1. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. University of Waterloo – Centre for Information Systems Assurance Research Symposium on Information Systems Assurance October 1-3, 2009 “Analyzing Late SEC Filings for Differential Impacts of IS and Accounting Issues” Discussant Notes Chris Anderson, CA(NZ), CISA, CMC, CISSP, PCI QSA

2. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. Summary Observations This is good work, building on a theme for the Symposium it is relatively succinct expresses and supports legitimate concern that IS auditors have given the internal control evaluation used most of the time to evaluate IT control weaknesses I found the study readable, convincing, and relevant. Could do with – a little more clarity, definitions earlier in the paper, some graphics to represent the data (particularly the differentials) to help us ‘see’ the impact – and the somewhat prurient, but high impact (average) stock price graph with event points (remember goolge and the crashes) 2

3. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. Comments on ‘Abstract’ Refers to ‘information systems’ issues Then refers to ‘IS issues, SOX implementations, and SEC investigations’ Then refers to ‘systems-related’ Not clear at first read if ‘IS issues’ include the others or not A lot of IS auditors will see overlap in ‘IS issues’ and ‘SOX implementations’ –And thus be concerned to see if the causes have been isolated enough 3

4. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. Comments on ‘Introduction’ “Empirical evidence suggests that automated and integrated IS environment can have pervasive effects on the effectiveness of a firm’s internal controls over financial reporting, the timeliness, and the reliability of a company’s financial reports” –Hallelujeh! Well Put! “when a company cites IS as the cause of filing delays, it would send a strong negative signal to the market” –But what is the reaction to the signal? Because of the surprise Because the financial, operational, regulatory (apparently unmanaged) threat(s) the IS event communicates Concern about overall Governance not ‘getting IT’ 4

5. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. Comments on ‘Introduction’ “Our sample is broad-based, covers both annual and quarterly NT filings, and we examine market response to the NT forms filed preceding delayed 10-Ks and 10-Qs and the reasons documented on these forms.” –Nice big sample, so naysayers can’t ignore “In addition, the stock market reaction tends to be stronger and longer-lasting around the filing dates for NT 10-Q reports than for NT 10-K reports.” –Why? 5

6. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. Comments on ‘Background and Hypotheses Development “In the financial cycle, companies have invested in ERP systems to seamlessly integrate information across the breadth and depth of the organization, and to achieve better timeliness in financial reporting” –True, and this also (in theory) improves operational efficiency. Is operations compromise a driver for stock price impact? “In our case, delayed filing due to IS issues could be an indicator of broader financial reporting issues in a company and such disclosure should convey new information to the market.” –What other problems could this be an indicator of (and thus cause stock price to go down)? 6

7. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. Comments on ‘Sample and Research Design’ Methodology: “we use a short window to estimate the denominator for standardization under the assumption that such a window should be as free as possible of the effects of other accounting information, including the effects of prior SEC 10-K or 10-Q filings and earnings announcements preceding the filing date” –This is fair, simple, and stops the naysayers! “Approximately 56% of the sample firms provide specific reasons for filing late in addition to the more general reason description— “insufficient time to file report.” –so 44% are not providing reasons. Are reasons filed later after SEC query 7

8. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. Comments on ‘Sample and Research Design’ Reasons are grouped into ‘eight logical and intuitive categories’ –Finally clarity, but it was at Page 16. The causes are comfortably heterogeneous, so the ‘pure’ IS issues impact is isolated –The study is robust and not ‘liberal, which would again allow naysayers to argue –And then IS issues and SOX implementation issues are also combined later in the analysis (good idea) But, how much of ‘Accounting Quality’, ‘Administrative Matters’, ‘Auditor Related’, and ‘Going Concern’ are related or have a causal relationship to ‘Information Systems Issues’ 8

9. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. Comment on ‘Empirical Results’ The ‘meat’ –“the 2-day excess returns are significantly negative to filing delays caused by SEC investigations, SOX implementation issues, and IS issues” –“group t-tests for the mean 2-day excess return show that IS issues are associated with more significant market response compared to all other reason groups, except for SEC in the NT 10-K” Can we see a graph of the average stock price and drops after the event(s) - by issue category and aggregate 9

10. © 2009 Grant Thornton LLP. A Canadian Member of Grant Thornton International Ltd. Comment on ‘Empirical Results’ “Overall, the evidence documented here suggests that differences in the investor response to filing reasons, IS in particular, are not subsumed by other firm and filing characteristics. IS reasons is more significant than other stated reasons for late filing. IS issues are pervasive and can affect the operational effectiveness. NT filings due to IS reasons signals doubt about the effectiveness and efficiency of a company’s business operations.” –Not necessarily true. Could be good operations but poor ICFR only ( unlikely since roaches don’t travel alone) –We know this is true, but the reason for the stock market response was ‘surprise’ previously in the study, now appears to be ‘pervasiveness’ overflowing to operational risk. How did you step into the mid of the investor? 10