Tempering Financial Reporting Risk through Board Risk Management

Abstract

Recent corporate governance failures have heightened stakeholder expectations that the board of directors engage in robust oversight of the firm’s risk management processes. This expectation is in line with widely embraced enterprise risk management frameworks, which assert that strong board risk management is a key component of an entity’s risk management process. We use a hand-coded measure of board engagement in risk management from the recent literature to measure the robustness of that oversight for a sample of large, publicly traded U.S. firms and examine the relationship between robust board risk management (board risk management) and firm-wide strategies for mitigating financial reporting risk. While controlling for board composition-related characteristics, we found a positive association between robust board risk management processes and two avenues for mitigating financial reporting risk (i.e., more effective internal control over financial reporting and the selection of industry specialist auditors). Our results indicate that firms with more robust board risk management are associated with fewer actual instances of materially misstated financial statements and less earnings management.

1. Introduction

We examine the relationship between robust risk management conducted by the board (board risk management) and firm-wide strategies for mitigating financial reporting risk. We define financial reporting risk as the risk that firms experience financial reporting failures (e.g., a restatement), and we investigate whether more robust board risk management is associated with known strategies for mitigating financial reporting risk (i.e., internal control effectiveness and selection of industry specialist auditors).1 We also examine whether robust board risk management is associated with lower incidences of financial reporting failures—an ex-post measure of financial reporting risk.

While an organization’s risk management processes are designed and implemented by management, it is the board of director’s responsibility to assess and approve the design and operational effectiveness of those risk management processes. As a result, the full board of directors, in its oversight capacity, serves as the ultimate risk management mechanism within the organization. Processes used by the full board, including the work of its subcommittees, to fulfil its risk management responsibilities vary across firms and potentially impact oversight effectiveness, including oversight of management’s actions related to financial reporting. This study focuses on the robustness of the full board’s risk management processes in the context of financial reporting.

The board as a whole, which consists of management and independent outside directors, plays a critical role in monitoring management’s risk-taking actions and decisions to ensure the risk of a financial reporting failure is sufficiently curtailed. While the full board may delegate aspects of risk management to one of its subcommittees, ultimately the board (which consists of both management and independent outside directors) is responsible for overseeing the risk-taking actions of management. However, firm stakeholders are concerned that board members without a deep understanding of the firm’s risk environment may blindly ‘go along with’ management’s representations, putting the reliability of financial reports at risk (Arjoon 2006; Castellano et al. 2011). Several corporate governance failures over the past two decades illustrate how a lack of prudent board engagement in risk management can contribute to financial reporting failures. For example, many argue that the boards for Enron, WorldCom, Lehman Brothers, Washington Mutual, and General Motors (among numerous others) failed in their risk management responsibilities by not understanding the significant risks undertaken by management (Arjoon 2006). These boards also failed to ensure these risks were adequately monitored with effective internal controls or other governance mechanisms, including external audit processes (Castellano et al. 2011; Temin 2014; Vlasic 2014). For these firms, the lack of robust board risk management resulted in stunning and calamitous financial reporting failures.

In response to stakeholders’ concerns that boards may not engage in sufficient risk management, principles-based governance frameworks now assert that the board should provide sufficient oversight over firm risk taking to ensure management’s decisions remain consistent with investor preferences (COSO 2013, 2017; ISO 2018). Additionally, regulatory bodies have enacted several changes over the past decade designed to strengthen the board of directors’ role in risk management and to increase transparency around board risk management efforts (NYSE 2013; Dodd-Frank 2010; NACD 2009, 2017; SEC 2010; S&P 2012).

In our study, we use a measure of the robustness of the board’s risk management (Bd Risk Mgt) from Beasley et al. (2021) to capture the strength of the firm’s risk management processes.2 We use this measure to examine the association between the robustness of board risk management and two firm-wide strategies designed to mitigate risk within the financial reporting process: internal control over financial reporting (ICFR) effectiveness and engagement of industry specialist auditors. ICFR effectiveness is relevant because of the board’s responsibility for overseeing management’s design, implementation, and operation of internal controls in response to identified risks, and the board’s critical role in ensuring an effective control environment (COSO 2013). Moreover, prior research indicates that ICFR effectiveness mitigates the risk of a financial reporting failure (Krishnan 2005; Doyle et al. 2007). We use the absence of a reported material weakness as a publicly observable indicator of effective ICFR. We also examine whether the board’s engagement in risk management processes is associated with the selection of an industry specialist auditor. We focus on industry specialist auditors given the board’s ultimate responsibility for selecting the external auditor and because prior research finds that industry specialist auditors are more effective in detecting and correcting potential material misstatements (Chin and Chi 2010; Romanus et al. 2008). Lastly, we examine the association between the robustness of board risk management and actual instances of financial reporting failures, as evidenced by the occurrence of restated financial statements.

We found that more robust board risk management is associated with decreased financial reporting risk. Specifically, we found that firms with more robust board risk management processes are positively associated with ICFR effectiveness and the use of industry specialist auditors. Moreover, firms with more robust board risk management are less likely to experience restatements (a salient indicator of mitigated financial reporting risk). Importantly, we found these results after controlling for a factor score of common board characteristics, managerial ability, innate risk, and other important predictors of financial reporting risk from prior literature. We also conducted a mediation analysis and found that the joint effects of ICFR effectiveness and the selection of an industry specialist auditor do not fully explain the negative association between board risk management and restatements, suggesting that board risk management reduces financial reporting risk beyond these two avenues. In additional analyses, we demonstrate the robustness of our results to endogeneity concerns and alternative proxies of financial reporting risk. As part of these analyses, we found a negative association between board risk management and earnings management.

Our study contributes to the ERM literature (e.g., Baxter et al. 2013; Cohen et al. 2017; Otero-González et al. 2022; Qazi and Can Emre Simsekler 2022) and the growing body of work examining the intersection of the board and ERM (e.g., Beasley et al. 2021). We expect the board to be a key contributor to any well-developed ERM system. So, our finding that board risk management is negatively associated with financial reporting risk demonstrates a tangible benefit to utilizing ERM best practices for risk management. Additionally, our study also contributes more broadly to corporate governance and financial reporting quality streams in the literature. We provide evidence that it is not just who sits on the board, but also the important risk management processes in which board members are involved that help to mitigate financial reporting risk.

2. Literature Review

2.1. Background

The goal of ERM is to help key leaders of the firm develop comprehensive enterprise-wide strategies for identifying, managing, and continuously monitoring all risks that might derail the firm’s achievement of its strategic objectives. Under ERM, firm leaders are encouraged to integrate potential risk outcomes of all strategic decisions with the intent of ensuring all firm-wide decisions remain consistent with stakeholders’ tolerance for risk. Best practices for ERM highlight the importance of the full board of directors as part of the leadership team in establishing an effective tone at the top and oversight of management’s risk-taking activities. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework asserts that ‘[t]he board of directors has the primary responsibility for risk oversight of the entity…’ (COSO 2017, p. 28). Similarly, the International Organization for Standardization (ISO) Risk Management Guidelines explicitly state, ‘oversight bodies are accountable for overseeing risk management’ (ISO 2018, p. 5). In sum, boards play a critical role in risk management and specifically in overseeing ERM (COSO 2009; Viscelli et al. 2017).

