Abstract
This study examines whether audit fees reflect risk premiums in the presence of control risk after controlling for audit effort through audit delay. Our results indicate that auditors adjust risk premiums as well as audit efforts in response to altered control risk. Further analysis shows that the extent of risk premium adjustment varies depending on the severity of the underlying internal control problems. Overall, these findings provide insights into the distinct role of audit effort and risk premium in audit pricing decisions.
Introduction
Recent research (Hoag & Hollingsworth, 2011; Hogan & Wilkins, 2008; Hoitash, Hoitash, & Bedard, 2008; Munsif, Raghunandan, Rama, & Singhvi, 2011; Raghunandan & Rama, 2006) has examined the relationship between audit fees and internal control risk using the publicly available data on effectiveness of internal control, as mandated by the Sarbanes–Oxley Act of 2002 (SOX). These studies find that audit fees are significantly higher for firms that disclose material weakness in internal control, and the remediation of a material weakness leads to a reduction in audit fee. The consistent findings from these studies are interpreted as auditors managing control risk by exerting more effort in audits of firms with weak internal controls, resulting in increased audit fees.
However, as noted in Hogan and Wilkins (2008), the documented fee increase could also be due partially to the risk premium associated with internal control deficiencies. The audit fee model developed by Simunic (1980) suggests that audit fee is a function of audit effort and the auditor’s expected future losses arising primarily from the litigation risk. In other words, auditors may respond to increased client risks by charging a premium to insure against potential litigation as well as exerting more engagement effort.
Prior studies show that the disclosure of internal control weaknesses is often associated with lower accruals quality and higher frequency of restatements (Ashbaugh-Skaife, Collins, Kinney, & LaFond, 2008; Doyle, Ge, & McVay, 2007), which, in turn, increases the likelihood of litigation against auditors (Abbott, Parker, & Peters, 2006; Barron, Pratt, & Stice, 2001; Heninger, 2001). This suggests that in the presence of increased control risk, although auditors can manage the risk by performing additional substantive tests, such tests cannot uncover all possible misstatements, especially frauds perpetrated through management collusion (Hoitash et al., 2008). To the extent that auditors cannot reduce control risk completely by additional auditing, they may charge clients a premium to compensate them for possible future litigation losses.
The purpose of this study is to empirically analyze whether audit fees reflect a premium for control risk. Our sample comprises all firms that filed Section 404 reports over the period of 2004-2011. We employ a research design that enables us to disentangle the two alternative explanations for the audit fee effect. 1 After controlling for auditor effort (proxied by audit delay), we find a positive association between changes in audit fees and changes in the quality of internal control, indicating that control risk explains a significant amount of variance in audit fees over and above that explained by audit effort. This result supports the view that auditors adjust the risk premium charged to clients for the assessed control risk in addition to the scope and nature of audit work. Further analysis shows that changes in audit fees due to the risk premium vary depending on the severity of the underlying problems pertaining to internal control. We find that auditors consider the type of weakness (i.e., general weaknesses [GWs] vs. account-specific problems) when adjusting the risk premium upward in response to increased control risk. However, this is not the case when they adjust the risk premium downward for decreased control risk. This result is consistent with auditors taking a more conservative approach when pricing the control risk for clients who have previously experienced internal control problems, irrespective of the type of weakness involved.
The above conclusions are drawn from the changes analysis. We adopt a changes analysis approach for two reasons. First, results based on a cross-sectional association are vulnerable to correlated omitted variables and endogeneity problems (Johnstone, Li, & Rupley, 2011). As a result, it is difficult to interpret the results because the reported parameter estimates from levels regression may be biased. A changes model allows us to control for unobservable company characteristics assumed to be constant over time and mitigate potential endogeneity bias. 2 Second, while levels analysis tests the cross-sectional differences in audit fee levels across firms, changes analysis examines fee changes over time within the same firm. Thus, the fee change design allows us to directly measure auditors’ responses to changes in control risks, and increases our ability to draw a causality relationship between material weaknesses in internal control and audit efforts/risk premiums.
Our study corroborates and extends prior research on audit fees and control risk. While much of the prior work in this area consistently finds higher audit fees in the presence of internal control weaknesses, little is known about whether the documented fee increment is attributable to extended audit effort and/or a higher risk premium. An exception is the study by Bedard and Johnstone (2004), which finds that auditors charge a higher hourly billing rate to clients with higher control risk as a premium to cover costs related to potential future litigation. However, our study differs from theirs in two important ways. First, we focus on auditors’ assessments of control risks and their pricing decisions in the presence of the identified risks, while their study focuses on auditors’ assessments of earnings manipulation risk and corporate governance risk, with control risk being included as a control variable in the model. Second, their study relies on data derived from engagement partners’ assessments of their clients’ internal control quality from a single year preceding the mandatory SOX 404 disclosure requirements, and thus is limited to one audit firm and a small sample size. In comparison, our study uses a much broader sample based on publicly available data, which enables us to conduct a more comprehensive analysis of and draw more reliable inferences about the relationship between internal control quality and risk premium. Overall, the results of this study provide new insights into the distinct roles of audit effort and risk premium in explaining the variations in audit fees.
