Download - Impact of SOX IT Material Weaknesses
-
8/3/2019 Impact of SOX IT Material Weaknesses
1/52
The Impact of Information Technology Material Weaknesses on Corporate Governance:Evidence from Executive and Director Turnover, and IT Governance Changes
Jacob Z. Haislip
Adi Masli
Vernon J. Richardson
Juan Manuel Sanchez
University of Arkansas
August 2011
-
8/3/2019 Impact of SOX IT Material Weaknesses
2/52
The Impact of Information Technology Material Weaknesses on Corporate Governance:
Evidence from Executive and Director Turnover, and IT Governance Changes
Abstract We provide a comprehensive examination of the impact of information technology (IT)internal control material weaknesses on changes in corporate governance. Specifically, weexamine the impact of IT weaknesses on CEO, CFO and director turnover, CEOs, CFOs anddirectors IT knowledge improvements, and upgrades to the companys financial reportingsystem. We find results consistent with our hypothesis that, because IT-related material
weaknesses have a more pervasive negative impact on the reliability of internal controls overfinancial reporting (relative to non-IT material weaknesses), IT material weakness firmsexperience higher CEO, CFO and director turnover rates. We also find that IT material weaknessfirms are more likely to replace executives with professionals possessing higher degrees of ITknowledge, and are more likely to upgrade their financial reporting IT. Finally, we find that in ITmaterial weakness firms that experience CFO turnover, the CFO replacement possessesadditional IT knowledge, and remediate internal control weaknesses in a more timely fashion.
-
8/3/2019 Impact of SOX IT Material Weaknesses
3/52
I. IntroductionInformation technology (IT) serves as the foundation of an effective system of internal
controls over financial reporting (Hunton et al. 2008; Li et al. 2010a; Masli et al. 2010). IT
provides the platform that integrates financial transactions and internal controls to increase the
likelihood of a properly functioning financial reporting process. Despite its importance, there is a
notion that Chief Executive Officers (CEOs) and Chief Financial Officers (CFOs) have not
placed enough attention to IT as a critical component of the financial reporting system process
(Deloitte 2005). Regulators seem to share this sentiment and suggest that boards of directors
need to do a better job providing oversight over their organizations IT functions, especially
those pertaining to internal controls and financial reporting (Nolan and McFarlan 2005; Klamm
and Watson 2009; Bart and Turel 2010).
Recent research (Klamm and Watson 2009) finds that firms with significant IT
deficiencies are more likely to issue misstated financial statements (relative to firms with regular
material weaknesses), further increasing the awareness of the importance of IT on the overall
financial reporting system.1
In this paper, we examine two related questions. First, we examine
the impact of IT material weaknesses on CEO, CFO, and board of director turnover. We focus on
the CEO and CFO because they are primarily responsible for the reliability and accountability of
internal controls over financial reporting. Section 302 of the Sarbanes-Oxley Act of 2002 (SOX)
requires these executives to sign off on financial statements and to report on the quality of the
internal controls surrounding financial reporting. Recent research also emphasizes the important
-
8/3/2019 Impact of SOX IT Material Weaknesses
4/52
members face penalties (in the form of an increased likelihood of turnover) for IT failures that
relate to internal control over financial reporting. This examination is important because while
extant research (Srinivasan 2005; Desai et al. 2006; Collins et al. 2009) documents the
consequences of financial misstatements on a firms governance structure (e.g., executive and
director turnover), little is known about the consequences of IT deficiencies on changes in
corporate governance.
Second, we examine how firms with IT material weaknesses remediate their deficiencies.
Specifically, we examine two distinct areas of remediation. Given the emerging call for greater
IT oversight among executives and board members, we first determine whether IT weakness
firms replace outgoing CEOs, CFOs, and directors with professionals who possess greater levels
of IT knowledge. Replacing the CEO, CFO and/or board members with individuals with greater
IT knowledge would signal the seriousness of a firms commitment to remediating the IT
governance environment. Finally, we examine whether firms with IT weaknesses subsequently
make other major IT changes, including upgrades specifically targeted to the financial and
accounting system. These changes include upgrading the IT, hiring an executive (beyond the
CEO or CFO) dedicated to the oversight and management of IT, or adding a technology
committee to the board. All of these changes are expected to help remediate problems associated
with the IT material weakness.
We rely on a sample of 289 IT material weakness firms identified by reading SOX 404
reports issued from 2004 through 2006. As a control group, we rely on a random sample of non-
-
8/3/2019 Impact of SOX IT Material Weaknesses
5/52
After controlling for economic determinants of turnover, including the number of weaknesses
reported and the incidence of restatements, we find that, IT weakness firms have a 8.2%, 16.3%,
and 19.4% greater likelihood of CEO, CFO, and director turnover than non-IT weakness firms,
respectively. These results imply that weak IT controls have a more pervasive and negative
impact on the financial reporting process and consequently result in greater penalties for the
executives primarily responsible for internal controls. Furthermore, the results suggest that
directors are held accountable for breakdowns in IT-related controls, thus providing support for
the idea that board members are now challenged to extend their monitoring and oversight duties
to IT functions.
When we contrast the turnover rates between IT and non-IT firms conditioning on inside
vs. outside directors, we find that the probability of turnover is greater for outside directors.
When we focus on the audit committee, however, we find that the turnover rate is not
significantly different between IT and non-IT weakness firms. In contrast, when we focus on the
turnover rates of the chairperson of the board, we find that the likelihood of turnover is 12.5%
higher in IT weakness firms. These results suggest that the firm eliminates the professional with
the most authority on the board as part of the remediation of the problems in the financial
reporting process. On balance, these results show that IT weakness firms make changes that are
more significant to the governance structure as compared to non-IT weakness firms.
With respect to the remediation, we find that IT weakness firms are more likely to replace
outgoing CEOs and CFOs, with executives that have greater levels of IT knowledge.2 This result
-
8/3/2019 Impact of SOX IT Material Weaknesses
6/52
IT expertise at the executive level and the quality of internal controls over financial reporting.
Our findings support the notion that IT weakness firms are more likely to obtain the services of
executives with IT knowledge, expecting that such appointments can contribute to improvements
in internal controls over financial reporting. We also find that IT weakness firms are more likely
to make upgrades to the accounting and financial reporting IT. In some cases, the IT weakness is
so pervasive throughout the system that firms opt to scrap the entire financial reporting system.3
On other cases, the IT weakness affected targeted areas, leading to changes only to specific
modules, such as Accounts Payable or Fixed Assets.4
In additional analysis, we examine the remediation efforts that IT weakness firms
undertake and find evidence suggesting that those IT weakness firms that replace (fill) their CFO
(board seats) with individuals possessing IT knowledge (compared to IT weakness firms that do
not) are more likely to experience a reduction in the number of internal control weaknesses
reported by the second year after the initial IT weakness year. This result implies that
replacement appointments of CFOs and/or directors with IT knowledge are among the most
effective remediation strategies for IT weakness firms.
Our study offers various contributions to the accounting information systems (AIS)
literature that examines the importance of IT in financial reporting and auditing. The IT-related
auditing literature focuses on the use of IT by auditors and how it can affect auditor judgment
3For example in 2005 Castle & Co stated, The Company started a business system replacement initiative in thethird quarter of 2005. The project scope includes a replacement of the Companys financial systems as a first phaseof the overall project plan The Company is currently performing parallel testing and expects to be in production
-
8/3/2019 Impact of SOX IT Material Weaknesses
7/52
(e.g., Messier 1995; ODonnell and David 2000; Brazel et al. 2004; ODonnell and Schultz 2003;
Bible et al. 2005; Bedard et al. 2007; Dowling and Leech 2007; Dowling 2009). The IT-related
accounting literature also focuses on the firm performance and internal control benefits firms
derive from IT (e.g., Dehning and Richardson 2002; Hunton et al. 2003; Kobelsky et al. 2008;
Masli et al. 2010). Our paper extends this literature by showing the detrimental effects of a
breakdown within the controls surrounding IT on a firms governance environment.
Prior literature focuses on the importance of financial accounting expertise of executives
and board members as it relates to the financial reporting process (Beasley 1996; DeFond et al.
2004; Hennes et al. 2008; Li et al. 2010b; Johnstone et al. 2010). We extend this literature by
documenting that firms also value the IT expertise of executives and directors when remediating
internal control issues. Furthermore, a stream of literature investigates the characteristics of firms
that report material weaknesses and the consequences the firms face in regard to the weaknesses
(Ge and McVay 2005; Doyle et al. 2007; Hammersley et al. 2008; Johnstone et al. 2010; Li et al.
2010b). We extend this literature by examining a unique type of internal control material
weakness we show to be a greater detriment to the financial reporting process. Finally, our
results provide support for the recommendations within the COSO and COBIT frameworks as
well as the PCAOB standards that advocate management and board oversight and accountability
over IT controls.
We organize the rest of the paper as follows: Section 2 explores the related literature and
develops our testable hypotheses. Section 3 describes the sample used to test the hypotheses.
-
8/3/2019 Impact of SOX IT Material Weaknesses
8/52
Sections 302 and 404 of SOX require management and auditors to report on the quality
of firms internal controls over financial reporting. Through this process, firms identify and
reveal internal control material weaknesses, which the Public Company Accounting Oversight
Board (PCAOB) defines as a significant deficiency, or a combination of significant
deficiencies, that results in more than a remote likelihood that a material misstatement of the
annual or interim financial statements will not be prevented or detected (PCAOB 2004).
Therefore, a material weakness indicates that there is a major problem with a firms financial
reporting process, potentially highlighting the possibility of misstated financial statements.
