IT Internal Control Weaknesses and Firm Performance: An Organizational Liability Lens

Abstract

The information systems literature and the public press have called for organizations to more closely scrutinize their information technology (IT) controls; however, little more than anecdotal evidence exists on the business value of IT internal control investments, beyond regulatory compliance. Drawing on the strategy and accounting literature, we (a) advance a strategic necessity perspective to the question of IT internal controls value; and (b) use the unique setting provided by the enactment of the Sarbanes-Oxley Act of 2002 (SOX) to investigates the relationship between IT internal control weaknesses (ICW) and both accounting earnings (a contemporaneous measure of firm performance) and market value (a forward looking, risk-adjusted measure of firm performance). Using a data set that provides audited annual assessments of the effectiveness of both IT and non-IT internal controls for a cross-section of companies as mandated by SOX, we find that firms that report an IT ICW have lower accounting earnings compared to firms with strong IT internal controls. We also find that IT ICW moderates the association between accounting earnings and market valuation, with firms reporting weak IT internal controls having a lower earnings response coefficient. These results are sustained even after controlling for non-IT ICW and firm-specific factors that are known determinants of ICW. The results are also robust to econometric corrections for potential simultaneity and self-selection bias using Heckman’s two-stage procedure. Overall, our results provide empirical evidence which suggests that IT internal controls are a strategic necessity and that information systems risk is priced by the capital markets.