1. Do Material Weaknesses in Information-Technology Related Internal Controls Affect Firms’ 8-K Filing Timeliness and Compliance? Tony Holder University of Toledo Co-authored with Khondkar Karim University of Massachusetts Lowell, Karen (Jingrong) Lin University of Massachusetts Lowell, Robert Pinsker Florida Atlantic University University of Waterloo Centre for Information Integrity & Information Systems Assurance 9th Biennial Research Symposium October 1-3, 2015

2. 1.Research Questions 2.Summary of Major Results 3.Hypotheses Development 4.Data & Methodology 5.Results/Tests 6.Robustness 7.Contributions and Conclusion Agenda/Overview

3. Internal Controls 8K Reporting Behavior ???? Timeliness? Conform? Research Question 1

4. Information Technology related IC 8K Reporting Behavior Research Question 2 ???? Timeliness? Conform?

5. H1: Does IC quality effect 8K Reporting? YES! Firms without (with) internal control weaknesses will file their Form 8-Ks in a more (less) timely manner. 1.Less likely to file their 8Ks in a timely manner. Positive relation between the likelihood of the firm reporting a material weakness in IC and 8-K filing timeliness. 2.More likely to exceed the reporting deadline Positive relation between the likelihood of the firm reporting a material weakness in IC and the probability of the firm not complying with the four day 8-K filing requirement. Results are invariant to Conditioning on complicated or uncomplicated events. Conditioning on surprising or unsurprising events. Summary of Major Results

6. H2: Does IT-related material IC weaknesses alter mgt’s 8-K reporting behavior. Sort of… 1. ITMW matter for the entire group and for complicated and non surprising events 2. ITMW do not affect conformance with deadline for the entire group or any of the subsamples Summary of Major Results

7. Why should we care? Existing research focused on 10-Ks, 10-Qs, and earnings announcements. 8-Ks: 1.Are fairly comprehensive 2.Used to notify investors of material corporate events. 3.Stricter requirements 1.Must be filed within four days of event occurrence with no extensions. 4.Provide investors with continuous stream of corporate information (SEC).

8. Why should we care? Recent 8-K Reporting Changes Formerly, needed to be filed with SEC within 10 days of the EOM of significant events After June 2002: 1.Number of reportable events increased to 22 2.Filing deadline shortened to 4 business days after occurrence. Reasons for changes: (1)investors increasingly demand ‘‘real-time’’ access to relevant and reliable information. (2)SOX (Sect. 409) mandates that public disclosure be easily understandable and on a ‘‘rapid and current basis’’. (3)Changes were expected to reduce opportunities for securities fraud.

9. Why should we care? SOX made major changes to Internal Control rules SOX (302/404) requires that firms provide documentation (and attestation) regarding the effectiveness of IC. Including thorough understanding of controls … even complex accounting estimates. Prior to SOX, firms required to disclose significant internal control deficiencies in Form 8-Ks only when disclosing a change in auditors. Proponents argue that increased internal control requirements will mitigate executives’ opportunistic behavior (specifically earnings manipulations) improving the quality of reported financial information.

10. Hypotheses Development Studies show positive relation between strong (weak) corporate governance and reduced (higher) information asymmetry between management and outside observers. In addition, strong corporate governance is associated with less earnings management (Klein 2002), fewer restatements (Abbott et al. 2004), less fraud (Beasley 1996), and more voluntary disclosures (Gul and Leung 2004). Research suggests a positive relation between strong (weak) corporate governance mechanisms and firm compliance (non- compliance) with mandatory disclosure regulation (Core 2001).

11. Hypotheses Development Optimal disclosure policy allows for managerial manipulation of disclosure (Core 2001). However, it is the governance structure that constrains the manager to follow the optimal disclosure policy. Strong corporate governance leads to more timely information disclosure (Core 2001).

12. Hypotheses Development Quality of internal controls is positively related to corporate governance (Ashbaugh-Skaife et al. 2007). 1.Internal control deficiencies found to be associated with noisier accruals (did not map as well into cash flows) (Ashbaugh-Skaife et al. (2008). 2.Internal control weaknesses more likely to lead to unintentional errors than intentional misstatements (Ashbaugh-Skaife et al. (2008). Suggests that internal control quality will be positively associated with better corporate governance mechanisms.

