A software audit framework for spyware risk mitigation

Our research described in this paper identifies a three part premise relating to the spyware paradigm. Firstly the data suggests spyware is proliferating at an exponential rate. Secondly ongoing research confirms that spyware produces many security risks – including that of privacy/confidentiality breaches via illicit data collection and reporting. Thirdly, anti-spyware controls are improving but are still considered problematic for several reasons. Our research then concludes that control measures to counter this very significant challenge should merit compliance auditing – and this auditing may effectively target the vital message passing performed by all illicit data collection spyware. Our research then evolves into an experiment involving the design and implementation of a software audit tool to conduct the desired compliance auditing. The software audit tool is positioned at the protected network’s gateway. The software audit tool uses ‘phone-home’ IP addresses as spyware signatures to detect the presence of the offending software. The audit tool also has the capability to differentiate legitimate message passing software from that produced by spyware – and ‘learn’ both new spyware signatures and new legitimate message passing profiles. The testing stage of the software has proven successful – albeit using very limited levels of network message passing variety and frequency.

The impact of board independence and ownership structure on the timeliness of corporate internet reporting of Irish-listed companies

Purpose – This study seeks to provide valuable new insight into the timeliness of corporate internet reporting (TCIR) by a sample of Irish-listed companies. Design/methodology/approach – The authors apply an updated version of Abdelsalam et al. TCIR index to assess the timeliness of corporate internet reporting. The index encompasses 13 criteria that are used to measure the TCIR for a sample of Irish-listed companies. In addition, the authors assess the timeliness of posting companies’ annual and interim reports to their web sites. Furthermore, the study examines the influence of board independence and ownership structure on the TCIR behaviour. Board composition is measured by the percentage of independent directors, chairman’s dual role and average tenure of directors. Ownership structure is represented by managerial ownership and blockholder ownership. Findings – It is found that Irish-listed companies, on average, satisfy only 46 per cent of the timeliness criteria assessed by the timeliness index. After controlling for size, audit fees and firm performance, evidence that TCIR is positively associated with board of director’s independence and chief executive officer (CEO) ownership is provided. Furthermore, it is found that large companies are faster in posting their annual reports to their web sites. The findings suggest that board composition and ownership structure influence a firm’s TCIR behaviour, presumably in response to the information asymmetry between management and investors and the resulting agency costs. Practical implications – The findings highlight the need for improvement in TCIR by Irish-listed companies in many areas, especially in regard to the regular updates of information provided on their web sites. Originality/value – This study represents one of the first comprehensive examinations of the important dimension of the TCIR in Irish-listed companies.

An empirical investigation of price competition and industry specialisation in NHS audit services

The NHS audit market is regulated by the Audit Commission (AC) and has unique features. We develop a model for audit fees that includes rigorous analysis of the type of auditor. Poor financial standing does not give rise to higher audit fees. Despite regulation the study supports the existence of a Big Five price premium on the audit fee, but only one firm has a premium. We found no premium due to industry specialisation. The removal of performance audit from AC regulation will require improved audit fee reporting and control.

Evaluating the impact of institutional logic on the corporate Internet reporting by Egyptian listed companies

This study explores the institutional logic(s) governing the Corporate Internet Reporting (CIR) by Egyptian listed companies. In doing so, a mixed methods approach was followed. The qualitative part seeks to understand the perceptions, believes, values, norms, that are commonly shared by Egyptian companies which engaged in these practices. Consequently, seven cases of large listed Egyptian companies operating in different industries have been examined. Other stakeholders and stockholders have been interviewed in conjunction with these cases. The quantitative part consists of two studies. The first one is descriptive aiming to specify whether the induced logic(s) from the seven cases are commonly embraced by other Egyptian companies. The second study is explanatory aiming to investigate the impact of several institutional and economic factors on the extent of CIR, types of the online information, quality of the websites as well as the Internet facilities. Drawing on prior CIR literature, four potential types of logics could be inferred: efficiency, legitimacy, technical and marketing based logics. In Egypt, legitimacy logic was initially embraced in the earlier years after the Internet inception. latter, companies confronted radical challenges in their internal and external environments which impelled them to raise their websites potentialities to defend their competitive position; either domestically or internationally. Thus, two new logics emphasizing marketing and technical perspectives have emerged, in response. Strikingly, efficiency based logic is not the most prevalent logic driving CIR practices in Egypt as in the developed countries. The empirical results support this observation and show that almost half of Egyptian listed companies 115 as on December 2010 possessed an active website, half of them 62 disclosed part of their financial and accounting information, during December 2010 to February 2011. Less than half of the websites 52 offered latest annual financial statements. Fewer 33(29%) websites provided shareholders and stock information or included a separate section for corporate governance 25 (22%) compared to 50 (44%) possessing a section for news or press releases. Additionally, the variations in CIR practices, as well as timeliness and credibility were also evident even at industrial level. After controlling for firm size, profitability, leverage, liquidity, competition and growth, it was realized that industrial companies and those facing little competition tend to disclose less. In contrast, management size, foreign investors, foreign listing, dispersion of shareholders and firm size provided significant and positive impact individually or collectively. In contrast, neither audit firm, nor most of performance indicators (i.e. profitability, leverage, and liquidity) did exert an influence on the CIR practices. Thus, it is suggested that CIR practices are loosely institutionalised in Egypt, which necessitates issuing several regulative and processional rules to raise the quality attributes of Egyptian websites, especially, timeliness and credibility. Beside, this study highlights the potency of assessing the impact of institutional logic on CIR practices and suggests paying equal attention to the institutional and economic factors when comparing the CIR practices over time or across different institutional environments in the future.

