

FOREIGN 0.371 0.484 0 0 1.000 0.496 0.501 0 0 1.000

M&A 0.395 0.490 0 0 1.000 0.528 0.500 0 1.000 1.000

RESTR 0.387 0.488 0 0 1.000 0.562 0.497 0 1.000 1.000

LOSS 0.271 0.445 0 0 1.000 0.191 0.394 0 0 1.000

BIG4 0.923 0.267 0 1.000 1.000 0.905 0.294 0 1.000 1.000

Continuous

COUNT_WEAK 0.212 0.650 0 0 6.000 0.148 0.664 0 0 8.000

SPECIFIC 0.342 0.963 0 0 6.000 0.249 0.935 0 0 8.000GENERAL 0.469 1.473 0 0 11.000 0.297 1.236 0 0 11.000

LOGSEG 0.714 0.638 0 0.693 2.079 0.709 0.702 0 0.693 2.079

SALEGRW 0.115 0.208 0.671 0.089 1.484 0.130 0.333 1.000 0.100 4.295

INVTAT 0.141 0.126 0 0.115 0.830 0.132 0.107 0 0.108 0.544

LOGMKTV 6.998 1.777 1.394 6.942 11.805 7.565 1.872 1.895 7.625 12.080

ZSCORE 4.226 3.582 5.091 3.314 28.197 3.554 5.332 42.59 3.221 35.271

LOGAGE 3.243 0.642 1.609 3.178 4.812 3.323 0.646 1.386 3.367 4.997

LOGERPAGE 2.400 0.173 1.946 2.398 2.773 2.400 0.173 1.946 2.398 2.773

TOTAL_ASSETS 1.536 2.059 0.011 0.678 8.054 2.465 4.380 0.017 0.872 34.621

Variable Definitions:ERP 1 for firms that implemented ERP systems; 0 for control firms;

WEAK indicator variable equal to 1 for firms reporting an ICW, else 0;

SPE

indicator variable equal to 1 for firms reporting a contributing factor related to specific account-levelcontrols, else 0;

GEN indicator variable equal to 1 for firms reporting a contributing factor related to general controls,else 0;

FOREIGN indicator variable equal to 1 if the firm has a nonzero foreign currency translation Compustatmnemonic FCA, else 0;

M&A indicator variable equal to 1 if acquisitions reported on the Statement of Cash Flows Compustatmnemonic AQC, else 0;

RESTR indicator variable equal to 1 if at least one of the following is not equal to 0 Compustat mnemonicsRCP, RCA, RCEPS, RCD, else 0;

LOSS indicator variable equal to 1 if earnings before extraordinary items Compustat mnemonic IB areless than 0, else 0;

BIG4 indicator variable equal to 1 if the firms auditor is one of the Big 4 firms, else 0;COUNT_WEAK number of material weaknesses recorded in Audit Analytics for each firm-year;

SPECIFIC number of contributing factors related to specific account-level controls;GENERAL number of contributing factors related to general controls;LOGSEG natural log of number of business segments Compustat mnemonic SEGNUM;

SALEGRW

percentage change in sales Compustat mnemonic SALE;INVTAT ratio of inventory over total assets Compustat mnemonic INVT/AT;

LOGMKTV natural log of market value of equity Compustat mnemonic MKVAL/MKVALM;ZSCOREAltmans Z-score;LOGAGE natural log of years the firm exists in the CRSP database;

LOGERPAGE natural log of the number of years since the ERP system was implemented; andTOTAL_ASSETS total assets billions beginning of implementation year n 108 for each group.

