The Impact of Enterprise Resou

JOURNAL OF INFORMATION SYSTEMS American Accounting Association
Vol. 25, No. 1 DOI: 10.2308/jis.2011.25.1.129

Spring 2011
pp. 129–157
The Impact of Enterprise Resource Planning

(ERP) Systems on the Effectiveness of
Internal Controls over Financial Reporting
John J. Morris
Kansas State University
ABSTRACT: Software vendors that market enterprise resource planning 共ERP兲 sys-
tems have taken advantage of the increased focus on internal controls that grew out of
the Sarbanes-Oxley 共SOX兲 legislation by emphasizing that a key feature of ERP sys-
tems is the use of “built-in” controls that mirror a firm’s infrastructure. They argue that
these built-in controls and other features will help firms improve their internal control
over financial reporting as required by SOX. This study tests that assertion by examin-
ing SOX Section 404 compliance data for a sample of firms that implemented ERP
systems between 1994 and 2003. The results suggest that ERP-implementing firms are
less likely to report internal control weaknesses 共ICW兲 than a matched control sample
of non-ERP-implementing firms. It also finds that this difference exists for both general
共entity-wide兲, and individual 共account-level兲 controls.
Keywords: enterprise resource planning; ERP; Sarbanes-Oxley; SOX; Section 404;

internal control.
Data Availability: The author will make available the list of firms used in the study. All
other data are available from public sources.
I. INTRODUCTION
he Sarbanes-Oxley Act of 2002 共SOX兲 requires companies to report on the effectiveness of
T their internal controls over financial reporting as part of an overall effort to reduce fraud
and restore integrity to the financial reporting process. Software vendors that market en-
terprise resource planning 共ERP兲 systems have taken advantage of this new focus on internal
controls by emphasizing that a key feature of ERP systems is the use of “built-in” controls that
mirror a firm’s infrastructure. They emphasize these features in their marketing literature, asserting
I thank the JIS editor, Paul John Steinbart, the anonymous associate editor, and two anonymous reviewers for their
comments and suggestions that have strengthened this paper. I also thank participants at the 2009 Midyear Meeting of the
AAA-IS Section, a Kansas State University Faculty Research Seminar, and members of my dissertation committee at Kent
State University for comments and suggestions on earlier versions of this paper.
Published Online: March 2011
129
130 Morris
that these systems will help firms improve the effectiveness of their internal controls as required
by SOX.1
These vendor statements motivate an interesting empirical research question about the impact
of ERP systems on internal control. Specifically, are firms that implement ERP systems more or
less likely to report internal control weaknesses in their annual reports than firms that do not?
Relatively little empirical/archival research has been conducted in this specific area, because prior
to SOX, internal control data did not have to be publicly reported. This study addresses that gap
in the literature by examining internal control data that is now available for a sample of firms that
have announced implementation of ERP systems and a control sample of similar firms that have
not.
Internal control is one of many mechanisms used in business to address the agency problem.
Others include financial reporting, budgeting, audit committees, and external audits 共Jensen and
Payne 2003兲. Studies have shown that internal control reduces agency costs 共Abdel-khalik 1993;
Barefield et al. 1993兲, with some even arguing that firms have an economic incentive to report on
internal control, even without the requirements of SOX 共Deumes and Knechel 2008兲. Their argu-
ment assumes that providing this additional information to the principal 共shareholder兲 about the
behavior of the agent 共management兲 reduces information asymmetry and lowers investor risk and,
therefore, the cost of equity capital. Other research has found that weaknesses in internal controls
are associated with increased levels of earnings management 共Chan et al. 2008; Ashbaugh-Skaife
et al. 2008兲. Earnings management is the agency problem that motivated SOX legislation in the
first place, specifically earnings manipulation by Enron, WorldCom, etc. ERP systems provide a
mechanism to deliver fast, accurate financial reporting with built-in controls that are designed to
ensure the accuracy and reliability of the financial information being reported to shareholders.
In addition to the increased assurances provided to the external principals 共shareholders兲
about the behavior of the agents 共management兲, ERP systems should also help mitigate the agency
problem between various levels of management in large corporations. The added transparency
combined with the use of built-in controls should make it more difficult for agents at all levels to
benefit from unobservable behavior. It is possible, however, that firms implementing ERP systems
may not take advantage of all the built-in control features, either for legitimate business reasons or
because management wants to avoid the added transparency in order to manage 共manipulate兲
earnings. By examining the effectiveness of these controls, this study not only extends the agency
theory stream of research, it also examines this tension between earnings management and internal
control with testable hypotheses related to overall internal controls, general 共entity-wide兲 controls,
and specific 共account-level兲 controls.
The study uses a sample of 108 firms that announced implementation of ERP systems be-
tween 1994 and 2003, and an equal number of control firms, matched by industry and size. The
results provide evidence that ERP-implementing firms are less likely to report internal control
weaknesses 共ICW兲 than the non-ERP control firms. This study further examines factors contrib-
uting to ICW and finds that those related to general 共entity-wide兲 controls and specific 共account-
1
SAP AG, the largest provider of ERP software in the world 共Eschinger 2006兲, states the following in one of its
brochures: “Embedded system controls within mySAP ERP financials include edit checks and tolerances for document
accuracy, required and system-populated fields for document completeness, and checks to prevent duplication of ac-
counting postings … mySAP ERP Financials can help you reduce risk related to compliance with the U.S. Sarbanes-
Oxley Act” 共SAP 2005兲. Also, Oracle Corporation, the world’s second-largest provider of ERP software 共Brunelli 2006兲,
in one of its brochures, states the following: “Each application in the Oracle Financials product family uses embedded
controls to automate process flows and enforce compliance across the organization, such as cross-validation rules for
master data, 2-, 3-, and 4-way purchase-order matching, sequential numbering, and the ability to centrally set quantity
and price-tolerance limits during invoice processing. This automated approach reduces risk by enforcing business rules
and simplifies auditing activities by making it easier to test controls” 共Oracle 2005兲.
Journal of Information Systems Spring 2011

American Accounting Association
The Impact of Enterprise Resource Planning (ERP) Systems 131
level兲 controls are both less likely to contribute to ICW in ERP firms than in non-ERP control
firms. This study also finds evidence that the advantage for ERP firms strengthened over time,
which suggests that firms may be implementing more of the built-in controls provided by ERP
systems as they gain experience with the system.
These findings are important because both SOX and ERP have been the subject of much
discussion and research in the academic and professional communities in recent years. Cost is
often the common denominator, with the high cost of SOX compliance and the high cost of
implementing ERP systems used as the basis for many research questions. These findings provide
evidence that ERP systems may contribute to improved internal controls, which is one of many
arguments used in justifying the high cost of ERP systems. This study is believed to be the first
empirical/archival test of those claims, and provides information about the factors that contribute
to internal control weaknesses 共ICW兲 that both the academic and professional communities should
find interesting. For instance, the most often cited factor is accounting documentation, policy,
and/or procedures. As expected, this factor is found less frequently for ERP firms than for the
control firms, perhaps justifying the effort needed to document systems during the implementation
process. This study also extends the research stream on the relationship between IT and agency
theory, in particular the link between the signaling effect of internal control reporting to the
financial markets and the use of ERP systems to facilitate that process.
The remainder of this paper is organized as follows: Section II summarizes prior research and
develops the hypotheses, Section III describes the data selection process and the research meth-
odology, Section IV presents empirical results, and Section V concludes.
II. PRIOR RESEARCH AND HYPOTHESES DEVELOPMENT

Internal Control Background
Internal control has played a major role in moderating the agency problem in corporations for
many years. Samson et al. 共2006兲 document several internal control procedures used by the
Baltimore and Ohio Railroad as early as 1831. In more recent times, internal control has been a
subject of discussion whenever there is a prominent scandal in the corporate world. For instance,
during the 1970s more than 400 corporations admitted making questionable or illegal payments to
foreign government officials, politicians, and political parties, which led to enactment of the
Foreign Corrupt Practices Act 共FCPA兲 of 1977 共Staggers 1977兲. Among other things, the FCPA
requires publicly traded companies to devise and maintain a system of internal accounting controls
共USC 1998兲.
During the 1980s, several high-profile audit failures led to creation of the Committee of
Sponsoring Organizations of the Treadway Commission 共COSO兲, organized for the purpose of
redefining internal control and the criteria for determining the effectiveness of an internal control
system 共Simmons 1997兲. They studied the causal factors that can lead to fraudulent financial
reporting and developed recommendations for public companies, independent auditors, educa-
tional institutions, the SEC, and other regulators 共COSO 1985兲. The product of their work is
known as the COSO Internal Control—Integrated Framework 共Simmons 1997兲. The COSO frame-
work broadly defines internal control as “a process, effected by an entity’s board of directors,
management and other personnel, designed to provide reasonable assurance regarding the achieve-
ment of objectives in the following categories: effectiveness and efficiency of operations, reliabil-
ity of financial reporting, and compliance with applicable laws and regulations” 共COSO 1992, 1兲.
It states that “there is synergy and linkage among these components, forming an integrated system
that reacts dynamically to changing conditions” 共COSO 1992, 1兲. The framework also points out
that controls are most effective when they are “built into” the entity’s infrastructure 共COSO 1992,
1兲 and further states that “built in controls support quality and empowerment initiatives, avoid
unnecessary costs and enable quick response to changing conditions” 共COSO 1992, 1兲.

132 Morris
At the turn of the century, another group of corporate scandals resulted in enactment of the
Sarbanes-Oxley Act of 2002 共SOX兲 which, among other things, requires a formal report on the
effectiveness of internal controls. The COSO framework plays a key role in compliance because
Section 404 of the Act requires companies to include in their annual report 共Form 10-K兲, a
separate management report on the company’s internal control over financial reporting and an
attestation report issued by a registered public accounting firm.2 Although other frameworks may
be accepted, the SEC has specifically stated that the COSO Framework satisfies SEC criteria and
“may be used as an evaluation framework for purposes of management’s annual internal control
evaluation and disclosure requirement” by companies listed on U.S. stock exchanges 共Gupta and
Thomson 2006, 28兲.
Prior Internal Control Research