This research is closely related to Hoag and Hollingsworth (2011). Yet, our study differs from theirs in several aspects. First, while their study examines the relationship between audit fees and internal control weakness, we focus on disentangling the two components of the audit fees and their distinct roles in the audit pricing process. Second, we provide a more comprehensive analysis of the impact of severity of internal control problems on audit fees. Third, our sample covers a much longer and more recent period, which increases our ability to draw more robust conclusions. Collectively, the articles in this area shed light on how internal controls affect audit pricing behavior.
The remainder of this article proceeds as follows: The section “Background, Literature Review, and Hypothesis Development” provides a literature review and develops our hypotheses; “Research Design” section describes the research design; “Empirical Results” section presents descriptive statistics and multivariate results; “Additional Analysis” section presents additional analysis; and the final section contains conclusions of this study.
Background, Literature Review, and Hypothesis Development
Background of Section 404
Internal control is a major focus of recent SOX regulatory changes. Prior to SOX, disclosure of significant deficiencies in internal control was publicly required only when companies changed their auditors (Securities and Exchange Commission [SEC], 1988). Public firms could voluntarily report on the effectiveness of internal controls, but few firms actually did so (Sankaraguruswamy & Whisenant, 2004). SOX Section 404 explicitly requires an annual report detailing internal controls over financial reporting to be filed with the SEC Form 10-K.
More specifically, Section 404 requires (a) management to establish, monitor, and sustain adequate internal controls and assess the effectiveness of these controls; (b) auditors to attest to management’s assessments and provide a separate opinion about internal control effectiveness based on their own review of the firm’s internal controls. 3 The auditor’s report must include disclosure of any material internal control weaknesses, and procedures and corrective actions taken to address the weaknesses. When one or more such weaknesses exist, the auditor is required to issue an adverse opinion on the effectiveness of internal controls.
Literature Review and Hypothesis Development
Disclosures about internal control, as entailed in Section 404 of SOX, provide an objective and reliable measure of auditors’ assessments of internal control risk. The audit risk model, discussed in the Statement on Auditing Standards (SAS) No. 107 (American Institute of Certified Public Accountants, 2006, Paragraph 26) and Auditing Standard No 8 (Public Company Accounting Oversight Board [PCAOB], 2010), suggests that as control risk increases, auditors can reduce detection risk to achieve a desirable level of overall audit risk by increasing substantive testing, resulting in increased audit fees for the client.
Recent research has provided strong evidence that, in the post-SOX period, firms disclosing material weaknesses in internal control pay higher audit fees than firms with an unqualified SOX 404 opinion. Raghunandan and Rama (2006) find that firms receiving adverse SOX 404 opinions paid 43% higher audit fees than firms that received clean audit reports. Hoitash et al. (2008) expand on Raghunandan and Rama (2006) by using more comprehensive samples, and confirm that firms with reported internal control problems under SOX Section 404 have substantially higher audit fees than firms without such disclosures. Hogan and Wilkins (2008) also document that audit firms increased fees for clients who disclosed internal control deficiencies under SOX Section 302. 4 To the extent that audit fees act as a proxy for audit effort, the evidence is consistent with the audit risk model and suggests that auditors increase their effort in response to increased control risk. 5
However, an important question that has not been addressed in these studies is whether the increase in audit fees is also attributable to the risk premium charged by the auditor to cover potential litigation risks. This issue was raised by Hoag and Hollingsworth (2011) in their inter-temporal analysis of audit fees and Section 404 internal control opinions. They find that although audit fees decline for companies that remediate a material weakness, the corresponding fee reduction does not occur instantaneously. According to them, a possible explanation for the slow decrease could be that “clients who report a material weakness pose an additional business or litigation risk to their auditors, and this additional risk is persistently priced in the client’s current and future audit fees” (Hoag & Hollingsworth, 2011, p. 198).
According to the audit pricing model developed by Simunic (1980), an audit fee is a function of two key elements: a resource cost component that is increasing the level of auditor effort and an expected future loss component, which arises primarily from litigation risk. If the existence of control risk is perceived to increase the likelihood of auditor litigation, and the litigation risk cannot be reduced by additional auditing, auditors may charge clients a form of insurance premium for possible future litigation losses.