In a report discussing the importance of the role of IT in the design and implementation
of internal controls, the IT Governance Institute (ITGI) states that IT is the foundation of an
effective system of internal controls over financial reporting (ITGI 2006). The Committee of
Sponsoring Organizations of the Treadway Commission (COSO 2009) makes a similar case, but
further emphasizes the importance of properly monitoring the effectiveness of IT. The PCAOB
also recognizes the importance of IT in the internal controls of financial reporting. Auditing
Standard No. 2 (and the superseding Standard No. 5) specifically states that IT controls have a
pervasive effect on the achievement of many overall objectives of the control criteria (PCAOB
2004), so auditors should understand how IT affects the firms flow of transactions and examine
the use of IT within the processes and controls. Overall, the regulatory perspective suggests that
IT plays an important role within the financial reporting system and the internal controls within
that system.
-
8/3/2019 Impact of SOX IT Material Weaknesses
9/52
correct IT material weaknesses. Common IT material weaknesses (as reported within SOX 404
reports) include lack of controls over who can initiate and approve journal entries, accounting
systems that are unable to process complicated transactions, and a lack of training to use the
accounting system software. The severity of these weaknesses can lead to the misstatement of
any account, and therefore cause a significant problem in financial reporting.
The Relation between IT Weaknesses and Executive Turnover
Extant literature provides evidence of executive and director turnover following financial
reporting failures. For example, Desai et al. (2006) find that restatements are associated with an
increased likelihood of CEO turnover, and that terminated executives have difficulty finding
similar positions at other firms following the turnover. Collins et al. (2009) show similar results
for CFOs, but also show that the labor market penalties (i.e., inability to find comparable
position) are more severe in a post-SOX era. Srinivasan (2005) shows that directors lose a
significant number of directorships following the announcement of earnings-decreasing
restatements. More recent research, including Li et al. (2010b) and Johnstone et al. (2010),
shows increased executive and director turnover in firms that report internal control material
weaknesses.
While material internal control weaknesses are associated with significant costs
(Ashbaugh-Skaife et al. 2009; Hammersley et al. (2008); Hogan and Wilkins 2008; Ye and
Krishnan 2008), it is likely that these costs are particularly great for IT material weaknesses
(relative to regular material weakness firms). For example, Klamm and Watson (2009) find that
-
8/3/2019 Impact of SOX IT Material Weaknesses
10/52
weaknesses than for firms with non-IT material weaknesses. Based on this evidence of the
impact of IT material weaknesses on the firm coupled with the evidence of executive turnover
around restatements and all types of material weaknesses, we, in turn, predict that there is a
greater likelihood of executive (CEO or CFO) and director turnover for IT weakness firms.
Therefore, our first hypothesis is as follows:
Hypothesis 1: The likelihood of CEO, CFO, and director turnover is greater for firmsthat report IT material weaknesses in internal control than for firms that report non-ITmaterial weaknesses.
The Relation between IT Weaknesses and IT Governance Changes
It is important to understand how corporate governance can affect financial reporting.
Bowen et al. (2008) find that weak governance allows management to use more discretion in
accounting information, which in turn leads to poor future performance. Farber (2005) finds an
association between the likelihood of fraud and characteristics commonly associated with weak
governance, such as few independent board members, a lack of financial expertise on the board,
and few audit committee meetings. Klein (2002) finds that firms with more independent boards
report lower levels of discretionary accruals. Larcker et al. (2007) find a positive association
between strong governance attributes and future firm performance. Finally, Krishnan (2005) and
Hoitash et al. (2009) both show that strong corporate governance decreases the likelihood of
material weaknesses in internal controls. These papers are important because they show that
strong corporate governance helps firms avoid internal control material weaknesses, thus
strengthening the financial reporting process.
-
8/3/2019 Impact of SOX IT Material Weaknesses
11/52
include hiring more independent directors and directors with financial expertise. The author
shows that following these corrective actions the firms experience in increase in stock
performance suggesting, investors appear to value governance improvements.
Extant research provides strong evidence on the consequences internal control weakness
remediation. For example, Ashbaugh-Skaife et al. (2009) find that when firms address
deficiencies in internal controls their cost of equity decreases, and Goh (2009) shows that the
timeliness of remediation is positively associated with the severity of the weakness. Goh (2009)
states that remediation is key to improving financial reporting quality and restoring investor
confidence. Li et al. (2010b) and Johnstone et al. (2010) document ways that firms attempt to
remediate material weaknesses, including replacing the CFO with a different one of higher
quality and hiring more independent directors. Following this line of research, in the case of IT
material weaknesses, we predict that firms also improve the characteristics of corporate
governance. However, we predict that not only do they try to improve the specific financial
knowledge of the firm, but since these weaknesses are IT related they will increase IT
characteristics of the firm as well. Our second hypothesis is as follows:
Hypothesis 2: Firms that report IT internal control material weaknesses are more likelyto make IT governance changes than firms that report non-IT internal control materialweaknesses.
We are also interested in the different types of IT governance changes these firms are
likely to make. First, we examine if these firms hire executives and directors with characteristics
that will improve financial reporting. Beasley (1996) shows that firms with more independent
-
8/3/2019 Impact of SOX IT Material Weaknesses
12/52
weaknesses, Li et al. (2010b) and Johnstone et al. (2010) find that following the weaknesses
firms hire executives and directors that are more qualified to remediate the weaknesses to
improve financial reporting quality. Li et al. (2010b) specifically show that firms hire CFOs with
more financial expertise and experience. We expect that firms hire executives and directors with
the right skill set to remediate any internal control material weaknesses. For that reason we
predict that firms that report IT related internal control weaknesses are more likely to hire
executives and directors with IT knowledge to remediate the IT weaknesses and improve
financial reporting quality. Specifically, our third hypothesis is as follows:
Hypothesis 3: Firms that report IT internal control material weaknesses are more likelyto hire executives and directors with IT knowledge than firms that report non-IT internal
control material weaknesses.
We also suggest that these firms proceed with other IT initiatives to improve financial
reporting. These initiatives include upgrading the IT financial reporting system, hiring an IT
executive, adding a technology committee to the board, or increasing the importance of the role
of the Chief Information Officer (CIO). The extant literature discusses how these different
initiatives can improve financial reporting. For example, Hunton et al. (2008) find that using IT
for continuous monitoring can decrease the level of real earnings management of firms. Li et al.
(2010a) find that better quality IT financial reporting systems provide higher quality information
to management. Kobelsky et al. (2008) find a positive association between IT budgets and firm
performance and shareholder returns. Finally, Masli et al. (2010) show that implementing
technology specifically used in monitoring the effectiveness of internal controls decreases the
-
8/3/2019 Impact of SOX IT Material Weaknesses
13/52
initiative changes to improve the quality of the internal control environment and financial
reporting. Specifically our fourth hypothesis is as follows:
Hypothesis 4: Firms that report IT internal control material weaknesses are more likelyto make IT initiative changes than firms that report non-IT internal control materialweaknesses.
Following Li et al. (2010a) in our final hypothesis we examine different types of IT
material weaknesses to determine how they differently affect the governance structure of firms.
These three different categories are Data Processing Integrity, Access and Security, and Structure
and Usage. Li et al (2010a) show that the Data Processing Integrity weaknesses are the most
directly aligned with the accurate and reliable production of data and find these weaknesses to
cause the greatest detriment to the information quality. Following this line of reason, we expect
the impact on the corporate governance of the firm for Data Processing Integrity weaknesses to
be greater than the Access and Security and the Structure and Usage IT weaknesses. Specifically
our fifth hypothesis is as follows:
Hypothesis 5: The turnover and remediation efforts are greatest for firms reporting DataProcessing Integrity internal control material weaknesses.
III. Sample Selection
Our sample is constructed using data from Audit Analytics, Annual COMPUSTAT
(financial statement variables), CRSP, I/B/E/S, Thomson Reuters, and SEC filings (DEF 14A,
10-K, etc.). We used Audit Analytics to identify firms that report material weaknesses in their
internal controls over financial reporting. We then used the SOX 404 reports within 10-K filings
-
8/3/2019 Impact of SOX IT Material Weaknesses
14/52
population of material weakness firms. This gives a total sample of 602 firm-year observations
where the firm reports an internal control material weakness (IT related and non-IT related). We
then collected data on management and the board of directors from proxy statements (DEF-14A)
and 10-K filings from 12 months before the year of the weakness to 24 months after the year of
the weakness. Additionally, we collected information for our control variables from
COMPUSTAT, CRSP, Thomson Reuters, and I/B/E/S. After eliminating observations with
missing information, our final sample included 578 firm year observations, 289 of which are IT
material weakness firm year observations. See Panel A of Table 1 for the sample reconciliation.
Panel B of Table 1 presents the industry classification (by two-digit SIC codes) across
our sample firms. In general, firms in our sample are from a broad spectrum of industries.
Specifically, they appear more often in the Services, Financial Institutions, and Electrical
industries. Finally, Panel C of Table 1 provides the distribution of the sample firms across years.
With the exception of 2006, the number of observations by year is around 200 and uniform
across time.
IV. Research Design
Hypothesis 1 posits a positive association between IT material weakness firms and
turnover for executives and directors. To test our first hypothesis, we run variations of the
following logistic regression model (See Table 2 for variable definitions):
Turnoveri = 0 +1IT Weaknessi,t+ 2Number of Weaknesses +3LnAssets i,t+
4Leveragei,t+ 5BTMi,t+ 6ROAi,t+ 7Lossi,t+ 8Institutional Holdingsi,t+ 9Analysti,t
+ 10Restatementi,t-1,t,t+1 + 11Board Sizei,t+ 12Board Independencei,t+ 13CEO
-
8/3/2019 Impact of SOX IT Material Weaknesses
15/52
two years following the weakness. We first examine the turnover for CEOs and CFOs. We then
run the model on different director positions: directors, chairman of the board, independent
directors, and audit committee members. Our variable of interest isIT Weakness, which is coded
1 if the firm is an IT weakness firm, and 0 otherwise. We expect the coefficient on this variable
to be positive and significant indicating that the likelihood of turnover is greater for IT weakness
firms than for non-IT weakness firms.