140 Morris



13/30

TABLE 3

Correlation Matrix: Pearson above the Diagonal and Spearman Below

1 2 3 4 5 1 COUNT_WEAK 1.000 0.048 0.041 0.037 0.006

0.184 0.265 0.305 0.874

2 ERP 0.089 1.000 0.126 0.133 0.175

0.015 0.001 0.000 0.0001

3 FOREIGN 0.004 0.126 1.000 0.027 0.175

0.921 0 .001 0.455 0.0001

4 M&A 0.040 0.133 0.027 1.000 0.063

0.271 0.000 0.455 0.085

5 RESTR 0.012 0.175 0.175 0.063 1.000

0.733 0.0001 0.0001 0.085

6 LOSS 0.167 0.094 0.061 0.084 0.166

0.0001 0.010 0.096 0.021 0.0001

7 BIG4 0.048 0.033 0.021 0.066 0.058

0.187 0.364 0.567 0.069 0.111

8 LOGSEG 0.007 0.005 0.019 0.042 0.115

0.849 0.889 0.611 0.246 0.002

9 SALEGRW 0.031 0.012 0.007 0.112 0.252

0.395 0.738 0.845 0.002 0.0001

10 INVTAT 0.003 0.018 0.039 0.058 0.001

0.927 0.616 0.279 0.113 0.971

11 LOGMKTV 0.176 0.156 0.076 0.222 0.035

0.0001 0.0001 0.038 0.0001 0.340

12 ZSCORE 0.092 0.019 0.103 0.123 0.262

0.011 0.604 0.005 0.001 0.0001

13 LOGAGE 0.050 0.057 0.021 0.086 0.005

0.174 0.120 0.562 0.019 0.901

14 LOGERPAGE 0.042 0.000 0.031 0.073 0.031

0.247 1.000 0.393 0.044 0.390

Journalof

InformationSystems

Spring2011



14/30

8 9 10 11 12

1 COUNT_WEAK 0.027 0.004 0.040 0.165 0.098

0.458 0.909 0.279 0.0001 0.007

2 ERP 0.004 0.028 0.040 0.154 0.074

0.918 0.441 0.270

0.0001 0.043 3 FOREIGN 0.019 0.023 0.078 0.061 0.033

0.612 0.523 0.032 0.095 0.361

4 M&A 0.040 0.113 0.021 0.210 0.002

0.267 0.002 0.561 0.0001 0.950

5 RESTR 0.120 0.125 0.076 0.063 0.246

0.001 0.001 0.038 0.083 0.0001

6 LOSS 0.018 0.179 0.001 0.452 0.350

0.617 0.0001 0.989 0.0001 0.0001

7 BIG4 0.036 0.074 0.105 0.339 0.048

0.318 0.042 0.004 0.0001 0.186

8 LOGSEG 1.000 0.029 0.025 0.041 0.099

0.433 0.497 0.265 0.006

9 SALEGRW 0.037 1.000 0.076 0.148 0.115

0.309 0.037

0.0001 0.002 10 INVTAT 0.114 0.084 1.000 0.254 0.005

0.002 0.022 0.0001 0.896

11 LOGMKTV 0.056 0.259 0.218 1.000 0.220

0.125 0.0001 0.0001 0.0001

12 ZSCORE 0.076 0.260 0.107 0.294 1.000

0.038 0.0001 0.003 0.0001

13 LOGAGE 0.198 0.073 0.044 0.217 0.018

0.0001 0.046 0.228 0.0001 0.630

14 LOGERPAGE 0.073 0.015 0.105 0.032 0.085

0.045 0.686 0.004 0.387 0.019

Variable Definitions:COUNT_WEAK number of internal control weaknesses reported;

ERP indicator variable equal to 1 for firms that have implemented ERP systems, else 0;FOREIGN indicator variable equal to 1 if the firm has a nonzero foreign currency translation Compustat mnemonic FCA, else 0;

M&A indicator variable equal to 1 if acquisitions reported on the Statement of Cash Flows Compustat mnemonic AQC), else 0


Spring2011



15/30

RESTR indicator variable equal to 1 if at least one of the following is not equal to 0 Compustat mnemonics RCP, RCA, RCEPSLOSS indicator variable equal to 1 if earnings before extraordinary items Compustat mnemonic IB are less than 0, else 0;BIG4 indicator variable equal to 1 if the firms auditor is one of the Big 4 firms, else 0;

LOGSEG natural log of number of business segments Compustat mnemonic SEGNUM;SALEGRW percentage change in sales Compustat mnemonic SALE;INVTAT ratio of inventory over total assets Compustat mnemonic INVT/AT;

LOGMKTV Natural log of market value of equity Compustat mnemonic MKVAL/MKVALM;ZSCORE Altmans Z-score Computed from Compustat as ZSCORE A 3.3 B 0.99 C 0.6 D 1.2 E 1.4. W

Net Sales/Total Assets; C Market Value of Equity/Total Liabilities; D Working Capital/Total Assets; E Retained ELOGAGE natural log of years the firm exists in the CRSP database; and

LOGERPAGE natural log of the number of years since the ERP system was implemented.

Journalof

InformationSystems

Spring2011



16/30

variables are more likely to be associated with lower levels of material weaknesses, and negative

estimates indicate that variables are less likely to be associated with lower levels of materialweaknesses. Therefore, it is expected that the primary variable of interest ERP will be positive,

indicating that ERP implementers ERP 1 are more likely to report lower levels of material

weaknesses than control firms ERP 0. As for the control variables, firms with foreign opera-

tions, merger and acquisition activity, restructuring activity, losses, more segments, more sales

growth, and higher inventory are expected to have negative estimates, indicating that they are less

likely to be associated with lower levels of material weaknesses than their counterparts. By