The link between internal control risk and business/litigation risk may be established through the potential impact of earnings management. 6 The presence of material weaknesses in internal control is often associated with lower earnings quality. Doyle et al. (2007) find that material weaknesses are generally associated with accruals that are not realized as cash flows, whereas Ashbaugh-Skaife et al. (2008) find that companies who remediated previously reported internal control deficiencies exhibit an increase in accrual quality. Lax internal controls facilitate earnings management and opportunistic managerial behavior, thus reducing the reliability of financial reporting and increasing the possibility that material misstatements will not be detected by normal audit procedures.
Not surprisingly, prior research has provided evidence that links earnings management to auditor litigation risk. For example, Heninger (2001) documents a positive association between income-increasing abnormal accruals and ex post auditor litigation. Barron et al. (2001) find that auditor assessments of litigation risk are higher when potential errors overstate financial performance. Palmrose and Scholz (2004) show that 83% of restatements that elicit litigation involve a reversal of previously income-increasing accounting. Accordingly, auditors consider the risks of earnings management in their assessment of litigation risks and incorporate these risks into their pricing decisions. In particular, Houston, Peters, and Pratt (1999) show that when the risk of irregularities is high, auditors add a risk premium to the audit fee to compensate them for bearing the business risk that cannot be controlled by gathering additional audit evidence. Johnstone and Bedard (2001) and Bedard and Johnstone (2004) both find that, in addition to planning more audit hours, auditors charge higher billing rates for clients who resort to earnings manipulation and fraud as a premium to compensate them for costs related to potential litigation and reputational damage.
In light of the above discussion, it is reasonable to assume that intensified control risk gives rise to higher litigation risk due to the prevalence of earnings management. This results in auditors charging a higher risk premium to reduce their exposure to future litigation as well as applying more audit effort toward detecting misstatements.
Focusing on the risk premium component of audit fees, we posit that risk premiums increase (decline) in a manner consistent with weakened (strengthened) internal controls. More specifically, we expect that when a company’s internal controls deteriorate (i.e., receiving a clean 404 opinion in the prior year and an adverse opinion in the current year), auditors respond to heightened control risk by increasing the risk premium. 7 By similar logic, the remediation of internal control weakness (i.e., receiving an adverse 404 opinion in the prior year and a clean opinion in the current year) should result in lower risk premiums, thus reflecting reduced control risk. Our first hypothesis is stated in an alternative form as follows:
Our next hypothesis considers the impact of the severity of internal control weakness on risk premium adjustments. General (company-level) material weaknesses, such as weakness in the control environment or the overall financial reporting process, represent a more serious concern regarding the reliability of financial reporting than account-specific weaknesses (SWs) that are related to specific account balances or transaction-level processes. While account-specific material weaknesses are identifiable and correctible by auditors through substantive testing, company-level weaknesses are more difficult to “audit around” (Ettredge, Li, & Sun, 2006). In other words, GWs are more likely to be associated with irregularities that are difficult to detect and correct.
Consistent with this view, Doyle et al. (2007) find that only GWs are significantly associated with lower accrual quality. Hammersley, Myers, and Shakespeare (2008) find that stock returns are significantly more negative when internal control weaknesses are company level as investors are more concerned about the potential for material misstatements. Management fraud is also more likely to occur at firms with company-wide internal control problems because management is more capable of overriding control procedures (Ettredge, Heintz, Li, & Scholz, 2011). Hence, compared with account-specific material weaknesses, general internal control problems pose greater audit and litigation risks to auditors. Accordingly, we hypothesize that auditors recognize the difference in the level of risks represented by these two types of material weaknesses and adjust the risk premium in a manner consistent with the degree of severity of internal control weaknesses. We state our second hypothesis in an alternative form as follows:
Research Design
Regression Model
Our hypotheses relate changes in internal control opinions to changes in risk premiums. To test the hypotheses, we estimate the following audit fee model:
The dependent variable is the change in the natural logarithm of audit fees (DAF). 8 Our variables of primary interest are a group of indicator variables representing the change in the level of control risk. We classify our sample firms into four groups based on the Section 404 disclosures in two successive years: (a) good internal controls in both years (GG); (b) good internal controls in a given year, followed by bad controls next year (GB); (c) bad internal controls in a given year, followed by good controls next year (BG); and (d) bad internal controls in both years (BB). The terms good and bad refer to unqualified and qualified SOX 404 opinions, respectively. 9 As GG serves as the reference group for the test, the other three test variables measure the change in audit fees relative to that of GG firms.