While thought leaders stress the importance of prudent board risk management, survey evidence indicates that board members also believe ‘there is an opportunity to improve the robustness of the risk oversight process’ (COSO 2010, p. 1). In surveys of large company board members, only 12% of survey respondents rated their company’s risk management process as highly effective and only one-half of companies reported that the board receives important risk information at least annually (COSO 2010). In addition, survey respondents reported that their firms have hesitated to implement best practices for risk management because they are not sure that the value is worth the cost of the firm’s resources (COSO 2010; Cohen et al. 2017). Thus, understanding the potential impacts of risk management best practices on strategic firm outcomes is extremely valuable to the literature and corporations, regulatory bodies, and thought leaders.

Emerging ERM research documents favorable outcomes of ERM implementation, including enhanced operating performance, higher firm value, and protections against lower tail outcomes (e.g., Baxter et al. 2013; Beasley et al. 2008; Otero-González et al. 2022). However, research on the intersection of the board and ERM is extremely nascent, except for recent research that finds a positive association between board risk management and more effective tax planning strategies (Beasley et al. 2021). More closely related to our paper, Cohen et al. (2017) surveyed executives and governance participants of publicly traded companies, finding that these governance players believe that effective ERM practices (which include the board’s involvement in the process) should play a substantive role in achieving strong internal control over financial reporting. However, we are aware of no empirical studies that examine whether board risk management is associated with a reduction in financial reporting risk.

While research on board engagement in ERM is limited, an abundance of prior research examines the association between broader board governance metrics and various measures of financial reporting risk. Broadly speaking, these studies found that favorable board composition-related characteristics (e.g., independence, financial expertise, tenure) are negatively associated with financial reporting risk (e.g., Beasley 1996; Dechow et al. 1996; Carcello et al. 2011a). These important board member characteristics help to reduce the financial reporting risk by ensuring that board members have the requisite skills to assess the reasonableness of financial reports (e.g., financial expertise) and by also ensuring that the board questions management when needed (e.g., objectivity). These characteristics serve as important factors (i.e., inputs) when identifying the types of individuals who serve on boards.

In contrast, we build upon this prior work to focus on processes used by the full board of directors in its risk management role, which is an important governance process undertaken by the board. We predict that, besides the objectivity and expertise of board members, robust board risk management processes will help board members to identify relevant risks to financial reporting (e.g., misreporting incentives, internal control weaknesses), reducing financial reporting risk. In our analyses, we control for the characteristics of board members (i.e., board inputs) to investigate the differential effect of board risk management on financial reporting risk. However, if the board input characteristics serve as a proxy for the underlying processes undertaken by the board, we may not observe a differential effect of the board’s specific risk management efforts, creating tension in our predictions. We focus on two avenues that help to reduce financial reporting risk: internal control quality and industry specialist auditors.

2.2. Hypotheses

COSO defines internal control as a process ‘designed to provide reasonable assurance regarding the achievement of objectives related to operations, reporting, and compliance’ (COSO 2013). Effectively designed and implemented systems of internal control help prevent or detect and correct material misstatements (Krishnan 2005). The COSO internal control framework highlights the importance of the board in monitoring the internal control system by stating that ‘[t]he board of directors retains oversight responsibility for management’s design, implementation, and conduct of internal control’ (COSO 2013, p. 39). Thus, one approach boards can use in their risk management efforts to mitigate financial reporting risk is by ensuring that management designs and implements effective systems of ICFR.

Recent qualitative research emphasizes the perceived importance of governance bodies and risk management practices in determining the firm’s control environment. Cohen et al. (2017) found in interviews with governance players from 11 publicly traded companies that these individuals strongly believe that effective ERM efforts, including greater involvement in the risk management process by governance parties, should play a substantive role in achieving strong ICFR. However, it remains an empirical question whether more robust risk management by the board translates into externally observable effective ICFR.

Prior research indicates that key characteristics of members of the board, including expertise, objectivity, and the number of board members, are positively associated with the strength of the control environment (Hoitash et al. 2009; Krishnan 2005; Zhang et al. 2007). However, qualitative research also argues that the board’s actions and focus are as important (if not more important) than the board’s composition in terms of the board’s ability to mitigate important firm risks (Weitzner and Peridis 2011). We propose that, in addition to the composition of the board, robust risk management processes at the board level should lead to stronger internal control environments. For example, continuous monitoring by the board of management’s risk management policies and procedures (e.g., COSO 2009, 2010; Rittenberg and Martens 2012) should help increase the effectiveness of internal control policies and procedures, thereby reducing financial reporting risk. Thus, we predict a positive association between boards with more robust risk management processes and effective ICFR, controlling for the board’s baseline member composition. Stated more formally, our first hypothesis predicts:

Hypothesis 1 (H1).

More robust board risk management is positively associated with effective ICFR.

In addition to ICFR, another avenue that boards can utilize to mitigate financial reporting risk is the choice of a higher quality external auditor.3 A strong external auditor helps to detect and correct material misstatements not prevented by internal controls (Behn et al. 2008; Francis and Yu 2009; Payne 2008; Reichelt and Wang 2010; Reynolds and Francis 2001). Specific to our setting, prior research documents that the selection of industry-specific audit experts is associated with lower incidences of firm financing reporting restatements (Chin and Chi 2010; Romanus et al. 2008).

Prior literature indicates that favorable board member characteristics, including size and independence, are associated with the choice to engage a higher quality auditor (Abbott and Parker 2000; Beasley and Petroni 2001; Chen and Zhou 2007; Lee et al. 2004), consistent with a greater demand for higher quality external assurance. Furthermore, Beasley and Petroni (2001) found that more independent boards within specialized industries seek auditors who specialize in the given industry (referred to as specialist auditors). This literature has not considered whether the board’s focus on risk management influences the choice of external auditor. If boards with more robust risk management processes place greater emphasis on mitigating important risks, including financial reporting risk, we would expect to see a positive association between board risk management processes and the demand for higher quality external auditors with specialized industry knowledge and expertise, holding constant the composition of the board.

The above argument assumes that internal monitoring and external monitoring act as complements to an overall strategy of financial reporting risk mitigation, or, in other words, decreased financial reporting risk. However, some prior research indicates that internal and external monitoring may be substitutes (Anderson et al. 1993); thus, firms with greater internal monitoring through board risk management may demand lower levels of external assurance. While this is possible, we concur with Carcello et al.’s (2011a) conclusion that strong governance and strong auditors should behave more like compliments than substitutes. Stated formally, we assert our second hypothesis:

Hypothesis 2 (H2).

