IT Internal Control Weaknesses and Firm Performance: An Organizational Liability Lens

45 Pages Posted: 26 Mar 2009 Last revised: 26 Jul 2014

See all articles by Dale Stoel

Dale Stoel

affiliation not provided to SSRN

Waleed A. Muhanna

The Ohio State University - Fisher College of Business

Date Written: July 14, 2009

Abstract

The information systems literature and the public press have called for organizations to more closely scrutinize their information technology (IT) controls; however, little more than anecdotal evidence exists on the business value of IT internal control investments, beyond regulatory compliance. Drawing on the strategy and accounting literature, we (a) advance a strategic necessity perspective to the question of IT internal controls value; and (b) use the unique setting provided by the enactment of the Sarbanes-Oxley Act of 2002 (SOX) to investigates the relationship between IT internal control weaknesses (ICW) and both accounting earnings (a contemporaneous measure of firm performance) and market value (a forward looking, risk-adjusted measure of firm performance). Using a data set that provides audited annual assessments of the effectiveness of both IT and non-IT internal controls for a cross-section of companies as mandated by SOX, we find that firms that report an IT ICW have lower accounting earnings compared to firms with strong IT internal controls. We also find that IT ICW moderates the association between accounting earnings and market valuation, with firms reporting weak IT internal controls having a lower earnings response coefficient. These results are sustained even after controlling for non-IT ICW and firm-specific factors that are known determinants of ICW. The results are also robust to econometric corrections for potential simultaneity and self-selection bias using Heckman’s two-stage procedure. Overall, our results provide empirical evidence which suggests that IT internal controls are a strategic necessity and that information systems risk is priced by the capital markets.

Keywords: IS Security, Internal Controls, Business value of IT, Sarbanes-Oxley Act (SOX), Strategic Liabilities, Market Valuation

JEL Classification: G12, G34, G38, M41, M49

Suggested Citation

Stoel, Dale and Muhanna, Waleed A., IT Internal Control Weaknesses and Firm Performance: An Organizational Liability Lens (July 14, 2009). Available at SSRN: https://ssrn.com/abstract=1368805 or http://dx.doi.org/10.2139/ssrn.1368805

Dale Stoel

affiliation not provided to SSRN ( email )

Waleed A. Muhanna (Contact Author)

The Ohio State University - Fisher College of Business ( email )

Dept. Accounting & Management Information Systems
2100 Neil Avenue
Columbus, OH 43210
United States
614-292-3808 (Phone)
614-292-2118 (Fax)

Register to save articles to
your library

Register

Paper statistics

Downloads
788
Abstract Views
4,171
rank
31,179
PlumX Metrics