To test whether audit firms adjust risk premiums in addition to altering their audit effort, we include in our model the audit delay measure (DAD) to control for the effect of audit effort. In its change form, DAD is calculated as the change in the number of days between the fiscal year-end and the date of audit report. 10 There exists a logical relationship between audit delay and the scope and extent of audit work as the more (fewer) hours an engagement consumes, the longer (shorter) the audit report lag will be. Knechel and Payne (2001) provide direct evidence that a lengthy audit delay is due to more audit hours and efforts being expended on an engagement. Ettredge et al. (2006) find that the reporting of internal control weaknesses is strongly associated with longer audit delay, indicating that the audit delay measure captures a significant portion of the extended audit work. 11 The inclusion of DAD in the audit fee model thus enables us to isolate the effects of audit effort and risk premium, two distinct components of the audit fee. With DAD capturing the effect of audit effort, the control risk indicator variables (i.e., GB, BG, and BB) represent the portion of audit fee change attributable to risk premium adjustment beyond that explained by altered audit effort. A risk premium for control risk in the audit fee can be inferred if the coefficients on GB, BG, and BB are statistically significant after audit effort (DAD) is controlled.
For completeness, we also estimate the audit delay model where the change in audit delay (DAD) serves as the dependent variable, as depicted below:
In light of the finding by Ettredge et al. (2006) that the presence of material weaknesses is associated with longer audit delays, we expect the coefficients on GB, BG, and BB to be highly significant if the audit delay measure captures the level of audit effort associated with managing control risk.
We also include in our models as control variables a comprehensive set of firm and auditor characteristics that have been identified as determinants of audit fees from prior studies. All control variables are measured as the change from year t − 1 to year t. Hay, Knechel, and Wong (2006) show that more complexity in clients’ business leads to higher audit fees. We control for audit complexity by including firm size (DSIZE), foreign sales (DFRGN), number of segments (DSEGNO), accounts receivables (DRECV), and inventory (DINVT). We also include the absolute value of discretionary accruals (DABACC) and accruals quality (DERROR) 12 to control for information risk, which has been shown in prior literature to be positively associated with audit fees (Simunic, 1980). Prior research has also found that audit fees are an increasing function of clients’ litigation risks (Simunic & Stein, 1996). We thus include leverage (DLVRG), loss (DLOSS), liquidity (DCATA), earnings before interest and taxes (DEBIT), quick ratio (DQUICK), and a direct measure of litigation risk (DLIT). 13 Furthermore, we control for financial statement audit opinion (DOPIN) because firms receiving modified audit opinions require more audit efforts (Simunic & Stein, 1996). As staff constraints usually occurring in the peak season may lead to increased audit fees and delays (Francis, Reichelt, & Wang, 2005), an indicator variable (DDY) is included to capture the effect of December fiscal year-end. We include auditor switch (DCHG) to account for the possible “low-ball” practice (DeAngelo, 1981) in initial audits. We also include an indicator variable for restatement (DREST) because it has been shown to be associated with longer audit delay, which, in turn, could affect audit fees (Feldmann, Read, & Abdolmohammadi, 2009). To account for differential filing deadlines, we include a dummy variable for large accelerated filers (DLACCL). 14 Finally, we control for industry (industry dummies) and year effects (year dummies). 15 Definitions and data sources of the variables are summarized in Table 1.
Variable Definitions.
Note. The data item and data source for each variable are included in square brackets.
Data
We begin with a sample of firms for which SOX 404 opinions are available in Audit Analytics for the years 2004-2011. First, we require all firms to have internal control data for 2 consecutive years, which eliminates 20,014 observations. Next, we exclude 2,016 observations with missing data on audit fees or audit report dates. To remain in the sample, firms must also have available Compustat data required for our tests. These restrictions result in a final sample of 26,940 firm-year observations. 16 Panel A of Table 2 summarizes the procedure of sample selection.
Sample Selection Procedure and Sample Distribution.
Note. Sample firms are classified into four groups based on the Section 404 disclosures in two successive years: (a) good internal controls in both years (GG); (b) good internal controls at t − 1 and bad internal controls at t (GB); (c) bad internal controls at t − 1 and good internal controls at t (BG); and (d) bad internal controls in both years (BB).
Note. SIC = Standard Industrial Classification.
Panel B of Table 2 displays the sample distribution by year-to-year change in Section 404 internal control opinions. Most firms (89.19%) in our sample report effective internal control in 2 successive years (GG firms). As shown in column BG, about 4.77% of the sample firms remedied internal control weaknesses in the year following the prior material weakness disclosure, 17 whereas approximately 3.30% of the firms reported a deterioration in their internal controls as revealed in the GB column. 18 Untabulated results show that non-remediation firms are typically those reporting a large number of weaknesses and certain types of weaknesses (such as weak control environment) that are more difficult to resolve. We also observe that the percentage of firms reporting consecutive clean opinions (GG) increases steadily over the sample period, with the percentage of GB, GB, and BB firms exhibiting a downward trend.