We include a set of control variables that prior literature shows can affect director and
management turnover. Ferris et al. (2003) show that the likelihood of turnover increases with
firm size, therefore we predictLnAssets to be positively associated with Turnover. We include
the totalNumber of Weaknessesbecause firms with more material weaknesses reported are more
likely to have an IT weakness. We includeLeveragebecause greater debt levels translate into
additional monitoring by creditors, who could influence the dismissal of poor performing
management and directors (Agrawal and Cooper 2007). We therefore predictLeverage to be
positively associated with Turnover. Since firms with low valuations experience a greater level
of turnover we expectBTMto be positively associated with Turnover. Prior literature also shows
that turnover is more likely for firms with poor operating performance (Weisbach 1988 and
Yermack 2004). Therefore, we expectROA to be negatively associated andLoss to be positively
associated with Turnover.
Following Johnstone et al. (2010), we include the variables Institutional Holdings and
Analystas a control that outsiders provide additional monitoring for the firm. Therefore, we
-
8/3/2019 Impact of SOX IT Material Weaknesses
16/52
Turnover. Extant literature provides mixed evidence regarding how the size of the board affects
corporate governance (Jensen 1993), so we make no prediction about the direction ofBoard Size.
Research also argues that independent boards are more likely to remove poor performers from
both management and the board (Jensen 1993); thus, we expectBoard Independence to be
positively associated with all measures ofTurnover. We include CEO Chairmanbecause as
discussed by Jensen (1993), when the CEO also serves as the board chair they are more
entrenched, so we expect this variable to be negatively associated with management turnover and
positively associated with director turnover. Finally, we include a set of control variables that
represent different high and low technology industries to control for any effects these IT
intensive industries have on our results (Kobelsky et al. 2008). These variables areAutomate,
Transform, High Tech, andLow Tech.
In additional analysis, we investigate whether certain types of IT SOX 404 material
weaknesses will have a greater impact on turnover. Therefore, following Li et al. (2010a), we
categorize IT material weaknesses across three dimensions: a) Data Processing Integrity, b)
System Access and Security, and c) System Structure and Usage. As discussed by Li et al.
(2010a), the three categories were developed by integrating the prior data quality literature,
auditing standards (i.e., AS5), and IT professional guidance. Detailed examples of the IT controls
and the coding of the categories appear in Appendices A and B. When examining the association
of the IT material weakness categories and turnover, we include the following independent
variables:Data Processing Integrity, System Access and Security, and System Structure and
-
8/3/2019 Impact of SOX IT Material Weaknesses
17/52
Hypothesis 2 posits a positive association between IT material weakness firms and IT
governance changes. To test our second hypothesis, we run variations of the following logistic
regression model (See Table 2 for variable definitions):
IT Governance Changei = 0 +1IT Weaknessi,t+2 Number of Weaknesses + 3LnAssets i,t+ 4ROAi,t+ 5Avg Sales Growthi,t+ 6Leveragei,t+ 7Uncertaintyi,t+
8Automatei,t+ 9Transformi,t+ 10High Techi,t+ 11Low Techi,t+ 12Foreigni,t+
13Mergeri,t+ 14Restructuringi,t+ 15Product Differentiationi,t+ 16Cost Leadershipi,t.
(2)
In this model, we examine the probability of a firm making changes to its IT governance
structure. We use two different dependent variables. First,IT Governance Change is definedas
an indicator variable set equal to 1 if the firm made any changes to its IT governance, and 0
otherwise. Second, Count of IT Governance Changes represents the number of changes the firm
makes to the IT governance. The specific IT governance changes that we examine include the
following: replacement of CEO with IT knowledge (CEO IT Knowledge); replacement of CFO
with IT knowledge (CFO IT Knowledge); hiring of chairman of the board of directors with IT
knowledge (Chairman IT Knowledge); hiring of audit committee members with IT knowledge
(Audit Committee IT Knowledge); hiring of directors with IT knowledge (Director IT
Knowledge); upgrading the IT (IT Upgrade); and upgrading IT management (IT Management).
We ascertain if an executive or board members possess IT knowledge by reading their
biographies in the firms proxy statements (form DEF 14A). An executive (board member) is
said to have IT Knowledge if he/she has prior experience as a CIO (or other IT-related
management positions), has previously worked in an IT/technology firm, or has IT-related
-
8/3/2019 Impact of SOX IT Material Weaknesses
18/52
an upgrade to IT management includes hiring an IT specific executive, adding a technology
committee to the board, or promoting the CIO position to become one of the top-five paid
executives of the firm.
Our variable of interest is againIT Weakness. We expect the coefficient to be positive
and significant because we expect firms to make more IT governance changes in response to the
IT material weaknesses to remediate the IT control problems within the financial reporting
process. When examining the association between IT material weakness categories and IT
governance changes, we substitute IT Weakness with the following independent variables:Data
Processing Integrity, System Access and Security, and System Structure and Usage.
We include a set of control variables that we expect will influence IT governance
changes. We includeLnAssetsbecause we predict that size affects a firms ability or desire to
make IT governance changes. We do not make a sign prediction for size. We expectROA to be
positively associated with IT changes, because profitable companies have more resources to
invest in IT changes. Dewan et al. (1998) find that firms with higher sales growth tend to under-
invest in IT, and we therefore expectAvg Sales Growth to be negatively associated with IT
governance changes. High debt levels can constrain a firms resources, so we therefore predict a
negative association forLeverage. We include Uncertainty, because we expect firms with higher
levels of risk to use more IT to help mitigate some of the risk. We therefore expect a positive
sign on the coefficient forUncertainty. We follow Chatterjee et al. (2001) in using theAutomate
and Transform variables determined at the industry level. These indicator variables provide
-
8/3/2019 Impact of SOX IT Material Weaknesses
19/52
scheme similar to Francis and Schipper (1999) to designateHigh Tech andLow Tech firms. We
expect High Tech firms to be more likely to make IT changes since these companies are more
likely to use IT in every day operations. We make no prediction forLow Tech firms because it is
not obvious whether these firms will avoid IT changes because they feel they are unnecessary, or
they will make the changes because they are obviously lacking IT. Finally, prior research
suggests that enterprise IT initiatives and IT management structure often require alignment with
the firms business strategies (e.g., Floyd and Wooldridge 1990; Banker et al. 2010). Therefore,
we include the following set of variables to control for business strategies that companies may
employ: Foreign, Merger Restructuring, Product Differentiation, and Cost Leadership. We make
no directional predictions about these variables.
Hypothesis 3 posits a positive association between IT material weakness firms and the
replacement (hiring) of executives (directors) with IT knowledge. To test our third hypothesis,
we run variations of the following logistic regression model (See Table 2 for variable
definitions)5:
IT Knowledgei = 0 +1IT Weaknessi,t+ 2Number of Weaknesses + 3LnAssets i,t+4ROAi,t+ 5Avg Sales Growthi,t+ 6Leveragei,t+ 7Uncertaintyi,t+ 8Automatei,t+9Transformi,t+ 10High Techi,t+ 11Low Techi,t+ 12Foreigni,t+ 13Mergeri,t+14Restructuringi,t+ 15Product Differentiationi,t+ 16Cost Leadershipi,t.
(3)Equation 3 follows the model in Equation 2, except we are specifically examining the changes in
IT knowledge for executives and directors. We run Equation 3 five different times to examine
the various changes in IT knowledge within the firm. We first run the model examining changes
-
8/3/2019 Impact of SOX IT Material Weaknesses
20/52
the IT knowledge for Chairman of the Board, directors in general, and audit committee members.
We measure Chairman IT knowledge similar to the executives in that we are only interested in
firms that changed from not having IT knowledge before the internal control weakness to hiring
a person with IT knowledge in response to the material weakness. We consider director (audit
committee) IT knowledge change to be positive if after the material weakness, the firm employs
additional directors (audit committee members) with IT knowledge than they did before the
material weakness. Find examples of biographies of executives and directors that possess IT
knowledge in Appendix C.
IT Weakness is again our variable of interest, and we expect it to be positive and
significant. We predict that IT material weakness firms will hire executives and directors with IT
knowledge in an effort to remediate problems that IT weaknesses generate within the financial
reporting process. When examining the association between IT material weakness categories and
IT knowledge changes, we substitute IT Weakness with the following independent variables:
Data Processing Integrity, System Access and Security, and System Structure and Usage.Finally,we include the same control variables used in Equation 2 for Equation 3.
Hypothesis 4 posits a positive association between IT material weakness firms and IT
initiative changes. To test our fourth hypothesis, we run variations of the following logistic
regression model (See Table 2 for variable definitions)5:
Major IT Initiativesi = 0 +1IT Weaknessi,t+2Number of Weaknesses + 3 Sum of ITKnowledge Score i,t+ 4LnAssets i,t+ 5ROAi,t+ 6Avg Sales Growthi,t+ 7Leveragei,t+
8Uncertaintyi,t+ 9Automatei,t+ 10Transformi,t+ 11High Techi,t+ 12Low Techi,t+
-
8/3/2019 Impact of SOX IT Material Weaknesses
21/52
Equation 4 follows the model in Equation 2. However, in Equation 4, we are interested in
examining IT governance changes related to IT upgrades and IT management. We examine four
categories of IT upgrades, which include General IT (IT Upgrade), Financial (Financial IT
Upgrade), Accounting (Accounting IT Upgrade), and Non-Financial (Non-Financial IT
Upgrade). Any upgrade to the IT is included in the general IT upgrade. Upgrades specific to the
financial functions of the firm are included in the Financial upgrades. Accounting upgrades are
financial upgrades that specifically mention changes to the AIS. All other IT upgrades are
included in the Non-Financial upgrades. We include examples of IT upgrades and its categories
in Appendix D. Finally, we define an IT management upgrade to be present when the firm hires
an IT specific executive, adds a technology committee to the board, or promotes the CIO to
become one of the top five paid executives.
