Examining the Potential Benefits of Internal Control Monitoring Technology

Adi Masli, Gary Peters and Vernon Richardson

Juan Manuel Sanchez

Sam M. Walton College of Business

Department of Accounting

University of Waterloo Centre for Information Integrity & Information Systems Assurance

6th Bi-Annual Research Symposium

Research Question

What are the potential benefits that firms can realize from implementing Internal Control Monitoring (ICM) technology designed to support and facilitate internal control processes?

Potential Benefits of ICM Technology

Enhanced Audit

Efficiency

More Effective Internal Control Systems

Timely Audit Reporting

Conceptually

Lower audit fees

Lower likelihood of material control weaknesses

Shorter audit report delays

Empirically

Incremental Contribution Structural changes have increased the demand for

and sophistication of effective internal control monitoring (Coderre 2006; PwC 2006; PCAOB 2007). SOX Section 404 requires evaluation and disclosure of

internal control process - penalties for non-compliance (e.g., Hammersley et al. 2008; Ashbaugh-Skaife et al. 2009).

COSO issued additional guidelines on monitoring internal control systems (2009). Many organizations were not fully utilizing the monitoring

component of internal control.

Practitioners’ (ITGI 2008) and external audit partner’s (Behn et al. 2006) views suggest that ICM technology may or may not work.

Effective Internal Control Systems

Enhanced Monitoring

Explicit Controls

SOX Process Support

Lower likelihood of Material Weaknesses

Period of Increasing Focus and Revelation of Material Weaknesses

H1: Firms implementing ICM technology will exhibit a lower likelihood of experiencing material internal control weaknesses subsequent to ICM technology implementation.

Doyle et al. (2007)

ICM

Technology

Enhanced Audit Efficiency

Timely Audit Support (persuasive evidence)

Enhanced SOX Audit Trails

Stronger Reporting Systems

Constraint on Increasing Audit Fees

Period of Increasing Audit Requirements and Audit Fees

H2: Firms implementing ICM technology will exhibit smaller increases in audit fees subsequent to ICM technology implementation.

Raghunandan and Rama (2006)

ICM

Technology

Enhanced Audit Timeliness

Stronger Reporting & Documentation Systems

Automation of Process Workflows

Management of Disparate Reporting Systems

Constraint on Increasing Audit Delays

Period of Increasing Audit Requirements and Audit Report Delays

H3: Firms implementing ICM technology will exhibit smaller increases in audit delays subsequent to ICM technology implementation.

Ettredge et al. (2006)

ICM

Technology

Strategic Nature of ICM technology

H4: ICM technology transformative implementations will exhibit greater impacts on assurance outcomes than ICM technology compliance implementations.

Dehning et al. (2003)

Go Beyond Complying with SOX

Integrate Enterprise-wide Risk and Compliance Assurance Initiatives

ICM is a Critical Component of IS

Greater Impacts on Assurance Outcomes

Relative to Compliance Implementations, Transformative Ones:

ICM

Technology

Sample• Announcements of “SOX” ICM IT Implementations

(2003-2006) (n = 139)• Audit Analytics Control Sample (n = 14,654)

Distribution by Year

Year SOX ICM FirmsControl Firms All

Transform Comply2003 2 11 3,074 3,087

2004 12 25 3686 3723

2005 14 47 4044 41052006 8 20 3850 3878

Total 36 103 14,654 14,793

Regression ModelsDoyle et al (2007); Rhagunandan and Rama (2006); Ettredge et al. (2006)

Independent Variables

SOX ICM

Size

Complexity

Financial Health

Reporting Quality

Auditor

Self-Selection

Dependent Variables

Material Weaknesses*

% Audit Fee Increase**

% Audit Delay Increase**

* Measured at year t+1

** Measured as changes from year t (implementation year) to t+1

Results (H1 and H4) – Material Weaknesses

Predicted DV = Number of Weaknesses at year t+1

Sign (1) (2) (3) (4) (5) (6)

SOX ICM - -0.103*** -0.161*** -0.100***

(0.006) (<0.001) (0.017)

SOX ICM Transform - -0.151*** -0.122** -0.093*

(0.002) (0.023) (0.081)

SOX ICM Comply - -0.086** -0.175*** -0.103**

(0.047) (0.001) (0.041)

Control Set 1

Control Set 2

Control Set 3

Control Set 1

Control Set 2

Control Set 3

Observations 14,788 14,788 12,156 14,788 14,788 12,156

R2 0.045 0.120 0.105 0.045 0.120 0.105

F 41.874 38.943 39.309 38.630 36.571 36.750

p for Model (<0.001) (<0.001) (<0.001) (<0.001) (<0.001) (<0.001)

Results (H2 & H4) – Audit Fee Change

Predicted DV = Audit Fee Percent Change (from year t to t+1)

Sign (1) (2) (3) (4) (5) (6)

SOX ICM - -0.151*** -0.141*** -0.071*

(0.001) (0.002) (0.082)

SOX ICM Transform - -0.269*** -0.261*** -0.188**

(0.001) (0.001) (0.011)

SOX ICM Comply - -0.109** -0.099** -0.031

(0.026) (0.040) (0.311)

Control Set 1

Control Set 2

Control Set 3

Control Set 1

Control Set 2

Control Set 3

Observations 14,793 14,793 12,161 14,793 14,793 12,161

R2 0.263 0.266 0.307 0.263 0.266 0.307

F 311.864 222.619 212.969 288.153 210.438 201.300

p for Model (<0.001) (<0.001) (<0.001) (<0.001) (<0.001) (<0.001)

Results (H3 & H4) – Audit Delays Change

Predicted DV = Audit Delays Percent Change (from year t to t+1)

Sign (1) (2) (3) (4) (5) (6)

SOX ICM - -0.060** -0.058** -0.063**

(0.015) (0.017) (0.030)

SOX ICM Transform - -0.134*** -0.133*** -0.149***

(0.001) (0.001) (0.003)

SOX ICM Comply - -0.034 -0.032 -0.032

(0.152) (0.168) (0.206)

Control Set 1

Control Set 2

Control Set 3

Control Set 1

Control Set 2

Control Set 3

Observations 14,793 14,793 12,161 14,793 14,793 12,161

R2 0.183 0.185 0.164 0.183 0.185 0.164

F 120.780 98.949 80.430 112.506 93.407 75.592

p for Model (<0.001) (<0.001) (<0.001) (<0.001) (<0.001) (<0.001)

Other Robustness Tests

• Alternate Control Group

• Management Changes and ICM

Technology Implementation

• Simultaneity Amongst DVs

• Econometric Issues Associated with

Material Weakness Tests

Limitations

• Self-selection not totally ruled out

• Short-window (1 year ahead) to capture

benefits

• Low sample size

• Examine only benefits

Conclusions

• Out study supports the benefit-related

assertions embedded within the

conceptual application of effective ICM

practices.

Thanks