More robust board risk management is positively associated with the use of industry specialist auditors.

H1 and H2 examine whether board risk management is associated with avenues designed to mitigate overall financial reporting risk. Our third hypothesis investigates whether more robust board risk management is associated with a reduction in the actual presence of material misstatements, an ex-post indicator of higher financial reporting risk. A profusion of prior research finds that boards with desirable board member characteristics (i.e., independence, expertise) are associated with lower value destroying earnings management behavior (Bédard et al. 2004; Xie et al. 2003), less frequent management fraud (Beasley 1996), and less frequent restatements (Badolato et al. 2014; Cohen et al. 2014), suggesting that these factors help to curtail financial reporting risk. However, we are unaware of any research examining whether board engagement in risk management activities incrementally influences financial reporting risk.

We predict that more robust board risk management processes will incrementally reduce the likelihood of issuing materially unreliable financial statements for several reasons. First, boards more engaged in risk management processes will more diligently monitor and evaluate the firm’s risk management processes designed to mitigate the likelihood of issuing unreliable reports, such as management’s development and implementation of risk identification and mitigation policies and procedures. Second, board engagement in risk management processes should help to set an appropriate risk-focused decision mindset and tone at the top that will discourage unethical reporting (Staubus 2005; Soltani 2014). Third, a board’s systematic monitoring of risks should not only help to constrain management from taking risks that are not in the best interests of investors (Weitzner and Peridis 2011) but also ensure that management is properly accounting for and disclosing important risks. In sum, more prudent monitoring of risk management processes should reduce the likelihood of issuing unreliable financial statements whether due to managerial misconduct or error. Stated more formally, we make the following hypothesis:

Hypothesis 3 (H3).

More robust board risk management is negatively associated with the likelihood of issuing unreliable financial reports.

3. Materials and Methods

3.1. Data and Sample Selection

Our sample comprised firms belonging to the Russell 1000 in 2014. We made this choice because of the constraints of the Beasley et al. (2021) board risk management robustness measure. We used information from the proxy statement closest to the 2014 year-end to develop our measure of board risk oversight.4 We assessed whether the information disclosed varied over time within firms by collecting and comparing the board oversight disclosures from the proxy statements in 2011 for a random subsample. Because we found no evidence that firms substantially altered the disclosures between the two periods, to increase the power to detect results in our outcome variables, we used this measure as a proxy for board risk oversight for 2011–2014 and we tested for the association between board risk oversight and our outcome variables using firm-years from 2011 through 2014. We were particularly interested in examining the 2011–2014 period given that time period followed one of the most volatile economic periods, widely referred to as the “Great Recession,” wherein financial reporting risks were elevated and board risk governance was especially critical as entities emerged from that significant event.

We began with 1021 Russell 1000 firms with data available in Compustat.5 We excluded firms in regulated industries, including 221 financial service firms (SIC codes 6000–6999) along with 59 utility firms (SIC codes 4900–4999). We also excluded 49 firms incorporated outside of the United States, as prior research indicates that country of origin influences firm risk management maturity (Ittner and Keusch 2015). Big 4 firms audited the vast majority of the sample, so we excluded 16 firms not audited by a Big 4 accounting firm. Finally, we excluded 20 firms for which the Bd Risk Mgt measure was not available.

We obtained financial statement variables from Compustat, auditor variables from Audit Analytics, institutional ownership data from Thomson Reuters 13f Holdings data, board compensation data from ExecuComp, board and audit committee characteristics from Institutional Shareholder Services (ISS, formerly RiskMetrics), and the managerial ability score from Demerjian et al. (2013).6 We excluded firms without data to estimate our regression models. We tested our hypotheses using all firm-years with available data for the period 2014 and the prior three fiscal periods. Our final sample included 441 firms and 1506 firm-years with data to calculate all variables.

3.2. Board Risk Management Measure

While boards may delegate aspects of risk governance to one of its subcommittees, the full board is ultimately responsible for overall risk management oversight. Thus, our study focused on the board of directors as a whole. We used the Beasley et al. (2021) board risk management robustness measure (Bd Risk Mgt) to capture the strength of the board’s risk management processes.7 As described in Beasley et al. (2021), Bd Risk Mgt was a hand-coded measure of the firm’s disclosed level of board involvement in risk management processes from annual proxy statements as of 2014.8 The measure comprised three underlying components (responsibility, consistency, and risk mindset). Each underlying component was coded as either 1 (present) or 0 (absent), and Bd Risk Mgt was the sum of each component and ranged from 0 to 3. These components are influenced by each individual who serves on the board and reflect an aggregate measure of their collective expertise, knowledge, and experience.

The first underlying component (Responsibility) captures the board’s formal articulation of responsibility for risk management. Although ERM best practices stress the importance of a formal articulation by the board of risk management monitoring responsibilities (COSO 2010; ISO 2018; Ittner and Keusch 2015; Rittenberg and Martens 2012), prior research and surveys suggest many boards do not accept any formal responsibility to oversee risk management (COSO 2010; Ittner and Keusch 2015; Beasley et al. 2021). Responsibility is equal to 1 if the proxy statement directly and verbally articulates the board’s responsibility for overseeing the firm’s risk management system (0 otherwise). The second underlying component (Consistency) captures the consistency with which the board monitors risk within the company by engaging in reviews of the firm’s risk management policies and procedures or discussing firm risks at board meetings at regular time intervals on at least an annual basis. It is equal to 1 if the firm discloses that the board regularly and systematically engages in risk monitoring activities (0 otherwise). The third component (Risk Mindset) addresses whether the board engages in monitoring related to ensuring that the firm maintains an appropriate risk mindset or tone at the top through involvement in addressing the firm’s risk appetite, risk strategy alignment, or corporate culture regarding risk and, if so, Risk Mindset is coded as 1 (0 otherwise) (Beasley et al. 2021).

3.3. Descriptive Statistics

Panel A of

Table 1. Descriptive Statistics for Board Risk Management and Board Inputs.