We again useIT Weakness as our variable of interest, and we expect it to be positive and
significant. When examining the association between IT material weakness categories and IT
knowledge changes, we substitute IT Weakness with the three categories of IT material
weaknesses (Data Processing Integrity, System Access and Security, and System Structure and
Usage).Finally, in Equation 4, we include the same control variables used in Equation 2 with theexception ofSum of IT Knowledge Score. This variable is a count of the total number of IT
knowledge changes the firm has undertaken. We include this variable because it is likely that the
new IT knowledge executive or director will make other IT changes to the firm.
V. Results
-
8/3/2019 Impact of SOX IT Material Weaknesses
22/52
structure and usage, respectively.6 For the control variables, compared to control firms, IT
material weakness firms are generally smaller, less profitable, have lower institutional holdings,
have less analyst following, have less independent directors, less likely to have the CEO as
chairman of the board, have a greater cost leadership, and have a higher sum of IT knowledge
score.
Table 3, Panel B, presents the univariate statistics for the executive and director turnover
variables. As Panel B shows, the CEO and CFO turnover rates in IT material weakness firms
(49.1% and 75.4%) are significantly higher (p< 0.01) than the control-firm CEO and CFO
turnover rates (34.9% and 52.2%). In addition, IT material weakness firms experienced
significantly higher (p
-
8/3/2019 Impact of SOX IT Material Weaknesses
23/52
difference). Moreover, IT material weakness (control) firms complete changes to 1.179 (0.502)
components of their IT governance (p
-
8/3/2019 Impact of SOX IT Material Weaknesses
24/52
positive and significant (p
-
8/3/2019 Impact of SOX IT Material Weaknesses
25/52
IT weakness firms without data processing integrity issues) have a 16.9% and 15.8% greater
likelihood of chairman of the board and independent director turnover, respectively. In addition
the coefficient for System Structure and Usage in regards to audit committee turnover is
significant (p
-
8/3/2019 Impact of SOX IT Material Weaknesses
26/52
Thus, the results imply that IT material weakness firms, compared to control firms, are more
likely replace their CEOs and CFOs with executives that possess IT knowledge. When we
estimate the marginal effects (dy/dx), our results suggest that, after controlling for other
important economic determinants, IT material weakness firms are 1.3% and 4.9% more likely to
replace their CEOs and CFOs, respectively, with individuals possessing IT knowledge. In
models 3 and 4 of Table 6, we use our three classification measures of IT material weaknesses.
The results show no significance on any of the tree classification measures.
Table 7 reports the results of estimation of the change in chairman of the board, director,
and audit committee IT knowledge models. The coefficient forIT Weakness is positive and
significant (p
-
8/3/2019 Impact of SOX IT Material Weaknesses
27/52
integrity issues are 4.49% more likely to replace their chairman of the board with an individual
having IT knowledge
In Table 8, we estimate several variations of our major IT initiative models. The
coefficient forIT Weakness is positive and significant (p
-
8/3/2019 Impact of SOX IT Material Weaknesses
28/52
for model 8, suggesting that IT material weakness firms with data processing integrity issues are
more likely to upgrade their accounting IT. When we estimate the marginal effects (dy/dx), our
results suggest that, after controlling for other important economic determinants, IT material
weakness firms with data processing integrity issues are 18.9% more likely to upgrade their
accounting IT.
Additional Analysis
We find that IT material weakness firms, compared to control firms, are more likely to
replace executives with individuals with IT knowledge as well as make major IT initiative
changes. In subsequent analysis, we examine whether IT weakness firms that undergo such
remediation efforts are better able to remediate their internal control weaknesses. Table 9 reports
results of OLS models that regress the change in the total count of material weaknesses from t to
t+2 on IT knowledge changes, major IT initiative changes, and control variables.7 As shown in
Model 1 of Table 9, the coefficient ofAny IT Knowledge Change is negative and significant
(p
-
8/3/2019 Impact of SOX IT Material Weaknesses
29/52
accounting restatements and material weaknesses in internal control over financial reporting. Our
study extends this literature by examining a unique failure of the financial reporting system.
Specifically we examine IT related internal control material weaknesses, because the evidence
suggests these weaknesses can be more detrimental to firms than other weaknesses.
In this study, we compare the remediation efforts of firms that report IT material
weaknesses to firms that report non-IT weaknesses. We find that the IT weakness firms have
higher levels of turnover of both executives and directors. This suggests that the firms are
punishing these executives and directors for the problems that IT weaknesses cause within the
financial reporting process. We also find that these firms follow this turnover with greater
remediation efforts by making changes to the corporate governance structure. Specifically, we
document that these firms replace (add) outgoing executives (directors) with individuals
possessing IT knowledge, and thus should have a better understanding of the IT weaknesses. In
addition, the IT weakness firms are more likely to upgrade their financial reporting IT and make
other IT initiative changes. However, we find evidence suggesting that IT weakness firms that
replace their CFO (and add directors) with IT knowledge are associated with successful
remediation of internal control weaknesses.
Overall, the evidence suggests that firms do recognize the importance of the role IT plays
within the financial reporting process. In the event of a failure, firms go to great lengths to
remediate the problems. We urge officers and directors of the firm to understand the importance
of IT in the financial reporting process and suggest they maintain strong oversight not just in
References
-
8/3/2019 Impact of SOX IT Material Weaknesses
30/52
References
Agrawal, A., and T. Cooper. 2007. Corporate governance consequences of accounting scandals:Evidence from top management, CFO and auditor turnover. Working paper, University ofAlabama.
Ashbaugh-Skaife, H., D. Collins, W. Kinney, and R. LaFond. 2009. The effect of SOX internalcontrol deficiencies on firm risk and cost of equity.Journal of Accounting Research 47(1): 1-43.
Banker, R. D., N. Hu, J. Luftman, and P. Pavlou. 2010. CIO reporting structure, strategic positioning, and firmperformance: To whom should the CIO report? Working paper, Temple University, University ofWisconsin, and Stevens Institute of Technology.
Bart, C., and O. Turel. 2010. IT and the board of directors: An empirical investigation into the governancequestions Canadian board members ask about IT.Journal of Information Systems 24 (2): 147-172.
Beasley, M. S. 1996. An empirical analysis of the relation between the board of director composition andfinancial statement fraud. The Accounting Review 71 (4): 443-465.
Bedard, J. C., M. L. Ettredge, and K. M. Johnstone. 2007. Using electronic audit workpaper systems in audit
practice: Task analysis, learning, and resistance.Advances in Accounting Behavioral Research 10: 2953.
Bible, L., L. Graham, and A. Rosman. 2005. Comparing auditors performance in paper and electronic workenvironments.Journal of Accounting, Auditing & Finance (March): 27-42.
Bowen, R., S. Rajgopal, and M. Venkatachalam. 2008. Accounting discretion, corporategovernance, and firm performance. Contemporary Accounting Research 25 (2): 351-405.
Brazel, J. F., C. P. Agoglia, and R. C. Hatfield. 2004. Electronic versus face-to-face review: The effects ofalternative forms of review on auditors performance. The Accounting Review 79 (4): 949-966.
Chatterjee, D. C., V. J. Richardson, and R. Zmud. 2001. Examining the shareholder effects of new CIO positionannouncements.Management Information Systems Quarterly 25 (1): 43-70.
Collins, D., A. Masli, A. L. Reitenga, and J. M. Sanchez. 2009. Earnings restatements the Sarbanes-Oxley Actand the disciplining of Chief Financial Officers. The Journal of Accounting, Auditing, and Finance 24(1): 1-34.
Committee of Sponsoring Organizations of the Treadway Commission (COSO). 1992.Internal Control-Integrated Framework. New York, NY: AICPA.
DeFond M L R N Hann and X Hu 2004 Does the market value financial expertise on audit committees of
-
8/3/2019 Impact of SOX IT Material Weaknesses
31/52
DeFond, M. L., R. N. Hann, and X. Hu. 2004. Does the market value financial expertise on audit committees ofboards of directors?Journal of Accounting Research 43 (2): 153-193.
Dehning, B., and V. J. Richardson. 2002. Returns on investments in information technology: A researchsynthesis.Journal of Information Systems 16 (1): 7-30.
Deloitte & Touche LLP. Why information technology controls can't be ignored. 2005 [cited May 10 2011].Available fromhttp://www.deloitte.com/view/en_CA/ca/services/ceocfocertification/article/2b21cb79791fb110VgnVCM100000ba42f00aRCRD.htm.
Desai, H., C. Hogan, and M. Wilkins. 2006. The reputational penalty for aggressive accounting:earnings restatements and management turnover. The Accounting Review 81 (1): 83-112.
Dewan, S., S. C. Michael, and C. Min. 1998. Firm characteristics and investments in information technology:Scale and scope effects.Information Systems Research 9 (3): 219-232.
Dowling, C. 2009. Appropriate audit support system use: The influence of auditor, audit team and firm factors.The Accounting Review 84 (3): 771-810.