Panel C reports sample distribution by industry. The industry group with the largest representation in our sample is manufacturing, followed by financials and services. Our sample’s industry composition is closely aligned to the industry composition in the Compustat database.
Empirical Results
Descriptive Statistics
Panel A of Table 3 presents descriptive statistics for the sample data. 19 The mean and median of changes in audit fees (DAF) are US$31,192 and US$6,471, respectively, indicating that, on average, audit fees increased over the period 2004-2011. Interestingly, the change in audit delay (DAD) has a negative mean of −0.5556 and a median of 0, suggesting a small decrease in the average audit delay over the sample period. This is probably due to the learning effects as auditors became more familiar with audits of internal controls, which started in 2004, when a substantial increase in audit delay compared with 2003 was observed (Ettredge et al., 2006). 20
Descriptive Statistics.
Note. See Table 1 for variable definitions.
Panel B shows the mean values of changes in audit fees and audit delays separately for the four groups. We observe a large increase in audit fees for GB firms (21.12%) and a moderate decline for BG firms (−5.98%). Note that the magnitude of fee decline for BG firms is considerably smaller than the magnitude of increase for GB firms, suggesting that there is some “stickiness” in audit fees (Munsif et al., 2011). Once an auditor increases the audit fee in response to ineffective internal controls, there is some resistance against reducing the fees to a great extent.
We also find that BB firms experience a significant increase in audit fees (3.27%), suggesting the auditors are particularly concerned about the heightened control risk associated with firms failing to remediate internal control weaknesses, and hence seek to reduce the risk by assessing higher fees. Audit firms continue to increase fees for GG firms (1.21%), probably reflecting the overall upward trend in audit fees during our test period.
Turning to the audit delay measure, GB and BG firms have, on average, a 9.52% increase and an 8.75% decrease in audit delay, respectively. The results are generally consistent with those for audit fees, supporting the notion that a significant portion of fee change is attributable to the variation in audit effort.
Panel C presents partial correlations between audit fees, audit delay, and the four internal control groups. GB has a positive association with both DAF (.1005) and DAD (.1444), whereas BG is negatively correlated with DAF (−.0430) and DAD (−.1491). We also find that both GG and BB are positively (negatively) correlated with DAF (DAD). These results are generally consistent with those reported in Panel B. In the appendix, we present the correlation matrix for all control variables used in our tests.
Overall, the univariate results provide evidence consistent with prior studies (Ettredge et al., 2006; Hoag & Hollingsworth, 2011). We next present a multivariate regression analysis to provide a direct test of our risk premium hypotheses.
Regression Results of Changes Model
Table 4 reports the ordinary least squares (OLS) regression results from the changes model. 21 For all regressions, the statistical inferences are based on the heteroskedasticity-consistent variance–covariance matrix (White, 1980). 22 The first column presents the audit delay model. We find that GB firms experience an average increase of 6.7113 days in audit delay, whereas BG firms have their average reporting lag shortened by 6.1872 days, after controlling for other determinants. To the extent that audit delay proxies for audit effort, these results suggest that auditors alter the scope and extent of audit work in response to the assessed control risk. 23
OLS Regression Results of Changes in Audit Delays and Audit Fees on Changes in Internal Control Quality.
Note. All p values are based on two-tailed tests. See Table 1 for variable definitions. OLS = ordinary least squares.
To investigate whether auditors also manage control risk by adjusting risk premiums, we estimate an audit fee model where the change in audit delay is included to control for audit effort. Column 2 presents the estimated results. As expected, the change in audit fees is an increasing function of the change in audit effort, as evidenced by the significantly positive coefficient on DAD. Importantly, after controlling for changes in audit effort, we find significant coefficients for all the internal control opinion groups. Specifically, the positive and significant coefficient on GB indicates that firms reporting deterioration in internal control incur additional audit fees beyond the costs associated with extended audit effort. In contrast, the negative and significant coefficient on BG indicates that there is an incremental reduction in audit fees over and above the fee decrease due to the reduced amount of audit work for firms remediating previously disclosed internal control weaknesses. Note that the size of fee decline for BG firms is considerably smaller than that of fee increase for GB firms (−0.012 vs. 0.1344), suggesting that auditors are more cautious about lowering fees for remediation clients. These results provide evidence that auditors manage control risk by adjusting risk premiums as well as audit efforts.