The impact of board independence and ownership structure on the timeliness of corporate internet reporting of Irish-listed companies

Purpose – This study seeks to provide valuable new insight into the timeliness of corporate internet reporting (TCIR) by a sample of Irish-listed companies. Design/methodology/approach – The authors apply an updated version of Abdelsalam et al. TCIR index to assess the timeliness of corporate internet reporting. The index encompasses 13 criteria that are used to measure the TCIR for a sample of Irish-listed companies. In addition, the authors assess the timeliness of posting companies’ annual and interim reports to their web sites. Furthermore, the study examines the influence of board independence and ownership structure on the TCIR behaviour. Board composition is measured by the percentage of independent directors, chairman’s dual role and average tenure of directors. Ownership structure is represented by managerial ownership and blockholder ownership. Findings – It is found that Irish-listed companies, on average, satisfy only 46 per cent of the timeliness criteria assessed by the timeliness index. After controlling for size, audit fees and firm performance, evidence that TCIR is positively associated with board of director’s independence and chief executive officer (CEO) ownership is provided. Furthermore, it is found that large companies are faster in posting their annual reports to their web sites. The findings suggest that board composition and ownership structure influence a firm’s TCIR behaviour, presumably in response to the information asymmetry between management and investors and the resulting agency costs. Practical implications – The findings highlight the need for improvement in TCIR by Irish-listed companies in many areas, especially in regard to the regular updates of information provided on their web sites. Originality/value – This study represents one of the first comprehensive examinations of the important dimension of the TCIR in Irish-listed companies.

Interactive data in financial reporting:the construction of the non-professional investor

The Securities and Exchange Commission (SEC) in the United States and in particular its immediately past chairman, Christopher Cox, has been actively promoting an upgrade of the EDGAR system of disseminating filings. The new generation of information provision has been dubbed by Chairman Cox, "Interactive Data" (SEC, 2006). In October this year the Office of Interactive Disclosure was created(http://www.sec.gov/news/press/2007/2007-213.htm). The focus of this paper is to examine the way in which the non-professional investor has been constructed by various actors. We examine the manner in which Interactive Data has been sold as the panacea for financial market 'irregularities' by the SEC and others. The academic literature shows almost no evidence of researching non-professional investors in any real sense (Young, 2006). Both this literature and the behaviour of representatives of institutions such as the SEC and FSA appears to find it convenient to construct this class of investor in a particular form and to speak for them. We theorise the activities of the SEC and its chairman in particular over a period of about three years, both following and prior to the 'credit crunch'. Our approach is to examine a selection of the policy documents released by the SEC and other interested parties and the statements made by some of the policy makers and regulators central to the programme to advance the socio-technical project that is constituted by Interactive Data. We adopt insights from ANT and more particularly the sociology of translation (Callon, 1986; Latour, 1987, 2005; Law, 1996, 2002; Law & Singleton, 2005) to show how individuals and regulators have acted as spokespersons for this malleable class of investor. We theorise the processes of accountability to investors and others and in so doing reveal the regulatory bodies taking the regulated for granted. The possible implications of technological developments in digital reporting have been identified also by the CEO's of the six biggest audit firms in a discussion document on the role of accounting information and audit in the future of global capital markets (DiPiazza et al., 2006). The potential for digital reporting enabled through XBRL to "revolutionize the entire company reporting model" (p.16) is discussed and they conclude that the new model "should be driven by the wants of investors and other users of company information,..." (p.17; emphasis in the original). Here rather than examine the somewhat illusive and vexing question of whether adding interactive functionality to 'traditional' reports can achieve the benefits claimed for nonprofessional investors we wish to consider the rhetorical and discursive moves in which the SEC and others have engaged to present such developments as providing clearer reporting and accountability standards and serving the interests of this constructed and largely unknown group - the non-professional investor.