Although internal controls have played a major role in corporate governance for many years,
empirical/archival research on internal controls was limited prior to SOX, mostly due to a lack of
public data. Internal control was considered an “internal issue” and public companies were not
required to disclose information about their internal control procedures.3 Following enactment of
SOX, internal control-related empirical/archival research has significantly increased. The added
reporting requirements of Sections 302 and 404 have placed information in the public domain that
researchers are using to examine numerous issues related to internal control and corporate gover-
nance. Section 302, which became effective in 2002, provided initial data that were used to test the
relationship between internal control weaknesses and other firm characteristics 共Ge and McVay
2005; Ashbaugh-Skaife et al. 2007; Doyle et al. 2007兲.4 Section 404, which requires a much more
extensive review of internal controls, became effective in 2004 under a two-phase schedule. In the
first phase, compliance is required for companies known as accelerated filers5 in annual reports for
fiscal years ending on or after November 15, 2004 共SEC 2003兲. The second phase, which includes
compliance for all other companies, has been extended several times and is now effective for fiscal
years ending on or after December 15, 2007, for the management report and June 15, 2010, for the
auditor attestation report 共SEC 2009兲.6 Although the exact form and language of the management
report on internal controls may vary from one firm to another, the report must disclose if there are
any material weaknesses in the internal controls over financial reporting. Therefore, it is now
possible to measure the effectiveness of internal controls by analyzing the material weaknesses
disclosed in these reports. Section 404 has been used by researchers to examine such issues as the
increased cost of audits 共Raghunandan and Rama 2006兲, delays in audits 共Ettredge et al. 2006兲,
2
The internal control report requires specific language including: 共1兲 a statement of management’s assessment of the
effectiveness of the company’s internal control over financial reporting, 共2兲 a statement identifying the framework used
by management to evaluate the effectiveness, and 共3兲 a statement that the registered public accounting firm that audited
the company’s financial statements included in the annual report has issued an attestation report on management’s
assessment of the company’s internal control over financial reporting 共SEC 2003兲.
3
The only exception was the required disclosure in Form 8-K of any internal control problems pointed out by predecessor
auditors when companies changed auditors. Some researchers have used this source of data to examine the relationship
between internal controls and other corporate governance measures. For instance, Krishnan 共2005兲 uses these disclo-
sures as a data source to compare internal control quality to audit committee quality.
4
Section 302 requires the CEO and CFO to certify that their financial statements “present fairly,” in all material respects,
the financial condition of their company, and that they have evaluated the effectiveness of their internal controls and
disclosed any material weakness and any significant changes in internal control procedures 共Ge and McVay 2005兲.
5
Accelerated filers are firms that have at least $75 million in market capitalization, have been subject to SEC reporting
requirements for at least 12 calendar months, that previously have filed at least one annual report, and that are not
eligible to file its quarterly and annual reports on Form 10-QSB and 10-KSB. Also excluded are mutual funds and
foreign firms that file Form 20-F.
6
The AICPA reports that language was added to the Investor Protection Act of 2010, which was recently signed by the
President, that would permanently exempt these nonaccelerated filers from the attestation report 共AICPA 2010兲.

percent of filers reporting deficiencies 共Grant et al. 2008兲, the relationship between internal control
weaknesses 共ICW兲 and the cost of equity 共Ogneva et al. 2007; Ashbaugh-Skaife et al. 2009兲, and
the relationship between ICW and earnings management 共Ashbaugh-Skaife et al. 2008; Chan et al.
2008兲.
Although internal control-related empirical/archival research is relatively new, there is a con-
siderable body of prior literature related to corporate governance, most of it using an agency
theory foundation 共Brennan and Soloman 2008兲. Eisenhardt 共1989兲 provides the theoretical basis
for the use of monitoring mechanisms such as financial reporting and audits to provide information
to the principal about the behavior of the agent.7 ERP systems facilitate this monitoring process in
two ways. First, they enable fast, accurate reporting of financial information to the principal, but
more importantly, they include features that facilitate implementation and enforcement of internal
controls that are used to ensure the accuracy of financial information being reported. One would
expect firms that implement ERP systems to maximize use of these built-in control features to not
only reduce agency costs, but to minimize the number of internal control weaknesses reported
under SOX Section 404.
These built-in controls are made possible in part because the systems are designed around the
concept of a single, integrated system that captures data in a common database for use throughout
the company. By contrast, most legacy systems, which evolved around the needs of individual
functional areas, have information spread across dozens or even hundreds of separate computer
systems 共Davenport 1998兲. Although legacy systems may include some built-in controls, one
would not expect these controls to be as effective as those that are designed into an integrated ERP
system. For instance, a typical ERP system will include built-in controls for matching purchase
orders, receiving documents, and invoices 共three-way match兲, taking advantage of the integrated
nature of all three functional areas. Legacy systems, on the other hand, may have different appli-
cations for purchasing, receiving, and accounts payable that have some built-in control features,
but do not communicate with each other. Consequently, manual controls would have to be used to
supplement the built-in controls and physically, rather than electronically, match the documents
prior to authorizing payment.
Auditing Standard No. 5 共AS No. 5兲, issued by the Public Company Accounting Oversight
Board 共PCAOB兲, provides some insight into the perceived relationship between information tech-
nology and internal controls. For instance, in Appendix B of AS No. 5, it states that “entirely
automated application controls are generally not subject to breakdowns due to human failure. This
feature allows the auditor to use a ‘benchmarking’ strategy … benchmarking automated applica-
tion controls can be especially effective for companies using purchased software when the possi-
bility of program changes is remote—e.g., when the vendor does not allow access or modification
to the source code” 共PCAOB 2007, B28, B32兲. Since ERP systems are purchased software, in
contrast to legacy systems, which are developed and maintained internally, company employees
would most likely have access to the source code for legacy systems, but not for ERP systems.
Given all of these factors, one would expect ERP systems to have a positive impact on the
effectiveness of internal controls over financial reporting.
However, a counter argument could be made that just because companies implement ERP
systems, they may not take advantage of all the built-in control features. It is possible, for instance,
that during implementation, some of the control features might not be activated. Or, in a more
sinister view, senior management may opt to override control features in order to manipulate data
to “manage earnings.” This argument would be more consistent with Brazel and Dang 共2008兲, who
7
Eisenhardt’s 共1989兲 second proposition states that “when the principal has information to verify agent behavior, the
agent is more likely to behave in the interest of the principal.”

134 Morris
argue that increased control by senior management over financial data in a centralized ERP system
will lead to an increase in earnings management. In support of their argument, they cite prior
research that finds reductions in audit and internal control quality following ERP adoption
共Bagranoff and Vendrzk 2000; Wright and Wright 2002; Hunton et al. 2004; Janvrin et al. 2004;
Brazel and Agoglia 2007兲. But Brazel and Dang 共2008兲 also point out that most of this research,
including theirs, relates to implementations that took place during the early years of ERP adoption,
prior to Sarbanes-Oxley, and argue that it is possible that these safeguards have since improved.
Indeed, the increased emphasis on internal controls following SOX makes it likely that firms that
adopted ERP systems early in the cycle have since taken advantage of the built-in features to
improve their internal controls, which leads to the following hypothesis stated in the alternate
form:
H1: Firms that have implemented ERP systems will be less likely to report material weak-
nesses in their internal controls than nonimplementers.
Looking only at total ICW may mask possible differences in subsets of controls. For instance,
it is possible that even if H1 is supported from an overall internal control perspective, the coun-
terintuitive behavior described above could still be taking place. If so, it may be uncovered by
segregating the internal controls into those that are general 共entity-wide兲 controls from those that
are specific 共account-level兲 controls. If management was overriding control features in order to
manage earnings, then one would expect to find more ICW related to general controls, even if the
specific 共account-level兲 controls are effective. This type of behavior should be uncovered during
the audit process since this is an area of concern specifically identified in AS No. 5, Paragraph 24,
which states that “entity-level controls include … controls over management override.” On the
other hand, a stronger argument could be made that if general controls are in place and working,
then one would expect to find less ICW related to general controls. This would be more consistent
with Chan et al. 共2008兲, who find an association between internal control weaknesses and positive
absolute discretionary accruals, and Ashbaugh-Skaife et al. 共2008兲, who find that firms reporting
internal control deficiencies have lower quality accruals. This leads to the following hypothesis
stated in the alternate form:
nesses related to general 共entity-wide兲 internal controls than nonimplementers.
Another explanation could be that firms have just not taken full advantage of the built-in
controls that are available. For instance, if the firms had opted not to activate certain control
features during implementation, then one might expect to find more ICW related to specific
共account-level兲 controls, even if the general 共entity-wide兲 controls are effective. However, if the
controls are in place and implemented, then one would expect to see less ICW in these types of
controls. Although a case could be made for either side of this argument given the pressures of
SOX, it is more likely that firms will take advantage of these built-in controls, which leads to the
following hypothesis stated in the alternate form:
nesses related to specific 共account-level兲 internal controls than nonimplementers.
III. DATA SELECTION AND RESEARCH METHODOLOGY

Sample Data Selection
An empirical/archival methodology is used to test these hypotheses by examining manage-
ment reports on the effectiveness of internal controls over financial reporting, included in Form
10-K annual reports, compiled by Audit Analytics. The sample data are based on 108 ERP-

implementing firms from 27 industry groups that announced implementation of ERP systems
between 1994 and 2003. Panel A of Table 1 provides a summary of the sample selection process
for these ERP-implementing firms. The process starts with the list of 91 ERP announcements
made between 1994 and 1998 from Hayes et al. 共2001兲,8 from which 36 firms were eliminated
because they are no longer listed or data were otherwise not available. The second step in the
process involves a search of all available newswire services using the LexisNexis service for years
after 1998, searching on key phrases such as: “ERP,” “Enterprise Resource Planning,” and “En-
terprise Systems.” This search found an additional 92 firm announcements yielding a total of 147
firms. This study examines the first five years that SOX 404 reporting was required, 2004–2008.
Not all firms were required to file in all years for a number of reasons, including the fact that the
effective date was for years beginning after November 15, 2004; therefore, only firms with No-
vember and December year-ends would be included for 2004. Also, some of the sample firms were
not classified as accelerated filers due to market capitalization levels and/or filing status. Elimi-
nating these observations leaves 108 firms and 377 firm-year observations for which SOX 404
reporting data are available in the Audit Analytics database.
Following the recommendations of Barber and Lyon 共1997兲 and the method used by Nicolaou
共2004兲, this study uses a matched pairs approach to select a control group. ERP-implementing
firms are first matched with other firms based on SIC code, then by total assets at the beginning of
the implementation year, then by the availability of Compustat accounting data and Audit Analyt-
ics SOX 404 reporting data. Once a match is identified, a further search of LexisNexis Newswires
is conducted for all available years using a combination of the firm name and several terms related
to ERP systems.9 If no newswire records are found, the firm is used as a match for this study. If
a record is found that indicates an ERP system may be in use, then the next closest firm in terms
of total assets is used, and the process repeated.10
Panel B of Table 1 provides a breakdown of the 108 ERP firms by two-digit SIC code and
implementation year. The sample is heavily concentrated around manufacturing firms that an-
nounced ERP system implementation from 1997–2000, consistent with the period of time that
firms were concerned about Y2K compliance.
Probit Regression Model

This study uses a probit regression model adopted from Ogneva et al. 共2007兲 with the number
of internal control weakness 共ICW兲 as the dependent variable, and an indicator variable for ERP
implementers as the primary variable of interest. It includes control variables that prior research
indicates are associated with ICW 共Ge and McVay 2005; Ashbaugh-Skaife et al. 2008; Doyle et al.
2007兲 plus one control variable specific to ERP systems. The resulting model is as follows:
Prob共COUNT_WEAKit兲 = f共␤ + ␤1ERPit + ␤2FOREIGNit + ␤3M&Ait + ␤4RESTRit

+ ␤5LOSSit + ␤6BIG4it + ␤7LOGSEGit + ␤8SALEGRWit
+ ␤9INVTATit + ␤10LOGMKTVit + ␤11ZSCOREit + ␤12LOGAGEit
+ ␤13LOGERPAGEit兲共1兲
8
I would like to thank David C. Hayes and Jacqueline L. Reck for providing this list of firms.
9
Terms include: 共1兲 ERP, 共2兲 Enterprise Resource Planning, 共3兲 Enterprise Systems, 共4兲 SAP, 共5兲 Oracle, 共6兲 QAD, 共7兲
Baan, 共8兲 Peoplesoft, 共9兲 JD Edwards, and 共10兲 Lawson. The specific vendors listed 共4–10兲 represent the seven most
common ERP systems identified in Nicolaou 共2004兲.
10
If the record is an announcement, then the firm is added to the ERP sample set; however, if the document only implies
that an ERP system is in use, it is rejected as a match, but not added to the ERP sample.