We also observe that the coefficient on BB is negative in the audit delay model but positive in the audit fee model. This implies that the fee increase for firms failing to remediate previously disclosed material weaknesses stems primarily from a rise in the risk premium rather than greater audit efforts. This might be because auditors become more efficient at dealing with the same internal control problems for these clients, and thus the actual audit hours could decrease (Hoag & Hollingsworth, 2011). At the same time, the continued existence of material weaknesses raises serious concerns about the reliability of financial reporting, and hence heightens the litigation risk. Auditors might resort to charging a higher risk premium to cover potentially higher incremental costs associated with such clients. 24
Collectively, these findings lend support to Hypothesis 1 and provide new insights into the driving factors underlying the previously documented relationship between changes in audit fee and changes in quality of internal control. 25
Severity of Internal Control Weaknesses
Next, we test Hypothesis 2 by considering the severity of internal control weakness in our analyses. In particular, we investigate the extent to which the risk premium adjustment differs by the type of material weakness. Following Munsif et al. (2011), we classify an internal control weakness into GW or SW based on the material weakness categories compiled by Audit Analytics. Depending on the Section 404 opinions received in 2 consecutive years, a company is classified into one of these nine distinct groups—GWGW, GWSW, GWNW, SWSW, SWGW, SWNW, NWSW, NWGW, and NWNW, where GW, SW, and NW represent general weakness, account-specific weakness, and no weakness, respectively. For example, a GWNW firm is one that discloses a GW in year t − 1, and subsequently receives a clean 404 opinion in year t. Such a classification scheme allows for cases, wherein the internal control disclosure shifts from a more severe type to a less severe one (GWSW) or vice versa (SWGW).
Table 5 displays the regression results of the change in audit delay or audit fee on the change in Section 404 internal control opinions categorized by the level of severity. As NWNW (firms reporting no internal control weakness in both t and t − 1) serves as the reference group, the parameter estimates for all other groups are measured relative to NWNW firms.
OLS Regression Results of Changes in Audit Delays and Audit Fees on Changes in Internal Control Disclosures Categorized by the Severity of Internal Control Weakness.
Note. NW, GW, and SW refer to no weakness, general weakness, and account-specific weakness, respectively. A combination of any two of the three internal control opinions indicates the change in internal control status. For example, GWNW represents a firm reporting GW in year t − 1 and subsequently receiving a clean 404 opinion in year t. p values are based on two-tailed tests. See Table 1 for the definition of other variables. OLS = ordinary least squares.
The results from the audit delay model are presented in column 1. We make several important observations. First, the coefficients for both NWGW and NWSW are significantly positive, indicating that a breakdown in the firm’s internal control leads to an increase in audit delay. A further test of the difference between these two parameter estimates shows that NWGW is significantly more positive than NWSW (7.0671 vs. 5.4913, p value < .0001), suggesting that auditors exert more effort in audits of firms with company-level control weaknesses. Second, we find that the coefficients on GWNW and SWNW are both negative and significant, indicating that remediation of material weaknesses results in a decrease in audit delay. The F test shows that the reduction in audit effort is greater for firms correcting general internal control problems than account-specific problems (−6.7897 vs. −4.3492, p value < .0001). Third, the coefficient on GWSW (SWGW) is significantly negative (positive). This suggests that auditors adjust the scope and extent of audit work even when there is only a partial remediation (degradation) of internal control deficiencies. Finally, we observe a marginally significant coefficient on GWGW and an insignificant coefficient on SWSW, indicating little change in audit effort when the severity of control weaknesses remains unchanged.
We next discuss the results from the audit fee model presented in column 2, where audit delay is included to control for the effect of audit effort. First, as with the audit delay model, the coefficients on NWGW and NWSW are both significantly positive, and the difference between the two coefficient estimates is statistically significant (0.1662 vs. 0.0639, p value < .0001). The result suggests that auditors charge higher risk premiums to clients who report GWs than to those disclosing account-specific problems, consistent with the notion that GWs are more difficult to audit around and rectify and thus reflect a higher level of risk. Second, we find negative and significant coefficients on GWNW and SWNW, suggesting that auditors lower risk premiums in response to reduced control risk. However, we find no significant difference between GWNW and SWNW. This seems to suggest that auditors consider the type of weakness when adjusting the risk premium upward, but do not do so in the case of a downward adjustment. While only a conjecture on our part, a possible explanation for the asymmetric pattern of risk premium adjustment is that auditors are not confident about clients who have previously disclosed internal control problems and thus do not distinguish firms by the type of weakness when reducing the risk premium. This is consistent with auditors taking a conservative approach in their pricing decisions. Third, the coefficient on SWGW is significantly positive, whereas the coefficient on GWSW is insignificant, indicating that auditors raise the risk premium when the internal control disclosure changes from a less severe type to a more severe one, but are reluctant to lower the premium in cases of partial remediation. The evidence again supports the view of auditor conservatism. Finally, we find positive and significant coefficients on both GWGW and SWSW. Contrasting this with the results for GWGW and SWSW in the audit delay model, the continued existence of material weaknesses seems to raise serious concerns about the reliability of financial reporting, and hence heightened litigation risk. However, instead of performing additional substantive tests, auditors rely on charging higher risk premiums to compensate themselves for bearing a higher risk.