Panel A: Descriptive Statistics for Bd Risk Mgt
				Percentiles:
Variable	N	Mean	St Dev	25th	50th	75th
Bd Risk Mgt	441	1.31	0.90	1.00	1.00	2.00
Bd Risk Mgt	N	% of firms
0	82	18.6%
1	186	42.2%
2	126	28.6%
3	47	10.6%
	441	100%
Bd Risk Mgt measure components—descriptive statistics
Component		Mean Score
Responsibility		0.60
Consistency		0.42
Risk Mindset		0.29
		1.31
Panel B: Descriptive statistics for board member characteristics
				Percentiles:
	N	Mean	St Dev	25th	50th	75th
Board financial expertise	1506	2.32	1.27	1.00	2.00	3.00
AC financial expertise	1506	2.28	1.25	1.00	2.00	3.00
Board size	1506	9.99	1.88	9.00	10.00	11.00
AC size	1506	4.01	1.03	3.00	4.00	5.00
Board independence	1506	0.82	0.10	0.75	0.85	0.90
Board tenure	1506	9.78	3.47	7.64	9.55	11.50

Notes: This table presents descriptive statistics for our variable of interest (Bd Risk Mgt) along with board input variables. We define all variables in Appendix A.

provides the descriptive statistics on Bd Risk Mgt for the 441 firms in our sample. The mean Bd Risk Mgt was 1.31 with a standard deviation of 0.90. We also provide the distribution of Bd Risk Mgt across its range (0 to 3). Approximately 19 (11) per cent of firm-years in our sample had low (high) board risk management, as evidenced by Bd Risk Mgt scores of 0 (3).9 Thus, there was considerable variation within the range of firm scores, as shown in Table 1.

Appendix A provides a definition for all variables used in this study, including board member characteristics. Panel B of Table 1 provides the descriptive statistics of common board composition input variables (i.e., board and audit committee size and financial expertise, board tenure, and board independence) for the 1506 firm-years used to test our hypotheses. These statistics indicate very little cross-sectional variation, which is consistent with researchers’ observations that, over time, regulation has reduced the variation in observable board input characteristics in recent years (Beasley et al. 2010, p. 20; Carcello et al. 2011a, p. 2).10 Consistent with Beasley et al. (2021), we used factor analysis to develop a board characteristics principal component to control for differences in board member characteristics in our primary analyses.11 We found that all six board member variables loaded on one factor with an Eigenvalue of 2.13. All variables loaded positively, except for board tenure, which loaded negatively. We defined Board Inputs as the principal component from a factor analysis of the six board member characteristic variables. Consistent with Beasley et al. (2021), we found a positive and significant correlation between Board Inputs and Bd Risk Mgt, but at a relatively low level (Spearman corr. = 0.0894, Pearson corr. = 0.1119 untabulated), indicating the two measures are distinct constructs.

3.4. Primary Empirical Analyses

Our first objective was to examine whether there is a positive association between board involvement in risk management and strategies for mitigating financial reporting risk. To achieve this objective, we relied on the following model:

Risk Mitigation Strategy_it = θ₀ + θ₁Bd Risk Mgt_i + Σθ_kControl + ε_it

(1)

Bd Risk Mgt, ranging from 0 (lowest possible score) to 3 (highest possible score) as described previously, was our primary variable of interest. We also presented comparative results using an indicator variable, High Bd Risk Mgt, equal to 1 if Bd Risk Mgt is equal to 3. Our two proxies for Risk Mitigation Strategy followed our H1 and H2. To test H1, following prior research (e.g., Hoitash et al. 2009; Goh 2009) we used the absence of a reported material weakness as a public indicator of effective ICFR. Effective ICFR is an indicator variable equal to 0 if management reports a material weakness in internal controls over financial statements in any of its quarterly Section 302 reports in year t, and 1 otherwise.12 H1 predicts a positive coefficient on θ₁ when Effective ICFR is one of the mechanisms used to mitigate financial reporting risk.

Recall that our sample consists of firms audited by a Big 4 accounting firm. To test H2, we focused on the extent of industry experience of the auditor for each firm in our sample. We defined Industry Specialist Auditor as the number of firms in the firm’s industry that are audited by the firm’s audit office in year t. Prior research documents an association between both office size and industry expertise and higher auditor quality (e.g., Balsam et al. 2003; Francis et al. 2005, 2013). Furthermore, Francis et al. (2005) argue that industry knowledge and expertise in auditing derive from servicing clients primarily based out of city-based practice offices. We based Industry Specialist Auditor on the measure of office size developed by Francis et al. (2013), and we augmented the measure by allowing it to capture industry expertise, as represented by a larger number of clients in a particular industry. This measure is continuous and thus avoids common criticisms of industry expertise variables that use arbitrary cutoffs or only define industry specialization as the firm with the largest market share of industry clients (Audousset-Coulier et al. 2015). H2 predicts a positive coefficient on θ₁ when Industry Specialist Auditor is the dependent variable.

In contrast to the first two hypotheses, which focused on strategies for mitigating financial reporting risk, our third hypothesis focused on the direct relationship between Bd Risk Mgt and ex-post financial reporting risk. To test H3, our outcome variable was a measure of financial reporting risk ex-post (i.e., a financial reporting failure). We estimated the following model to test H3:

Restate_it = θ₀ + θ₁Bd Risk Mgt_i + Σθ_kControl + ε_it

(2)

We defined Restate equal to 1 for all firm-years associated with a restatement and zero otherwise.13 Restate is a salient indicator of publicly released unreliable financial reports. H3 predicts a negative coefficient on θ₁ when Restate is the dependent variable, suggesting that board engagement in risk management reduces the risk of a financial reporting failure.

Models (1) and (2) included the same set of control variables that prior research has shown to be associated with financial reporting risk. We controlled for board member characteristics using the factor score discussed previously (Board Inputs). We expected the coefficient on this variable to be positive (negative) in the risk mitigation strategy (restatement) tests. However, the small amount of variation in board member characteristics in our sample of large, prominent firms may also lead to no significant association between Board Inputs and our outcome variables. In addition, we included several control variables that prior research indicates are associated with financial reporting risk (e.g., Badolato et al. 2014; Boone et al. 2015; Carcello et al. 2011b; Hoitash et al. 2009; Demerjian et al. 2013), as well as other risk conditions that may affect the risk profile of the firm. These control variables included firm size (Size), leverage (Debt), growth (MTB), financial distress (Zscore, Loss), litigation risk (Litrisk), capital issuance and intensity (Issue, Capint), cash flow volatility (Opvol), firm’s operating cycle (Opcycle), the number of business segments (Lseg), and managerial ability (Mgr Ability). Based on prior research, we expected Size to be positively (negatively) associated with Effective ICFR (Restate). However, larger firms may realize economies of scale in internal monitoring, which may lead to lower demand for external monitoring (Anderson et al. 1993). Therefore, we did not predict a direction on Size when Industry Specialist Auditor is the dependent variable. We expected Mgr Ability to be positively (negatively) associated with Effective ICFR (Restate) but we did not predict a direction on this variable when Industry Specialist Auditor is the dependent variable. We did not have strong directional predictions on the other control variables.