Journal of Information Systems
136
TABLE 1
Summary of Sample Selection Process
Panel A: Sample Selection Process
Initial ERP announcements from Hayes et al. 共2001兲 91
Less firms no longer listed or data otherwise not available ⫺36
Remaining firms from Hayes et al. 共2001兲 55
Additional ERP announcements collected from Lexis-Nexis search 92
Total firms with ERP implementation announcements 147
Firms not required to file Section 404 共or Section 404 data not available兲 ⫺39
Total firms announcing ERP implementations used in study 108
Panel B: Distribution of ERP Firms by Two-Digit SIC Code and Implementation Year
Two-Digit SIC Codes 94 95 96 97 98 99 00 01 02 03 Total
13-Oil and Gas Extraction 1 2 2 5
20-Mfg: Food and Kindred Products 1 1 2 1 1 6
23-Mfg: Apparel 1 1 1 3
24-Mfg: Lumber and Wood Products 1 1
25-Mfg: Furniture and Fixtures 1 2 1 4
26-Mfg: Paper and Allied Products 1 1 1 1 4
27-Mfg: Printing and Publishing 1 1 1 3
28-Mfg: Chemicals 1 1 2 1 2 2 2 2 13
29-Mfg: Petroleum Refining 1 1
33-Mfg: Primary Metal Industries 1 1 2
34-Mfg: Fabricated Metal Products 1 1 2
35-Mfg: Ind. and Com. Machinery 1 4 7 2 4 1 1 20
36-Mfg: Electronic and Elect. Equip. 1 2 5 2 2 12
37-Mfg: Transportation Equipment 1 1
38-Mfg: Measuring and Control Instr. 1 2 1 1 1 1 1 8
39-Mfg: Misc. Manufacturing 1 1
42-Motor Freight Transportation 1 1
Spring 2011
45-Transportation by Air 2 2
Morris
(continued on next page)
Panel B: Distribution of ERP Firms by Two-Digit SIC Code and Implementation Year
The Impact of Enterprise Resource Planning (ERP) Systems

Two-Digit SIC Codes 94 95 96 97 98 99 00 01 02 03 Total
48-Communications 1 1 2
50-Wholesale: Durable Goods 2 2
51-Wholesale: Non-Durable Goods 1 1
52-Retail: Bldg Materials, Hardware 1 1
54-Retail: Food Stores 1 1
59-Retail: Miscellaneous 1 2 1 4
67-Holding and Other Investment 1 1
73-Automotive Repair and Service 1 2 3 6
87-Engineering, Actg., R&D, Mgt 1 1
Totals 1 5 4 13 25 28 12 10 6 4 108
Spring 2011
137
138 Morris
where:
COUNT_WEAK ⫽ number of ICW reported;

ERP ⫽ indicator variable equal to 1 for firms that have implemented ERP systems,
else 0;
FOREIGN ⫽ indicator variable equal to 1 if the firm has a nonzero foreign currency
translation 共Compustat mnemonic FCA-Foreign Exchange Income
共Loss兲兲, else 0;
M&A ⫽ indicator variable equal to 1 if acquisitions reported on the Statement of
Cash Flows 共Compustat mnemonic AQC-Acquisitions兲, else 0;
RESTR ⫽ indicator variable equal to 1 if at least one of the following Compustat
mnemonics is not equal to zero: 共RCP-Restructuring Costs Pretax,
RCA-Restructuring Costs After-Tax, RCEPS-Restructuring Costs Basic EPS
Effect, RCD-Restructuring Costs Diluted EPS Effect兲, else 0;
LOSS ⫽ indicator variable equal to 1 if earnings before extraordinary items
共Compustat mnemonic IB-Income Before Extraordinary Items兲 are less than
0, else 0;
BIG4 ⫽ indicator variable equal to 1 if the firm’s auditor is one of the Big 4 firms,
else 0;
LOGSEG ⫽ natural log of number of business segments 共computed from Compustat
mnemonic SNAME-Segment Name in the Segment database兲;
SALEGRW ⫽ percentage change in sales 共Compustat mnemonic SALE-Net Sales兲;11
INVTAT ⫽ ratio of inventory over total assets 共Compustat mnemonic INVT-Inventories
⫺ Total/AT ⫺ Assets-Total兲;
LOGMKTV ⫽ natural log of market value of equity 共Compustat mnemonic MKVAL-Market
Value兲;
ZSCORE ⫽ Altman’s Z-score 共Computed from Compustat data兲;12
LOGAGE ⫽ natural log of years the firm exists in the CRSP database;13 and
LOGERPAGE ⫽ natural log of the number of years since the ERP system was implemented.14
The control variables from prior research that are hypothesized to be associated with ICW are
categorized as: 共1兲 complexity of operations 共FOREIGN, LOGSEG兲; 共2兲 organizational change
共M&A, RESTR兲; 共3兲 indicators of resource constraint 共LOSS, LOGMKTV兲; 共4兲 accounting appli-
cations measurement risk 共SALEGRW, INVTAT兲; and 共5兲 other factors including potential for
bankruptcy 共ZSCORE兲, age of the company 共LOGAGE兲, and size of the audit firm 共BIG4兲. One
additional control variable is added specific to ERP systems; 共LOGERPAGE兲 is used to control for
11
Ogneva et al. 共2007兲 use an indicator variable if a firm’s sales growth is in the upper quintile of its industry, rather than
percentage growth, which is the same approach used by Doyle et al. 共2007兲, who report that their results are not
sensitive to the use of percentage growth instead. The indicator method does not change the overall results of this study
either, although it does not provide as strong of a model fit.
12
ZSCORE ⫽ A ⫻ 3.3 ⫹ B ⫻ 0.99 ⫹ C ⫻ 0.6 ⫹ D ⫻ 1.2 ⫹ E ⫻ 1.4; where A ⫽ EBIT/Total Assets; B ⫽ Net Sales/Total
Assets; C ⫽ Market Value of Equity/Total Liabilities; D ⫽ Working Capital/Total Assets; E ⫽ Retained Earnings/Total
Assets兲. Ogneva et al. 共2007兲 used a decreasing deciles rank rather than the actual Z-score, which also would not impact
the overall results of this study, only reduce the measure of model fit.
13
If firm not found in CRSP database, then age was based on information from either Compustat or the company’s
website.
14
The implementation year is assumed to be the year before the announcement, the year of the announcement, or the year
after the announcement, depending on whether the announcement is prospective or retrospective in nature and whether
it is made early or late in the year.

the possibility that firms with ERP systems that have been in place longer are more likely to have
implemented more of the built-in internal control features.
IV. EMPIRICAL RESULTS

Univariate Analysis
Table 2 provides a summary of univariate statistics for the key dichotomous and continuous
variables used in this study, divided between the treatment firms 共ERP ⫽ 1兲 and the control firms
共ERP ⫽ 0兲. The majority of firms that report material weaknesses in their internal controls only
report one weakness, although that weakness may be attributed to a number of factors identified in
the review process. Note, for instance, that the maximum number of reported weaknesses 共COUN-
T_WEAK兲 is only six for control firms and eight for ERP firms, with mean values of only 0.212
and 0.148, and standard deviations of 0.650 and 0.664. Total assets for the ERP group are larger
on average than that of the control group 共2.465 versus 1.536; t ⫽ 2.696兲; however, the results are
not sensitive to this difference. Dropping 11 pairs with the largest absolute value differences in
total assets results in a sample that is not statistically different in size 共1.446 versus 1.345; t ⫽
1.364兲 and does not change the overall conclusions of this study.
Table 3 is a correlation matrix of the variables used in the probit model. No significant
multicollinearity problems are indicated since all significant correlations 共p ⬍ 0.05兲 among the
independent variables have r values less than 0.50, except for the Spearman correlation between
LOSS and ZSCORE 共0.508兲. Additional diagnostic tests using variance inflation factors confirm no
significant multicollinearity in that all VIF values are below 2.0.
Table 4 summarizes the frequency of internal control weaknesses 共ICW兲 reported by firms in
their 10-K annual reports for the years 2004–2008, extracted from the Audit Analytics database.
The first three columns report frequencies, and the next three, proportions of firms reporting no
ICW 共Weak ⫽ 0兲 or at least one ICW 共Weak ⫽ 1兲 for each year and in total for the five years. The
results shows that in total for all five years, 81 firm-years out of the 754 共10.7 percent兲 reported at
least one ICW, with 30 共8 percent兲 out of 377 ERP-implementing firm-years compared to 51 共13.5
percent兲 out of 377 of the control firm-years. The 5.5 percent proportional difference between ERP
implementers and control firms has a Z-statistic of 2.47, which indicates a significant difference at
the 0.01 level based on a one-tailed test.
The results for individual years reflect significant differences between ERP implementers and
nonimplementers for 2006–2008, but no significant differences in 2004 or 2005. These numbers
compare to the following results for all filers reported by Audit Analytics during the first four years
that SOX Section 404 compliance was required: Year 1 ⫽ 16.9 percent; Year 2 ⫽ 10.3 percent;
Year 3 ⫽ 9.1 percent; and Year 4 ⫽ 7.0 percent15 共Cheffers et al. 2008兲.
Probit Regression Analysis

Although the univariate results provide initial support for the first hypothesis 共H1兲 in that a
higher proportion of control firms reported internal control weaknesses than ERP-implementing
firms, other variables may be contributing to the differences. To control for this, a probit regres-
sion analysis is run using the model described in the prior section that includes control variables
that prior research has found to be associated with internal control weaknesses. The results are
presented in Table 5. The probit procedure models the probability that levels of COUNT_WEAK
have lower ordered values, which enables interpretation of parameter estimates based on the
likelihood that they are associated with lower levels of weaknesses. Positive estimates indicate that
15
Audit Analytics defines Years 1 through 4 as November 15, 2004, through November 14, 2008, which corresponds to the
effective date of the SOX Section 404 reporting requirements.