TABLE 4

Frequency of Internal Control Weaknesses

Frequency Proportions

Z-statERP 0 ERP 1 Total ERP 0 ERP 1 Total Diff

20042008

Weak 0 326 347 673 86.5% 92.0% 89.3%

Weak 1 51 30 81 13.5% 8.0% 10.7% 5.5% 2.47***

Totals 377 377 754 100.0% 100.0% 100.0%

2004

Weak 0 54 59 113 76.1% 83.1% 79.6%

Weak 1 17 12 29 23.9% 16.9% 20.4% 7.0% 1.04

Totals 71 71 142 100.0% 100.0% 100.0%

2005

Weak 0 78 80 158 86.7% 88.9% 87.8%

Weak 1 12 10 22 13.3% 11.1% 12.2% 2.2% 0.46

Totals 90 90 180 100.0% 100.0% 100.0%

2006

Weak 0 76 81 157 88.4% 94.2% 91.3%

Weak 1 10 5 15 11.6% 5.8% 8.7% 5.8% 1.35*

Totals 86 86 172 100.0% 100.0% 100.0%

2007

Weak 0 79 85 164 89.8% 96.6% 93.2%

Weak 1 9 3 12 10.2% 3.4% 6.8% 6.8% 1.79**

Totals 88 88 176 100.0% 100.0% 100.0%

2008

Weak 0 39 42 81 92.9% 100.0% 96.4%

Weak 1 3 0 3 7.1% 0.0% 3.6% 7.1% 1.76**

Totals 42 42 84 100.0% 100.0% 100.0%

*, **, *** Prob Z at 0.10, 0.05, and 0.01 levels, respectively, such that Proportion ERP 0 ERP 1 0.Weak 0: Firms with no Internal Control Weaknesses in the Audit Analytics database.

Weak 1: Firms with at least one Internal Control Weakness in the Audit Analytics database.

ERP 1: Firms that implemented ERP systems between 1994 and 2003.

ERP 0: Control firms that have not reported implementation of an ERP system.

144 Morris



17/30

TABLE 5

Probit Regression Results

ParameterExp.Sign Estimate

Std.Error Wald 2

Intercept ? 1.8123 1.9089 0.9000

ERP 0.5732 0.2668 4.6162**FOREIGN 0.0514 0.2573 0.0398

M&A 0.6106 0.2643 5.3397**RESTR 0.0353 0.2640 0.0179

LOSS 0.4735 0.3101 2.3311*BIG4 0.1257 0.4209 0.0892

LOGSEG 0.0319 0.1974 0.0262

SALEGRW 0.5363 0.2918 3.3790**INVTAT 0.1786 1.0122 0.0311

LOGMKTV 0.3195 0.0931 11.7866***ZSCORE 0.0390 0.0248 2.4752*LOGAGE 0.0543 0.1958 0.0770

LOGERPAGE 0.7435 0.6917 1.1552

Log Likelihood 322.560

Observations 754

*, **, *** Indicate significance at 0.10, 0.05, and 0.01 levels, respectively, using one-tailed test where sign is predicted.Confidence limits are based on 95 percent Wald Confidence Limits.

ProbCOUNT_WEAKit = f+ 1ERPit+ 2FOREIGNit+ 3M&Ait+ 4RESTRit+ 5LOSSit+ 6BIG4it

+ 7LOGSEGit+ 8SALEGRWit+ 9INVTATit+ 10LOGMKTVit+ 11ZSCOREit

+ 12LOGAGEit+ 13LOGERPAGEit

Variable Definitions:COUNT_WEAK number of internal control weaknesses reported;

ERP indicator variable equal to 1 for firms that have implemented ERP systems, else 0;FOREIGN indicator variable equal to 1 if the firm has a nonzero foreign currency translation Compustat

mnemonic FCA, else 0;M&A indicator variable equal to 1 if acquisitions reported on the Statement of Cash Flows Compustat

mnemonic AQC, else 0;RESTR indicator variable equal to 1 if at least one of the following is not equal to 0 Compustat mnemonics

RCP, RCA, RCEPS, RCD, else 0;LOSS indicator variable equal to 1 if earnings before extraordinary items Compustat mnemonic IB are

less than 0, else 0;BIG4 indicator variable equal to 1 if the firms auditor is one of the Big 4 firms, else 0;LOGSEG natural log of number of business segments Compustat mnemonic SEGNUM;SALEGRW percentage change in sales Compustat mnemonic SALE;INVTAT ratio of inventory over total assets Compustat mnemonic INVT/AT;LOGMKTV natural log of market value of equity Compustat mnemonic MKVAL/MKVALM;ZSCORE Altmans Z-score Computed from Compustat as ZSCORE A 3.3 B 0.99 C 0.6

D 1.2 E 1.4. Where A EBIT/Total Assets; B Net Sales/Total Assets; C MarketValue of Equity/Total Liabilities; D Working Capital/Total Assets; E Retained Earnings/Total

Assets;LOGAGE natural log of years the firm exists in the CRSP database; andLOGERPAGE natural log of the number of years since the ERP system was implemented.




18/30

contrast, firms that use Big 4 audit firms have higher market value, higher Z-scores, are older, and

have older ERP systems are expected to have positive estimates, indicating that they are more

likely to be associated with lower levels of material weaknesses.