We included two governance-related variables. Since other external monitoring mechanisms may affect financial reporting risk, we included the percentage of institutional owners (Instown) to proxy for the level of external monitoring. In addition, we included an indicator variable equal to 1 if the CEO is the Chairman of the board (CEO is Chair) given prior research suggests that this arrangement can cause agency conflicts. We included two relevant control variables from the risk management literature in all our models. We included a dummy variable coded as 1 if the firm disclosed in the proxy statement that it had a Chief Risk Officer (CRO) to proxy for ERM sophistication (Pagach and Warr 2011). Based on Cohen et al.’s (2017) finding of a perceived complimentary association between ERM effectiveness and financial reporting risk, we expected CRO to be positively (negatively) associated with Effective IC (Restate), while it was less clear how CRO would relate to the demand for an industry specialist auditor. Since the NYSE requires audit committees to discuss risk policies and procedures, we included an indicator in the model (NYSE) for whether a firm traded on the NYSE (Ittner and Keusch 2015), but we did not make a directional prediction on this variable.

Finally, we also controlled for city size (City Size) in the Industry Specialist Auditor model because firms in larger cities are likely to have auditors with larger audit offices, so we predicted the coefficient on this variable to be positive. We included industry and year fixed effects in all models. We used a linear probability model when Restate and Effective ICFR are the dependent variables to facilitate the inclusion of fixed effects.14

4. Results and Discussion

4.1. Primary Analyses

Table 2. Descriptive Statistics for Regression Variables.

Panel A: All variables
				Percentiles:
	N	Mean	St Dev	25th	50th		75th
Outcome variables
Effective ICFR	1506	0.981	0.137	1.000	1.000		1.000
Industry Specialist Auditor	1506	2.796	3.141	1.000	2.000		3.000
Restate	1506	0.059	0.236	0.000	0.000		0.000
Control variables:
Capint	1506	0.767	1.032	0.264	0.414		0.750
CEO is Chair	1506	0.404	0.489	0.000	0.000		1.000
City Size	1506	16.057	1.303	15.014	15.990		16.626
CRO	1506	0.050	0.218	0.000	0.000		0.000
Debt	1506	0.238	0.154	0.133	0.223		0.321
Instown	1506	0.799	0.145	0.728	0.819		0.899
Issue	1506	0.394	0.489	0.000	0.000		1.000
Litrisk	1506	−0.140	2.326	−1.504	−0.755		0.425
Loss	1506	0.054	0.227	0.000	0.000		0.000
Lseg	1506	0.784	0.722	0.000	1.099		1.386
Size	1506	8.948	1.171	8.109	8.797		9.650
MTB	1506	4.098	6.287	1.871	3.004		4.681
Mgr ability	1506	0.046	0.185	−0.078	−0.011		0.127
NYSE	1506	0.750	0.433	0.000	1.000		1.000
Opvol	1506	0.025	0.021	0.011	0.019		0.032
Opcycle	1506	119.87	78.52	69.90	106.27		148.32
Zscore	1506	5.212	3.582	2.987	4.491		6.550
Panel B: Outcome variables by Bd Risk Mgt Score
	Industry Specialist Auditor			Restate		Effective ICFR
Bd Risk Mgt:
0	2.340			0.079		0.977
1	2.653			0.065		0.975
2	3.060			0.051		0.984
3	3.358			0.024		1.000

Notes: This table presents descriptive statistics for our regression variables. We define all variables in Appendix A.

presents the descriptive statistics for the variables used in each of our models. As expected, since our sample comprises large, prominent firms, a small percentage of firms reported a material weakness in their internal control over financial reporting, given the significance of that kind of deficiency. Our variable, Effective ICFR, reflects the percentage of our sample firms that do not disclose a material weakness in internal control (98.1%). The mean Industry Specialist Auditor (the number of clients per auditor-city-industry-year) was 2.796. Approximately 5.9% of our sample firm-years were associated with a restatement. In Table 2, Panel B, we present our three outcome variables of interest by Bd Risk Mgt score (0 to 3). We found that Effective ICFR and Industry Specialist Auditor increase and Restate decreases monotonically as Bd Risk Mgt increases. We found that only 2.4% of firm-years with the highest Bd Risk Mgt (equal to 3) were associated with a restatement as compared to 7.9% of firm-years with the lowest Bd Risk Mgt (equal to 0). Similarly, 100% of firm-years with Bd Risk Mgt equal to 3 reported effective ICFR (Effective ICFR = 1), whereas 97.7% of firms with Bd Risk Mgt equal to 0 reported effective ICFR. These univariate results are consistent with our hypotheses.

Table 3. Internal Control Effectiveness Regression.

Dependent Variable:		Effective ICFR
		(1)		(2)
Variable	Pred	Coef	t-Stat	Coef	t-Stat
Intercept	?	0.901 ***	15.06	0.911 ***	15.27
Bd Risk Mgt	+	0.008 **	2.01
High Bd Risk Mgt	+			0.026 ***	3.44
Size	+	0.008 *	1.55	0.008 *	1.57
Debt	?	0.040	1.03	0.036	0.93
MTB	?	0.001 *	1.65	0.001 *	1.73
Capint	?	−0.002	−0.54	−0.003	−0.65
Opcycle	?	0.000	−1.07	0.000	−1.08
Issue	?	0.012 *	1.95	0.011 *	1.80
Lseg	?	−0.005	−0.78	−0.005	−0.78
Opvol	?	−0.016	−0.10	−0.015	−0.10
Loss	?	0.016 **	2.15	0.016 **	2.08
Zscore	?	0.000	−0.08	0.000	−0.14
Litrisk	?	0.000	0.07	0.000	−0.04
CRO	+	0.016 **	1.99	0.016 **	2.00
NYSE	?	−0.004	−0.30	−0.003	−0.24
Instown	?	0.004	0.11	0.002	0.07
Board Inputs	+	−0.002	−0.48	−0.002	−0.42
CEO is Chair	?	−0.019 **	−2.20	−0.020 **	−2.23
Mgr ability	+	0.034 *	1.44	0.036 *	1.51
R-squared		0.0224		0.0231
N		1506		1506

Notes: This table presents results for our test examining the association predicted in H1 between board risk management (Bd Risk Mgt) and internal control effectiveness (Effective ICFR). All continuous variables are winsorized at the 1st and 99th percentiles. All variables are defined in Appendix A. *, **, and *** indicate 10%, 5%, and 1% significance levels, respectively. p-values are based on one-tailed t-tests when a direction is predicted. The model includes industry (Fama French 17 specification) and year fixed effects.

,

Table 4. Industry Specialist Auditor Regression.

