Optimal internal control regulation: Standards, penalties, and leniency in enforcement

Abstract

To protect investors, regulators increasingly rely on regulating firms’ internal controls over financial reporting, but they punish noncompliance only if an internal control weakness enabled accounting manipulation. In other words, enforcement is manipulation-contingent. We develop an economic model with a manager who sequentially chooses internal control quality and manipulative effort, and a welfare-maximizing regulator who determines an internal control standard, the penalty size for internal control weaknesses, and when to invoke such a penalty. Internal control regulation under manipulation-contingent enforcement not only provides incentives to invest in internal controls, but also improves manipulation deterrence when there are internal control weaknesses. The optimal regulation takes advantage of this additional deterrence effect by using a very strict internal control standard and an intermediate penalty that is only levied in the event of accounting manipulation. Overall, we rationalize why the commitment to lenient enforcement of internal control regulation is optimal.