Reporting and managing risk:a look at current practice at Tesco, RBS, local and central government

These case studies from CIMA highlight the need to embed risk management within more easily understood behaviours, consistent with the overall organisational culture. In each case, some form of internal audit team provides either an oversight function or acts as an expert link in that feedback loop. Frontline staff, managers and specialists should be completely aligned on risk, in part just to ensure that there is a consistency of approach. They should understand instinctively that good performance includes good risk management. Tesco has continued to thrive during the recession and remains a robust and efficient group of businesses despite the emergence of potential threats around consumer spending and the supply chain. RBS, by contrast, has suffered catastrophic and very public failures of risk management despite a large in-house function and stiff regulation of risk controls. Birmingham City Council, like all local authorities, is adapting to more commercial modes of operation and is facing diverse threats and opportunities emerging as a result of social change. And DCMS, like many other public sector organisations, has to handle an incredibly complex network of delivery partners within the context of a relatively recent overhaul of central government risk management processes. Key Findings: •Risk management is no longer solely a financial discipline, nor is it simply a concern for the internal control function. •Where organisations retain a discrete risk management cadre – often specialists at monitoring and evaluating a range of risks – their success is dependent on embedding risk awareness in the wider culture of the enterprise. •Risk management is most successful when it is explicitly linked to operational performance. •Clear leadership, specific goals, excellent influencing skills and open-mindedness to potential threats and opportunities are essential for effective risk management. •Bureaucratic processes and systems can hamper good risk management – either as a result of a ‘box-ticking mentality’ or because managers and staff believe they do not need to consider risk themselves.

Associations between SOX 404 opinions and auditors, audit committees, and executives

This dissertation examined three issues associated with Section 404 of the Sarbanes-Oxley Act (SOX) that are of current interest to regulators and the accounting profession. For the first essay, I examined auditor changes from 2003 to 2005 for 2,454 non-financial firms that filed their initial SOX 404 opinions prior to July 1, 2005. My results showed that there is a significant association between the receipt of an adverse SOX 404 opinion and auditor resignations - both before and after the issuance of the SOX 404 opinion. The data related to auditor dismissals show that clients are not successful in opinion shopping, since clients dismissing the auditor before the SOX 404 report also are more likely to receive an adverse SOX 404 opinion than clients not changing auditors. My second essay examined the relation between audit committee characteristics and changes in material weaknesses in internal control over financial reporting under the new SOX regime. My results showed that improvements in internal control in the second year of SOX are associated with: (1) the number of audit committee members and (2) financial expertise of audit committee members. My third essay examined the relation between the appointment of the new executives and the subsequent receipt of initial section 404 of SOX opinions. My results showed that adverse SOX 404 reports will be more likely at firms that recently hired a new chief financial officer (CFO).

Internal control reporting by non-accelerated filers

I examine three issues related to internal control reporting by non-accelerated filers. Motivation for the three studies comes from the fact that Section 404 of the Sarbanes-Oxley Act (SOX) continues to be controversial, as evidenced by the permanent exemption from Section 404(b) of SOX granted to non-accelerated filers by the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. The Dodd-Frank Act also requires the SEC to study compliance costs associated with smaller accelerated filers. In the first part of my dissertation, I document that the audit fee premium for non-accelerated filers disclosing a material weakness in internal controls (a) is significantly lower than the corresponding premium for accelerated filers, and (b) declines significantly over time. I also find that in the case of accelerated filers remediating clients pay lower fees compared to clients continuing to report internal control problems; however, such differences are not observed in the case of non-accelerated filers. The second essay focuses on audit report lag. The results indicate that presence of material weaknesses are associated with increased audit report lags, for both accelerated and non-accelerated filers. The results also indicate that the decline in report lag following remediation of problems is greater for accelerated filers than for non-accelerated filers. The third essay examines early warnings (pursuant to Section 302 disclosures) for firms that subsequently disclosed internal control problems in their 404 reports. The analyses indicate that non-accelerated firms with shorter CFO tenure, presence of accounting experts on the audit committee, and more frequent audit committee meetings are more likely to provide prior Section 302 warnings. Overall the results suggest that there are differences in internal control reporting between the accelerated and non-accelerated filers. The results provide empirical grounding for the ongoing debate about internal control reporting by non-accelerated filers.