, and S. A. Leech. 2007. Audit support system design and decision aids: Current practice and
opportunities for future research.International Journal of Accounting Information Systems 8: 92-116.
Doyle, J., W. Ge, and S. McVay. 2007. Determinants of weaknesses in internal control over financial reporting.Journal of Accounting and Economics 44: 193-223.
Farber, D. B. 2005. Restoring trust after fraud: Does corporate governance matter? The Accounting Review 80(2): 539-561.
Ferris, S., M. Jagannathan, and A. Pritchard. 2003. Too busy to mind the business? Monitoringby directors with multiple board appointments.Journal of Finance 48: 1087-1112.
Floyd, S. W., and B. Wooldridge. 1990. Path analysis of the relationship between competitive strategy,information technology, and financial performance.Journal of Management Information Systems 7 (1):47-64.
Francis, J., and K. Schipper. 1999. Have financial statements lost their relevance?Journal of Accounting
Research 37 (2): 319-352.
Ge, W., and S. McVay. 2005. The disclosure of material weaknesses in internal control after the Sarbanes-Oxley Act.Accounting Horizons 19 (3): 137-158.
Goh B W 2009 Audit committees boards of directors and remediation of material weaknesses
Hennes, K., A. Leone, and B. Miller. 2008. The importance of distinguishing errors from irregularities in
-
8/3/2019 Impact of SOX IT Material Weaknesses
32/52
Hennes, K., A. Leone, and B. Miller. 2008. The importance of distinguishing errors from irregularities inrestatement research: The case of restatements and CEO/CFO turnover. The Accounting Review 83 (6):1487-1519.
Hogan, C., and M. Wilkins. 2008. Evidence on the audit risk model: Do auditors increase audit
fees in the presence of internal control deficiencies? Contemporary Accounting Research25: 219-242.
Hoitash, U., R. Hoitash, and J. Bedard. 2009. Corporate governance and internal control overfinancial reporting: A comparison of regulatory regimes. The Accounting Review 84 (3):839-867.
Hunton, J. E., B. Lippincott, and J. L. Reck. 2003. Enterprise resource planning systems: Comparing firm
performance of adopters and nonadopters.International Journal of Accounting Information Systems 4:165-184.
, E. G. Mauldin, and P. R. Wheeler. 2008. Potential functional and dysfunctional effects of continuousmonitoring. The Accounting Review 83 (6): 1551-1569.
Information Technology Governance Institute (ITGI). 2006.ISACA/ITGI Response to SEC Concept Release.Rolling Meadows, IL: Information Systems Assurance and Control Association (ISACA).
. 2007. COBIT 4.1. Rolling Meadows, IL. Available on-line on March 28, 2008 at:http://www.isaca.org/Template.cfm?Section=COBIT6&Template=/TaggedPage/TaggedPageDisplay.cf
m&TPLID=55&ContentID=7981
Jensen, M. 1993. The modern industrial revolution, exit and the failure of internal controlsystems.Journal of Finance 48: 831-880.
Johnstone, K, C. Li, and K. Rupley. 2010. Changes in corporate governance associated with the revelation ofinternal control material weaknesses and their subsequent remediation. Contemporary AccountingResearch, Forthcoming.
Klamm, B. K., and M. W. Watson. 2009. SOX 404 reported internal control weaknesses: A test of COSOframework components and information technology.Journal of Information Systems 23 (2) Fall: 1-23.
Klein, A. 2002. Audit committees, board of director characteristics, and earnings management.Journal of Accounting and Economics 33: 375-400.
Kobelsky, K., V. J. Richardson, R. E. Smith, and R. W. Zmud. 2008. Determinants and consequences of firminformation technology budgets. The Accounting Review 83 (4): 957-995.
Li, C., G. Peters, V. J. Richardson, and M. W. Watson. 2010a. The consequences of information technology
-
8/3/2019 Impact of SOX IT Material Weaknesses
33/52
, , , , q gycontrol weaknesses on management information systems: The case of Sarbanes-Oxley internal controlreports.Management Information Systems Quarterly, Forthcoming.
, L. Sun, and M. Ettredge. 2010b. Financial executive quality, financial executive turnover,
and adverse SOX 404 opinions.Journal of Accounting and Economics, Forthcoming.
Masli, A., G. Peters, V. J. Richardson, and J. M. Sanchez. 2010. Examining the potential benefits of internalcontrol monitoring technology. The Accounting Review 85 (3): 1001-1034.
Messier, W. 1995. Research in and development of audit-decision aids. InJudgment and Decision-MakingResearch in Accounting and Auditing, edited by Ashton, R., and A. Ashton, 207-230. New York, NY:Cambridge University Press.
Nolan, R. and F. W. McFarlan. 2005. Information technology and the board of directors.Harvard BusinessReview October 2005: 1-11.
ODonnell, E., and J. David. 2000. How information systems influence user decisions: A research frameworkand literature review.International Journal of Accounting Information Systems 1 (3): 178-203.
, and J. J. Schultz. 2003. The influence of business-process-focused audit support software on analytical
procedures judgments.Auditing: A Journal of Practice & Theory 22 (2): 265-279.
Public Company Accounting Oversight Board (PCAOB). 2004.An Audit of Internal Control over FinancialReporting Performed in Conjunction with an Audit of Financial Statements. Auditing Standard No. 2.Washington, D.C.: PCAOB.
. 2007.An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit ofFinancial Statements. Auditing Standard No. 5. Washington,D.C.: PCAOB.
Srinivasan, S. 2005. Consequences of financial reporting failure for outside directors: Evidencefrom accounting restatements and audit committee members.Journal of AccountingResearch 43 (2): 291-334.
Weisbach, M. 1988. Outside directors and CEO Turnover.Journal of Financial Economics 20:431-460.
Ye, Z. and J. Krishnan. 2008. Weak internal controls, auditor fees, and shareholderdissatisfaction. Working paper, Kennesaw State University.
Yermack, D. 2004. Remuneration: Retention and reputation incentives for outside directors.Journal of Finance 59: 2281-2308.
Table 1
-
8/3/2019 Impact of SOX IT Material Weaknesses
34/52
Sample Selection and Distribution
Panel A: Sample reconciliation
Firm year observations identified with IT Material Weaknesses 305
Less: Firms for which no DEF 14A or 10-K was found 9Less: Firms not in the Compustat Database 7
Final # of IT Material Weakness firm year observations 289
Random sample of non-IT Material Weakness firm year observations 289
Final # of firm year observations 578
Panel B: Industry representation
Industry2-Digit SIC
Code n % Total
Chemicals 28-29 36 6.23%
Electrical 36, 38 77 13.32%
Equipment 35 33 5.71%
Financial Institutions 60-65, 67 84 14.53%
Healthcare 80, 82 25 4.33%Media 27, 48 27 4.67%
Oil 13, 46 18 3.11%
Retail Sales 50-59 51 8.82%
Services 70-79 118 20.42%
All Others All Others 109 18.86%
Total 578 100%
Panel C: Year distribution
Year n % of Total
2004 205 35.47%2005 201 34.78%2006 172 29.76%
Total 578 100%
Table 2. Variable Definitions
-
8/3/2019 Impact of SOX IT Material Weaknesses
35/52
Panel A: Turnover Dependent Variable Definitions
Variable Definition
CEO Turnover Equals one if there is CEO turnover in year t, t+1, or t+2; zero otherwise.
CFO Turnover Equals one if there is CFO turnover in year t, t+1, or t+2; zero otherwise.
Chairman TurnoverEquals one if there is Chairman of the board of directors turnover in year t, t+1, ort+2; zero otherwise.
Director Turnover Equals one if there is any director turnover in year t, t+1, or t+2; zero otherwise.Independent DirectorTurnover
Equals one if there is any independent director turnover in year t, t+1, or t+2; zerootherwise.
Audit Committee
Turnover
Equals one if there is any audit committee turnover in year t, t+1, or t+2; zero
otherwise.
Panel B: IT Governance Change Dependent Variable Definitions
Variable Definition
Any IT GovernanceChange
Equals one if the firm hires any managers or directors with IT knowledge or makesan IT Initiative Change in year t, t+1, or t+2; zero otherwise.
Count of ITGovernance Changes
Equals a count of the number of IT changes made in year t, t+1, or t+2. Thisvariable can range from 0 to 7.
CEO IT Knowledge Equals one if the firm replaced a NON-IT knowledge CEO with an IT KnowledgeCEO in year t, t+1, or t+2 ; zero otherwise.
CFO IT KnowledgeEquals one if the firm replaced a NON-IT knowledge CFO with an IT KnowledgeCFO in year t, t+1, or t+2 ; zero otherwise.
Chairman ITKnowledge
Equals one if the firm replaced a NON-IT knowledge BOD Chairman with an ITKnowledge BOD Chairman in year t, t+1, or t+2 ; zero otherwise.
Director ITKnowledge
Equals one if the firm hired at least one director with IT knowledge in year t,t+1, ort+2 ; zero otherwise.
Audit Committee ITKnowledge
Equals one if the firm hired at least one audit committee member with ITknowledge in year t,t+1, or t+2 ; zero otherwise.
IT Upgrade Equals one if the firm upgraded their IT; zero otherwise
Financial IT Upgrade Equals one if the firm upgraded their financial reporting IT; zero otherwise
Accounting ITUpgrade
Equals one if the firm upgraded their accounting IT; zero otherwise
Non-Financial IT
Upgrade Equals one if the firm upgraded their non-financial reporting IT; zero otherwise
IT ManagementEquals one hired an IT executive, added a technology committee, or moved the CIOto be a top 5 executive in year t,t+1, or t+2; zero otherwise.