Dependent Variable:		Industry Specialist Auditor
		(1)		(2)
Variable	Pred	Coef	t-Stat	Coef	t-Stat
Intercept	?	−14.446 ***	−6.63	−14.205 ***	−6.56
Bd Risk Mgt	+	0.323 ***	2.68
High Bd Risk Mgt	+			0.537 *	1.39
Size	?	−0.208 **	−2.13	−0.205 **	−2.09
City Size	+	1.147 ***	9.44	1.159 ***	9.44
Debt	?	−1.916 **	−2.55	−1.944 **	−2.55
MTB	?	0.006	0.59	0.005	0.53
Capint	?	0.371 *	1.91	0.340 *	1.73
Opcycle	?	0.003 **	2.11	0.003 **	2.05
Issue	?	−0.159	−1.06	−0.177	−1.17
Lseg	?	0.079	0.54	0.082	0.55
Opvol	?	8.324 *	1.82	8.201 *	1.77
Loss	?	−0.148	−0.43	−0.165	−0.48
Zscore	?	−0.028	−1.04	−0.034	−1.28
Litrisk	?	−0.030	−0.72	−0.031	−0.74
CRO	?	−0.717 **	−1.97	−0.734 **	−2.07
NYSE	?	0.078	0.33	0.100	0.42
Instown	?	−0.003	0.00	−0.052	−0.08
Board Inputs	+	0.257 **	2.08	0.276 **	2.22
CEO is Chair	?	0.047	0.23	0.050	0.24
Mgr ability	?	−0.549	−0.97	−0.525	−0.91
R-squared		0.4090		0.4036
N		1506		1506

Notes: This table presents results for our test examining the association predicted in H2 between board risk management (Bd Risk Mgt) and industry specialist auditor (Industry Specialist Auditor). All continuous variables are winsorized at the 1st and 99th percentiles. All variables are defined in Appendix A. *, **, and *** indicate 10%, 5%, and 1% significance levels, respectively. p-values are based on one-tailed t-tests when a direction is predicted. The model includes industry (Fama French 17 specification) and year fixed effects.

and

Table 5. Restatement Regression.

Dependent Variable:		Restate
		(1)		(2)
Variable	Pred	Coef	t-Stat	Coef	t-Stat
Intercept	?	0.208	1.56	0.187	1.40
Bd Risk Mgt	-	−0.017 **	−1.91
High Bd Risk Mgt	-			−0.037 **	−1.86
Size	-	−0.010	−1.11	−0.011	−1.12
Debt	?	0.007	0.12	0.011	0.18
MTB	?	0.001	1.33	0.001	1.35
Capint	?	−0.013	−1.37	−0.011	−1.23
Opcycle	?	0.000	0.19	0.000	0.18
Issue	?	−0.016	−1.11	−0.014	−1.02
Lseg	?	0.009	0.59	0.009	0.59
Opvol	?	0.244	0.56	0.247	0.56
Loss	?	0.011	0.30	0.012	0.33
Zscore	?	−0.001	−0.32	−0.001	−0.22
Litrisk	?	0.000	0.05	0.000	0.08
CRO	-	−0.039	−1.24	−0.038	−1.25
NYSE	?	0.016	0.66	0.015	0.61
Instown	?	−0.059	−0.78	−0.057	−0.75
Board Inputs	-	−0.010 *	−1.38	−0.011 *	−1.49
CEO is Chair	?	0.010	0.46	0.010	0.46
Mgr ability	-	−0.035	−0.95	−0.037	−0.99
R-squared		0.0297		0.0281
N		1506		1506

Notes: This table presents results for our test examining the association predicted in H3 between board risk management (Bd Risk Mgt) and observable material misstatements (Restate). All continuous variables are winsorized at the 1st and 99th percentiles. All variables are defined in Appendix A. *, **, and *** indicate 10%, 5%, and 1% significance levels, respectively. p-values are based on one-tailed t-tests when a direction is predicted. The model includes industry (Fama French 17 specification) and year fixed effects.

present the multivariate results of our hypothesis tests. Table 3 presents the results of the ICFR effectiveness tests (H1). Column 1 presents the results using the continuous measure of Bd Risk Mgt, and column 2 presents the results using High Bd Risk Mgt. We found a positive association between board risk management and Effective ICFR using both the continuous measure of Bd Risk Mgt in column 1 (θ₁ = 0.008, p < 0.05) and the indicator for High Bd Risk Mgt in column 2 (θ₁ = 0.026, p < 0.01), supporting H1. In terms of economic significance, our results suggest that robust board risk management (High Bd Risk Mgt = 1) is associated with a 2.65% increase (0.026 divided by the sample mean of 0.981) in ICFR effectiveness. Our control variables were generally consistent with predictions. We did not find that Board Inputs is significantly associated with Effective ICFR. However, this may not be surprising given the low frequency of material weaknesses in our sample and/or the small variation in board member characteristics. This analysis also suggests that board risk management may be more important for explaining ICFR effectiveness compared to board composition in very large firms in which the variation in board input characteristics is minimal.

Table 4 presents the results of our industry specialist auditor analysis (H2). Overall, we found convincing support for the assertion that boards more involved in risk management seek to reduce financial reporting risk by choosing an auditor with greater industry experience. Specifically, we found that Bd Risk Mgt is positively associated with Industry Specialist Auditor (Column 1, θ₁ = 0.323, p < 0.01; Column 2, θ₁ = 0.537, p < 0.10). Given that the mean Industry Specialist Auditor (i.e., the number of clients of the audit office in the firm’s industry) was 2.796 (see Table 2), we found that a one unit increase in Bd Risk Mgt is associated with an approximately 12% increase in using industry specialist auditors.15 Our control variables were generally consistent with predictions. We found a positive association between Board Inputs and Industry Specialist Auditor. Thus, our results suggest that variation in the board’s level of risk management incrementally explains the variation in the choice of auditor with industry experience beyond board member characteristics.

Table 5 presents the results of the restatement test (H3). We found that boards with more robust risk management are associated with a lower likelihood of a restatement (Column 1, θ₁ = −0.017, p < 0.05; Column 2, θ₁ = −0.037, p < 0.05), supporting H3. Given the unconditional likelihood of a restatement within our sample firms of 5.9%, our results suggest that a one unit increase in Bd Risk Mgt is associated with a 29% decrease in the likelihood of experiencing a restatement.16 The control variables are generally consistent with prior literature. We found a negative association between Board Inputs and the likelihood of a restatement. Again, these results suggest that the board’s risk management activities are of differential importance to the composition of the board in terms of reducing the likelihood of issuing an unreliable financial report.

Overall, our results were consistent with all three hypotheses. We found that more robust board risk management is associated with financial reporting risk management strategies that include an effective ICFR and selection of auditors with greater industry experience, and board risk management is associated with a lower incidence of issuing misstated financial statements. Importantly, because we controlled for board member characteristics, these results suggest that the board’s risk management activities are complementary to the composition of the board in terms of reducing financial reporting risk.

4.2. Mediation Analysis

We performed an additional analysis to examine whether the association between Bd Risk Mgt and Restate is fully or partially explained by the two underlying avenues for mitigating financial reporting risk ex-ante (i.e., Effective ICFR and Industry Specialist Auditor). We presented the comparative results after adding these variables individually into Model (2) in

Table 6. Mediation Analysis Using the Avenue Variables.

