IT internal control weaknesses and the market value of firms

Abstract

Purpose With computer technology fast becoming the engine that drives productivity, IT systems have become more pervasive in the daily operations of many businesses. Large, as well as small, businesses in the USA now rely heavily on IT systems to function effectively and efficiently. However, past studies have shown CEOs do not always understand how reliant their business is on IT systems. To the authors’ knowledge, no research has not yet examined if financial markets understand how IT affects the performance of businesses. The paper aims to discuss these issues. Design/methodology/approach In this study, the authors utilize the event study method to examine how financial markets interpret weaknesses in businesses IT systems. The authors examine this in the context of the Sarbanes-Oxley Act – Section 404 requirements and utilize the internal reporting requirement in the annual financial statement filing with the Securities Exchange Commission as a proxy to evaluate how the financial markets interpret IT weaknesses. Findings Using an event study, the authors show that the market does not necessarily understand and respond to the effects of IT weaknesses on overall financial performance of firms and thus challenge the efficient market hypothesis theory. Originality/value A second contribution is methodological in nature. IS researchers thus far have been using limited market benchmarks, statistical tests, and event windows in their respective event studies of market performance. This study shows shortcomings of that approach and the necessity of expanding usage of available event analysis tools. The authors show that using more than one market benchmark and statistical test across multiple time frames uncovers the effects that using a single benchmark and test over a single window would have overlooked.

Investigating identity fraud management practices in e-tail sector: a systematic review

“…The identity frauds are also a serious obstacle to the development of online business markets, as lack of customers' trust in online purchasing hinders growth in online business activities. To some extent these frauds may be the result of the lack of internal control, which leads to negative impact on stock value (Kuhn and Morris, 2017). The extant literature has multiple studies on various aspects of fraud management, but no study presents a holistic view of on practices to manage identity frauds effectively.…”

Adoption of a combined assurance framework in South Africa’s provincial government departments: A compliance case study

“…In the public sector it is believed that internal controls should minimise risks in the public sector due to factors like fraud and incapacity. Kuhn and Morris (2017) state that Internal controls are policies and procedures intended to achieve the objectives of efficient and effective operations, reliable financial reporting, and compliance with laws and regulations. Izza and Islami (2022) examined the necessity of the internal control system in the public sector.…”

Accounting Environment: Ranking of Internal Controls to Safeguard Accounting Information and its Integration with IT Operations

“…In fact, by the year 2021, the cybercrime's global cost is estimated to reach $6 trillion (Cybercrime Damages, 2016;Otero & Fink, 2020). Such constant attacks lead to devastating losses resulting in the loss of confidentiality, integrity, and availability of sensitive accounting information (Kuhn & Morris, 2017;Ponemon, 2016). Examples of sensitive accounting information constantly attacked, based on Tucker (2018), include transactions associated with globalization, intercompany trades, and mergers and acquisitions as these transactions create major risks related to financial and regulatory reporting.…”

“…Internal controls related to IT or General IT Controls (GITC) support the effective functioning of applications, the integrity of reports generated from those applications, and the security of data housed within the applications (Kuhn & Morris, 2017;Otero, 2019b). GITC commonly include controls over (1) computer or information systems operations; (2) access security; and (3) change management.…”