13. Hypotheses Development Timeliness is an important discretionary element of mandatory financial disclosure (Dwyer and Wilson 1989). Timely 8-K filings are essential for achieving adequate information disclosure (SEC). 1.Financial disclosure should be relevant and reliable (SFAC No. 2). 1.To be relevant, must be available to investors before it loses its capacity to influence their decisions. 2.Timeliness is key to making information “useful”.

14. Hypotheses H1a: Firms without (with) internal control weaknesses will file their Form 8-Ks in a more (less) timely manner.

15. Hypotheses First hypothesis does not inform whether material weaknesses in IC are associated with managers’ overall compliance with the 8-K regulation guidelines. A more restrictive hypothesis investigates the association between late 8-K filers and internal control material weaknesses. H1b: Firms without (with) internal control weaknesses are more (less) likely to file their Form 8-Ks in conformity with the SEC’s mandatory four-day reporting requirement.

16. Hypotheses Development IT-Related Versus Non-IT Material Weaknesses The impact of internal controls varies based on the type of material weakness (Li et al. 2012). IT corporate governance (ITG) represents an increasingly important subset of corporate governance (Debreceny (2013, 129). Alignment of business strategy and IT strategy has emerged as a critical issue for all firms (Rathnam et al. (2004-2005). Poor alignment can cause costly IT failures and a steady decline in competitive ability (Liebowitz 1999). IT-related material internal control weaknesses can be considered the by-product of poor ITG.

17. Hypotheses Development Good ITG suggests strong alignment between IT strategy and business strategy results in good firm performance. IT-related controls affect the quality of information produced by a firm’s system (Doyle et al. 2007) Weaker IT-related controls associated with less timely 8-K filings, a lack of compliance with the four day reporting requirement, and an increase in non-IT control weaknesses. Firms with IT-related weak components report more material weaknesses (Klamm and Watson 2009). Stronger (weaker) IT controls will lead to higher (lower) information quality, this will in turn cause more (less) 8-K reporting timeliness.

18. Hypotheses H2a: Firms with (without) IT-related material internal control weaknesses will file their 8-Ks in a less (more) timely manner -even after controlling for other types of material weaknesses in internal controls. H2b:Firms with (without) IT-related material internal control weaknesses are less (more) likely to file their 8Ks in conformity with the SEC’s mandatory four day reporting requirement - even after controlling for other types of material weaknesses in internal controls.

19. Sample Selection Data comes from Intersection of Direct Edgar, Compustat and Audit Analytics for the time period of 2005-2011 1. 8K information (Direct Edgar) 2. Internal Control information (Audit Analytics). 3. Financial Statement information (Compustat) 4. Final sample includes 118,863 firm-year observations existing in all three databases. 5. Normal filtering criteria applied.

20. Sample Distribution *CompEvents = complicated events; NonCompEvents = other events

21. Sample Distribution (Cont)

23. Table 2 Descriptive Statistics (selected)

24. Table 2 Correlations (selected)

25. Regression Models: REPLAG (reporting lag) = 8-k filing date minus the event date. ICMW = to 1 if company has material weakness in IC, 0 otherwise. A positive (negative) α 1 is consistent with material weaknesses in IC exacerbating (mitigating) managers’ 8-K filing timeliness. H1a: Firms with (without) internal control weaknesses will file their 8- Ks in a less (more) timely manner.

26. Table 3: Panel A. The Effect of IC Weakness on Reporting Timeliness – Complicated vs. Non-complicated Events

27. Table 4: The Effect of IC Weakness on Reporting Timeliness – Surprising vs. Non-surprising Events

28. Regression Models: NONCONFORM = to 1 if the 8-K filing exceeds 4 day requirement and 0 otherwise. A positive (negative) β 1 is consistent with material weaknesses in IC exacerbating (mitigating) managers’ 8-K filing compliance. Positive coefficient would indicates ICMW more likely to cause managers to file their 8-Ks late. H1b: Firms with (without) ICMW are less (more) likely to file their 8-Ks in conformity with 4 day requirement.

