262 /304
沙賓法
404
條及審計準則第
5
號是否會減少內部控制揭露錯誤？
262
ICFR opinions.
5
We presume that deterioration in ICFR-disclosure quality is shown by an
increase in the likelihood of Type II errors (that a restatement company fails to conclude
that its internal control system is ineffective for the restated period) or an increase in the
likelihood of Type I errors (that a non-restatement company concludes that its internal
control system is ineffective for the non-restatement period).
2.3 SOX 404 and ICFR-Disclosure Errors
Conceptually, to conclude that ICFR is ineffective, three conditions must be met:
there exist control deficiencies, control deficiencies are discovered, and managers decide
to disclose those deficiencies (Ashbaugh-Skaife, Collins, and Kinney, 2007). Following
this argument, both detection capability and disclosure incentives are important factors to
high-quality ICFR reports. Control weaknesses may not be discovered if managers are not
competent enough to apply adequate and sufficient assessment procedures in evaluating
internal control systems. SOX 404(a) requires a formal management assessment of
internal controls that must be prepared according to publicly recognized internal controls
frameworks, such as the Committee of Sponsoring Organizations of the Treadway
Commission (COSO) or Control Objectives for Information and Related Technology
(COBIT) frameworks. Kinney and Shepardson (2011) have found substantial increases in
material weakness disclosure rates for small companies undergoing the initial SOX 404(a)
management self-assessment of ICFR. Thus, the requirement of Section 404(a) might
enhance detection capability of top management and mitigate the problem of manager
incompetence in examining internal control systems.
SOX 404(b) requires that issuers’ internal control systems be evaluated by external
auditors who have professional knowledge, training, and experience in examining internal
control systems. Most internal control weaknesses are detected by auditors rather than by
5 After excluding the firms with multiple restatements or without necessary data, Rice and Weber (2012)
have shown that over 70% of their collected restatements are linked to internal-control weaknesses.
Around 20% of restating companies do not explicitly report on the link between restatement and
internal controls, and only 6% of restatement companies report that restatement is not attributable to
ineffective internal controls. With their findings, we believe that it is justifiable to presume that
internal-control weaknesses are more likely to exist in the misstated periods of restatement companies.
Moreover, the strong but not absolute relation between restatements and internal-control weaknesses
could weaken our statistical power. We also believe that the strong but not absolute relation does not
invalidate our research design because we have found significant results, which will be discussed in
the study’s results section.