140 Morris
TABLE 2
Firm Characteristics (Univariate Statistics)
ERP ⴝ 0 (n ⴝ 377) ERP ⴝ 1 (n ⴝ 377)
Std. Std.
Mean Dev. Min Med Max Mean Dev. Min Med Max
Dichotomous
WEAK 0.135 0.342 0 0 1.000 0.079 0.271 0 0 1.000
SPE 0.135 0.342 0 0 1.000 0.079 0.271 0 0 1.000
GEN 0.129 0.337 0 0 1.000 0.077 0.267 0 0 1.000
FOREIGN 0.371 0.484 0 0 1.000 0.496 0.501 0 0 1.000
M&A 0.395 0.490 0 0 1.000 0.528 0.500 0 1.000 1.000
RESTR 0.387 0.488 0 0 1.000 0.562 0.497 0 1.000 1.000
LOSS 0.271 0.445 0 0 1.000 0.191 0.394 0 0 1.000
BIG4 0.923 0.267 0 1.000 1.000 0.905 0.294 0 1.000 1.000
Continuous
COUNT_WEAK 0.212 0.650 0 0 6.000 0.148 0.664 0 0 8.000
SPECIFIC 0.342 0.963 0 0 6.000 0.249 0.935 0 0 8.000
GENERAL 0.469 1.473 0 0 11.000 0.297 1.236 0 0 11.000
LOGSEG 0.714 0.638 0 0.693 2.079 0.709 0.702 0 0.693 2.079
SALEGRW 0.115 0.208 ⫺0.671 0.089 1.484 0.130 0.333 ⫺1.000 0.100 4.295
INVTAT 0.141 0.126 0 0.115 0.830 0.132 0.107 0 0.108 0.544
LOGMKTV 6.998 1.777 1.394 6.942 11.805 7.565 1.872 1.895 7.625 12.080
ZSCORE 4.226 3.582 ⫺5.091 3.314 28.197 3.554 5.332 ⫺42.59 3.221 35.271
LOGAGE 3.243 0.642 1.609 3.178 4.812 3.323 0.646 1.386 3.367 4.997
LOGERPAGE 2.400 0.173 1.946 2.398 2.773 2.400 0.173 1.946 2.398 2.773
TOTAL_ASSETS 1.536 2.059 0.011 0.678 8.054 2.465 4.380 0.017 0.872 34.621
Variable Definitions:
ERP ⫽ 1 for firms that implemented ERP systems; 0 for control firms;
WEAK ⫽ indicator variable equal to 1 for firms reporting an ICW, else 0;
SPE ⫽ indicator variable equal to 1 for firms reporting a contributing factor related to specific 共account-level兲
controls, else 0;
GEN ⫽ indicator variable equal to 1 for firms reporting a contributing factor related to general controls,
else 0;
FOREIGN ⫽ indicator variable equal to 1 if the firm has a nonzero foreign currency translation 共Compustat
mnemonic FCA兲, else 0;
M&A ⫽ indicator variable equal to 1 if acquisitions reported on the Statement of Cash Flows 共Compustat
mnemonic AQC兲, else 0;
RESTR ⫽ indicator variable equal to 1 if at least one of the following is not equal to 0 共Compustat mnemonics
RCP, RCA, RCEPS, RCD兲, else 0;
LOSS ⫽ indicator variable equal to 1 if earnings before extraordinary items 共Compustat mnemonic IB兲 are
less than 0, else 0;
BIG4 ⫽ indicator variable equal to 1 if the firm’s auditor is one of the Big 4 firms, else 0;
COUNT_WEAK ⫽ number of material weaknesses recorded in Audit Analytics for each firm-year;
SPECIFIC ⫽ number of contributing factors related to specific 共account-level兲 controls;
GENERAL ⫽ number of contributing factors related to general controls;
LOGSEG ⫽ natural log of number of business segments 共Compustat mnemonic SEGNUM兲;
SALEGRW ⫽ percentage change in sales 共Compustat mnemonic SALE兲;
INVTAT ⫽ ratio of inventory over total assets 共Compustat mnemonic INVT/AT兲;
LOGMKTV ⫽ natural log of market value of equity 共Compustat mnemonic MKVAL/MKVALM兲;
ZSCORE ⫽ Altman’s Z-score;
LOGAGE ⫽ natural log of years the firm exists in the CRSP database;
LOGERPAGE ⫽ natural log of the number of years since the ERP system was implemented; and
TOTAL_ASSETS ⫽ total assets 共billions兲 beginning of implementation year 共n ⫽ 108 for each group兲.


TABLE 3
Correlation Matrix: Pearson above the Diagonal and Spearman Below
1 2 3 4 5 6 7
1 COUNT_WEAK 1.000 ⫺0.048 ⫺0.041 0.037 0.006 0.161 ⫺0.060
0.184 0.265 0.305 0.874 ⬍0.0001 0.102
2 ERP ⫺0.089 1.000 0.126 0.133 0.175 ⫺0.094 ⫺0.033
0.015 0.001 0.000 ⬍0.0001 0.010 0.364
3 FOREIGN ⫺0.004 0.126 1.000 0.027 0.175 0.061 0.021
0.921 0.001 0.455 ⬍0.0001 0.096 0.567
4 M&A 0.040 0.133 0.027 1.000 0.063 ⫺0.084 0.066
0.271 0.000 0.455 0.085 0.021 0.069
5 RESTR 0.012 0.175 0.175 0.063 1.000 0.166 ⫺0.058
0.733 ⬍0.0001 ⬍0.0001 0.085 ⬍0.0001 0.111
6 LOSS 0.167 ⫺0.094 0.061 ⫺0.084 0.166 1.000 ⫺0.191
⬍0.0001 0.010 0.096 0.021 ⬍0.0001 ⬍0.0001
7 BIG4 ⫺0.048 ⫺0.033 0.021 0.066 ⫺0.058 ⫺0.191 1.000
0.187 0.364 0.567 0.069 0.111 ⬍0.0001
8 LOGSEG 0.007 ⫺0.005 ⫺0.019 0.042 0.115 ⫺0.021 0.036
0.849 0.889 0.611 0.246 0.002 0.571 0.329
9 SALEGRW ⫺0.031 0.012 0.007 0.112 ⫺0.252 ⫺0.279 0.118
0.395 0.738 0.845 0.002 ⬍0.0001 ⬍0.0001 0.001
10 INVTAT 0.003 ⫺0.018 ⫺0.039 0.058 0.001 ⫺0.026 ⫺0.101
0.927 0.616 0.279 0.113 0.971 0.477 0.006
11 LOGMKTV ⫺0.176 0.156 0.076 0.222 ⫺0.035 ⫺0.436 0.308
⬍0.0001 ⬍0.0001 0.038 ⬍0.0001 0.340 ⬍0.0001 ⬍0.0001

12 ZSCORE ⫺0.092 ⫺0.019 ⫺0.103 0.123 ⫺0.262 ⫺0.508 0.076
0.011 0.604 0.005 0.001 ⬍0.0001 ⬍0.0001 0.036
13 LOGAGE ⫺0.050 0.057 ⫺0.021 0.086 ⫺0.005 ⫺0.115 ⫺0.016
0.174 0.120 0.562 0.019 0.901 0.002 0.656
14 LOGERPAGE ⫺0.042 0.000 ⫺0.031 ⫺0.073 ⫺0.031 0.012 0.015
0.247 1.000 0.393 0.044 0.390 0.746 0.686
Spring 2011
141
8 9 10 11 12 13 14
142
1 COUNT_WEAK ⫺0.027 ⫺0.004 0.040 ⫺0.165 ⫺0.098 ⫺0.029 ⫺0.062
0.458 0.909 0.279 ⬍0.0001 0.007 0.421 0.091
2 ERP ⫺0.004 0.028 ⫺0.040 0.154 ⫺0.074 0.062 0.000
0.918 0.441 0.270 ⬍0.0001 0.043 0.089 1.000
3 FOREIGN ⫺0.019 0.023 ⫺0.078 0.061 ⫺0.033 ⫺0.012 ⫺0.068
0.612 0.523 0.032 0.095 0.361 0.739 0.061
4 M&A 0.040 0.113 0.021 0.210 ⫺0.002 0.097 ⫺0.065
0.267 0.002 0.561 ⬍0.0001 0.950 0.008 0.073
5 RESTR 0.120 ⫺0.125 ⫺0.076 ⫺0.063 ⫺0.246 0.012 ⫺0.045
0.001 0.001 0.038 0.083 ⬍0.0001 0.752 0.222
6 LOSS ⫺0.018 ⫺0.179 0.001 ⫺0.452 ⫺0.350 ⫺0.137 ⫺0.016
0.617 ⬍0.0001 0.989 ⬍0.0001 ⬍0.0001 0.000 0.659
7 BIG4 0.036 0.074 ⫺0.105 0.339 0.048 ⫺0.024 0.008
0.318 0.042 0.004 ⬍0.0001 0.186 0.516 0.821
8 LOGSEG 1.000 ⫺0.029 0.025 0.041 ⫺0.099 0.173 ⫺0.107
0.433 0.497 0.265 0.006 ⬍0.0001 0.003
9 SALEGRW ⫺0.037 1.000 ⫺0.076 0.148 0.115 ⫺0.053 ⫺0.012
0.309 0.037 ⬍0.0001 0.002 0.146 0.745
10 INVTAT 0.114 ⫺0.084 1.000 ⫺0.254 0.005 0.029 ⫺0.031
0.002 0.022 ⬍0.0001 0.896 0.422 0.399
11 LOGMKTV 0.056 0.259 ⫺0.218 1.000 0.220 0.224 ⫺0.019
0.125 ⬍0.0001 ⬍0.0001 ⬍0.0001 ⬍0.0001 0.595
12 ZSCORE ⫺0.076 0.260 0.107 0.294 1.000 0.006 0.018
0.038 ⬍0.0001 0.003 ⬍0.0001 0.868 0.624
13 LOGAGE 0.198 ⫺0.073 0.044 0.217 0.018 1.000 0.054
⬍0.0001 0.046 0.228 ⬍0.0001 0.630 0.136
14 LOGERPAGE ⫺0.073 ⫺0.015 ⫺0.105 0.032 ⫺0.085 0.054 1.000
0.045 0.686 0.004 0.387 0.019 0.137
COUNT_WEAK ⫽ number of internal control weaknesses reported;
ERP ⫽ indicator variable equal to 1 for firms that have implemented ERP systems, else 0;
Spring 2011
FOREIGN ⫽ indicator variable equal to 1 if the firm has a nonzero foreign currency translation 共Compustat mnemonic FCA兲, else 0;
M&A ⫽ indicator variable equal to 1 if acquisitions reported on the Statement of Cash Flows 共Compustat mnemonic AQC), else 0;
Morris