29. Table 3: Panel B. The Effect of IC Weakness on Reporting Timeliness – Complicated vs. Non-complicated Events

30. Table 4: The Effect of IC Weakness on Reporting Timeliness – Surprising vs. Non-surprising Events

31. Regression Models: A positive (negative) α 1 is consistent with IT-related material weaknesses in internal control having additional explanatory power in exacerbating (mitigating) managers’ 8-K filing reporting. H2a:Firms with (without) IT-related material IC weaknesses will file their 8-Ks in a less (more) timely manner -even after controlling for other types of material weaknesses in internal controls.

32. Table 5: The Effect of IT Weakness and Other Weakness on Reporting Timeliness - Complicated vs. Non-complicated Events

33. Table 6: The Effect of IT Weakness and Other Weakness on Reporting Timeliness - Surprising vs. Non-surprising Events

34. Regression Models: Positive (negative) β 1 is consistent with IT-related material weaknesses in internal control exacerbating (mitigating) managers’ 8-K filing compliance. H2b: Firms with (without) IT-related MW IC weaknesses are less (more) likely to file their 8Ks in conformity with 4 day requirement…

35. Table 5: The Effect of IT Weakness and Other Weakness on Reporting Timeliness - Complicated vs. Non-complicated Events

36. Table 6: The Effect of IT Weakness and Other Weakness on Reporting Timeliness - Surprising vs. Non-surprising Events

37. Robustness Tests Calculate two-way cluster robust standard errors (i.e., robust to both time-series and cross-sectional correlation) Petersen’s (2009). Residuals in the pooled time series cross sectional analyses may be correlated within firms or over time, leading to biases in estimates of the coefficient standard errors. Include both year and industry fixed effects.

38. Robustness Tests ITMW are more pervasive and costly to correct than ICMW (Weidenmier and Ramamoorti 2006; Canada et al. 2009). Firms with ITMW subsequently report more material weaknesses (both IT and non-IT) in future years (Klamm et al. (2012). Suggesting persistence and pervasiveness of IT-related internal controls. Existing research suggest that remediation of previously reported internal control deficiencies leads to increases in accrual quality Ashbaugh-Skaife et al. (2008). Consider any improvement or lack thereof in ITMW in the subsequent year of analysis (t + 1).

39. Table 7: The Effect of Improvement or Worsening of IT Weakness on Reporting Lag - Complicated vs. Non-complicated Events

41. Table 8: The Effect of Improvement or Worsening of IT Weakness on Reporting Lag - Surprising vs. Non-surprising Events

43. Complying versus non-complying firms (Table 9) REPLAG (reporting lag) = 8-k filing date minus the event date. ICMW = to 1 if company has material weakness in IC, 0 otherwise. A positive (negative) α 1 is consistent with material weaknesses in IC exacerbating (mitigating) managers’ 8-K filing timeliness. Should the quality of internal controls be linked to firms’ Form 8-K reporting? Following tests restricts the sample to Compliance Firms Only

44. Table 9: The Effect of IC Weakness on Reporting Timeliness – Reporting Lag - Surprising vs. Non-surprising Events (Compliance Firms Only )

45. Table 9: The Effect of IC Weakness on Reporting Timeliness (Reporting Lag) Complicated vs. Non-complicated Events (Compliance Firms Only)

46. Contributions / Conclusions AIS focus, so we divide our sample into complicated and non- complicated events and further divide into surprising and unsurprising events. Overall find a negative relation between 8K filing timeliness and ICMW Results are invariant to whether the events are complicated or non-complicated or surprising or unsurprising events. For complicated events we find evidence that IT-related material weaknesses in internal controls are more likely to cause delays in 8-K reporting even after controlling for all other types of material weaknesses in internal controls. For non-complicated events, we find no association between IT-related material weaknesses in internal controls and the 8-K reporting timeliness.

47. Contributions / Conclusions Also investigate if remediation (deterioration) in the quality of IT- related internal controls are associated with managers’ 8-K filing behavior. We are unable to find an association between firms with improving or deteriorating IT-related weaknesses and firms reporting lag behavior. Add to several literature streams: (1) mandatory SEC reporting, (2) management incentives/strategy, (3) IT governance literature, (4) effectiveness of SOX and (5) 8-K filing timeliness. Lack of archival research that explicitly considers the impact of IT controls on information quality (Li et al. 2012, 183). Use proprietary database to identify a large sample of firms that filed 8-K reports.

48. Thank you!!! Questions ???