The primary variable of interest ERP is positive and significant at the 0.05 level, as ex-

pected, indicating that ERP-implementing firms are more likely to be associated with lower levels

of material weaknesses. Control variables with significant results in the expected direction include:

M&A, LOSS, SALESGRW, LOGMKTV, and ZSCORE, indicating that firms with M&A activity,

losses, higher sales growth, lower market values, and lower Z-scores are less likely to report lower

levels of material weaknesses. The variable related to age of the ERP implementation LOGER-

PAGE is not significant, which does not support the argument that older implementations may be

using more of the control features. These results may be impacted by low power due to the

relatively small sample size. The model is a good fit, with a Log Likelihood of322.560.

Sensitivity Analysis

An argument can be made that the number of material weaknesses counted may not be the

best measure of internal control, because even if only one weakness is found, the company has an

internal control problem that must be reported. As a sensitivity analysis, a logistic regression wasrun using a dichotomous variable WEAK set to 1 if any material weaknesses were found and

0 if none were found. The results untabulated are very similar to the probit regression with the

variable of interest ERP significant at the 0.05 level, and the same control variables significant at

similar levels as with the probit regression. To test the sensitivity of results to the size difference

discussed in the previous section, the regression was run using a sub-set of the observations

excluding the 11 pairs of firms with the largest absolute value difference in total assets. The

untabulated results were essentially the same, with the coefficient on the ERP variable still sig-

nificant at the 0.05 level. Other tests of model assumptions, including: a Hosmer and Lemeshow

Goodness-of-Fit test, a Percent Concordant test, analysis of classification tables, analysis of cor-

relations, and test for multicollinearity, all validate the model. These results further support the

first hypothesis H1 in that ERP-implementing firms are less likely to report material weaknesses

than the control firms, after controlling for other variables found in prior research to contribute toICW.

Factors Contributing to Material Weakness Determination

To test the second and third hypotheses, it is necessary to examine the specific factors con-

tributing to material weakness determination. Audit Analytics includes in their database a listing of

these factors with detailed descriptions for each. It is important to understand that there is no

specific standardized requirement for companies or their auditors to categorize the factors that lead

to a determination of internal control weakness. These factors are classified by Audit Analytics

after reading the compliance document. The Appendix is an abridged example of an audit report

issued by PricewaterhouseCoopers, LLP, for Pride International, Inc. for December 31, 2004,

which concurs with managements determination that a material weakness has been identified. The

appropriate section of the audit report has been underlined to illustrate the point. Based on thislanguage, Audit Analytics identified 11 factors contributing to internal control weakness, which

are listed at the end of the sample audit report. These contributing factors are not considered to be

11 instances of ICW, but 11 factors that contribute to a single ICW.

A panel of experts was used to review the various factors defined by Audit Analytics and

identify those that relate to general entity-wide controls and those that relate to specific account-

level controls. The panel consisted of three members of the accounting profession familiar with

146 Morris



19/30

SOX Section 404 reporting and internal controls. One is a partner for a Big 4 CPA firm, one is a

supervisor for a large regional CPA firm, and one is a supervisor for a Fortune 50 corporation with

internal audit experience. Table 6 provides a summary of factors contributing to general entity-

wide internal control weaknesses in Panel A and specific account-level internal control weak-

nesses in Panel B for the 754 firm-year observations. The EP# column identifies the number of

expert panel members that were in agreement 2 or 3 as to which category was appropriate. The

table shows the frequency with which each of the factors has been cited and the proportion of the

total represented by that frequency. The most often cited factor, accounting documentation,

policy and/or procedures was cited in 50 6.63 percent of the control firm-years and only 30

3.98 percent of the ERP firm-years, with the differences statistically significant, at a p-value

0.01 level. This result indicates that control firms will report more of these factors than the

ERP-implementing firms.

Although many of the factors are not statistically different between the ERP implementers and

control firms, three of the general entity-wide factors and six of the specific account-level

factors are at least marginally significant. In the general entity-wide category, they include in

addition to the documentation factor discussed above: accounting personnel resources,

competency/training and material and/or numerous auditor/YE adjustments. The specificaccount-level category includes: 1 restatement or non-reliance of company filings, 2 re-

statement of previous 404 disclosures, 3 intercompany/investment w/subsidiaries/affiliates is-

sues, 4 financial derivatives/hedging FAS No. 133 accounting, 5 tax expense/benefits/

deferral/other FAS No. 109 issues, and 6 Pension and other post-retirement benefit issues.

