Determinants and consequences of noncompliance with the 2013 COSO framework

Highlights

• Noncompliance with the 2013 COSO framework is positively associated with proxies for resource constraints, financial distress, and a weak internal control environment, and negatively associated with auditor industry specialization, board size, and audit committee accounting expertise.

• Following supersession of the COSO 1992 framework, evidence suggests that investors view quarterly earnings surprises of the noncompliant firms to be less credible and that noncompliance increases regulatory scrutiny. These consequences appear to persist even after the noncompliant firms implement the updated COSO framework.

• Some evidence indicates that accounting conservatism increases after supersession of the 1992 framework for compliant firms relative to noncompliant firms, suggesting that noncompliance can delay the potential benefits of implementing the updated framework.

• Investors do not view quarterly earnings surprises of the early implementers to be more credible than those of on-time implementers. However, early implementers are less likely than on-time implementers to receive SEC comment letters, including letters with multiple comments. Additionally, early implementers exhibit some evidence of increased accounting conservatism relative to on-time implementers.

Abstract

The Securities and Exchange Commission (SEC) requires firms to use a “suitable framework” as a basis for evaluating the effectiveness of internal control over financial reporting. The COSO 1992 framework was the most commonly used suitable framework until it was superseded by the COSO 2013 framework. Because strict compliance with the updated framework was not enforced by regulatory authorities, a nontrivial number of firms did not comply in a timely fashion. We investigate determinants and consequences of noncompliance with the COSO 2013 framework following the supersession of the COSO 1992 framework. We find that noncompliance is positively associated with proxies for resource constraints, financial distress, and a weak internal control environment, and negatively associated with auditor industry specialization, board size, and audit committee accounting expertise. Further tests suggest that following supersession of the 1992 framework, investors view quarterly earnings surprises of the noncompliant firms to be less credible and that noncompliance increases regulatory scrutiny. Finally, we find some evidence that accounting conservatism increases after supersession of the 1992 framework for compliant firms relative to noncompliant firms, suggesting that noncompliance can delay the potential benefits of implementing the updated framework.

Introduction

The Securities and Exchange Commission (SEC) requires companies to use a “suitable framework” as a basis for evaluating the effectiveness of internal control over financial reporting (ICFR) as required by Section 404 of the Sarbanes-Oxley Act of 2002 (SOX). The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework, developed in 1992, was considered a suitable framework until it was superseded by the COSO 2013 framework. However, because compliance was not strictly enforced by regulatory authorities, a nontrivial number of firms were not in compliance with the COSO 2013 framework following the supersession.^1,2 According to issuer data analyzed by Protiviti and Audit Analytics, only 82% of firms’ fiscal 2014 annual reports with audited ICFR opinions disclosed the use of the COSO 2013 framework, which increased to 96% and 99% for fiscal 2015 and 2016 annual reports, respectively.³ Given the importance that internal control systems play in effective governance (e.g., Doyle et al., 2007a, Goh and Li, 2011) and the potential signal that nontimely compliance provides to investors and regulators, we examine determinants and consequences of noncompliance with the COSO 2013 framework following the supersession of the COSO 1992 framework.

Since the release of the original COSO 1992 framework, businesses and operating environments have changed dramatically. In response to these changes, COSO embarked on a project to modernize the original 1992 framework. We discuss the substantive changes to the framework in more detail in the next section. The process of transitioning to the COSO 2013 framework should help firms identify potential weaknesses in internal control environment design and better calibrate monitoring effort and control activities with relevant risks of material misstatement.

After the updated framework was introduced on May 14, 2013, public issuers had the choice to use either the original 1992 framework or the updated 2013 framework as the underlying internal control framework during a transition period from May 14, 2013, to December 15, 2014, as long as the applicable framework was disclosed. Following the transition period, COSO considers the 1992 framework as having been superseded. Despite the potential benefits of the updated framework and encouragement from the COSO board to transition as soon as feasible, some firms did not transition even after supersession of the 1992 framework.

