Effects of Materiality Assessment on Internal Controls over Financial Reporting Maturity

The paper investigates the effects of materiality assessment on Internal Controls over Financial Reporting (ICFR) Maturity. Based on private data collected from Italian listed companies, the paper aims to provide a unique score for assessing ICFR Maturity of a company and to assess the effect of quantitative and qualitative factors used to evaluate materiality. Specifically, it examines the processes used to identify significant entities, significant accounts and associating accounts with process. A Partial Least Squares (PLS) Path Modeling approach is used. Among quantitative factors, total assets, sales and earnings before taxation are the best accounting measures used by companies to select entities, while income statement value is more useful than the balance sheet in selecting significant accounts. This last activity is relatively more relevant that the others. Scoping results show: 1) the importance of identification of entities at group level; 2) multiple association accounts – processes is better than single association. Finally results show different effects on ICFR Maturity for the manufacturing and services industry and for the financial industry.


Introduction
After the financial scandals of the 2000s, evaluation of Internal Control over Financial Reporting (ICFR) was made mandatory in most parts of the world and findings of the evaluation today have to be published for use on the market.The legislation introducing the obligation was in the USA the Sarbanes-Oxley Act (Gupta et al. 2006) and in individual countries in Europe national laws.These national laws show certain differences, but they have the same aim.Research usually investigates public data on the evaluation of ICFR, such as the material weaknesses disclosed under the Sarbanes-Oxley Act, but there is limited empirical evidence in the existing literature on the evaluation of ICFR because of the lack of data on internal control.In general, it is difficult to directly observe or verify internal control quality.We contribute to the literature using private data on internal control collected by questionnaires and by proposing a Partial Least Squares (PLS) Path Models (Esposito Vinzi et al., 2010) which allows us to compute a global score for assessing the ICFR Maturity of a company.This research addresses evaluation of ICFR in Italy in 2008, the first year of the application of Italian Law No. 262, by focusing on quality of Scoping, Planning and Risk Assessment as the audit cycle activities.Given that Italian legislation does not provide guidelines to identify the three phases, listed companies mainly follow US frameworks and standards, such as the Auditing Standards (AS) 5 of Public Company Accounting Oversight Board (PCAOB), in order to organize their ICFR.Following AS5 we explore the specific activities of Identifying Significant Subsidiaries, Identifying Significant Accounts and Associating Accounts with Processes.
We contribute to the literature by analyzing the principle of materiality in each activity investigated, firstly through the analysis of the qualitative and quantitative factors used.The literature shows that although the use of percentage in defining materiality is generally accepted, there is a lack of consensus on the magnitude of the percentage used as threshold level.Furthermore, materiality is defined on the basis of many accounts, and net income used as the basis of the definition.We contribute to the literature in investigating different threshold levels for different accounts, in order to provide evidence that there is a lack of consensus on this among Chief Financial Officers and internal auditors evaluating ICFR in Italy in compliance with Law No. 262.Qualitative factors are also found to be important in defining materiality in various standards and in the literature.We therefore investigate several qualitative risk factors which we add to our quantitative calculations based on the magnitude of the financial statement accounts.
We collected data by questionnaire for 2008, the first year that Law No. 262 was in force.
The paper provides useful findings about the relevance of qualitative and quantitative factors in the assessment of the Materiality.These factors are basic to the quality of Scoping, Planning and Risk Assessment.We define a global score to measure the ICFR Maturity of a company composed of three sub-dimensions: capability in detecting significant subsidiaries, capability in detecting significant accounts and the capability in associating accounts with processes.We assess the relative importance of the different dimensions of global quality of an audit process in defining the global score.
We use both qualitative and quantitative measures for assessing capability in identifying significant subsidiaries and significant accounts, while only qualitative measures are used to assess the capability in associating accounts with processes.
We show the relative importance of the different component activities of Scoping, Planning and Risk Assessment, and find that the most important driver for global quality of Audit is capability in detecting significant accounts.
We find that companies use a range of items among quantitative income statement factors (sales, net income) and balance sheet factors (total asset, net equity) in order to select subsidiaries, account and processes coherently with the materiality principle.We also find that qualitative risk factors are very important in materiality.Qualitative risk factors are the key factors for Identifying Subsidiaries, and they are more important than quantitative risk factors in Identifying Significant Account.Finally, we find that the three factors (Identify subsidiaries, Identify significant account, Associate account with process) often have a direct relation with Scoping, Planning and Risk Assessment Quality.Identifying Significant Accounts is the most important factor considered by internal audit and firms in the assessment of the procedure for account-specific controls.