Table 7 summarizes further analysis of the contributing factors. Panel A presents frequencies

of firm-years reporting general versus specific contributing factors to ICW, while Panel B evalu-

ates the mean values of total occurrences for each category. General entity-wide factors are

found in 49 13.0 percent of control firm-year reports versus 29 7.7 percent of the ERP firm-

year reports. The 5.3 percent difference is statistically significant at the p 0.01 level. Similar

results are shown for the specific account-level factors, with 51 13.5 percent of control firm-

year observations and 30 8.0 percent of ERP firm-year observations, with the 5.5 percent differ-

ence also significant at the p 0.01 level. Comparing the mean values in Panel B yields similarresults, with both general and specific averages significantly larger for control firm-years than the

ERP firm-years. Note also that for control firms, the average number of general entity-wide

factors is significantly higher than the average number of specific account-level factors, whereas

the differences are not significant for the ERP firms.

Table 8 summarizes results of probit regressions of factors related to general entity-wide and

specific account-level control weaknesses, using the previous model from Table 5 to test H2 and

H3. The primary variable of interest ERP is positive and significant at the 0.05 level in both

cases, rejecting the null hypotheses, indicating that firms that implemented ERP systems were

more likely to report lower levels of both general entity-wide and specific account-level

control-related weaknesses than the control group. Similar to the previous probit regressions, four

of the control variables related to general entity-wide controls and five of the control variables

related to specific account-level controls are significant with the expected sign, indicating theyare impacting the results similar to prior research. Firms with M&A activity, higher sales growth,

lower market value, and lower Z-scores are less likely to report higher levels of general entity-

wide control-related factors. Likewise, firms with M&A activity, losses, higher sales growth,

lower market value, and lower Z-scores are less likely to report higher levels of specific account-

level control-related factors. The overall model is reasonable, with log likelihood of358.314

and 358.685 for general and specific models, respectively.


http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


20/30

TABLE 6

Factors Contributing to Internal Control Weaknesses

Panel A: General (Entity-Wide) Factors

AARef EP #

Frequency

ERP 0 ERP 1

Inadequate disclosure controls timely, accuracy, comp. 9 3 0 1

Senior management competency, tone, reliability 13 3 2 3

Accounting documentation, policy and/or procedure 17 3 50 30

Insufficient or nonexistent internal audit function 18 3 0 1

Scope disclaimer of opinion or other limitations 20 3 1 1

Ethical or compliance issues with personnel 21 3 2 3

Information technology, software, security, access 22 3 9 8

Segregations of duties/design of control personnel 42 3 4 5

Accounting personnel resources, compet./training 44 3 28 19

Unspecified/unidentified/inapplicable FASB/GAAP 68 3 3 1

Material and/or numerous auditor/YE adjustments 4 2 28 17 Fin Stmt, footnote, U.S. GAAP, segment disclosure 40 2 2 4

Remediation of material weakness identified 57 2 0 1

Total General Entity-Wide Factors 129 94

Panel B: Specific (Account-Level) Factors

Lease, FAS No. 5, legal, contingency, and commit issues 3 2 4 4

Restatement or nonreliance of company filings 5 2 21 12

Cash flow statement FAS No. 95 classification errors 10 2 2 1

Consolidation, Fin46r/Off BS and foreign currency 24 2 4 2

Income statement classification, margin, and EPS 36 2 1 0

Foreign, related party, affiliated and/or subsidiary 38 2 8 5

Restatement of previous 404 disclosures 43 2 14 1

Lease, leasehold, and FAS No. 13 98 subcategory 73 2 3 3

Journal entry control issues 76 2 5 6 Nonroutine transaction control issues 77 2 9 7

Intercompany/Investment w/sub/affil issues 8 3 4 0


Spring2011



21/30

Panel B: Specific (Account-Level) Factors

Untimely or inadequate account reconciliations 12 3 12 10

Capitalization of expenditures issues 14 3 1 0

Accounts/loans receivable, investments, and cash 15 3 5 5

PPE, intangible or fixed asset value/diminution 16 3 9 5 Deferred, stock-based, or executive comp issues 27 3 7 3

Depreciation, depletion, or amortization issues 28 3 5 4

Expense recording payroll, SG&A issues 29 3 1 2

Financial derivatives/hedging FAS No. 133 accounting 30 3 2 0

Inventory, vendor, and cost of sales issues 32 3 13 10

Liabilities, payables, reserves, and accrual estimate 33 3 8 8

Acquisition, merger, disposal, or reorganization 35 3 6 4

Revenue recognition issues 39 3 10 11

Tax expense/benefit/deferral/other FAS No. 109 41 3 19 8

Debt, quasi-debt, warrants, and equity BCF security 47 3 1 1

Pension and other post-retirement benefit issues 80 3 2 0

Asset retirement obligation issues 81 3 1 0

Total Specific Account-Level Factors 177 112

Total of All Factors Reported 306 206

*, **, *** Prob Z at 0.10, 0.05, and 0.01 levels, respectively, such that Proportion ERP 0 ERP 1 0.AA Ref Audit Analytics Reference Number.

EP # Expert Panel members in agreement on classification.

ERP 1: ERP Implementing Firms.

ERP 0: Control Firms.

