The Sarbanes-Oxley Act of 2002 (SOX) requires management and auditors to opine on the effectiveness of internal controls for many public companies. One intention of SOX is to improve the reliability of information public companies provide to the financial markets (COSO 2006; PCAOB 2004). Investors in initial public offering (IPO) companies may be expected to benefit greatly from such regulation due to IPO companies’ high information asymmetry and management incentives to engage in advantageous disclosure when raising capital. At the time of the IPO, however, SOX does not require management or the auditor to opine on the effectiveness of the company’s internal controls. The auditor is required to opine on internal control effectiveness in the second fiscal year after the IPO, at the earliest. For qualifying companies, Title I of the Jumpstart Our Business Startups (JOBS) Act of 2012 deferred compliance with this requirement to the fifth year after the IPO. The JOBS Act legislation responds to concerns that significant SOX compliance costs were discouraging companies from going public. In the absence of a formal opinion from management or the auditor, IPO investors are forced to seek alternative sources for information on the effectiveness of internal controls. My research examines whether auditor voluntary internal controls-related disclosure, as a potential alternative source of information on internal control quality, is informative as to information quality, company risk, and company future performance in the IPO setting.

Auditors are required to consider internal controls in the conduct of their financial statement audit, regardless of whether they are engaged to opine on internal control effectiveness. This means that auditors have an understanding of a company’s internal control environment at the time of the IPO, but the current standard unqualified audit report does not provide an outlet to publicly communicate internal control deficiencies, if identified. Auditors can, however, voluntarily modify their unqualified audit report to include additional, non-standard disclosure stating that the opinion on the financial statements does not extend to the effectiveness of internal controls (PCAOB 2001). Because IPO companies are not required to report on internal control effectiveness, and therefore IPO investors do not expect such reporting, the auditor’s additional disclosure is not likely informative at face value.

Auditor voluntary internal controls-related disclosures may be informative when provided in response to poor internal controls. Audit report modifications are costly to auditors because clients have a preference for a standard unqualified audit report. Auditor insistence on adding non-standard content to the unqualified audit report can strain the auditor-client relationship and increase the risk of losing the client as a revenue source. Despite these potential, severe consequences, auditors have two key motives for additional audit report disclosure. One, auditors have a fiduciary responsibility to modify the audit report when conditions warrant. Two, auditors have heightened litigation risk exposure for IPOs relative to existing public companies. Auditor litigation risk stems from the likelihood of being sued as a result of a financial reporting failure (Palmrose 1987, 1988; Stice 1991; Lys and Watts 1994) and internal control deficiencies often underlie financial reporting failures. Litigation risk is elevated for IPO companies because they are subject to the Securities Exchange Act of 1933, which imposes strict liability on issuers for material misstatements or omissions in a registration statement (Venkataraman, Weber, and Willenborg 2008). Comparatively, existing public companies are subject to the Securities Exchange Act of 1934, which requires one to demonstrate that an issuer knowingly misled investors [emphasis added]. Enhanced disclosure is an effective hedge against all types of litigation (Hanley and Hoberg 2012) and voluntary internal controls-related audit report disclosure can be thought of as a form of enhanced auditor disclosure.

The above discussion leads to four hypotheses. One, I expect auditor voluntary disclosure that reflects poor internal controls is associated with a higher likelihood of future internal control deficiencies, as companies’ processes to evaluate internal controls are not as strong as auditors’ (Bedard and Graham 2011) and resource-constrained (e.g., IPO) companies are less likely to remediate deficiencies (Bedard, Hoitash, Hoitash, and Westermann 2012). This suggests that auditor voluntary disclosure out of concern for pre-IPO internal control deficiencies will persist until the auditor’s first SOX audit. Two, I predict a positive association between auditor voluntary disclosure and audit fees, as a proxy for risk, because auditors seem to increase fees when control deficiencies exist (Hogan and Wilkins 2008). Three, I expect a negative association between auditor voluntary disclosure and post-IPO stock returns. Auditor voluntary disclosure may suggest that the reliability of financial statement information is lower and the quality of company-specific information is relevant for pricing decisions (Francis, LaFond, Olsson, and Schipper 2005). Further, companies with internal control deficiencies have significantly higher risk and cost of equity (Ashbaugh-Skaife, Collins, Kinney, and Lafond 2009; Beneish, Billings, and Hodder 2008). Four, I predict auditor voluntary disclosure is associated with lower future earnings, as internal controls can improve the quality of information available for internal decision-making (Lambert, Leuz, and Verrecchia 2007) and poor internal controls are associated with poorly estimated accruals (Doyle, Ge, and McVay 2007).