Background
Materiality in ICFR is related to materiality in external audit.No standardized system of evaluating materiality has yet been developed by regulators; but there is instead widespread reliance on the professional judgment of auditors.Italian auditing standard, in the period considered in this research, are very similar to ISA.ISA320 ''Materiality in Planning and Performing an Audit'' establishes the auditor's responsibility for applying the concept of Materiality in planning and performing an audit of financial statements.ISA 450 ''Evaluation of Misstatements Identified During the Audit'' explains how Materiality is applied in evaluating the effect of identified misstatements on the audit and of uncorrected misstatements, if any, on the financial statements.
In the USA, the Statement of Auditing Standard (SAS) 107 and AS11 deal with audit Materiality.Both ISA 320 and SAS 107 view the assessment of what is material as a matter of professional judgment and contain no quantitative guidelines for handling Materiality.Only two example thresholds are provided in the application of ISA 320.Both standards require that Materiality be defined at both the overall financial statement level (entity) and in relation to particular account balances, classes of transactions and disclosures (account-specific).In general, these two standards recommend that a percentage of a chosen benchmark be used as a starting point for determining the Materiality threshold (quantitative), thereby underscoring the importance of an auditor's professional judgment (qualitative).

Literature Review and Hypothesis
Several audit quality frameworks proposed by the literature (Francis 2004;Francis 2011;Bedard et al. 2010;Knechel et al. 2013;Defond and Zhang 2014) and regulators (Financial Reporting Council 2008;International Auditing and Assurance Standards Board 2011;Public Company Accounting Oversight Board 2013) use an input-process-outcome approach together with external factors to analyze audit quality.Like external audit, ICFR (Bentley-Goode, 2017, Gupta, Parveen et al., 2016, Qi, Baolei et al., 2017) Maturity can also be evaluated using input or process approaches.We focus on the process approach, in which the first steps are the Scoping, Planning and Risk Assessment.
The main objective of this research is to evaluate whether the Scoping, Planning and Risk Assessment activities influence ICFR Maturity.For this purpose we use AS5 issued by PCAOB which describes "Using a Top-Down Approach" (Paragraphs 21-41) with different activities: "Identifying Entity-Level Controls" (Paragraphs 22-27); "Identifying Significant Accounts and Disclosures and Their Relevant Assertions" (Paragraphs 28-33); "Understanding Likely Sources of Misstatement with Performing Walkthroughs" (Paragraphs 34-38); "Selecting Controls to Test" (Paragraphs 39-41).Following AS5 we analyze 3 phases of the audit cycle: 1) Identifying Subsidiaries; 2) Identifying Significant Accounts; 3) Associating Accounts with processes.
1. Identifying Subsidiaries considers the method of identification of Subsidiaries to be included in the scope and thus be subject of the evaluation.Subsidiaries can be identified by way of absolute value or percentage of quantitative indicators or qualitative indicators.
2. Identifying Significant Accounts is the choice of which accounts should be included in scope and thus be subject of the evaluation.Significant Accounts can be identified by way of absolute value or percentage of quantitative indicators or qualitative indicators.
3. Associating Accounts with processes is the activity that identifies relevant processes and associates them with Significant Accounts identified as above.There are three types of association: 'multiple base accounts association'-linking each account to all the process that influence it, 'single base accounts association' -linking each account to only the process that mainly influences it, and 'multiple base process' -linking each process to all the accounts influenced by it.Association can also be made by 'additional correlation' -using additional factors linking accounts with processes.
To assess the effect of the capability of these three controls on ICFR Maturity we observe the determinants of each one and estimate a system of first-order scores measuring each of the three dimensions.
We define as possible determinants for both the capability in identifying significant Subsidiaries and significant accounts quantitative percentages on accounts, based on the Botha and Gloeck (1998) meta-analysis of 27 studies concerning Materiality.Botha and Gloeck (1998) underline that objectives and research methods varied in the studies, but despite those differences, the results generally showed that an even or sliding percentage scale should be applied to the appropriate quantitative bases to calculate a Materiality limit.Budescu et al., (2012) evaluate the manipulation of quantitative materiality with six levels: 0.5 per cent, 1.5 per cent, 2 per cent, 3 per cent, 5 per cent.These six levels include usual materiality thresholds for revenues.Moreover, Bennett et al., (2017) find that auditors lower their materiality assessment of control deficiencies when they are under deadline pressure, but only when the auditor causes the delay that leads to deadline pressure.Finally, Wu and Wang, (2018), analyzing management's materiality criteria of Internal Control Weaknesses in China, find that revenue is more suceptible to manipulation than pretax income, although the latest is most commonly used as the benchmark for materiality assessment.Materiality has also been addressed by several Italian studies (CNDCEC doc 320; Livatino et al. 2000;Livatino et al. 2007;Maione 2004;Pecchiari 2003;Russo 2004;Tartaglia Polcini 1996) which confirm the main results of international studies.
These quantitative percentages can be based on equity, total assets, revenues and earnings before taxation (Blokdijk et al. 2003;Eilifsen and Messier 2014;McKee and Eilifsen 2000;Chewning and Higgs 2002;Leslie 1985).Prior literature on Internal Control Deficiencies (Bedard and Graham 2011;Mazza and Azzali 2015) identify the most severe and persistent Internal Control Deficiencies in revenue.Moreover, SEC (1999) defines specific procedures for auditing revenues.Because revenues are one of the main risks resulting in Internal Control Deficiencies, they are one of the most important factors used in the Identifying Significant Subsidiaries.An alternative view is that the percentage effect of an item on net profit is the primary factor influencing materiality judgment (Bernstein 1967;Boatsoman and Robertson 1974;Dyer 1975;Emery et al. 1981;Firth 1979;Friedberg et al. 1989;Frishkoff 1970;Gupta et al. 1994;Iselin and Iskandar 1999;Krogstad et al. 1981;Messier 1981;Messier et al. 2005;Moriarity and Barron 1976;Pattillo 1976;Roberts and Dwyer 1989;Robinson and Fertuck 1985;Woolsey 1954Woolsey , 1973)).Among income statement values, we expect that:

Hp1a: Revenue percentage is the key factor (i.e. the indicator with the highest weight) in assessing capability in identifying significant Subsidiaries.
Comparing Balance Sheet values and Income Statement values, we expect that:

Hp1b: The income statement is the key factor (i.e. the indicator with the highest weight) in assessing capability in detecting significant accounts.
Following prior literature (Eilifsen and Messier 2014;Messier et al. 2005;Krogstad et al. 1984;Mayper et al. 1989;Botha and Gloeck 1998;DeZoort et al. 2003;Iselin and Iskandar 2000), we then define, as possible determinants, qualitative factors.Iselin and Iskandar (2000) in their evaluation of previous Materiality research discover an important trend: early researchers focused on quantitative factors, whereas later research considers both quantitative and qualitative factors.Messier et al. (2005) draw the same conclusion.They show that empirical research on materiality conducted prior to 1982 did not provide any definite comprehensive implications for audit practice or for policy formulation.There was renewed interest in Materiality in the late 1980s, most likely due to the adoption of the audit risk model that increased the importance of qualitative risk factor in auditing standards and its integration by public accounting firms into their audit methodologies.An example of early research is Krogstad et al. (1984), which shows that auditors use non-financial information in their Materiality decisions.The impact of non-financial information however is lower than the impact of net income on Materiality decisions and there is lack of consensus on which non-financial information should be used.Examples of later research are Mayper et al. (1989), Botha andGloeck (1998) andDeZoort et al. (2003).The findings of Mayper et al. (1989) imply that auditors' evaluation of a material internal control weakness consists of first evaluating the type of weakness and the internal control area affected (qualitative) and then determining the potential dollar exposure (quantitative).Botha and Gloeck (1998) also show that Materiality decision making is influenced by a combination of appropriate quantitative and qualitative factors.DeZoort et al. (2003) show that audit committee members give more support to auditors when justification on auditor Materiality includes both qualitative and quantitative indicators.In addition to quantitative factors, Eilifsen and Messier (2014) note that several qualitative factors lead to an adjustment in the materiality level.Important qualitative factors are the risk of fraud, a history of misstatements found, and the strength of the internal control environment.Among qualitative aspects, we expect that:

Hp1c: The level of association is the key factor (i.e. the indicator with the highest weight) in the Association of Accounts with Process.
There is a lack of consensus between accountants and auditors that leads to identification of different threshold levels of Materiality (Azzopardi and Baldacchino 2009;Chewning and Higgs 2002;Chong 2002;Friedberg et al. 1989;Holstrum and Messier 1982;Iselin and Iskandar 2000;Maione 2004;Martinov and Roebuck 1998;Pany and Wheeler 1989;Pattillo 1976) and this is consistent with the literature on expert judgment (Ashton 1973;Joyce 1976).Iselin and Iskandar (2000), summarizing the literature, find a wide range of thresholds ranging between 2-7% and 20%.Different Materiality levels are assigned by auditors according to culture, experience and audit size and structure (Arnold et al. 2001;Bernardi and Arnold 1994;Carpenter et al. 1994;Carpenter and Dirsmith 1992;Estes and Reames 1988;Icerman and Hillison 1991;Messier 1983;Wright and Wright 1997), for different clients (Blokdijk et al. 2003;Elliott 1983;) and by different stakeholders such as creditors, internal auditors, external auditors, lawyers and courts (Jennings et al. 1987;Jennings et al. 1991;Pattillo and Seibel 1974;Pattillo 1976).Lack of consensus has also been found in internal control Materiality decisions (Mayper 1982(Mayper , 1989)).Pany and Wheeler (1989) show that "among the various rules of thumb for calculating materiality, sizeable differences can occur depending upon the method and the industry".Chewning and Higgs (2002) and Azzopardi and Baldacchino (2009) show that auditors do not treat materiality uniformly, with large discrepancies between thresholds applied in practice.
Lack of consensus may be due in part to the abstract nature of Materiality and to an absence of professional guidance in this area.Today however, standard setters are unwilling to introduce more specific Materiality guidelines, preferring to use the criterion of professional judgment.The absence of professional operational guidance is particularly marked in Italy, where because there is no official guidance on the application of Law No. 262/2005, companies tend to use PCAOB (AS5).
The main aim of ICFR is for documents and reports to be reliable; and for this the internal auditor needs to reduce the risk of a material misstatement.Control of all accounts is generally not a feasible objective, so the internal audit needs to be able to identify the more risky accounts.In the same way, capability in identifying significant accounts (i.e. the risky accounts for the material level) improves efficiency by reducing the whole risk with less time and effort and fewer controls.We thus expect that capability in identifying significant accounts will be positively related to ICFR Maturity.This expectation is consistent with results of Dickins et al. (2011), who show how a better quality of risks assessment helps to increase the awareness of organizational objectives, the development of a sense of employee ownership of internal controls, the early detection of risks, and the effectiveness of the unit's controls.This is also consistent with the results of Bell et al. (1997), who show how the documentation of key objectives and activities of the business process, considering possible business risks, and identification of the types of transaction present in the business process (routine, non-routine, and accounting estimates) are all activities which improve an auditor's identification of process-level business risks.