Journalof

InformationSystems

Spring2011



22/30

V. CONCLUSIONS

Summary of Results

This study examines the impact that enterprise resource planning ERP systems have on the

effectiveness of internal controls over financial reporting. It uses a sample of firms that imple-

mented ERP systems from 1994 to 2003 matched with control firms based on industry and size. Itcompares internal control weaknesses ICW reported in Form 10-K for each of the groups. The

results show that during the first five years that SOX Section 404 has required such reporting, a

smaller proportion of ERP-implementing firms have reported ICW than the control firms. These

results hold up in a probit regression analysis that includes several control variables that prior

research has found to be associated with ICW. The regression suggests that firms that implemented

ERP systems are less likely to have ICW than the non-ERP control firms.

TABLE 7

Analysis of Factors Contributing to Material Weaknesses

Panel A: Frequency of Firms Reporting General versus Specific Contributing Factors

Frequency Proportions

Z-statERP 0 ERP 1 Total ERP 0 ERP 1 Total Diff

General

GEN 0 328 348 676 87.0% 92.3% 89.7%

GEN 1 49 29 78 13.0% 7.7% 10.3% 5.3% 2.39***Totals 377 377 754 100.0% 100.0% 100.0%

Specific

SPE 0 326 347 673 86.5% 92.0% 89.3%

SPE 1 51 30 81 13.5% 8.0% 10.7% 5.5% 2.47***Totals 377 377 754 100.0% 100.0% 100.0%

Panel B: Mean Values of Contributing Factors Reported

ALL ERP 0 ERP 1 Diff t-stat

n 754 377 377

GENERAL 0.383 0.469 0.297 0.172 1.741

SPECIFIC 0.295 0.342 0.249 0.093 1.343

Difference 0.088 0.127 0.048

t-stat 2.782##

2.479##

1.314

*, **, *** 0.10, 0.05, and 0.01 levels, respectively, such that Prob Z Proportion ERP 0 ERP 1 0; one-tailedtest.,,

0.10, 0.05, and 0.01 levels, respectively, such that Prob t ERP 0 ERP 1 0; one-tailed test.#,##,###

0.10, 0.05, and 0.01 levels, respectively, such that Prob t GENERAL SPECIFC 0; two-tailed test.

ERP 1: Firms that implemented ERP systems between 1994 and 2003.

ERP 0: Control firms that have not reported implementation of an ERP system.

GEN 0: Firms with no Internal Control Weaknesses in the Audit Analytics database.

GEN 1: Firms with at least one Internal Control Weakness in the Audit Analytics database and contributing factors thatare related to General controls.

SPE 0: Firms with no Internal Control Weaknesses in the Audit Analytics database.

SPE 1: Firms with at least one Internal Control Weakness in the Audit Analytics database and contributing factors thatare related to Specific account-level controls.

GENERAL: Number of factors contributing to material weaknesses that relate to general controls.

SPECIFIC: Number of factors contributing to material weaknesses that relate to specific account-level controls.

150 Morris



23/30

TABLE 8

Probit Regression Results for General (Entity-Wide) and Specific (Account-Level) Controls

ParameterExp.Sign

Dependent Variable GENERAL

Dependent Variable SPECIFIC

EstimateStd.

Error Wald 2 EstimateStd.

Error Wald 2

Intercept ? 1.7742 1.9255 0.8500 1.5444 1.8858 0.6700

ERP ? 0.5452 0.2697 4.0863** 0.5628 0.2653 4.5007**FOREIGN 0.1395 0.2674 0.2827 0.0121 0.2566 0.0022

M&A 0.6131 0.2672 5.2653** 0.5714 0.2632 4.7128**RESTR 0.0757 0.2669 0.0804 0.0937 0.2652 0.1249

LOSS 0.3129 0.3157 0.9825 0.4722 0.3136 2.2676*BIG4 0.2894 0.4342 0.4442 0.1786 0.4180 0.1826

LOGSEG 0.0338 0.2002 0.0285 0.0322 0.1954 0.0272

SALEGRW 0.6216 0.2914 4.5494** 0.5429 0.2870 3.5785**INVTAT 0.0790 1.0116 0.0061 0.0401 1.0159 0.0016LOGMKTV 0.3228 0.0953 11.4704*** 0.3058 0.0908 11.3503***ZSCORE 0.0605 0.0264 5.2565** 0.0366 0.0243 2.2687*LOGAGE 0.1289 0.1986 0.4211 0.0173 0.1973 0.0077

LOGERPAGE 0.6391 0.7027 0.8272 0.7483 0.6843 1.1957

Log Likelihood 385.314 358.685

Observations 754 754

*, **, *** Indicate significance at 0.10, 0.05, and 0.01 levels, respectively, using one-tailed test where sign is predicted,otherwise two-tailed test.

Confidence limits are based on 95 percent Wald Confidence Limits.