RESTR ⫽ indicator variable equal to 1 if at least one of the following is not equal to 0 共Compustat mnemonics RCP, RCA, RCEPS, RCD兲, else 0;
LOSS ⫽ indicator variable equal to 1 if earnings before extraordinary items 共Compustat mnemonic IB兲 are less than 0, else 0;
LOGMKTV ⫽ Natural log of market value of equity 共Compustat mnemonic MKVAL/MKVALM兲;
ZSCORE ⫽ Altman’s Z-score 共Computed from Compustat as ZSCORE ⫽ A ⫻ 3.3 ⫹ B ⫻ 0.99 ⫹ C ⫻ 0.6 ⫹ D ⫻ 1.2 ⫹ E ⫻1.4. Where A ⫽ EBIT/Total Assets; B ⫽
Net Sales/Total Assets; C ⫽ Market Value of Equity/Total Liabilities; D ⫽ Working Capital/Total Assets; E ⫽ Retained Earnings/Total Assets兲;
LOGAGE ⫽ natural log of years the firm exists in the CRSP database; and
LOGERPAGE ⫽ natural log of the number of years since the ERP system was implemented.
Spring 2011
143
144 Morris
TABLE 4
Frequency of Internal Control Weaknesses
Frequency Proportions
ERP ⴝ 0 ERP ⴝ 1 Total ERP ⴝ 0 ERP ⴝ 1 Total Diff Z-stat
2004–2008
Weak ⫽ 0 326 347 673 86.5% 92.0% 89.3%
Weak ⫽ 1 51 30 81 13.5% 8.0% 10.7% 5.5% 2.47***
Totals 377 377 754 100.0% 100.0% 100.0%
2004
Weak ⫽ 0 54 59 113 76.1% 83.1% 79.6%
Weak ⫽ 1 17 12 29 23.9% 16.9% 20.4% 7.0% 1.04
Totals 71 71 142 100.0% 100.0% 100.0%
2005
Weak ⫽ 0 78 80 158 86.7% 88.9% 87.8%
Weak ⫽ 1 12 10 22 13.3% 11.1% 12.2% 2.2% 0.46
Totals 90 90 180 100.0% 100.0% 100.0%
2006
Weak ⫽ 0 76 81 157 88.4% 94.2% 91.3%
Weak ⫽ 1 10 5 15 11.6% 5.8% 8.7% 5.8% 1.35*
Totals 86 86 172 100.0% 100.0% 100.0%
2007
Weak ⫽ 0 79 85 164 89.8% 96.6% 93.2%
Weak ⫽ 1 9 3 12 10.2% 3.4% 6.8% 6.8% 1.79**
Totals 88 88 176 100.0% 100.0% 100.0%
2008
Weak ⫽ 0 39 42 81 92.9% 100.0% 96.4%
Weak ⫽ 1 3 0 3 7.1% 0.0% 3.6% 7.1% 1.76**
Totals 42 42 84 100.0% 100.0% 100.0%
*, **, *** Prob ⬎ Z at 0.10, 0.05, and 0.01 levels, respectively, such that Proportion 共ERP ⫽ 0⫺ ERP ⫽ 1兲 ⬎ 0.
Weak ⫽ 0: Firms with no Internal Control Weaknesses in the Audit Analytics database.
Weak ⫽ 1: Firms with at least one Internal Control Weakness in the Audit Analytics database.
ERP ⫽ 1: Firms that implemented ERP systems between 1994 and 2003.
ERP ⫽ 0: Control firms that have not reported implementation of an ERP system.
variables are more likely to be associated with lower levels of material weaknesses, and negative
estimates indicate that variables are less likely to be associated with lower levels of material
weaknesses. Therefore, it is expected that the primary variable of interest 共ERP兲 will be positive,
indicating that ERP implementers 共ERP ⫽ 1兲 are more likely to report lower levels of material
weaknesses than control firms 共ERP ⫽ 0兲. As for the control variables, firms with foreign opera-
tions, merger and acquisition activity, restructuring activity, losses, more segments, more sales
growth, and higher inventory are expected to have negative estimates, indicating that they are less
likely to be associated with lower levels of material weaknesses than their counterparts. By

TABLE 5
Probit Regression Results
Exp. Std.
Parameter Sign Estimate Error Wald ⌾2
Intercept ? ⫺1.8123 1.9089 0.9000
ERP ⫹ 0.5732 0.2668 4.6162**
FOREIGN ⫺ 0.0514 0.2573 0.0398
M&A ⫺ ⫺0.6106 0.2643 5.3397**
RESTR ⫺ 0.0353 0.2640 0.0179
LOSS ⫺ ⫺0.4735 0.3101 2.3311*
BIG4 ⫹ ⫺0.1257 0.4209 0.0892
LOGSEG ⫺ ⫺0.0319 0.1974 0.0262
SALEGRW ⫺ ⫺0.5363 0.2918 3.3790**
INVTAT ⫺ 0.1786 1.0122 0.0311
LOGMKTV ⫹ 0.3195 0.0931 11.7866***
ZSCORE ⫹ 0.0390 0.0248 2.4752*
LOGAGE ⫹ 0.0543 0.1958 0.0770
LOGERPAGE ⫹ 0.7435 0.6917 1.1552
Log Likelihood ⫺322.560
Observations 754
*, **, *** Indicate significance at 0.10, 0.05, and 0.01 levels, respectively, using one-tailed test where sign is predicted.
Confidence limits are based on 95 percent Wald Confidence Limits.
Prob共COUNT_WEAKit兲 = f共␤ + ␤1ERPit + ␤2FOREIGNit + ␤3M&Ait + ␤4RESTRit + ␤5LOSSit + ␤6BIG4it
+ ␤7LOGSEGit + ␤8SALEGRWit + ␤9INVTATit + ␤10LOGMKTVit + ␤11ZSCOREit
+ ␤12LOGAGEit + ␤13LOGERPAGEit兲
COUNT_WEAK ⫽ number of internal control weaknesses reported;
LOSS ⫽ indicator variable equal to 1 if earnings before extraordinary items 共Compustat mnemonic IB兲 are
less than 0, else 0;
ZSCORE ⫽ Altman’s Z-score 共Computed from Compustat as ZSCORE ⫽ A ⫻ 3.3 ⫹ B ⫻ 0.99 ⫹ C ⫻ 0.6 ⫹
D ⫻ 1.2 ⫹ E ⫻ 1.4. Where A ⫽ EBIT/Total Assets; B ⫽ Net Sales/Total Assets; C ⫽ Market
Value of Equity/Total Liabilities; D ⫽ Working Capital/Total Assets; E ⫽ Retained Earnings/Total
Assets兲;

146 Morris
contrast, firms that use Big 4 audit firms have higher market value, higher Z-scores, are older, and
have older ERP systems are expected to have positive estimates, indicating that they are more
likely to be associated with lower levels of material weaknesses.
The primary variable of interest 共ERP兲 is positive and significant at the 0.05 level, as ex-
pected, indicating that ERP-implementing firms are more likely to be associated with lower levels
of material weaknesses. Control variables with significant results in the expected direction include:
M&A, LOSS, SALESGRW, LOGMKTV, and ZSCORE, indicating that firms with M&A activity,
losses, higher sales growth, lower market values, and lower Z-scores are less likely to report lower
levels of material weaknesses. The variable related to age of the ERP implementation 共LOGER-
PAGE兲 is not significant, which does not support the argument that older implementations may be
using more of the control features. These results may be impacted by low power due to the
relatively small sample size. The model is a good fit, with a Log Likelihood of ⫺322.560.
Sensitivity Analysis
An argument can be made that the number of material weaknesses counted may not be the
best measure of internal control, because even if only one weakness is found, the company has an
internal control problem that must be reported. As a sensitivity analysis, a logistic regression was
run using a dichotomous variable 共WEAK兲 set to 共1兲 if any material weaknesses were found and
共0兲 if none were found. The results 共untabulated兲 are very similar to the probit regression with the
variable of interest 共ERP兲 significant at the 0.05 level, and the same control variables significant at
similar levels as with the probit regression. To test the sensitivity of results to the size difference
discussed in the previous section, the regression was run using a sub-set of the observations
excluding the 11 pairs of firms with the largest absolute value difference in total assets. The
untabulated results were essentially the same, with the coefficient on the ERP variable still sig-
nificant at the 0.05 level. Other tests of model assumptions, including: a Hosmer and Lemeshow
Goodness-of-Fit test, a Percent Concordant test, analysis of classification tables, analysis of cor-
relations, and test for multicollinearity, all validate the model. These results further support the
first hypothesis 共H1兲 in that ERP-implementing firms are less likely to report material weaknesses
than the control firms, after controlling for other variables found in prior research to contribute to
ICW.
Factors Contributing to Material Weakness Determination

To test the second and third hypotheses, it is necessary to examine the specific factors con-
tributing to material weakness determination. Audit Analytics includes in their database a listing of
these factors with detailed descriptions for each. It is important to understand that there is no
specific standardized requirement for companies or their auditors to categorize the factors that lead
to a determination of internal control weakness. These factors are classified by Audit Analytics
after reading the compliance document. The Appendix is an abridged example of an audit report
issued by PricewaterhouseCoopers, LLP, for Pride International, Inc. for December 31, 2004,
which concurs with management’s determination that a material weakness has been identified. The
appropriate section of the audit report has been underlined to illustrate the point. Based on this
language, Audit Analytics identified 11 factors contributing to internal control weakness, which
are listed at the end of the sample audit report. These contributing factors are not considered to be
11 instances of ICW, but 11 factors that contribute to a single ICW.
A panel of experts was used to review the various factors defined by Audit Analytics and
identify those that relate to general 共entity-wide兲 controls and those that relate to specific 共account-
level兲 controls. The panel consisted of three members of the accounting profession familiar with

SOX Section 404 reporting and internal controls. One is a partner for a Big 4 CPA firm, one is a
supervisor for a large regional CPA firm, and one is a supervisor for a Fortune 50 corporation with
internal audit experience. Table 6 provides a summary of factors contributing to general 共entity-
wide兲 internal control weaknesses in Panel A and specific 共account-level兲 internal control weak-
nesses in Panel B for the 754 firm-year observations. The EP# column identifies the number of
expert panel members that were in agreement 共2 or 3兲 as to which category was appropriate. The
table shows the frequency with which each of the factors has been cited and the proportion of the
total represented by that frequency. The most often cited factor, “accounting documentation,
policy and/or procedures” was cited in 50 共6.63 percent兲 of the control firm-years and only 30
共3.98 percent兲 of the ERP firm-years, with the differences statistically significant, at a p-value
⬍0.01 level. This result indicates that control firms will report more of these factors than the
ERP-implementing firms.
Although many of the factors are not statistically different between the ERP implementers and
control firms, three of the general 共entity-wide兲 factors and six of the specific 共account-level兲
factors are at least marginally significant. In the general 共entity-wide兲 category, they include 共in
addition to the documentation factor discussed above兲: “accounting personnel resources,
competency/training” and “material and/or numerous auditor/YE adjustments.” The specific
共account-level兲 category includes: 共1兲 “restatement or non-reliance of company filings,” 共2兲 “re-
statement of previous 404 disclosures,” 共3兲 “intercompany/investment w/subsidiaries/affiliates is-
sues,” 共4兲 “financial derivatives/hedging 共FAS No. 133兲 accounting,” 共5兲 “tax expense/benefits/
deferral/other 共FAS No. 109兲 issues,” and 共6兲 “Pension and other post-retirement benefit issues.”
Table 7 summarizes further analysis of the contributing factors. Panel A presents frequencies
of firm-years reporting general versus specific contributing factors to ICW, while Panel B evalu-
ates the mean values of total occurrences for each category. General 共entity-wide兲 factors are
found in 49 共13.0 percent兲 of control firm-year reports versus 29 共7.7 percent兲 of the ERP firm-
year reports. The 5.3 percent difference is statistically significant at the p ⬍ 0.01 level. Similar
results are shown for the specific 共account-level兲 factors, with 51 共13.5 percent兲 of control firm-
year observations and 30 共8.0 percent兲 of ERP firm-year observations, with the 5.5 percent differ-
ence also significant at the p ⬍ 0.01 level. Comparing the mean values in Panel B yields similar
results, with both general and specific averages significantly larger for control firm-years than the
ERP firm-years. Note also that for control firms, the average number of general 共entity-wide兲
factors is significantly higher than the average number of specific 共account-level兲 factors, whereas
the differences are not significant for the ERP firms.
Table 8 summarizes results of probit regressions of factors related to general 共entity-wide兲 and
specific 共account-level兲 control weaknesses, using the previous model from Table 5 to test H2 and
H3. The primary variable of interest 共ERP兲 is positive and significant at the 0.05 level in both
cases, rejecting the null hypotheses, indicating that firms that implemented ERP systems were
more likely to report lower levels of both general 共entity-wide兲 and specific 共account-level兲
control-related weaknesses than the control group. Similar to the previous probit regressions, four
of the control variables related to general 共entity-wide兲 controls and five of the control variables
related to specific 共account-level兲 controls are significant with the expected sign, indicating they
are impacting the results similar to prior research. Firms with M&A activity, higher sales growth,
lower market value, and lower Z-scores are less likely to report higher levels of general 共entity-
wide兲 control-related factors. Likewise, firms with M&A activity, losses, higher sales growth,
lower market value, and lower Z-scores are less likely to report higher levels of specific 共account-
level兲 control-related factors. The overall model is reasonable, with log likelihood of ⫺358.314
and ⫺358.685 for general and specific models, respectively.