Panel C: Independent Variables
-
8/3/2019 Impact of SOX IT Material Weaknesses
36/52
Variable Definition
Main Independent
Variables
IT Weakness FirmEquals one if the firm reported and IT material weakness in internal controls in year
t; zero otherwise.Data ProcessingIntegrity Equals one if a firm has ITMW related to data processing integrity; zero otherwise.System Access andSecurity
Equals one if a firm has ITMW in the data quality dimension of access; zerootherwise.
System Structure andUsage Equals one if a firm has ITMW in IT structure quality dimensions; zero otherwise.
Control Variables
Number ofWeaknesses
Equal to the total number of SOX 404 material weaknesses in internal controlreport by the firm in year t.
LnAssets Equal to the natural log of total assets in year t.
Leverage Equals to total debt divided by total assets in year t.
BTM Equals to the book to market ratio in year t.
ROAEquals to the return on assets calculated as net income divided by total assets inyear t.
Loss Equals one if the company reports a net loss in year t; zero otherwise.Institutional Holdings
Equals to the proportion of institutional shareholdings of common stock in the firmin year t.
Analyst Equals to the average number of analysts following the firm in year t.
RestatementEquals one if the company reports a restatement in year t-1, t, or t+1; zerootherwise.
Board Size Equals to the number of directors serving on the board in year t.
Board Independence Equals to the proportion of independent directors serving on the board in year t.
CEO Chairman Equals one if the CEO is also the chairman of the board in year t; zero otherwise.
Avg Sales GrowthEquals average sales growth for t-1 and t. (sales growth is calculated as sales in yeart/ sales in year t-1)
UncertaintyEquals the standard deviation of earnings before extraordinary items for previousfive years scaled by sales
Automate Equals one if automate industry IT role, zero otherwise.
Transform Equals one if transform industry IT role, zero otherwise.
High Tech Equals one if high-tech industry, zero otherwise.Low Tech Equals one if low-tech industry, zero otherwise.
Foreign Equals one if the firm engaged in foreign transactions, zero otherwise.
Merger Equals one if the firm engaged in mergers and acquisitions, zero otherwise.
Restructuring Equals one if the firm engaged in restructuring activity, zero otherwise.
Table 3. Selected Summary Statistics for IT Material Weakness and Non-IT Material Weakness Firms
-
8/3/2019 Impact of SOX IT Material Weaknesses
37/52
Panel A: Descriptive statistics for control variables
IT Weakness Firms Non-IT Weakness Firms
N= 289 N= 289 p-value
Variables Mean Median Mean Median Diff
Data Processing Integrity 0.716 1
System Access and Security 0.512 1
System Structure and Usage 0.208 0
Number of Weaknesses 3.888 3 1.594 1
-
8/3/2019 Impact of SOX IT Material Weaknesses
38/52
Panel C: Descriptive statistics for change in IT governance variables
IT Weakness Firms Non-IT Weakness Firms
n= 289 n= 289 p-value
Variables Mean Median Mean Median Diff
Any Change to IT Governance 0.675 1 0.349 0
-
8/3/2019 Impact of SOX IT Material Weaknesses
39/52
(Note:Controlvariablesincludedintheregressionappearonthenextpage)
The sample consists of IT and non-IT material weakness firm-year observations. The dependent variableis an indicator variable set equal to one if there was turnover in the specified position in any of the yearst, t+1, and t+2.
Panel A. Executive and director turnover
Model 1 Model 2 Model 3 Model 4 Model 5 Model 6
Variables PredCEO
TurnoverCFO
TurnoverDirectorTurnover
CEOTurnover
CFOTurnover
DirectorTurnover
IT Weakness + 0.338** 0.738*** 0.982***(0.047) (0.000) (0.000)
IT WeaknessClassification
Data ProcessingIntegrity
+ 0.438** 0.629** 0.733***
(0.047) (0.014) (0.005)System Access andSecurity
+ -0.516 -0.021 0.014
(0.968) (0.528) (0.481)
System Structure andUsage
+ 0.156 -0.258 0.082
(0.318) (0.738) (0.408)
Table 4 Panel A continued
Model 1 Model 2 Model 3 Model 4 Model 5 Model 6
-
8/3/2019 Impact of SOX IT Material Weaknesses
40/52
Model 1 Model 2 Model 3 Model 4 Model 5 Model 6
Variables PredCEO
Turnover
CFO
Turnover
Director
Turnover
CEO
Turnover
CFO
Turnover
Director
TurnoverControl Variables
Number of Weaknesses + 0.103*** 0.164*** -0.079 0.128*** 0.193*** -0.059(0.006) (0.002) (0.973) (0.002) (0.001) (0.911)
LnAssets + -0.094 -0.045 -0.076 -0.092 -0.035 -0.056
(0.904) (0.717) (0.831) (0.897) (0.669) (0.760)
Leverage + 0.139 -0.533 -0.565 0.113 -0.578 -0.629
(0.352) (0.891) (0.912) (0.379) (0.908) (0.932)
BTM + 0.022* 0.032** -0.559 0.025* 0.032** -0.597
(0.089) (0.019) (0.999) (0.085) (0.018) (0.999)
ROA - 0.155 -0.082 0.225 0.132 -0.092 0.214
(0.786) (0.386) (0.841) (0.750) (0.377) (0.833)
Loss + 0.384** 0.494** 0.069 0.363** 0.483** 0.054
(0.027) (0.012) (0.374) (0.035) (0.014) (0.400)
Institutional Holdings + -0.408 -0.612 0.482* -0.440 -0.613 0.494*
(0.885) (0.959) (0.086) (0.899) (0.962) (0.080)
Analyst + 0.010 0.034** -0.004 0.010 0.032* -0.005
(0.314) (0.049) (0.578) (0.314) (0.054) (0.599)
Restatement + -0.094 0.391** 0.614*** -0.162 0.352** 0.564***
(0.687) (0.027) (0.001) (0.794) (0.042) (0.003)
Board Size ? 0.167*** -0.022 0.136*** 0.167*** -0.021 0.133**
(0.000) (0.607) (0.009) (0.000) (0.624) (0.011)
Board Independence + -0.627 -0.047 -0.729 -0.816 -0.245 -0.995
(0.836) (0.529) (0.853) (0.902) (0.647) (0.930)
CEO Chairman -/+ 0.147 -0.177 0.918*** 0.153 -0.175 0.855***
(0.702) (0.278) (0.004) (0.709) (0.272) (0.006)
Automate ? -0.053 0.999* 0.153 -0.055 0.965* 0.132
(0.904) (0.058) (0.753) (0.897) (0.074) (0.780)Transform ? 0.753*** 0.184 -0.016 0.725*** 0.143 -0.055
(0.006) (0.520) (0.957) (0.008) (0.610) (0.845)
High Tech ? 0.306 -0.115 -0.248 0.256 -0.138 -0.289
(0.168) (0.628) (0.293) (0.255) (0.556) (0.215)
Low tech ? 0.225 0.007 0.316 0.179 -0.102 0.229
(0.669) (0.989) (0.578) (0.729) (0.833) (0.685)
Intercept -1.590** -0.196 0.175 -1.311** 0.013 0.472
(0.018) (0.766) (0.809) (0.050) (0.984) (0.515)Year Indicator Included Included Included Included Included Included
Number of observations 578 578 578 578 578 578
Model 2 42.29 61.35 65.47 43.58 55.00 54.51
Pseudo R2 0.067 0.111 0.101 0.069 0.104 0.087
Correctly Classified 0 634 0 692 0 688 0 634 0 697 0 689
P l B T f di t t
-
8/3/2019 Impact of SOX IT Material Weaknesses
41/52
Panel B. Type of director turnover
Model 1 Model 2 Model 3 Model 4 Model 5 Model 6
Variables Pred
Chairman
of BODTurnover
Independent
DirectorTurnover
Audit
CommitteeTurnover
Chairman
of BODTurnover
Independent
DirectorTurnover
Audit
CommitteeTurnover
IT Weakness + 0.966*** 0.951*** 0.216(0.001) (0.000) (0.155)
IT Weakness
Classification
DataProcessing
Integrity
+ 1.169*** 0.679*** 0.107
(0.000) (0.004) (0.351)SystemAccess andSecurity
+ -0.476 0.132 -0.002
(0.922) (0.315) (0.502)SystemStructure and
Usage
+ -0.199 0.009 0.486*
(0.687) (0.489) (0.071)
Table 4 Panel B Continued
Model 1 Model 2 Model 3 Model 4 Model 5 Model 6
Chairman Independent Audit Chairman Independent Audit
-
8/3/2019 Impact of SOX IT Material Weaknesses
42/52
Variables Pred
Chairman
of BOD
Turnover
Independent
Director
Turnover
Audit
Committee
Turnover
Chairman
of BOD
Turnover
Independent
Director
Turnover
Audit
Committee
Turnover
Control Variables
Number of Weaknesses + 0.017 -0.088 -0.079 0.038 -0.072 -0.085(0.347) (0.989) (0.969) (0.217) (0.965) (0.973)
LnAssets + 0.029 -0.025 -0.001 0.063 -0.003 0.005(0.379) (0.631) (0.505) (0.260) (0.518) (0.524)
Leverage + 0.024 -0.352 -0.142 -0.062 -0.430 -0.146(0.480) (0.798) (0.631) (0.550) (0.846) (0.634)
BTM + -0.414 -0.474 -0.254 -0.444 -0.507 -0.237(0.996) (0.979) (0.983) (0.995) (0.984) (0.973)
ROA - -0.120 0.253 0.081 -0.148 0.231 0.064
(0.314) (0.805) (0.643) (0.271) (0.797) (0.620)Loss + 0.185 0.243 0.034 0.174 0.221 -0.001
(0.234) (0.120) (0.436) (0.251) (0.139) (0.503)
Institutional Holdings + 0.177 0.680** -0.153 0.175 0.691** -0.174(0.348) (0.021) (0.669) (0.348) (0.019) (0.690)
Analyst + 0.013 -0.004 -0.012 0.014 -0.004 -0.011(0.307) (0.583) (0.717) (0.299) (0.584) (0.699)
Restatement + 0.460* 0.395** 0.469** 0.400* 0.361** 0.469**(0.051) (0.021) (0.011) (0.077) (0.032) (0.011)
Board Size ? 0.111** 0.171*** 0.079* 0.113** 0.169*** 0.078*(0.040) (0.000) (0.063) (0.042) (0.000) (0.064)
Board Independence + 1.329 1.714*** 0.618 0.946 1.415** 0.530(0.121) (0.005) (0.189) (0.195) (0.013) (0.222)
CEO Chairman + 0.088 0.518** 0.524** 0.073 0.452* 0.506**(0.410) (0.042) (0.038) (0.427) (0.064) (0.042)
Automate ? 0.208 -0.193 -0.483 0.195 -0.223 -0.474(0.712) (0.669) (0.378) (0.732) (0.618) (0.395)
Transform ? -0.105 0.316 0.325 -0.087 0.278 0.306(0.775) (0.248) (0.227) (0.814) (0.301) (0.261)
High Tech ? 0.118 -0.125 0.204 0.072 -0.161 0.175(0.679) (0.579) (0.373) (0.804) (0.473) (0.446)
Low tech ? 0.457 0.206 0.355 0.351 0.146 0.390(0.456) (0.700) (0.488) (0.589) (0.782) (0.447)
Intercept -5.205*** -2.902*** -2.040*** -4.932*** -2.615*** -1.974***(0.000) (0.000) (0.004) (0.000) (0.000) (0.006)
Year Indicator Included Included Included Included Included Included Number of observations 578 578 578 578 578 578
Model 2 38.73 57.36 25.89 43.13 50.26 27.09
Pseudo R2 0.098 0.099 0.042 0.101 0.087 0.045Correctly Classified 0.847 0.643 0.689 0.846 0.657 0.694
note: *** p
-
8/3/2019 Impact of SOX IT Material Weaknesses
43/52
to IT Governance is an indicator variable set equal to one if there were any changes to IT Governance made in any ofthe years t, t+1, or t+2. The dependent variable Count of IT Governance Changes is a count of the total number ofchanges made to IT Governance made in the years t, t+1, and t+2. These IT Governance changes include hiring orappointing a CEO, CFO, director, chairman, or audit committee member with IT knowledge, upgrading the FinancialIT, or making an IT management Change.