Dependent Variable:	Restate
		(1)		(2)
Variable	Pred	Coef	t-Stat	Coef	t-Stat
Intercept	?	0.442 ***	2.73	0.143	0.79
Bd Risk Mgt	?	−0.015 **	−1.73	−0.016 **	−1.81
Effective ICFR	-	−0.238 **	−2.18
Industry Specialist Auditor	-			−0.004 *	−1.45
Citysize	?			0.007	0.96
Size	-	−0.008	−0.92	−0.012	−1.26
Debt	?	0.017	0.29	0.000	0.00
MTB	?	0.001	1.54	0.001	1.38
Capint	?	−0.013	−1.44	−0.011	−1.27
Opcycle	?	0.000	0.02	0.000	0.29
Issue	?	−0.013	−0.93	−0.016	−1.17
Lseg	?	0.008	0.54	0.009	0.61
Opvol	?	0.240	0.56	0.267	0.61
Loss	?	0.015	0.40	0.011	0.30
Zscore	?	−0.001	−0.34	−0.001	−0.33
Litrisk	?	0.000	0.06	0.000	−0.01
CRO	-	−0.035	−1.15	−0.042 *	−1.34
NYSE	?	0.015	0.65	0.017	0.70
Instown	?	−0.058	−0.78	−0.061	−0.81
Board Inputs	-	−0.011 *	−1.50	−0.009	−1.21
CEO is Chair	?	−0.027	−0.73	−0.038	−1.04
Mgr ability	-	−0.015 **	−1.73	−0.016 **	−1.81
Change in the coefficient on Bd Risk Mgt compared to Table 5
		Diff	Chi Sq.	Diff	Chi Sq.
Bd Risk Mgt		−0.002 *	2.81	0.001	1.09
R-squared		0.0472		0.0301
N		1506		1506
Industry & Year FE		Yes		Yes

Notes: This table presents results for our mediation analysis examining the explanatory power of Industry Specialist Auditor and Effective ICFR for the association between Bd Risk Mgt and Restatements. All continuous variables are winsorized at the 1st and 99th percentiles. All variables are defined in Appendix A. *, **, and *** indicate 10%, 5%, and 1% significance levels, respectively. p-values are based on one-tailed t-tests when a direction is predicted. The model includes industry (Fama French 17 specification) and year fixed effects.

. We used seemingly unrelated regression to compare the change in the coefficient on Bd Risk Mgt after including the avenue variables to the primary restatement results in Table 5. We found in column 1 that the coefficient on Effective ICFR (Coef = −0.238, p < 0.05) was significantly negative, as predicted. Adding Effective ICFR reduced the coefficient on Bd Risk Mgt from the baseline model (shown in Table 5) by 0.002 (p < 0.10); however, the coefficient on Bd Risk Mgt remained significantly negative. This analysis indicates that Effective ICFR partially explains the association between Bd Risk Mgt and Restate. Although we found that the coefficient on Industry Specialist Auditor (Coef = −0.004, p < 0.10) in column 2 was significantly negative, we did not find that the coefficient on Bd Risk Mgt significantly changed by adding Industry Specialist Auditor to the model. This finding suggests that auditor industry specialization and board risk management appear to be complementary mechanisms for mitigating the risk of issuing unreliable financial reports. In sum, this analysis suggests that robust board risk management is associated with a reduction in the likelihood of a restatement beyond the avenues of higher internal control effectiveness and an industry specialist auditor.

4.3. Falsification Test—Disclosure Content vs. Length

We performed a falsification test to demonstrate that the qualitative information disclosed regarding board risk management processes, rather than the quantity of information, best captures the underlying construct of board risk management robustness. Again, using data from Beasley et al. (2021), we replaced Bd Risk Mgt with the log of the number of words in the board’s risk management disclosure (NWords) and re-estimated our models. We tabulated these results in

Table 7. Falsification Test: Alternative Measure of Bd Risk Mgt—Number of words in the board risk management disclosure.

Dependent Variable:	Effective ICFR		Industry Specialist Auditor		Restate
	(1)		(2)		(3)
Variable	Coef	t-Stat	Coef	t-Stat	Coef	t-Stat
Intercept	0.907 ***	14.18	−14.439 ***	−5.94	0.097	0.63
Nwords	0.001	0.13	0.041	0.21	0.017	1.12
Size	0.008 *	1.51	−0.208 **	−2.11	−0.012	−1.22
City Size			1.163 ***	9.34
Debt	0.043	1.07	−1.805 **	−2.40	0.005	0.09
MTB	0.001	1.54	0.004	0.36	0.001	1.50
Capint	−0.003	−0.79	0.328 *	1.67	−0.01	−1.09
Opcycle	0.000	−1.03	0.003 **	2.11	0.000	0.16
Issue	0.012 **	1.99	−0.150	−0.98	−0.016	−1.13
Lseg	−0.005	−0.77	0.083	0.55	0.008	0.51
Opvol	−0.021	−0.13	8.042 *	1.73	0.237	0.53
Loss	0.016 **	2.09	−0.155	−0.44	0.013	0.33
Zscore	0.000	−0.13	−0.033	−1.25	−0.001	−0.15
Litrisk	0.000	0.18	−0.025	−0.61	0.000	−0.04
CRO	0.014 **	1.89	−0.771 **	−2.29	−0.037	−1.22
NYSE	−0.004	−0.30	0.084	0.36	0.015	0.61
Instown	0.003	0.09	−0.043	−0.07	−0.058	−0.76
Board Inputs	−0.002	−0.35	0.282 **	2.28	−0.012 *	−1.57
CEO is Chair	0.034 *	1.43	−0.562	−0.97	−0.032	−0.87
Mgr ability	0.001	0.13	0.041	0.21	0.017	1.12
R-squared	0.0198		0.4009		0.0273
N	1506		1506		1506

Notes: This table presents results for our falsification test replacing Bd Risk Mgt with the board risk management disclosure length (NWords). All continuous variables are winsorized at the 1st and 99th percentiles. All variables are defined in Appendix A. *, **, and *** indicate 10%, 5%, and 1% significance levels, respectively. p-values are based on one-tailed t-tests when a direction is predicted. The model includes industry (Fama French 17 specification) and year fixed effects.

. We found no evidence that NWords was significantly associated with any of our financial reporting risk or risk mitigation proxies. This analysis provides evidence that the content of disclosed board risk management activities, rather than the amount of information disclosed, explains the variation in financial reporting risk.