To summarize, the findings reported in Tables 4 and 5 jointly present a fairly consistent picture of how changes in the effectiveness of internal control relate to changes in auditor efforts and risk premiums. We find strong evidence that the audit fee bears a risk premium for control risk. It is worth noting that although we find some evidence that the adjustment of risk premium differs by the type of material weakness, such an adjustment is more sensitive to increases in control risk, reflecting conservatism on the part of the auditor.
Additional Analyses
Fama–MacBeth Regressions
This study covers a much longer sample period (2004-2011) than those used in prior research. The study period, however, was characterized by increasing regulatory scrutiny on auditing practices and the issuance of several new auditing standards and SEC rules. To assess the sensitivity of our results to these regulatory changes, we rerun our main analyses by estimating annual regressions. Following Fama and MacBeth (1973), we average out the regression coefficients across the 7 yearly regressions for years 2005-2011, and compute t statistics using the standard error of the coefficients. The results are presented in Table 6. For brevity, we report only test variables. The estimated results are generally consistent with the results obtained from the pooled sample.
Fama–MacBeth Regression Results of Changes in Audit Delays and Audit Fees on Changes in Internal Control Quality.
Note. This table presents the regression results using the Fama–MacBeth procedure. The reported coefficient estimates are obtained by averaging the coefficient estimates from annual regressions for years 2005-2011, and p values are calculated using the standard errors of the annual coefficient estimates. See Table 1 for variable definitions.
Size Analysis
The documented relation between audit fees and quality of internal control could vary across different sized firms. Prior research has shown that large clients (or Big N auditors) have greater negotiation power than small clients (or non-Big N auditors). The relation could also vary depending on the SEC filer type. Effective November 15, 2006, large accelerated filers have been subject to the newly instituted 60-day Form 10-K filing deadline, whereas small accelerated filers continue to comply with the 75-day deadline. The different requirements regarding the filing deadline might yield differential results across filer types.
We therefore perform separate tests to investigate whether size could affect our results. First, we partition the sample based on the auditor type (Big4 vs. non-Big4). In our second test, we partition our sample based on whether the firm is a large or small accelerator filer, where a large accelerated filer is defined as a company that has a public float of US$700 million or more. Our final test partitions firms into two subgroups based on their fiscal year-end total assets.
The results are presented in Panels A, B, and C of Table 7, respectively. In general, the inferences drawn from size analyses are qualitatively similar to our primary analysis. In combination, these three tests suggest that our results are not driven by any subgroup of the sample.
Sensitivity Analyses.
Note. See Table 1 for variable definitions.
Reporting Periods
The PCAOB issued Auditing Standard No. 5 (AS5) effective for fiscal year-ends on or after November 15, 2007 (PCAOB, 2004, 2007). AS5 prescribes a top-down, risk-based audit approach, which the PCAOB believes will increase audit efficiency and result in significant cost savings. Consistent with this expectation, recent research has documented a decrease in audit fees, following the implementation of AS5 (Doogar, Sivadasan, & Solomon, 2010; Krishnan, Krishnan, & Song, 2011).
To assess the potential impacts of AS5 on audit pricing behavior, we partitioned our sample period into AS2 versus AS5 and reran our analyses separately for these two subperiods. As shown in Panel D of Table 7, the results are qualitatively similar across the two periods and our inferences remain unchanged.
Conclusion
This study addresses the important question as to whether audit fees reflect risk premiums in the presence of control risk. We hypothesize that increased control risk gives rise to heightened risk of earnings management, which in turn increases the likelihood of litigation against auditors. To the extent that the risk of errors and irregularities are high and normal audit procedures cannot reduce the risks to tolerable levels, a premium is added to the fee to compensate auditors for potential future litigation losses. We test this hypothesis by investigating whether control risk provides additional explanatory power over and above that provided by audit effort in explaining audit pricing.
Employing a changes analysis approach, we find strong evidence of auditors responding to increased control risk by charging fees above the cost of conducting additional audits. This suggests that auditors adjust risk premiums as well as audit procedures in face of increasing control risk. In further analysis, we find some evidence that changes in risk premiums are also associated with changes in the severity of the underlying internal control problems. Auditors assess a higher risk premium to clients reporting GWs compared with firms reporting account-specific problems. However, reduction in risk premiums is indistinguishable between these two types of weaknesses when clients remediate their internal control problems. This result is consistent with auditors taking a more conservative approach when pricing the control risk for clients that have previously experienced internal control problems, regardless of the type of weakness involved.