Model 1 Model 2 Model 3 Model 4
Variables Pred
Any Change
to IT
Governance
Count of IT
Governance
Changes
Any Change
to IT
Governance
Count of IT
Governance
Changes
IT Weakness Firm + 1.211*** 1.157***(0.000) (0.000)
IT Weakness Classification
Data Processing Integrity + 0.840*** 0.610***(0.001) (0.004)
System Access and Security + 0.303 0.282(0.132) (0.125)
System Structure and Usage + -0.310 -0.103(0.808) (0.635)
Control Variables
Number of Weaknesses + 0.108*** 0.108*** 0.133*** 0.130***(0.006) (0.000) (0.002) (0.000)
LnAssets ? -0.132** -0.100 -0.113 -0.091(0.049) (0.145) (0.102) (0.190)
ROA + 0.199 -0.017 0.185 -0.022(0.163) (0.533) (0.172) (0.545)
Avg Sales Growth - -0.284* -0.147 -0.268* -0.136(0.093) (0.225) (0.097) (0.231)
Leverage - -0.461 -0.429 -0.500* -0.430(0.119) (0.128) (0.100) (0.123)
Uncertainty + 0.023** 0.012* 0.021* 0.010(0.044) (0.085) (0.056) (0.126)
Automate + 0.363 0.143 0.308 0.074(0.237) (0.363) (0.274) (0.432)
Transform + -0.463 -0.131 -0.499 -0.169(0.943) (0.671) (0.962) (0.726)
High Tech + 0.114 0.465** 0.070 0.419**(0.314) (0.017) (0.383) (0.029)
Low Tech ? -0.499 -0.405 -0.634 -0.490(0.342) (0.401) (0.205) (0.284)
Foreign ? 0.468** 0.603*** 0.487** 0.610***(0.025) (0.001) (0.018) (0.001)
Merger ? -0.156 0.126 -0.072 0.145
(0.755) (0.808) (0.874) (0.760)Restructuring ? 0.620*** 0.459** 0.596*** 0.466**(0.006) (0.021) (0.007) (0.019)
Product Differentiation ? -0.059 -0.006 -0.060 -0.008(0.253) (0.871) (0.272) (0.827)
Cost Leadership ? 0.182 0.287** 0.207 0.307**(0 168) (0 024) (0 124) (0 019)
Table 6. IT Material Weaknesses and Executive IT KnowledgeThe sample consists of IT and non-IT material weakness firm-year observations. The dependent variable is anindicator variable set equal to one if the company replaced an executive lacking IT knowledge with an IT
-
8/3/2019 Impact of SOX IT Material Weaknesses
44/52
q p y p g gknowledge executive in any of the years t, t+1, or t+2.
Model 1 Model 2 Model 3 Model 4
Variables PredCEO IT
Knowledge
CFO IT
Knowledge
CEO IT
Knowledge
CFO IT
Knowledge
IT Weakness Firm + 0.821* 0.845**(0.075) (0.011)
IT Weakness Classification
Data Processing Integrity + 0.437 -0.154(0.249) (0.620)
System Access and Security + -0.215 0.554(0.646) (0.133)
System Structure and Usage + 0.152 -0.040(0.411) (0.532)
Control Variables Number of Weaknesses + 0.059 0.149*** 0.094* 0.174***
(0.185) (0.002) (0.092) (0.001)LnAssets ? -0.171 -0.190 -0.170 -0.195
(0.444) (0.215) (0.464) (0.214)ROA + -0.358 0.487* -0.362 0.442
(0.864) (0.090) (0.877) (0.111)Avg Sales Growth - -1.061** 0.083 -0.989* 0.093
(0.048) (0.639) (0.056) (0.655)Leverage - -0.810 -0.551 -0.840 -0.517
(0.216) (0.217) (0.202) (0.246)Uncertainty + 0.002 -0.000 -0.001 -0.001
(0.477) (0.508) (0.514) (0.518)Automate + 1.492 -0.081 1.368 -0.179
(0.104) (0.535) (0.117) (0.576)Transform + 1.231** -1.041 1.213** -1.025
(0.019) (0.971) (0.026) (0.973)High Tech + 0.328 -0.990** 0.310 -0.973**
(0.297) (0.991) (0.312) (0.991)
Low Tech ? 1.351 -1.410 1.240 -1.346(0.209) (0.280) (0.267) (0.291)
Foreign ? 0.623 0.290 0.578 0.327(0.162) (0.393) (0.202) (0.339)
Merger ? 1.159 0.569 1.178 0.644(0.179) (0.343) (0.165) (0.291)
Restructuring ? 1.373*** 0.978*** 1.382*** 0.969***(0.007) (0.006) (0.007) (0.006)
Product Differentiation ? 0.049 -0.152 0.039 -0.136
(0.687) (0.117) (0.751) (0.137)Cost Leadership ? 0.539* 0.193 0.525* 0.209
(0.064) (0.309) (0.075) (0.278)Intercept -3.459** -2.583** -3.273* -2.320**
(0.048) (0.016) (0.060) (0.027)Year Indicator Included Included Included Included
N b f b i 578 578 578 578
Table 7. IT Material Weaknesses and Board of Directors IT Knowledge
The sample consists of IT and non-IT material weakness firm-year observations. The dependent variable is an indicatorvariable set equal to one if the company replaced a chairman lacking IT knowledge with an IT knowledge chairman or
-
8/3/2019 Impact of SOX IT Material Weaknesses
45/52
increased the total number of IT knowledge directors in any of the years t, t+1, or t+2.