148
TABLE 6
Factors Contributing to Internal Control Weaknesses
Panel A: General (Entity-Wide) Factors
AA
Ref EP # ERP ⴝ 0 ERP ⴝ 1 ERP ⴝ 0 ERP ⴝ 1
Inadequate disclosure controls 共timely, accuracy, comp.兲 9 3 0 1 0.00 0.13
Senior management competency, tone, reliability 13 3 2 3 0.27 0.40
Accounting documentation, policy and/or procedure 17 3 50 30 6.63 3.98***
Insufficient or nonexistent internal audit function 18 3 0 1 0.00 0.13
Scope 共disclaimer of opinion兲 or other limitations 20 3 1 1 0.13 0.13
Ethical or compliance issues with personnel 21 3 2 3 0.27 0.40
Information technology, software, security, access 22 3 9 8 1.19 1.06
Segregations of duties/design of control 共personnel兲 42 3 4 5 0.53 0.66
Accounting personnel resources, compet./training 44 3 28 19 3.71 2.52*
Unspecified/unidentified/inapplicable FASB/GAAP 68 3 3 1 0.40 0.13
Material and/or numerous auditor/YE adjustments 4 2 28 17 3.71 2.25**
Fin Stmt, footnote, U.S. GAAP, segment disclosure 40 2 2 4 0.27 0.53
Remediation of material weakness identified 57 2 0 1 0.00 0.13
Total General 共Entity-Wide兲 Factors 129 94
Panel B: Specific (Account-Level) Factors

Lease, FAS No. 5, legal, contingency, and commit issues 3 2 4 4 0.53 0.53
Restatement or nonreliance of company filings 5 2 21 12 2.79 1.59*
Cash flow statement 共FAS No. 95兲 classification errors 10 2 2 1 0.27 0.13
Consolidation, 共Fin46r/Off BS兲 and foreign currency 24 2 4 2 0.53 0.27
Income statement classification, margin, and EPS 36 2 1 0 0.13 0.00
Foreign, related party, affiliated and/or subsidiary 38 2 8 5 1.06 0.66
Restatement of previous 404 disclosures 43 2 14 1 1.86 0.13***
Lease, leasehold, and FAS No. 13 共98兲共subcategory兲 73 2 3 3 0.40 0.40
Journal entry control issues 76 2 5 6 0.66 0.80
Spring 2011
Nonroutine transaction control issues 77 2 9 7 1.19 0.93

Intercompany/Investment w/sub/affil issues 8 3 4 0 0.53 0.00**
Morris
Panel B: Specific (Account-Level) Factors

Untimely or inadequate account reconciliations 12 3 12 10 1.59 1.33
Capitalization of expenditures issues 14 3 1 0 0.13 0.00
Accounts/loans receivable, investments, and cash 15 3 5 5 0.66 0.66
PPE, intangible or fixed asset 共value/diminution兲 16 3 9 5 1.19 0.66
Deferred, stock-based, or executive comp issues 27 3 7 3 0.93 0.40
Depreciation, depletion, or amortization issues 28 3 5 4 0.66 0.53
Expense recording 共payroll, SG&A兲 issues 29 3 1 2 0.13 0.27
Financial derivatives/hedging 共FAS No. 133兲 accounting 30 3 2 0 0.27 0.00*
Inventory, vendor, and cost of sales issues 32 3 13 10 1.72 1.33
Liabilities, payables, reserves, and accrual estimate 33 3 8 8 1.06 1.06
Acquisition, merger, disposal, or reorganization 35 3 6 4 0.80 0.53
Revenue recognition issues 39 3 10 11 1.33 1.46
Tax expense/benefit/deferral/other 共FAS No. 109兲 41 3 19 8 2.52 1.06**
Debt, quasi-debt, warrants, and equity 共BCF兲 security 47 3 1 1 0.13 0.13
Pension and other post-retirement benefit issues 80 3 2 0 0.27 0.00*
Asset retirement obligation issues 81 3 1 0 0.13 0.00
Total Specific 共Account-Level兲 Factors 177 112
Total of All Factors Reported 306 206
*, **, *** Prob ⬎ Z at 0.10, 0.05, and 0.01 levels, respectively, such that Proportion 共ERP ⫽ 0 ⫺ ERP ⫽ 1兲 ⬎0.
AA Ref ⫽ Audit Analytics Reference Number.
EP # ⫽ Expert Panel members in agreement on classification.
ERP ⫽ 1: ERP Implementing Firms.
ERP ⫽ 0: Control Firms.

Spring 2011
149
150 Morris
TABLE 7
Analysis of Factors Contributing to Material Weaknesses
Panel A: Frequency of Firms Reporting General versus Specific Contributing Factors
ERP ⴝ 0 ERP ⴝ 1 Total ERP ⴝ 0 ERP ⴝ 1 Total Diff Z-stat
General
GEN ⫽ 0 328 348 676 87.0% 92.3% 89.7%
GEN ⫽ 1 49 29 78 13.0% 7.7% 10.3% 5.3% 2.39***
Totals 377 377 754 100.0% 100.0% 100.0%
Specific
SPE ⫽ 0 326 347 673 86.5% 92.0% 89.3%
SPE ⫽ 1 51 30 81 13.5% 8.0% 10.7% 5.5% 2.47***
Totals 377 377 754 100.0% 100.0% 100.0%
Panel B: Mean Values of Contributing Factors Reported

ALL ERP ⴝ 0 ERP ⴝ 1 Diff t-stat
n 754 377 377
GENERAL 0.383 0.469 0.297 0.172 1.741⫹⫹
SPECIFIC 0.295 0.342 0.249 0.093 1.343⫹
Difference 0.088 0.127 0.048
t-stat 2.782## 2.479## 1.314
*, **, *** 0.10, 0.05, and 0.01 levels, respectively, such that Prob ⬎ Z Proportion 共ERP ⫽ 0 ⫺ ERP ⫽ 1兲 ⬎ 0; one-tailed
test.
⫹,⫹⫹,⫹⫹⫹
0.10, 0.05, and 0.01 levels, respectively, such that Prob ⬎ t 共ERP ⫽ 0 ⫺ ERP ⫽ 1兲 ⬎ 0; one-tailed test.
#,##,###
0.10, 0.05, and 0.01 levels, respectively, such that Prob ⬎ t 共GENERAL ⫺ SPECIFC兲 ⬎⬍0; two-tailed test.
ERP ⫽ 1: Firms that implemented ERP systems between 1994 and 2003.
ERP ⫽ 0: Control firms that have not reported implementation of an ERP system.
GEN ⫽ 0: Firms with no Internal Control Weaknesses in the Audit Analytics database.
GEN ⫽ 1: Firms with at least one Internal Control Weakness in the Audit Analytics database and contributing factors that
are related to General controls.
SPE ⫽ 0: Firms with no Internal Control Weaknesses in the Audit Analytics database.
SPE ⫽ 1: Firms with at least one Internal Control Weakness in the Audit Analytics database and contributing factors that
are related to Specific 共account-level兲 controls.
GENERAL: Number of factors contributing to material weaknesses that relate to general controls.
SPECIFIC: Number of factors contributing to material weaknesses that relate to specific 共account-level兲 controls.
V. CONCLUSIONS
Summary of Results
This study examines the impact that enterprise resource planning 共ERP兲 systems have on the
effectiveness of internal controls over financial reporting. It uses a sample of firms that imple-
mented ERP systems from 1994 to 2003 matched with control firms based on industry and size. It
compares internal control weaknesses 共ICW兲 reported in Form 10-K for each of the groups. The
results show that during the first five years that SOX Section 404 has required such reporting, a
smaller proportion of ERP-implementing firms have reported ICW than the control firms. These
results hold up in a probit regression analysis that includes several control variables that prior
research has found to be associated with ICW. The regression suggests that firms that implemented
ERP systems are less likely to have ICW than the non-ERP control firms.

