1. Yue Liu, Rutgers University
Does the Internal Control Risk Factor Disclosure Complement SOX 404 Disclosure of Material Weaknesses in Internal Control?
Yue Liu, Rutgers University

2. Introduction
Understanding the internal control of a firm is important to its stakeholders because effectiveness of internal control is the base for more complete and reliable financial statement (AICPA 2014).
Section 404 of Sarbanes Oxley (SOX 404) and Auditing Standard No. 2 (PCAOB 2004) require management and auditors to disclose material weaknesses in internal controls over financial reporting (ICFR) (Raghunandan and Rama 2006).
In addition to this mandatory assessment on ICFR, firms can also disclose ICFR-related risk factors in section Item 1A – Risk Factors.
This paper is trying to evaluate the informativeness of the ICFR-related risk factor disclosures.

3. Related literature and hypothesis development
Truthfully disclosed ICFR-related risk factors should reflect higher internal control risk for the firm
Audit fee as a proxy for internal control risk: prior studies find internal control weaknesses and audit fees are positively related (e.g., Raghunandan and Rama 2006, Hogan and Wilkins 2008)
H1: Disclosure of ICFR-related risk factors is positively related to current year audit fees.

4. Firms with internal control deficiencies are more likely to misstate in financial reports and have subsequent restatements (e.g, Li and Wang 2006; Hoitash, Hoitash, and Bedard 2008; Nagy 2010; Rice and Weber 2012).
Therefore, disclosure of ICFR-related risk factors, as an indicator of control risk, may be predictive of the restatement of the corresponding annual report
H2: Disclosure of ICFR-related risk factors is positively related to the restatement of the annual report.

5. Specific types of qualitative risk disclosures are found to be informative of future related outcomes (Gaulin 2017; Campbell et al 2017)
ICFR-related risk factors could be predictive of future restatement of annual reports and material weaknesses in internal controls.
H3a: Disclosure of ICFR-related risk factors is positively related to future restatement of 10-Ks.
H3b: Disclosure of ICFR-related risk factors is positively related to future material weaknesses in internal control.

6. Research method
Download 10-Ks in and extract individual risk factors using method described in Campbell et al. (2014) and Gaulin (2017).
Identify ICFR-related risk factors using key words “internal control(s)”, “restatement(s)”, and “material weakness(es)”, “reporting obligation(s)”, “reporting deficiency(ies)”. Generate dummy IC_RF equal to 1 if the firm discloses at least one ICFR-related risk factors and 0 otherwise. (See example)
Test H1: apply audit fee model only on sample of observations without material weakness disclosure

7. Examples of headings of two ICFR-related risk factors
1. We face risks related to our recent accounting restatements. In 2004, we reported a restatement to previously issued financial statements. More recently, in February 2007, we reported that we had discovered accounting errors in previously reported Consolidated Statements of Operations and Comprehensive Earnings. These errors related to the presentation of deferred charge as a non-interest expense amount compared to the restated presentation as a component of income tax expense…The occurrence of any of the foregoing could harm our business and reputation and cause the price of our securities to decline. (IMPAC MORTGAGE HOLDINGS, INC., 10-K of the fiscal year 2007)
2. Failure of our internal controls over financial reporting could harm our business and financial results. Our management is responsible for establishing and maintaining effective internal control over financial reporting…A significant financial reporting failure or material weakness in internal control over financial reporting could cause a loss of investor confidence and decline in the market price of our stock. (BUFFALO WILD WINGS, INC., 10-K of the fiscal year 2009)

8. To test H2 and H3a/b, generate three additional dummies: 1) ONLYICRF=1 if the firm only discloses ICFR-related risk factors, 2) ONLYMW=1 if the firm only discloses material weaknesses in internal control, and 3) ICFR_MW=1 if firm discloses both ICFR-related risk factors and material weaknesses.
Test H2 (Dechow et al 2011 model):
Test H3a/b (Dechow et al 2011 and Judd et al 2017 model):

9. Results
Correlation between IC_RF and MW is , and significant at 0.01 level
Relationship between disclosure of ICFR-related risk factors and material weaknesses MW 1
Total
IC_RF
23050
577
23722
5581
1038
6619
28726
1615
30341

10. Results H1 DV=LNFEE DV=ΔLNFEE coef p-value IC_RF 0.0832*** 0.000
DV=LNFEE
DV=ΔLNFEE
coef
p-value
IC_RF
0.0832***
0.000
ΔIC_RF
0.0401*** H2
DV=RESTATEMENT
ONLYICRFt
0.1675**
0.036
ONLYMWt
2.1900***
ICRF_MWt
1.2956***
H3a and H3b
DV=MW
ONLYICRFt-1
0.1454*
0.087
0.3267***
ONLYMWt-1
0.6840***
2.1003***
ICRF_MWt-1
0.6369***
2.4411***

11. Additional analysis
Contents of ICFR-related risk factors vary in informativeness.
To capture more informative disclosure: rank (Chin et al 2018); length (Gaulin 2017); specificity (Hope et al 2016); boilerplate percentage (Dyer et al 2017).
DV= LNFEE 
coef
p-value
IC_RANK
0.1320***
0.003
SPECIFICITY
0.8621***
0.001
LENGTH
0.0004**
0.026
BOILERPERCENT
0.0547
0.180

12. Trend of informativeness of ICFR-related risk factors

14. Conclusion
1. ICFR-related risk factors do complement the SOX 404 material weaknesses disclosure by providing additional information about the firm’s potential internal control issues
2. Three measures (rank, specificity, and length) are shown to be able to capture the informativeness of the ICFR-related risk factors.
3. More firms are disclosing ICFR-related risk factors, but the informativeness of such risk factors seems to be decreasing.

15. Thank You!

16. MW disclosure and ICFR-related risk factors
NORTHWEST PIPE COMPANY 10-K for fiscal year 2016
Item 1a: We have identified material weaknesses in internal control in prior years. For the year ended December 31, 2014 a material weakness in our internal control over financial reporting related to goodwill was identified…No material weaknesses were identified as of December 31, 2016 or However, we cannot assure you that additional material weaknesses in our internal control over financial reporting will not be identified in the future…
Item 9a: …Under the supervision and with the participation of our management, including our CEO and CFO, we conducted an assessment of our internal control over financial reporting as of December 31, In making this assessment, we used the criteria set forth in “Internal Control-Integrated Framework” (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Based on this evaluation, management concluded that the Company’s internal control over financial reporting was effective as of December 31,
Evidence for changing rank: this firm discovered a MW in 2011, and in item 1a, ICFR-related risk factor is the first risk factor. In 2012, when the MW is remediated, ICFR-related risk factor is the 30th risk factor.