We first examine determinants of noncompliance. We refer to noncompliant firms as those that continue to use the COSO 1992 framework after its supersession (i.e., fiscal years ending on or after December 15, 2014). Our analyses are based on a sample of firms subject to the reporting requirements of Section 404(b) of SOX, which requires auditor attestation on the effectiveness of ICFR. Our sample consists of 1,761 firms that made a timely transition to the COSO 2013 framework and 305 firms that continue to use the original 1992 framework after supersession. Prior research examining internal control effectiveness (Doyle et al., 2007b, Feng et al., 2015, Ge and McVay, 2005) as well as financial press articles and speeches issued/made around the implementation of the COSO 2013 framework motivate the determinants of noncompliance that we examine.

The results suggest that resource constraints, financial distress, and a weak internal control environment influence noncompliance. We find that noncompliant firms are smaller, are less likely to have an internal audit function (IAF), are more highly leveraged, are more likely to be financially distressed, and are more likely to have a material weakness in internal controls. We find that KPMG clients were more likely to be noncompliant, consistent with financial press articles suggesting that KPMG counseled its clients not to rush the transition process. We find that firms were less likely to be noncompliant with the new framework if they engaged an industry specialist auditor, had a larger board of directors, or had at least one audit committee member with accounting expertise. Surprisingly, we find that noncompliance is positively associated with a higher proportion of institutional investment in the firm.

We next examine consequences of noncompliance. Because noncompliance can provide a signal to investors and regulators, we examine whether investors view quarterly earnings surprises of noncompliant firms to be less credible and whether noncompliance increases regulatory scrutiny. Finally, given the potential governance benefits associated with the updated framework, we examine whether accounting conservatism increases for firms that implement the updated framework relative to noncompliant firms that continue to use the 1992 framework. For each of these tests, we use a difference-in-differences research design to draw stronger inferences regarding noncompliance (or compliance) with the updated framework.

Results of these tests suggest that in the period(s) following supersession of the 1992 framework, investors view quarterly earnings surprises of noncompliant firms to be less credible and that noncompliance increases regulatory scrutiny as evidenced by the receipt of an SEC comment letter (or one with multiple comments) and an increasing number of comments in SEC comment letters received by noncompliant firms following supersession of the COSO 1992 framework. These results highlight how noncompliance intensifies regulatory scrutiny on issuers’ financial statements and disclosures broadly. We also find some evidence that accounting conservatism increases after the supersession of the 1992 framework for compliant firms relative to noncompliant firms, suggesting that noncompliance can delay the potential benefits of the updated framework. These results are robust to the use of propensity-score matched samples.

In additional analyses, we break out compliant firms into early and on-time implementers. We identify on-time implementers as those firms that implemented the 2013 framework in the first fiscal year ending on or after the supersession date (i.e., December 15, 2014). Early implementers are those firms that implemented the 2013 COSO framework in a fiscal year ending before the required transition date (December 15, 2014). We then reexamine our consequence-related tests. In terms of quarterly earnings response coefficients (ERCs), we do not find that ERCs change differentially for early relative to on-time implementers after transitioning to the updated 2013 framework. However, we find that early implementers are less likely to receive SEC comment letters, including letters with multiple comments, relative to on-time implementers. Additionally, we find some evidence that early implementers exhibit increased accounting conservatism relative to on-time implementers.

This study provides several important contributions. To our knowledge, this is the first study that examines the determinants of noncompliance with the COSO 2013 framework. The study suggests that resource constraints, resource distractions, financial distress, and weak internal control environments can delay transitions to new and updated internal control frameworks. Although updates to internal control reporting frameworks are not frequent, these results have important insights for the COSO board when considering future framework updates and to regulators such as the SEC when considering enforcement of transition requirements. The study also highlights investor and regulator responses to noncompliance. The results from our difference-in-differences tests suggest that investors view quarterly earnings surprises of noncompliant firms to be less credible and that regulators increase their scrutiny of noncompliant firms’ financial reports following evidence of noncompliance. These consequences appear to persist even after the noncompliant firms implement the updated COSO framework. These insights should be informative to boards of directors and managers as they devise compliance strategies for future updates, new rules, or new regulations involving ICFR. Additionally, the study provides some evidence of a substantive impact of the COSO 2013 framework on reporting conservatism. This result aligns with the framework’s increased emphasis on governance and anti-fraud measures and better calibration of internal control design to relevant financial statement risks.