265 /304
265
臺大管理論叢
第
28
卷第
1
期
control audits.
6
The PCAOB has documented that after AS5, 15 percent of the 309 audit
engagements inspected by the Board failed to obtain sufficient audit evidence to support
their ICFR-audit opinions (PCAOB, 2012). Moreover, risk-based audit approaches have
been related with the high-profile audit failures (e.g., HealthSouth and WorldCom) and
previously have been criticized by the PCAOB (Bell et al., 2008; Berkowitz and Rampell,
2002; Weil, 2004). Thus, the implementation of AS5 might lead to under-auditing and
increased Type II errors if auditors misuse the risk-based approach.
Facing the two contradicting arguments, we are not sure whether the incidence of
Type II errors of public ICFR disclosures has increased or decreased after the AS5
implementation, which is an empirical issue that is examined further in the study. In
contrast, we expect that the efficiency of ICFR audits has improved, and the incidence of
Type I errors has decreased after the implementation of AS5. Thus, our Hypothesis 2a and
2b are as follows.
Hypothesis 2a: The substitution of AS5 for AS2 does not increase or decrease Type II
errors, which are measured as the likelihood that a restatement
company fails to conclude that its internal control system is
ineffective for the restated period.
Hypothesis 2b: The substitution of AS5 for AS2 decreases Type I errors, which are
measured as the likelihood that a non-restatement company
concludes that its internal control system is ineffective for the non-
restatement period.
3. Research Design
3.1 Sample
We begin with all the company-year observations available in the Audit Analytics’
disclosure control (SOX302)
7
and internal control files (SOX404) for the period 2002–
2010.
8
We then merge the data with Audit Analytics restatement files and Compustat
6 Please refer to Footnote 2.
7 SOX 302 requires management to conclude on the effectiveness of ICFR in periodic reports. In
contrast, SOX 404 requires that management assessments and audit opinions of ICFR be disclosed in
annual reports. To reconcile the inconsistency of reporting frequency, we consider only 302 disclosures
made in annual reports.
8 We identify two nonoverlapping groups of U.S. companies that are separately subject to the two levels
of SOX regulations of ICFR: (1) SOX 302 regime, companies regulated before November 15, 2004,
and (2) SOX 404 regime, companies regulated after November 15, 2004.