Week6_Li et al (2012)_Xue Guo

The consequences of information technology control weaknesses on management information systems: the case of Sarbanes-Oxley internal control reports

This paper investigated the association between the strength of IT control over management information systems and the subsequent forecasting ability of the information produced by those systems. Sarbanes-Oxley (SOX) Act of 2002 highlights the importance of information system control related to the financial reporting systems. It hypothesizes and tests that management forecasts are less accurate for firms with IT material weaknesses in their financial reporting system (FRS) than the forecast for firms that do not have IT material weaknesses.

At first, the paper compared the management forecast accuracy for firms having IT material weaknesses with firms having either effective internal control or non-IT material weaknesses. Then the paper investigated whether certain categories of IT material weaknesses have a greater impact on the informational quality of the FRS than others.

The paper acquired the data from SOX 404 reports that available on Audit analytics from 2004 to 2008. The model uses management forecast error as the proxy for decision outcomes resulting from the quality of information produced by the FRS. The results show that firms with IT-related internal control material weaknesses have lower management accuracy than the firms have efficient internal control and have non-IT material weaknesses. And, when categorizes IT control quality into three dimensions: data processing integrity, system access and security, and system structure and usage, the paper found that data processing integrity has a greater impact on information quality than others.

One contribution of this paper is to highlight the implications of IT control on information quality issues for system users and decision makers. Also, the paper provides evidence that internal control reports, mandated by SOX, can provide information to system users about the underlying system and data quality.