TABLE 8
Probit Regression Results for General (Entity-Wide) and Specific (Account-Level) Controls
Dependent Variable ⴝ Dependent Variable ⴝ

GENERAL SPECIFIC
Exp. Std. Std.
Parameter Sign Estimate Error Wald ⌾2 Estimate Error Wald ␹2
Intercept ? ⫺1.7742 1.9255 0.8500 ⫺1.5444 1.8858 0.6700
ERP ? 0.5452 0.2697 4.0863** 0.5628 0.2653 4.5007**
FOREIGN ⫺ 0.1395 0.2674 0.2827 0.0121 0.2566 0.0022
M&A ⫺ ⫺0.6131 0.2672 5.2653** ⫺0.5714 0.2632 4.7128**
RESTR ⫺ 0.0757 0.2669 0.0804 0.0937 0.2652 0.1249
LOSS ⫺ ⫺0.3129 0.3157 0.9825 ⫺0.4722 0.3136 2.2676*
BIG4 ⫹ ⫺0.2894 0.4342 0.4442 ⫺0.1786 0.4180 0.1826
LOGSEG ⫺ ⫺0.0338 0.2002 0.0285 ⫺0.0322 0.1954 0.0272
SALEGRW ⫺ ⫺0.6216 0.2914 4.5494** ⫺0.5429 0.2870 3.5785**
INVTAT ⫺ 0.0790 1.0116 0.0061 ⫺0.0401 1.0159 0.0016
LOGMKTV ⫹ 0.3228 0.0953 11.4704*** 0.3058 0.0908 11.3503***
ZSCORE ⫹ 0.0605 0.0264 5.2565** 0.0366 0.0243 2.2687*
LOGAGE ⫹ 0.1289 0.1986 0.4211 0.0173 0.1973 0.0077
LOGERPAGE ⫹ 0.6391 0.7027 0.8272 0.7483 0.6843 1.1957
Log Likelihood ⫺385.314 ⫺358.685
Observations 754 754
*, **, *** Indicate significance at 0.10, 0.05, and 0.01 levels, respectively, using one-tailed test where sign is predicted,
otherwise two-tailed test.
Confidence limits are based on 95 percent Wald Confidence Limits.
Prob共DVit兲 = f共␤ + ␤1ERPit + ␤2FOREIGNit + ␤3M&Ait + ␤4RESTRit + ␤5LOSSit + ␤6BIG4it + ␤7LOGSEGit
+ ␤8SALEGRWit + ␤9INVTATit + ␤10LOGMKTVit + ␤11ZSCOREit + ␤12LOGAGEit + ␤13LOGERPAGEit兲
DV ⫽ dependent variable: count of weaknesses related to GENERAL or SPECIFIC controls;
LOSS ⫽ indicator variable equal to 1 if earnings before extraordinary items 共Compustat mnemonic IB兲 are less
than 0, else 0;
ZSCORE ⫽ Altman’s Z-score 共Computed from Compustat as ZSCORE ⫽ A ⫻ 3.3 ⫹ B ⫻ 0.99 ⫹ C ⫻ 0.6 ⫹ D
⫻ 1.2 ⫹ E ⫻ 1.4. Where A ⫽ EBIT/Total Assets; B ⫽ Net Sales/Total Assets; C ⫽ Market Value of
Equity/Total Liabilities; D ⫽ Working Capital/Total Assets; E ⫽ Retained Earnings/Total Assets兲;

152 Morris
The study also examines factors contributing to ICW by dividing them into those that are
related to general 共entity-wide兲 controls and specific 共account-level兲 controls. The results indicate
that ERP-implementing firms are less likely than the control firms to report factors contributing to
ICW in both categories, and these results are also robust when control variables are added in a
probit regression. There is not a significant difference between the factors related to general and
specific controls for ERP-implementing firms. However, control firms report significantly more
general factors than specific factors.
Limitations and Future Research

This study has several limitations. First, the sample suffers from a large-firm bias that results
from the phased-in timing of compliance with SOX Section 404. It is possible that results for
smaller firms that were not required to comply with SOX initially may be different. Future
research should expand this study to include the nonaccelerated filers after sufficient data have
accumulated.
Second, the selection process, which uses press releases to select ERP implementing and
control firms, introduces potential bias. Additional large-firm bias may be introduced in that larger
firms may be more inclined to issue press releases than smaller firms. Also, it is possible that some
of the control group may have implemented ERP systems, but did not issue any press releases
discussing it. In this case the results would be biased against the ERP firms, which would only
strengthen the findings. Another issue relates to how much of the ERP system has been imple-
mented and is being used. Since the press releases tend to only identify that an ERP system is
being 共or has been兲 implemented, there is no way to know how many of the modules have been
implemented, how much of the organization has adopted the system, or, for that matter, how many
of the built-in internal control features are being used. As with the previous limitation, this would
also bias the results against the ERP firms, which would strengthen the findings. Future research
should consider additional ways to identify ERP implementers and the extent to which the systems
have been implemented and are being utilized.
There is also the problem of human judgment related to the factors that contribute to internal
control weaknesses. The first judgment is made by the staff at Audit Analytics, who determine
which factors apply by reading the management and audit reports that are filed. The second
judgment is in determining which of those factors are related to general 共entity-wide兲 controls and
which are related to specific 共account-level兲 controls. The first one is not critical to this study
because it is not focused on identifying specific factors, only on the impact of ERP on ICW. The
second one is addressed by using a diversified expert panel to spread the judgment to multiple
parties from different perspectives, including national and regional CPA firms and internal corpo-
rate accounting.
Implications and Contribution

This study’s finding that firms which implement ERP systems report fewer material ICW than
firms that do not use ERP systems is important for a number of reasons. First, it provides support
for the claim that ERP systems help improve internal controls over financial reporting as required
by Sarbanes-Oxley Section 404. To my knowledge, this is the first empirical/archival test of these
claims and should be of interest to many constituencies, including those responsible for purchasing
such systems, auditors, software vendors, and the academic community.
Second, the results provide additional data that may contribute to a better understanding of the
conflicting results in prior ERP research related to earnings management. For instance, Brazel and
Dang 共2008兲 find an increase in earnings management activity following implementation of ERP
systems from 1993–1999. Dorantes et al. 共2009兲 argue that earnings management, in general,
increased during this period of time until the passage of SOX in 2002, and that Brazel and Dang’s

共2008兲 research design does not take this general trend into consideration because the sample is
not compared to a control group, only to itself before and after implementation. In their study,
Dorantes et al. 共2009兲 find a decrease in earnings management, relative to a control group, which
is similar to the findings by Morris 共2009兲 for discretionary working capital accruals. These
conflicting results could be explained in part by the enactment of SOX and the increased emphasis
on internal controls. It is conceivable that as firms work to comply with SOX, they implement
more of the built-in features of ERP systems, placing more emphasis on internal control, which
then leads to a decrease in earnings management activity 共at least relative to non-ERP firms兲. This
explanation is consistent with findings in the current study as presented in Table 4, which shows
no significant difference between ERP and non-ERP firms in the first two years of SOX reporting,
marginally significant differences in the third year, and significant differences in the fourth and
fifth years. However, it is not consistent with the fact that the coefficients on the LOGERPAGE
variables in the probit regression analyses 共Tables 5 and 8兲 were not significant. It is possible that
the nonsignificance is due to low power that results from a relatively small sample size. Future
research should examine this issue after more data become available, which will increase the
power of the tests.
Third, the findings that both general 共entity-wide兲 and specific 共account-level兲 controls are
less likely to contribute to ICW for ERP firms than for control firms is consistent with the overall
findings. Also consistent with the overall findings is the fact that ERP firms report no significant
differences between the two categories while non-ERP firms report more general 共entity-wide兲
control factors than specific 共account-level兲 control factors 共see Table 7兲. This information, along
with the prior findings of Dorantes et al. 共2009兲 and Morris 共2009兲, suggests that Brazel and Dang
共2008兲 may be an anomaly. Additional research is needed to further examine the inconsistencies in
the relationship between ERP systems, earnings management, and internal control. The use of
additional methodologies such as field studies and/or survey data may be needed to better under-
stand the details of how ERP systems are implemented and used, which may then help to better
explain some of these differences.

154 Morris
APPENDIX
ABRIDGED EXAMPLE OF AN AUDIT REPORT
PRIDE INTERNATIONAL, INC.
Report of Independent Registered Public Accounting Firm16
To the Stockholders and Board of Directors of Pride International, Inc.: We have completed an integrated
audit of Pride International, Inc.'s 2004 consolidated financial statements and of its internal control over
financial reporting as of December 31, 2004 and audits of its 2003 and 2002 consolidated financial
statements in accordance with the standards of the Public Company Accounting Oversight Board (United
States). Our opinions, based on our audits, are presented below.
Consolidated financial statements

In our opinion, the accompanying consolidated balance sheet and the related consolidated statements of
operations, stockholders' equity and cash flows present fairly, in all material respects, the financial
position of Pride International, Inc. and its subsidiaries…
Internal control over financial reporting

Also, we have audited management's assessment, included in Management's Report on Internal Control
Over Financial Reporting appearing under Item 9A, that Pride International, Inc. did not maintain
effective internal control over financial reporting as of December 31, 2004 because the Company did not
maintain effective controls… based on criteria established in Internal Control -- Integrated Framework
issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)…
A material weakness is a control deficiency, or combination of control deficiencies, that results in more
than a remote likelihood that a material misstatement of the annual or interim financial statements will not
be prevented or detected. The following material weakness has been identified and included in
management's assessment. As of December 31, 2004, the Company did not maintain effective controls
over the communication among operating, functional and accounting departments of financial and other
business information that is important to the period-end financial reporting process, including the
specifics of non-routine and non-systematic transactions. Contributing factors included the large number
of manual processes utilized during the period-end financial reporting process and an insufficient number
of accounting and finance personnel to, in a timely manner: (1) implement extensive structural and
procedural system and process initiatives during 2004, (2) perform the necessary manual processes, and
(3) analyze non-routine and non-systematic transactions. This control deficiency resulted in errors that
required the restatement of the Company's consolidated financial statements for 2003 and 2002, the first
three quarterly periods in 2004 and all quarterly periods in 2003, as discussed in Note 2 to the
consolidated financial statements. The errors primarily affected property and equipment and the related
depreciation expense, debt and the related interest and financing costs, minority interest balances and
activity and income tax balance sheet accounts and the related provisions. This deficiency also resulted in
audit adjustments to the 2004 consolidated financial statements primarily affecting accrued employee
benefits and interest and the corresponding expense accounts. Additionally, this control deficiency could
result in a material misstatement to the Company's annual or interim consolidated financial statements
that would not be prevented or detected. Accordingly, management has determined that this control
deficiency constitutes a material weakness. This material weakness was considered in determining the
nature, timing, and extent of audit tests applied in our audit of the 2004 consolidated financial statements,
and our opinion regarding the effectiveness of the Company's internal control over financial reporting
16
Source of Audit Report is from Form 10-K Filing in EDGAR

does not affect our opinion on those consolidated financial statements. In our opinion, management's
assessment that Pride International, Inc. did not maintain effective internal control over financial
reporting as of December 31, 2004, is fairly stated, in all material respects, based on criteria established in
Internal Control -- Integrated Framework issued by the COSO. Also, in our opinion, because of the effect
of the material weakness described above on the achievement of the objectives of the control criteria,
Pride International, Inc. has not maintained effective internal control over financial reporting as of
December 31, 2004, based on criteria established in Internal Control -- Integrated Framework issued by
the COSO.
PricewaterhouseCoopers LLP
Houston, Texas March 25, 2005
The Audit Analytics Database lists the following contributing factors based on the above opinion. The
section of the audit report that discusses the internal control weaknesses is underlined.
Internal Control Weaknesses (4):

Accounting documentation, policy and/or procedures
Non-routine transaction control issues
Restatement or nonreliance of company filings
Restatement of previous 404 disclosures
Accounting Rules (GAAP/FASB) Application Failures (7):