I use a sample of IPOs completed on United States equity exchanges from 2005 through 2014 to test my hypotheses. My sample period begins in 2005 because that is when I observe auditors begin to routinely add internal controls-related disclosure. After 2005, such voluntary disclosure is present in nearly 60 percent of the sample. Consistent with my predictions, I find that pre-IPO auditor voluntary internal controls-related disclosure is associated with a higher likelihood of auditor-reported internal control deficiencies in the first year the auditor opines on internal control effectiveness, higher IPO accounting and auditing expenses, lower post-IPO returns, and lower post-IPO earnings. Interestingly, additional analysis reveals that the association between auditor voluntary disclosure and post-IPO earnings is largely explained by the accruals component of earnings, rather than the cash flow component. I obtain consistent results when performing procedures designed to address the endogenous nature of the auditor’s disclosure decision.

Overall, my results indicate that auditor voluntary internal controls-related disclosure is useful in assessing information quality, risk, and future performance in the IPO setting. This research should be of interest to four primary constituents. One, investors who routinely evaluate the quality of disclosed information and assess the future prospects of forthcoming IPOs may benefit from attending to the non-standard content of the pre-IPO audit report. Two, legislators may be curious to learn that the recently passed JOBS Act of 2012 likely further delays auditor public communication of internal control deficiencies reasonably known at the IPO. Three, audit regulators tasked with reforming the current auditor’s reporting model can better understand the informativeness of auditor voluntary disclosures under current auditing standards. Four, academics conducting research in related areas can consider future projects that examine the usefulness of auditor voluntary disclosures to non-equity investor users and in non-IPO settings.

REFERENCES

Ashbaugh-Skaife, H., D.W. Collins, W.R. Kinney Jr., and R. Lafond 2009. The effect of SOX internal control deficiencies on firm risk and cost of equity. Journal of Accounting Research 47 (1): 1-43.

Bedard, J.C. and L. Graham. 2011. Detection and severity classifications of Sarbanes-Oxley Section 404 internal control deficiencies. The Accounting Review 86 (3): 825-855.

__________, R. Hoitash, U. Hoitash, and K. Westermann. 2012. Material weakness remediation and earnings quality: A detailed examination by type of control deficiency. Auditing: A Journal of Practice & Theory 31 (1): 57-78.

Beneish, M.D., M.B. Billings, and L. Hodder. 2008. Internal control weaknesses and information uncertainty. The Accounting Review 83 (3): 665-703.

Committee of Sponsoring Organizations (COSO). 2006. Internal Control over Financial Reporting – Guidance for Smaller Public Companies. New York, NY: AICPA.

Doyle, J.T., W. Ge, and S. McVay. 2007. Accruals quality and internal control over financial reporting. The Accounting Review 82 (5): 1141-1170.

Francis, J., R. LaFond, P. Olsson, and K. Schipper. 2005. The market pricing of accruals quality. Journal of Accounting and Economics 39 (2): 295-327.

Hanley, K.W. and G. Hoberg. 2012. Litigation risk, strategic disclosure and the underpricing of initial public offerings. Journal of Financial Economics 103: 235-254.

Hogan, C.E. and M.S. Wilkins. 2008. Evidence on the audit risk model: Do auditors increase audit fees in the presence of internal control deficiencies? Contemporary Accounting Research 25 (1): 219-242.

Lambert, R., C. Leuz, and R.E. Verrecchia. 2007. Accounting information, disclosure, and the cost of capital. Journal of Accounting Research 45 (2): 385-420.

Lys, T. and R.L. Watts. 1994. Lawsuits against auditors. Journal of Accounting Research 32; 65-93.

Palmrose, Z-V. 1987. Litigation and independent auditors: The role of business failures and management fraud. Auditing: A Journal of Practice & Theory 6: 90-103.

__________. 1988. An analysis of auditor litigation and audit service quality. The Accounting Review 63: 55-73.

Public Company Accounting Oversight Board (PCAOB). 2001. Other Information in Documents Containing Audited Financial Statements: Auditing Interpretations of Section 550. AU 9550 (Interim Standards).

__________. 2004. An Audit of Internal Controls over Financial Reporting Performed in Conjunction with an Audit of Financial Statements. Auditing Standard No. 2. Washington, D.C.: PCAOB.

Stice, J.D. 1991. Using financial and market information to identify pre-engagement factors associated with lawsuits against auditors. The Accounting Review 66: 516-553.

Venkataraman, R., J.P. Weber, and M. Willenborg. 2008. Litigation risk, audit quality, and audit fees: Evidence from initial public offerings. The Accounting Review 83 (5): 1315-1345.

The preceding post comes to us from Keith Czerney, Assistant Professor of Accountancy at the University of Nebraska-Lincoln College of Business Administration. The post is based on his article, which is entitled “Are Voluntary Internal Controls-Related Audit Report Disclosures Informative in IPOs?” and available here.