An examination of the relationship of IT control weakness to company financial performance and health

Purpose – The purpose of this study is to investigate the relationship of weaknesses in IT-related internal controls to companies' overall financial performance and health. Design/methodology/approach – The study examines four accounting measures: liquidity, solvency, profitability, and market value. During the four-year period of 2004-2007, the authors identified companies that reported at least one material IT weakness and matched them with a similar set of companies with no reported material weaknesses. Additionally, for a subset of the companies in which a good match could be identified, a second data set was developed for comparison of companies reporting only material non-IT weaknesses. Findings – As expected, companies reporting IT weaknesses experienced less of an ability to pay short-term and long-term debts, earned lower profits, and possessed lower market value than companies with no weaknesses. Companies reporting IT weaknesses experienced worse financial performance and health than companies with non-IT weaknesses. Research limitations/implications – At the time of this study, most foreign registrants listed on US stock exchanges had not completed and filed their initial SOX 404 assessment with the SEC. Furthermore, small public companies (i.e. under a $75 million market capitalization) were not required to comply with 404 reporting requirements at the time of this study. In addition, Compustat provides information only on publicly traded companies. Originality/value – The current study builds on IT governance research in two key ways. First, academia and industry must move past the discussion of IT governance design to examine the performance of IT governance efforts (i.e. effectiveness of controls audited by an independent third party) in relation to key financial performance and health indicators. Second, this study uses more objective measures of IT governance than were available in the past (i.e. the internal control and financial data reported in companies' audited financial statements). The results provide insight into the relationship of IT governance to overall financial well-being.