Information technology internal control material weaknesses in financial reporting: Categories, trends, associations, and industry effects

Information technology internal control material weaknesses (ITICMW)s can lead to misrepresentations of companies’ financial information and inefficiencies in financial decision-making because of the significant role of IT in financial reporting processes. Previous studies of ITICMWs are mostly based on ITICMWs in general. Despite a few studies addressing specific categories of ITICMWs, they used pre-2010 data and were unable to represent the state of ITICMWs given the fast evolvement of IT in recent years. Additionally, the trends, associations, and industry effects on ITICMWs remain to be explored. We collected SOX 404 Auditor Internal Control Opinion Reports from a recent five-year period (2014 ∼ 2018) and analyzed them using a combination of thematic analysis, association rule mining, and statistical analysis methods. The data analyses generate a categorization schema of ITICMWs, uncover an increasing trend in average ITICMW incident counts per report from 2016 to 2018, and indicate recent shifts in some specific categories of ITICMWs in comparison with the findings of previous studies. Our results also reveal cross-industry differences in ITICMW categories and identify their association patterns for the first time. This research not only contributes to the accounting information system and auditing literature in multiple aspects but also offers practical implications for improving the efficiency and effectiveness of internal control compliance, IT auditing and consulting practices, and financial decision-making.