Information content of control deficiency disclosures under the Sarbanes–Oxley Act: An empirical investigation

Abstract

Sections 302 and 404 of the landmark Sarbanes–Oxley Act require firms to periodically assess and report certain types of internal control deficiencies to the audit committee, external auditors, and to the Securities and Exchange Commission (SEC). External auditors are also required to opine separately on the effectiveness of their client's system of internal control over financial reporting and issue an ‘adverse opinion’ on internal control effectiveness in the presence of even a single material weakness. These new requirements have elicited opposition from corporations, while regulators have cited their benefits to capital markets. Given this differential view, we examine whether such internal control weakness disclosures convey valuation-relevant information to the US equity markets. This issue is important because increasing disclosure requirements without any attendant effect on valuation would impose unnecessary deadweight costs on the shareholders of a company. Thus, to understand whether such disclosures about the effectiveness of a company's internal controls over financial reporting have any new information content, we study a number of voluntary disclosures made by the SEC registrants in the very early days of Sarbanes–Oxley implementation. We find that internal control weakness disclosures are associated with a negative stock price reaction, on average, indicating that such disclosures do indeed convey valuation-relevant information. This reaction is mitigated to some extent, but not fully, if management also discloses alongside the internal control weaknesses specific remediation steps that have been taken to correct the reported deficiencies. Additionally, the price reaction is less negative for firms employing a Big-4 auditing firm as their external auditors. Conversely, the reaction is more negative for firms with larger current liabilities relative to total assets, which suggest that disclosed internal control weaknesses may have implications for short-term default risk by the registrants.