ProbDVit = f+ 1ERPit+ 2FOREIGNit+ 3M&Ait+ 4RESTRit+ 5LOSSit+ 6BIG4it+ 7LOGSEGit

+ 8

SALEGRWit

+ 9

INVTATit

+ 10

LOGMKTVit

+ 11

ZSCOREit

+ 12

LOGAGEit

+ 13

LOGERPAGEit

Variable Definitions:DV dependent variable: count of weaknesses related to GENERAL or SPECIFICcontrols;ERP indicator variable equal to 1 for firms that have implemented ERP systems, else 0;

FOREIGN indicator variable equal to 1 if the firm has a nonzero foreign currency translation Compustatmnemonic FCA, else 0;

M&A indicator variable equal to 1 if acquisitions reported on the Statement of Cash Flows Compustatmnemonic AQC, else 0;

RESTR indicator variable equal to 1 if at least one of the following is not equal to 0 Compustat mnemonicsRCP, RCA, RCEPS, RCD, else 0;

LOSS indicator variable equal to 1 if earnings before extraordinary items Compustat mnemonic IB are lessthan 0, else 0;

BIG4 indicator variable equal to 1 if the firms auditor is one of the Big 4 firms, else 0;LOGSEG natural log of number of business segments Compustat mnemonic SEGNUM;SALEGRW percentage change in sales Compustat mnemonic SALE;INVTAT ratio of inventory over total assets Compustat mnemonic INVT/AT;

LOGMKTV

natural log of market value of equity Compustat mnemonic MKVAL/MKVALM;ZSCORE Altmans Z-score Computed from Compustat as ZSCORE A 3.3 B 0.99 C 0.6 D 1.2 E 1.4. Where A EBIT/Total Assets; B Net Sales/Total Assets; C Market Value ofEquity/Total Liabilities; D Working Capital/Total Assets; E Retained Earnings/Total Assets;

LOGAGE natural log of years the firm exists in the CRSP database; andLOGERPAGE natural log of the number of years since the ERP system was implemented.




24/30

The study also examines factors contributing to ICW by dividing them into those that are

related to general entity-wide controls and specific account-level controls. The results indicate

that ERP-implementing firms are less likely than the control firms to report factors contributing to

ICW in both categories, and these results are also robust when control variables are added in a

probit regression. There is not a significant difference between the factors related to general andspecific controls for ERP-implementing firms. However, control firms report significantly more

general factors than specific factors.

Limitations and Future Research

This study has several limitations. First, the sample suffers from a large-firm bias that results

from the phased-in timing of compliance with SOX Section 404. It is possible that results for

smaller firms that were not required to comply with SOX initially may be different. Future

research should expand this study to include the nonaccelerated filers after sufficient data have

accumulated.

Second, the selection process, which uses press releases to select ERP implementing and

control firms, introduces potential bias. Additional large-firm bias may be introduced in that larger

firms may be more inclined to issue press releases than smaller firms. Also, it is possible that some

of the control group may have implemented ERP systems, but did not issue any press releases

discussing it. In this case the results would be biased against the ERP firms, which would only

strengthen the findings. Another issue relates to how much of the ERP system has been imple-

mented and is being used. Since the press releases tend to only identify that an ERP system is

being or has been implemented, there is no way to know how many of the modules have been

implemented, how much of the organization has adopted the system, or, for that matter, how many

of the built-in internal control features are being used. As with the previous limitation, this would

also bias the results against the ERP firms, which would strengthen the findings. Future research

should consider additional ways to identify ERP implementers and the extent to which the systems

have been implemented and are being utilized.

There is also the problem of human judgment related to the factors that contribute to internal

control weaknesses. The first judgment is made by the staff at Audit Analytics, who determine

which factors apply by reading the management and audit reports that are filed. The secondjudgment is in determining which of those factors are related to general entity-wide controls and

which are related to specific account-level controls. The first one is not critical to this study

because it is not focused on identifying specific factors, only on the impact of ERP on ICW. The

second one is addressed by using a diversified expert panel to spread the judgment to multiple

parties from different perspectives, including national and regional CPA firms and internal corpo-

rate accounting.

Implications and Contribution

This studys finding that firms which implement ERP systems report fewer material ICW than

firms that do not use ERP systems is important for a number of reasons. First, it provides support

for the claim that ERP systems help improve internal controls over financial reporting as required

by Sarbanes-Oxley Section 404. To my knowledge, this is the first empirical/archival test of these

claims and should be of interest to many constituencies, including those responsible for purchasingsuch systems, auditors, software vendors, and the academic community.