Model 1 Model 2 Model 3 Model 4 Model 5 Model 6
Variables Pred
Chairman
IT
Knowledge
Director
IT
Knowledge
Audit
Committee
ITKnowledge
Chairman
IT
Knowledge
Director
IT
Knowledge
Audit
Committee
ITKnowledge
IT Weakness Firm + 0.725** 0.211 0.303(0.011) (0.217) (0.188)
IT Weakness Classification
Data Processing Integrity + 0.581* -0.358 0.234(0.065) (0.824) (0.300)
System Access and Security + -0.471 0.400 0.407(0.884) (0.142) (0.186)
System Structure and Usage + 0.449 0.143 -0.531(0.142) (0.367) (0.833)Control Variables
Number of Weaknesses + 0.072* 0.083** 0.012 0.097** 0.095** 0.003(0.063) (0.036) (0.409) (0.025) (0.022) (0.482)
LnAssets ? -0.484*** -0.066 0.065 -0.491*** -0.066 0.085(0.000) (0.546) (0.535) (0.000) (0.549) (0.435)
ROA + 0.539** -0.493 -0.422 0.500** -0.507 -0.436(0.011) (0.978) (0.954) (0.012) (0.983) (0.962)
Avg Sales Growth - -0.162 -0.127 0.068 -0.146 -0.129 0.040(0.229) (0.333) (0.602) (0.254) (0.334) (0.565)
Leverage - 0.765 -1.081** -1.233 0.717 -1.099** -1.283*(0.933) (0.022) (0.94) (0.940) (0.020) (0.052)
Uncertainty + 0.009 0.007 -0.181* 0.006 0.007 -0.169*(0.269) (0.376) (0.966) (0.352) (0.377) (0.960)
Automate + -0.031 -0.277 -0.038 -0.297(0.516) (0.601) (0.519) (0.607)
Transform + 0.332 0.451* 0.483 0.309 0.457* 0.494(0.178) (0.092) (0.132) (0.189) (0.090) (0.124)
High Tech + 0.555** 0.955*** 1.437*** 0.472* 0.964*** 1.467***(0.041) (0.001) (0.000) (0.074) (0.001) (0.000)
Low Tech ? -0.514 0.322 0.021 -0.504 0.375 -0.021(0.639) (0.625) (0.983) (0.650) (0.566) (0.983)
Foreign ? 0.839*** 0.581** 0.144 0.831*** 0.582** 0.152(0.004) (0.026) (0.671) (0.006) (0.026) (0.656)
Merger ? 0.170 -0.039 -1.555 0.233 -0.020 -1.531(0.767) (0.948) (0.144) (0.686) (0.973) (0.148)
Restructuring ? 1.019*** 0.309 -0.363 1.017*** 0.337 -0.357
(0.001) (0.253) (0.294) (0.001) (0.214) (0.299)Product Differentiation ? -0.016 0.099 0.191 -0.030 0.101 0.180(0.783) (0.178) (0.139) (0.617) (0.161) (0.134)
Cost Leadership ? -0.315 -0.036 -0.111 -0.336 -0.024 -0.101(0.187) (0.852) (0.639) (0.160) (0.899) (0.667)
Intercept -0.675 -1.796** -3.234*** -0.451 -1.770** -3.326***(0 473) (0 023) (0 001) (0 632) (0 027) (0 001)
-
8/3/2019 Impact of SOX IT Material Weaknesses
46/52
Restructuring ? 0.125 0.119 -0.644** 0.697* -0.144 0.088 0.082 -0.655** 0.740* -0.159
(0.628) (0.661) (0.029) (0.097) (0.695) (0.729) (0.758) (0.028) (0.084) (0.668)
-
8/3/2019 Impact of SOX IT Material Weaknesses
47/52
45
Product Differentiation ? -0.028 -0.026 -0.031 -0.005 0.309 -0.030 -0.030 -0.039 0.005 0.243
(0.588) (0.634) (0.653) (0.962) (0.186) (0.528) (0.539) (0.529) (0.965) (0.286)
Cost Leadership ? 0.379*** 0.423*** 0.220 0.398 0.682*** 0.404*** 0.442*** 0.239 0.398 0.686***
(0.008) (0.005) (0.189) (0.114) (0.001) (0.007) (0.005) (0.165) (0.117) (0.001)
Intercept -4.073*** -4.934*** -6.018*** -1.726 -1.165 -3.899*** -4.494*** -5.355*** -1.770 -1.038(0.000) (0.000) (0.000) (0.230) (0.355) (0.000) (0.000) (0.000) (0.203) (0.411)
Year Indicator Included Included Included Included Included Included Included Included Included Included
Number of observations 578 578 578 556 578 578 578 578 556 578
Model 2 114.21 117.81 78.28 29.66 56.89 99.07 102.39 76.78 34.41 58.94
Pseudo R2 0.222 0.273 0.256 0.086 0.121 0.183 0.215 0.199 0.094 0.128
Correctly Classified 0.775 0.812 0.843 0.946 0.922 0.777 0.793 0.854 0.945 0.918
note: *** p
-
8/3/2019 Impact of SOX IT Material Weaknesses
48/52
404 material weaknesses reported from year t to t+2. Any IT Knowledge Change is defined as 1 if CEO IT Knowledge=1 OR CFOIT Knowledge=1 OR Chairman IT Knowledge=1 OR Director IT Knowledge=1 OR Audit Committee IT Knowledge=1, 0otherwise. The changes in control variables represent changes from t to t+2. Please see Table 2 for other variable definitions.
DV =Change in # of Weaknesses from t to t+2
Pred Model 1 Model 2 Model 3 Model 4
IT Knowledge Changes
Any IT Knowledge Change - -0.745**(0.048)
CEO IT Knowledge - -0.169 -0.064 -0.034(0.391) (0.409) (0.484)
CFO IT Knowledge - -1.004* -0.930* -0.909*(0.070) (0.089) (0.072)
Chairman IT Knowledge - 0.426 0.423 0.409(0.694) (0.695) (0.725)
Director IT Knowledge - -0.945* -0.913* -0.900**
(0.058) (0.065) (0.045)Audit Committee IT Knowledge - 0.885 0.915 0.911
(0.561) (0.560) (0.588)Major IT Initiatives
Financial IT Upgrade - -0.318 -0.314(0.230) (0.225)
IT management - -0.234(0.364)
Control Variables
Change in Ln Assets - 0.451 0.332 0.327 0.332(0.679) (0.757) (0.762) (0.740)
Change in Leverage + -0.750 -0.719 -0.653 -0.650(0.694) (0.711) (0.734) (0.775)
Change in BTM + -0.002 0.002 0.001 0.001(0.901) (0.794) (0.859) (0.921)
Change in ROA - 0.143 0.217 0.237 0.232(0.809) (0.753) (0.736) (0.781)
Change in Loss + 0.181 0.101 0.132 0.130(0.620) (0.783) (0.723) (0.738)
Change in Merger + -1.301 -1.417 -1.436 -1.468(0.946) (0.961) (0.960) (0.962)
Change in Foreign + -0.898 -0.952 -1.035 -1.038(0.940) (0.944) (0.951) (0.964)
Change in Restructuring + -0.612 -0.692 -0.702 -0.702(0.943) (0.959) (0.960) (0.959)
Change in Growth - 0.003 -0.066 -0.059 -0.054(0.995) (0.773) (0.801) (0.785)
Change in Board Size + 0.124 0.108 0.114 0.119(0.326) (0.398) (0.376) (0.290)
Change in Board Independence - -0.089 0.464 0.443 0.437(0.965) (0.903) (0.908) (0.914)
Change in Institutional Holdings - -1.582* -1.585* -1.546* -1.558**(0.080) (0.082) (0.085) (0.042)
Automate ? 0.128 0.230 0.330 0.299(0.842) (0.725) (0.630) (0.773)
Transform ? -0.343 -0.539 -0.586 -0.602(0.631) (0.450) (0.414) (0.339)
High Tech ? 0.130 -0.209 -0.213 -0.215
Appendix A. IT Control Quality Dimensions (Adapted from Li et al. 2010a)
QualityDimension
Identifier Definitions* Examples from the SOX 404 Managements Report on Internal Control
-
8/3/2019 Impact of SOX IT Material Weaknesses
49/52
47
Dimension
Data processingintegrity
IT PROCESS The extent to which data arecorrect and reliable.
Ability to change closed accounting periods in systemAbility to delete (used) accounts from the systemData or program changes lack user review/approval/authorization/testingDid not properly maintain master files (e.g., vendor, price, inventory)Inadequate development and maintenance (e.g., new system, updates)Inadequate IS/IT support staffInadequate system to support business processes (includes manually intense processes)Integrity of computer data not verified (e.g., accuracy, validity, completeness)Lack of IS/IT controlsLack of IS/IT controls over subsidiary/foreign operationsLack of IT experience (inadequate skills)Program change controls missing or inadequate
Programming errorsRelying on systems of others (outsourcing) where controls not verifiedSpreadsheet(s), lack of controls over(Too) Functionally complex systemsWeak application controlsWeak general controlsWeak IT Control ActivitiesWeak IT Control EnvironmentWeak IT Risk Assessment
Weak IT MonitoringSystem Access
and SecurityIT SECURITY The extent to which:
data are available, or easilyand quickly retrievable and
access to data is restrictedappropriately to maintainits security.
(Business user) Segregation of duties not implemented in systemInadequate records and storage retentionLack of disaster recovery plan for systemsIS/IT personnel access not properly segregatedLogical access issuesSecurity issues
System Structureand Usage
ITSTRUCTURE
The extent to which data are:
easily comprehended presented in the same
format
Decentralized systemsDisparate (non-integrated) systems
Insufficient training on systemLack of system documentation, policies, proceduresWeak Information & Communication
-
8/3/2019 Impact of SOX IT Material Weaknesses
50/52
-
8/3/2019 Impact of SOX IT Material Weaknesses
51/52
Appendix D. Examples of IT Upgrades
-
8/3/2019 Impact of SOX IT Material Weaknesses
52/52
50
IT Upgrade (Affirmative Insurance Holdings Inc.)
To remediate the IT material weakness described above, we have implemented new policies and procedures to ensure proper access controls are
maintained and monitored. We have increased the supervisory control over access controls, centralizing it for more direct monitoring. In someinstances, we have adjusted system configurations and incorporated software tools where appropriate to limit and restrict the ability of system usersto enter, change and view data and to provide a detailed history of changes to the applications and data.
Financial IT Upgrade (Richardson Electronics LTD)
The Company is in the application development stage of implementing certain modules of enterprise resource management software (PeopleSoft).
Accounting IT Upgrade (Adelphia Communications)With respect to the access to financial applications and data material weakness described above, subsequent to December 31, 2004, we havesubstantially completed our remediation efforts. We have implemented controls, including policies and procedures that govern security and access toour IT systems, programs and data, including those supporting our financial data relating to property and equipment and our general ledger andfinancial reporting applications.
Non-Financial IT Upgrade (Actividentity Corp.)
To meet these challenges we implemented a new customer relationship management system in fiscal 2005, and are continuing the process ofmodifying and refining it to better meet our needs.