4.4. Abnormal Accruals Test

Although managerial misconduct involving fraud or GAAP violations that results in a restatement is most concerning for the board, these severe forms of misconduct occur rather infrequently and are only observable if detected. Financial statements that are unreliable because of managerial opportunism, even if they never result in a restatement, are also a significant concern. Thus, we also examined the association between robust board risk management and unreliable financial reporting through accruals-based earnings management. Moreover, this test helps to provide further insight into the association between board risk management and general financial reporting quality.

To measure abnormal accruals, we used the performance-adjusted cross-sectional variation of the modified Jones model (Kothari et al. 2005; Prawitt et al. 2009). We estimated the model by industry (two-digit SIC code) and year, and we required ten firms in each industry-year to estimate the model. To estimate abnormal accruals, we used all firms in Compustat during the period 2011–2014 with available data.17 Since we did not predict a direction of the earnings management, we used the absolute value of the error term as our measure of abnormal accruals (Abnormal Accruals). We estimated Model (2) replacing Restate with Abnormal Accruals. We tabulated the results from this analysis in

Table 8. Earnings Management Regression.

Dependent Variable:		Abnormal Accruals
		(1)		(2)
Variable	Pred	Coef	t-Stat	Coef	t-Stat
Intercept	?	0.047 ***	3.21	0.045 ***	3.11
Bd Risk Mgt	-	−0.002 **	−1.67
High Bd Risk Mgt	-			−0.005 *	−1.60
Size	-	−0.003 ***	−2.67	−0.003 ***	−2.69
Debt	?	0.012	0.92	0.013	0.96
MTB	?	0.000	0.58	0.000	0.58
Capint	?	0.001	1.01	0.002	1.11
Opcycle	?	0.000	1.30	0.000	1.28
Issue	?	0.003	1.52	0.003	1.61
Lseg	?	0.001	0.53	0.001	0.52
Opvol	?	0.414 ***	5.29	0.414 ***	5.29
Loss	?	0.001	0.16	0.001	0.19
Zscore	?	0.000	−0.37	0.000	−0.30
Litrisk	?	0.002	1.43	0.002	1.44
CRO	-	−0.004	−0.90	−0.004	−0.90
NYSE	?	−0.003	−1.19	−0.004	−1.25
Instown	?	−0.006	−0.83	−0.006	−0.79
Board Inputs	-	0.002	1.56	0.002	1.45
CEO is Chair	?	0.000	0.11	0.000	0.12
Mgr ability	-	0.028 ***	3.19	0.028 ***	3.15
R-squared		0.1252		0.1243
N		1506		1506

Notes: This table presents results for our test examining the association between board risk management (Bd Risk Mgt) and earnings management (Abnormal Accruals). All continuous variables are winsorized at the 1st and 99th percentiles. All variables are defined in Appendix A. *, **, and *** indicate 10%, 5%, and 1% significance levels, respectively. p-values are based on one-tailed t-tests when a direction is predicted. The model includes industry (Fama French 17 specification) and year fixed effects.

. Similar to our primary analysis, we found that board risk management is associated with significantly lower abnormal accruals in both columns (Column 1, θ₁ = −0.002, p < 0.05; Column 2, θ₁ = −0.005, p < 0.10). Thus, we found that board risk management is associated with significantly less earnings management. These findings indicate that more robust board risk management helps to mitigate financial reporting risk not only by reducing the risk of a financial reporting failure but also by constraining the degree of unreliability in financial statements because of earnings management.

4.5. Untabulated Robustness Tests

We also performed several untabulated robustness tests. First, endogeneity is a concern in all empirical studies. Since our study is an association study, we cannot statistically draw inferences regarding causality. However, the preponderance of prior research, corporate governance theory, and regulations, particularly the Sarbanes–Oxley Act of 2002, strongly suggest that the board, often through its audit committee, has ultimate responsibility for the choice of auditor (rather than industry specialist auditors choosing clients). Based on that, we have no plausible reason to believe that reverse causality explains our auditor choice results. Furthermore, we also expected that board risk management improves ICFR effectiveness, as suggested by widely embraced internal control and risk management frameworks that pinpoint the ultimate responsibility for internal control oversight to the board of directors. Thus, we have no plausible reason to believe that reverse causality explains our ICFR effectiveness results.

However, it is plausible that some unmeasured underlying factor explains the association between Bd Risk Mgt and the risk of a financial reporting failure.18 To mitigate this concern, we used entropy balancing (Hainmueller 2012), which emulates a matched sample with fewer restrictions as an alternative research design. Specifically, we used entropy balancing to balance the means of all covariates in our primary models between firms with high board risk management (Bd Risk Mgt = 3; N = 165) and those with lower board risk management (Bd Risk Mgt < 3; N = 1341), and we re-estimated our models using High Bd Risk Mgt as our variable of interest. In the untabulated tests, we found that results using entropy-balanced samples yielded similar inferences to our primary results.

Second, in the untabulated analyses, we examined the robustness of our results to alternative measures of auditor quality. In the untabulated analyses, we found that our results also held using alternative measures of auditor quality, including: (1) a dummy variable equal to 1 for the city-industry-year audit fee leader (Francis et al. 2005; Reichelt and Wang 2010), and (2) auditor office size (Francis and Yu 2009; Francis et al. 2013).19

5. Conclusions

The board plays an important governance oversight role on behalf of key stakeholders in overseeing management’s risk-taking behaviors. We used a hand-coded measure of the board’s risk management processes developed by Beasley et al. (2021), which captured qualitative information disclosed in the firm’s proxy statements regarding board risk management, to empirically examine the association between the robustness of the board of director’s risk management processes and two mechanisms used by boards to mitigate risks related to financial reporting. We also examined the association between the robustness of board risk management processes and an observable measure for financial reporting failure (e.g., restatement). In doing so, we advance ERM, corporate governance, and accounting research by providing evidence of an association between the robustness of risk management processes and the risk of a financial reporting failure. Given that our measure captures information publicly available to all stakeholders in annual proxy statements about board risk management processes (particularly focused on components of the board’s risk management responsibility, consistency, and risk mindset), our study contributes to the board governance literature by illustrating how such information can be informative to users. We document that this relationship is orthogonal to the composition of the board.

We found that boards with more robust risk management are associated with effective internal control over financial reporting, the engagement of industry specialist auditors, and a lower likelihood of issuing unreliable financial statements. Importantly, we found these results after controlling for board member characteristics. Collectively, these findings indicate that board risk management processes help to mitigate financial reporting risks beyond the composition of the board. Given that requirements for public disclosure of the board’s role in risk oversight are relatively new (e.g., first required for U.S. public companies in 2010), our study provides insight about the relative usefulness of the information disclosed in annual proxy statements about board risk management processes. Thus, the results of our study should interest policymakers, firms, and other stakeholder groups, as best practices for board risk management are still emerging. The results should also be of interest to boards evaluating the tradeoff between the cost of oversight activities and positive firm outcomes. We also believe our study will be informative to future research seeking to better understand factors that may impact board risk management processes.