Hogan and Wilkins (2008) call for additional research to investigate whether higher audit fees in the presence of internal control weakness during the new SOX 404 reporting regime are due to extended audit effort or a higher risk premium. Our study thus can be viewed as a direct response to this call. The findings in this study lead us to conclude that the positive relation between internal control disclosures and audit fees documented in prior research (Hoag & Hollingsworth, 2011; Hogan & Wilkins, 2008; Hoitash et al., 2008; Munsif et al., 2011; Raghunandan & Rama, 2006) is driven by changes in both risk premiums and auditor efforts.
Overall, this study provides a more comprehensive analysis of the dynamics between audit fee responses and changes in internal control quality, and of the distinct role of audit effort versus risk premium in explaining the variance in audit fees. The findings reported in our study further add to our understanding of the impact of SOX 404 requirements on the cost of internal control auditing.
One limitation of this study is our use of the audit delay measure as a proxy for the scope and extent of audit work. We acknowledge that audit delay measures audit effort with some noise. This is because audit delays can be influenced by many other unobservable determinants (e.g., auditors’ favor to a particular client in scheduling audit time). Furthermore, we estimate audit delay by counting the number of days from the fiscal year-end to the audit report date because actual audit delays—the number of days between the start and finish of audit work—are not publicly available. Ideally, such a study should be conducted using audit hours and rates data obtained directly from audit firms’ working papers and internal billing records. Therefore, our conclusions regarding audit effort versus risk premium are valid to the extent that the audit delay measure adequately captures the effects of audit effort.
Footnotes
Appendix
Pearson’s Correlations for Control Variables.
| (2) | (3) | (4) | (5) | (6) | (7) | (8) | (9) | (10) | (11) | (12) | (13) | (14) | (15) | (16) | (17) | (18) | (19) | (20) | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| (1) |
|
|
|
|
|
.00 | .01 |
|
|
|
|
|
|
|
|
|
|
|
|
| (2) | −.01 | −.01 | .00 |
|
|
.01 |
|
|
|
|
|
|
|
|
|
|
|
|
|
| (3) |
|
|
|
|
|
|
|
.00 |
|
|
|
|
|
|
|
|
|
||
| (4) | .00 | −.01 | .00 | .01 | .01 | −.01 | .00 | −.01 |
|
.00 |
|
|
.01 | .00 |
|
.00 | |||
| (5) | −.01 |
|
|
.00 | .00 | .00 |
|
.00 |
|
.00 |
|
−.01 | −.01 | −.01 |
|
||||
| (6) |
|
|
−.01 | .00 | .01 |
|
|
|
|
|
.00 |
|
|
|
|||||
| (7) |
|
|
|
.00 |
|
.00 |
|
|
|
.00 |
|
.00 |
|
||||||
| (8) |
|
.00 | −.01 |
|
|
|
|
|
.00 |
|
|
|
|||||||
| (9) | .00 |
|
|
|
|
|
|
|
.00 |
|
|
||||||||
| (10) | .00 |
|
.01 |
|
.00 | −.01 | .00 | .00 | −.01 | .00 | |||||||||
| (11) |
|
|
−.01 |
|
|
|
|
.00 |
|
||||||||||
| (12) |
|
|
|
|
|
.01 |
|
|
|||||||||||
| (13) | −.01 |
|
|
|
|
|
|
||||||||||||
| (14) |
|
|
.00 | .00 |
|
.00 | |||||||||||||
| (15) |
|
|
.00 |
|
|
||||||||||||||
| (16) | .00 | .00 |
|
|
|||||||||||||||
| (17) | .01 | .00 |
|
||||||||||||||||
| (18) |
|
|
|||||||||||||||||
| (19) |
|
Note. (1) DAF (2) DAD (3) DSIZE (4) DFRGN (5) DSEGNO (6) DABACC (7) DRECV (8) DINVT (9) DOPIN (10) DDY (11) DCHG (12) DLVRG (13) DLOSS (14) DCATA (15) DEBIT (16) DQUICK (17) DREST (18) DERROR (19) DLIT (20) DLACCL. Bold text indicates significance at the .10 level or better (two-tailed).
Acknowledgements
The authors thank Bharat Sarath, the Editor, and two anonymous referees for their careful reviews and constructive suggestions. They also thank participants and discussants at the 2011 American Accounting Association Annual Meeting for helpful comments and suggestions in the early phase of the paper.
Declaration of Conflicting Interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author(s) received no financial support for the research, authorship, and/or publication of this article.