Second, the results provide additional data that may contribute to a better understanding of the

conflicting results in prior ERP research related to earnings management. For instance, Brazel and

Dang 2008 find an increase in earnings management activity following implementation of ERP

systems from 19931999. Dorantes et al. 2009 argue that earnings management, in general,

increased during this period of time until the passage of SOX in 2002, and that Brazel and Dangs

152 Morris

http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


25/30

2008 research design does not take this general trend into consideration because the sample isnot compared to a control group, only to itself before and after implementation. In their study,Dorantes et al. 2009 find a decrease in earnings management, relative to a control group, whichis similar to the findings by Morris 2009 for discretionary working capital accruals. These

conflicting results could be explained in part by the enactment of SOX and the increased emphasison internal controls. It is conceivable that as firms work to comply with SOX, they implementmore of the built-in features of ERP systems, placing more emphasis on internal control, whichthen leads to a decrease in earnings management activity at least relative to non-ERP firms. Thisexplanation is consistent with findings in the current study as presented in Table 4, which showsno significant difference between ERP and non-ERP firms in the first two years of SOX reporting,marginally significant differences in the third year, and significant differences in the fourth andfifth years. However, it is not consistent with the fact that the coefficients on the LOGERPAGEvariables in the probit regression analyses Tables 5 and 8 were not significant. It is possible thatthe nonsignificance is due to low power that results from a relatively small sample size. Futureresearch should examine this issue after more data become available, which will increase thepower of the tests.

Third, the findings that both general entity-wide and specific account-level controls areless likely to contribute to ICW for ERP firms than for control firms is consistent with the overall

findings. Also consistent with the overall findings is the fact that ERP firms report no significantdifferences between the two categories while non-ERP firms report more general entity-widecontrol factors than specific account-level control factors see Table 7. This information, alongwith the prior findings of Dorantes et al. 2009 and Morris 2009, suggests that Brazel and Dang2008 may be an anomaly. Additional research is needed to further examine the inconsistencies inthe relationship between ERP systems, earnings management, and internal control. The use ofadditional methodologies such as field studies and/or survey data may be needed to better under-stand the details of how ERP systems are implemented and used, which may then help to betterexplain some of these differences.


http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-http://-/?-


26/30

APPENDIX

ABRIDGED EXAMPLE OF AN AUDIT REPORT

PRIDE INTERNATIONAL, INC.

Report of Independent Registered Public Accounting Firm16

To the Stockholders and Board of Directors of Pride International, Inc.: We have completed an integrated

audit of Pride International, Inc.'s 2004 consolidated financial statements and of its internal control overfinancial reporting as of December 31, 2004 and audits of its 2003 and 2002 consolidated financialstatements in accordance with the standards of the Public Company Accounting Oversight Board (UnitedStates). Our opinions, based on our audits, are presented below.

Consolidated financial statementsIn our opinion, the accompanying consolidated balance sheet and the related consolidated statements ofoperations, stockholders' equity and cash flows present fairly, in all material respects, the financialposition of Pride International, Inc. and its subsidiaries

Internal control over financial reportingAlso, we have audited management's assessment, included in Management's Report on Internal ControlOver Financial Reporting appearing under Item 9A, that Pride International, Inc. did not maintaineffective internal control over financial reporting as of December 31, 2004 because the Company did not

maintain effective controls based on criteria established in Internal Control -- Integrated Frameworkissued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)

A material weakness is a control deficiency, or combination of control deficiencies, that results in morethan a remote likelihood that a material misstatement of the annual or interim financial statements will not

be prevented or detected. The following material weakness has been identified and included inmanagement's assessment. As of December 31, 2004, the Company did not maintain effective controlsover the communication among operating, functional and accounting departments of financial and other

business information that is important to the period-end financial reporting process, including thespecifics of non-routine and non-systematic transactions. Contributing factors included the large numberof manual processes utilized during the period-end financial reporting process and an insufficient number

of accounting and finance personnel to, in a timely manner: (1) implement extensive structural andprocedural system and process initiatives during 2004, (2) perform the necessary manual processes, and

(3) analyze non-routine and non-systematic transactions. This control deficiency resulted in errors thatrequired the restatement of the Company's consolidated financial statements for 2003 and 2002, the firstthree quarterly periods in 2004 and all quarterly periods in 2003, as discussed in Note 2 to theconsolidated financial statements. The errors primarily affected property and equipment and the related

depreciation expense, debt and the related interest and financing costs, minority interest balances andactivity and income tax balance sheet accounts and the related provisions. This deficiency also resulted inaudit adjustments to the 2004 consolidated financial statements primarily affecting accrued employeebenefits and interest and the corresponding expense accounts. Additionally, this control deficiency couldresult in a material misstatement to the Company's annual or interim consolidated financial statements

that would not be prevented or detected. Accordingly, management has determined that this controldeficiency constitutes a material weakness. This material weakness was considered in determining thenature, timing, and extent of audit tests applied in our audit of the 2004 consolidated financial statements,and our opinion regarding the effectiveness of the Company's internal control over financial reporting

16Source of Audit Report is from Form 10-K Filing in EDGAR

154 Morris

http://-/?-http://-/?-


27/30

does not affect o

The Impact of Enterprise Resource Planning 1

Documents

Transcript of The Impact of Enterprise Resource Planning 1