Nonprofessional investor perceptions of the partial remediation of IT and non-IT control weaknesses: An experimental investigation

Abstract

In this study, we investigate whether nonprofessional investors' judgments about a firm with known and disclosed material weaknesses in internal control as required by the Sarbanes Oxley (SOX) Act of 2002 depend on the remediation strategy used by the firm. Analysis of SOX internal control weakness disclosures reveals that firms (1) often have multiple internal control weaknesses, (2) frequently have a mix of information technology (IT) and non-IT control weaknesses, and (3) invariably fail to remediate all control weaknesses in the period they are identified. We design an experiment to investigate how nonprofessional investors respond to remediation of a subset of disclosed material weaknesses in internal control, when a firm discloses a remediation plan that prioritizes the remediation of an IT (non-IT) internal control weakness leaving a non-IT (IT) weakness unremediated. We apply counterfactual theory to the future oriented remediation setting and find that investors favor a firm remediation strategy that prioritizes the remediation of an IT weakness over a strategy that prioritizes the remediation of a non-IT weakness. We further find that perceived effectiveness of remediation, financial misstatement risk attributed to the unresolved internal control weakness, and management credibility fully mediate the relation between company remediation strategies and investing judgments. These findings should be informative to both auditors and management when confronted with a range of IT and non-IT internal control weaknesses following the initial identification and disclosure of multiple material weaknesses as required by SOX.