Is Operational Control Risk Informative of Undetected Financial Reporting Deficiencies?

Abstract

This study provides evidence concerning the significance of assessing operational control risks as part of an integrative evaluation of internal controls. We examine whether operational control weaknesses can be used as cues to potential unreported financial reporting control weaknesses, and in turn, relate to subsequent financial reporting deficiencies. We find positive relations between operational control weaknesses and future financial reporting control weaknesses, restatements, SEC comment letters, and audit fees, even after controlling for contemporaneous financial reporting control weaknesses. These findings question the completeness and accuracy of regulated assessments of financial reporting control weaknesses, and suggest that operational control risk is informative of potential financial reporting deficiencies.

Keywords: Operational controls; financial reporting quality; audit fees; data breaches

JEL Classification: M41, M43, M49, G34, G38