Accounts/loans receivable, investments & cash issues
Consolidation, (Fin46r/Off BS) & foreign currency translation issues
Debt, quasi-debt, warrants & equity (BCF) security issues
Depreciation, depletion or amortization issues
Liabilities, payables, reserves and accrual estimate failures
PPE, intangible or fixed asset (value/diminution) issues
Tax expense/benefit/deferral/other (FAS 109) issues
REFERENCES
Abdel-khalik, A. R. 1993. Why do private companies demand auditing? A case for organizational loss of
control. Journal of Accounting, Auditing and Finance 8 共Winter兲: 31–52.
American Institute of Certified Public Accountants 共AICPA兲. 2010. Section 404(b) of Sarbanes-Oxley Act of
2002. Available at: http://www.aicpa.org/advocacy/issues/pages/section404bofsox.aspx.
Ashbaugh-Skaife, H., D. W. Collins, and W. R. Kinney. 2007. The discovery and reporting of internal control
deficiencies prior to SOX-mandated audits. Journal of Accounting and Economics 44 共1兲: 166–192.
——–, ——–, ——–, and R. LaFond. 2008. The effect of SOX internal control deficiencies and their reme-
diation on accrual quality. The Accounting Review 83 共1兲: 217–250.
——–. 2009. The effect of SOX internal control deficiencies on firm risk and cost of equity. Journal of
Accounting Research 47 共1兲: 1–43.
Bagranoff, N. A., and V. P. Vendrzk. 2000. The changing role of IS audit among the big five US-based
accounting firms. Information Systems and Control Journal 5: 33–37.
Barber, B. M., and J. D. Lyon. 1997. Detecting long-run abnormal stock returns: The empirical power and
specification of test statistics. Journal of Financial Economics 43: 341–372.
Barefield, R. M., J. J. Gaver, and T. B. O’Keefe. 1993. Additional evidence on the economics of attest:
Extending results from the audit market to the market for compilations and reviews. Auditing: A
Journal of Practice & Theory 12 共Spring兲: 74–87.
Brazel, J., and C. P. Agoglia. 2007. An examination of auditor planning judgments in a complex accounting
information system environment. Contemporary Accounting Research 24 共Winter兲: 1059–1083.
——–, and L. Dang. 2008. The effect of ERP system implementations on the management of earnings and
earnings release dates. Journal of Information Systems 22 共2兲: 1–21.
Brennan, N. M., and J. Soloman. 2008. Corporate governance, accountability and mechanisms of account-
ability: An overview. Accounting, Auditing & Accountability Journal 21 共7兲: 885–906.

156 Morris
Brunelli, M.. 2006. Smaller Vendors Challenge SAP, Oracle in ERP Market. Available at: http://
searchoracle.techtarget.com/originalContent/0,289142,sid41_gci1229162,00.html.
Chan, K. C., B. R. Farrell, and P. Lee. 2008. Earnings management of firms reporting material internal
control weaknesses under Section 404 of the Sarbanes-Oxley Act. Auditing: A Journal of Practice &
Theory 27 共2兲: 161–179.
Cheffers, M., D. Whalen, and M. Thrun. 2008. 404 Dashboard: Year 4 Update: Audit Analytics Database
Report.
Committee of Sponsoring Organizations 共COSO兲. 1985. Organization background information. Available at:
http://www.coso.org/.
——–. 1992. Internal Control—Integrated Framework: Executive Summary. The Committee of Sponsoring
Organizations of the Treadway Commission 1992. Available at: http://www.coso.org/ic-
integratedframework-summary.htm.
Davenport, T. H. 1998. Putting the Enterprise into the Enterprise System. Boston, MA: Harvard Business
Review.
Deumes, R., and W. R. Knechel. 2008. Economic incentives for voluntary reporting on internal risk man-
agement and control systems. Auditing: A Journal of Practice & Theory 27 共1兲: 35–66.
Dorantes, C. A., C. Li, G. F. Peters, and V. J. Richardson. 2009. The effect of enterprise systems implemen-
tations on the firm information environment. Available at: http://papers.ssrn.com/sol3/
papers.cfm?abstract_id⫽1526521.
Doyle, J. T., W. Ge, and S. McVay. 2007. Determinants of weaknesses in internal control over financial
reporting. Journal of Accounting and Economics 44 共1–2兲: 193–223.
Eisenhardt, K. M. 1989. Agency theory: An assessment and review. Academy of Management Review 14 共1兲:
57–74.
Eschinger, C. 2006. Market share: ERP software, worldwide, 2005 共executive summary兲. In ID Number:
G00141080, edited by Gartner. Stamford, CT: Gartner, Inc.
Ettredge, M. L., L. Sun, and C. Li. 2006. The impact of SOX Section 404 internal control quality assessment
on audit delay in the SOX era. Auditing: A Journal of Practice & Theory 25 共2兲: 1–23.
Ge, W., and S. McVay. 2005. The disclosure of material weaknesses in internal control after the Sarbanes-
Oxley Act. Accounting Horizons 19 共3兲: 137–158.
Grant, G. H., K. C. Miller, and F. Alali. 2008. The effect of IT controls on financial reporting. Managerial
Auditing Journal 23 共8兲: 803–823.
Gupta, P., and J. C. Thomson. 2006. Use of COSO 1992 in management reporting on internal control.
Strategic Finance 共September兲: 27–33.
Hayes, D. C., J. E. Hunton, and J. L. Reck. 2001. Market reaction to ERP implementation announcements.
Journal of Information Systems 15 共1兲: 3–18.
Hunton, J. E., A. M. Wright, and S. Wright. 2004. Are financial auditors overconfident in their ability to
assess risks associated with enterprise resource planning systems? Journal of Information Systems 18
共2兲: 7–28.
Janvrin, J. D., J. Bierstaker, and D. J. Lowe. 2004. The impact of client information technology on audit
procedures. Working paper, Iowa State University.
Jensen, K. L., and J. L. Payne. 2003. Management trade-offs of internal control and external auditor exper-
tise. Auditing: A Journal of Practice & Theory 22 共2兲: 99–119.
Krishnan, J. 2005. Audit committee quality and internal control: An empirical analysis. The Accounting
Review 80 共2兲: 649–675.
Morris, J. J. 2009. Measuring the impact of enterprise resource planning 共ERP兲 systems through the prism of
accounting theory. Dissertation, Kent State University.
Nicolaou, A. I. 2004. Firm performance effects in relation to the implementation and use of enterprise
resource planning systems. Journal of Information Systems 18 共2兲: 79–105.
Ogneva, M., K. R. Subramanyam, and K. Raghunandan. 2007. Internal control weakness and cost of equity:
Evidence from SOX Section 404 disclosures. The Accounting Review 82 共5兲: 1255–1297.
Oracle. 2005. Information Generates Value: The Cornerstone for Sustainable Compliance and Growth 2005.
Available at: http://www.oracle.com/applications/financials/finance.pdf.

Public Company Accounting Oversight Board 共PCAOB兲. 2007. An Audit of Internal Control over Financial
Reporting that is Integrated with An Audit of Financial Statements. Auditing Standard No. 5. Wash-
ington, D.C.: PCAOB.
Raghunandan, K., and D. V. Rama. 2006. SOX Section 404 material weakness disclosures and audit fees.
Auditing: A Journal of Practice & Theory 25 共1兲: 99–114.
Samson, W. D., D. L. Flesher, and G. J. Previts. 2006. Corporate governance and external and internal
controls: The case of the Baltimore and Ohio Railroad, circa 1831. Issues in Accounting Education 21
共1兲: 45–62.
SAP. 2005. Enterprise Governance and Sarbanes-Oxley Compliance with mySAP ERP Financials 2005.
Available at:
http://www.sap.com/usa/solutions/business-suite/erp/financials/pdf/entpr_gov_so_compliance.pdf.
Securities and Exchange Commission 共SEC兲. 2003. Final Rule: Management’s Reports on Internal Control
over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports. Edited by
U.S. SaE Commission. Available at: http://www.sec.gov/rules/final/33-8238.htm.
——–. 2009. Internal Control over Financial Reporting in Exchange Act Period Reports of Non-Accelerated
Filers. Edited by SEC: Release No. 33-9072, 14. Washington, D.C.: Government Printing Office.
Simmons, M. R. 1997. COSO based auditing. The Internal Auditor 54 共6兲: 68–73.
Staggers, H. O. 1977. Unlawful Corporate Payments Act of 1977. Available at: http://www.justice.gov/
criminal/fraud/fcpa/history/1977/houseprt-95-640.pdf.
U.S. Congress. 1998. Anti-Bribery and Books & Records Provisions of the Foreign Corrupt Practices Act (as
amended November 10, 1998). Washington, D.C.: USDOJ.
Wright, S., and A. M. Wright. 2002. Information system assurance for enterprise resource planning systems:
Unique risk considerations. Journal of Information Systems 16: 99–113.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.

The Impact of Enterprise Resou

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

The Impact of Enterprise Resou

Uploaded by

Copyright:

Available Formats

JOURNAL OF INFORMATION SYSTEMS American Accounting Association

Vol. 25, No. 1 DOI: 10.2308/jis.2011.25.1.129

The Impact of Enterprise Resource Planning

Keywords: enterprise resource planning; ERP; Sarbanes-Oxley; SOX; Section 404;

Published Online: March 2011

Journal of Information Systems Spring 2011

II. PRIOR RESEARCH AND HYPOTHESES DEVELOPMENT

Journal of Information Systems Spring 2011

Prior Internal Control Research

Journal of Information Systems Spring 2011

Journal of Information Systems Spring 2011

III. DATA SELECTION AND RESEARCH METHODOLOGY

Journal of Information Systems Spring 2011

Probit Regression Model

Prob共COUNT_WEAKit兲 = f共␤ + ␤1ERPit + ␤2FOREIGNit + ␤3M&Ait + ␤4RESTRit

Journal of Information Systems Spring 2011

The Impact of Enterprise Resource Planning (ERP) Systems

COUNT_WEAK ⫽ number of ICW reported;

Journal of Information Systems Spring 2011

IV. EMPIRICAL RESULTS

Probit Regression Analysis

Journal of Information Systems Spring 2011

Journal of Information Systems Spring 2011

The Impact of Enterprise Resource Planning (ERP) Systems

⬍0.0001 ⬍0.0001 0.038 ⬍0.0001 0.340 ⬍0.0001 ⬍0.0001

(continued on next page)

The Impact of Enterprise Resource Planning (ERP) Systems

Journal of Information Systems Spring 2011

Journal of Information Systems Spring 2011

Factors Contributing to Material Weakness Determination

Journal of Information Systems Spring 2011

Journal of Information Systems Spring 2011

Panel B: Specific (Account-Level) Factors

Nonroutine transaction control issues 77 2 9 7 1.19 0.93

The Impact of Enterprise Resource Planning (ERP) Systems

Total Specific 共Account-Level兲 Factors 177 112

Total of All Factors Reported 306 206

ERP ⫽ 0: Control Firms.

Panel B: Mean Values of Contributing Factors Reported

Journal of Information Systems Spring 2011

Dependent Variable ⴝ Dependent Variable ⴝ

Journal of Information Systems Spring 2011

Limitations and Future Research

Implications and Contribution

Journal of Information Systems Spring 2011

Journal of Information Systems Spring 2011

Report of Independent Registered Public Accounting Firm16

Consolidated financial statements

Internal control over financial reporting

Journal of Information Systems Spring 2011

Internal Control Weaknesses (4):

Accounting Rules (GAAP/FASB) Application Failures (7):

Journal of Information Systems Spring 2011

Journal of Information Systems Spring 2011

Journal of Information Systems Spring 2011

You might also like