Audit committee director turnover

Actions by both private sector organizations and legislators in recent years have highlighted the importance of the audit committee of the board of directors of corporations in the financial reporting process. For example, the Sarbanes Oxley Act of 2002 has multiple sections that deal with the composition and functioning of audit committees. My dissertation examines multiple issues related to the composition of audit committees. In the first two parts of my dissertation, I examine the stock market reactions to disclosures of audit committee appointments and departures in the 8-Ks filed with the SEC during 2008 and 2009. I find that there is a positive stock market reaction to the appointment of audit committee directors who are financial experts. The second essay investigates the cumulative abnormal return to departure of audit committee directors. I find that when an accounting expert leaves the audit committee, the market reaction is significantly negative. These results are consistent with regulators’ concerns related to having directors with audit, accounting and other financial expertise on corporate audit committees. The third essay of my dissertation examines the changes in audit committee composition in the last decade. I find that while the increase in audit committee size is relatively modest, there has been a significant increase in the number of audit committee experts and the frequency of audit committee meetings over the past decade; interestingly, such increase in the number of meetings has persisted even after the media focus on the auditing profession, in the immediate aftermath of the Enron and Andersen failures, have waned. My results show that audit committee composition and its role continues to evolve with regulatory and other corporate governance related changes.

Audit Tendering in the UK: A Review of Stakeholders’ Views

This study reports the results of a content analysis of the comment letters sent to the UK Financial Reporting Council (FRC), in response to its consultation document on the 2012 revisions of the UK Corporate Governance Code, concerning the proposal for mandatory audit tendering. The results indicate a general support for the FRC’s proposals with a number of key concerns related to audit quality, auditor independence and audit cost. There is also clear conflict of interests among some stakeholder groups such as audit firms and companies on one side and institutional investors on the other side. There is evidence of conflict of interest between Big 4 and non-Big 4 audit firms. Implications for future consultations and legislations are also discussed.

The influence of remuneration structures on financial reporting quality: evidence from Australia

This cross-sectional study investigates the influence of a company's remuneration structure on managers' opportunistic behaviour. The findings support the proposed hypothesis that a higher level of compliance with Remuneration Principle 8-ASX Corporate Governance Council) is associated with a lower level of earnings management. The findings support the efficient functioning of the ASX proposed remuneration structure. This cross-sectional study investigates the influence of remuneration structures on financial reporting quality, based on a sample of companies listed on the Australian Securities Exchange (ASX). Compliance with Remuneration Principle eight issued by ASX (providing recommendations on formation, operation and disclosure of remuneration committees) is expected to improve financial reporting quality represented by a decreased level of earnings management. This study expands the corporate governance literature by examining an under-researched mechanism to address the agency problem. Earnings management, as a consequence of the agency problem, is measured using the level of absolute discretionary accruals. In this study, we use the modified Jones model to measure the level of discretionary accruals and the existence of reduced earnings management. The study is conducted using a random sample of 214 firm-year observations selected from the ASX listed companies. Our findings show a higher level of compliance with the principle on remuneration is associated with lower levels of earnings management. The findings support the efficient functioning of the ASX-proposed remuneration structure in reducing earnings manipulations.

Short-term debt maturity structures, credit ratings, and the pricing of audit services

ABSTRACT: Short-term debt and credit ratings have benefits for financial reporting quality that may be associated with lower audit fees. Using U.S. data for 2003 through 2006, we find that short-term debt is negatively related to audit fees for firms rated by Standard & Poor’s, consistent with more monitoring and better governance mechanisms in firms with higher short-term debt. Credit ratings quality is negatively related to audit fees, consistent with ratings quality reflecting a firm’s liquidity risk, governance mechanisms, and monitoring from rating agencies. We also find that the negative relation between short-term debt and audit fees is stronger for firms with low-quality credit ratings, consistent with auditors pricing lender monitoring.