Hp2a: Capability in identifying significant Subsidiaries/accounts and the association accounts with processes have a positive effect on ICFR Maturity.
Association Accounts with Processes is phase which depends on the capability in Identifying Significant Accounts.An internal auditor is unlikely to check a process which is not linked to a significant account identified in a prior phase.
Identifying Significant Subsidiaries happens before Identifying Significant Accounts in terms of timing.Even though a Subsidiary may not be quantitatively significant, it can still be qualitatively significant because of its impact on an account, and so be identified and included in the scoping.
We thus expect that capability in Identifying Significant Accounts will have the strongest impact on ICFR Maturity.One underlying reason for our expectation is that this phase is the central phase.Moreover, the accounts are the source of financial information, the subject of the controls.
Hp2b: Among the 3 factors analyzed, capability in identifying significant accounts is the most important driver for ICFR Maturity, On the basis of the literature we expect different industries to use different definitions of the materiality threshold, and consequently to obtain statistically significant different performance scores in terms of ICFR Maturity as well as capability in identifying significant Subsidiaries and accounts and identifying significant association.In particular, we expect the financial industry to have a lower mean ICFR Maturity score than other industries.One underlying reason is that financial firms are more complex, and evaluation of internal control over financial reporting in the first years the regulation is applied is more difficult.Therefore, non-financial firms could have higher efficiency and effectiveness in evaluation in the early years simply because the evaluation is easier to implement.

Interviews and Questionnaire
We collected private data on account specific controls through interviews and questionnaires.
Because different industries have different internal control systems, we performed 6 interviews on 2 companies from each industry (banking, insurance and the manufacturing and service industries).Moreover, size (total assets) can influence the evaluation process because larger firms have more resources and more controls.We thus selected one firm from the top and one firm from the bottom quartile of the total assets for each industry.We conducted an exploratory interview with a general open question: "How do you implement Law 262/2005?".This helped us to build structured interviews.Interviews were carried out during the period October -November 2008.Two professors and a PhD student carried out face-to-face interviews of CFO or financial staff.Each interview was recorded, and lasted about 3 hours because after answering the first general question, firms often showed us their system and the details of controls and the procedures of the audit cycle.The information collected was mainly used to draw up a questionnaire and interpret responses to it.We prepared the questionnaire together with external auditors from one of the Big4.We discussed and selected instruments for each construct based on frameworks.External auditors made a key contribution in ensuring language would be comprehensible for the target companies.We used multiple choice and yes/no questions about the procedures implemented for the evaluation process, with none of the questions requiring discretionary judgment.
The questionnaire was next tested on three firms from the target population: a bank, an insurance firm and a manufacturing firm.On the basis of their responses and comments, the questionnaire, the study design and the measurement of some constructs were slightly adapted.
The questionnaire focused on evaluating the year 2008 and was distributed by email in 2009.Responses were received in a narrow time frame of three months.The distribution procedure involved sending a survey package containing the questionnaire and a covering email underlining the importance of the research and encouraging firms to reply.In order to increase the response rate, we contacted by phone companies which were slow to respond.
We opted to make the questionnaire confidential, i.e. although the names of respondent companies are known to us they are not disclosed here, and results are shown only in aggregate form.We were thus able to link the data collected by questionnaires with other sources.Finally, we hand-collected data from the consolidated annual reports 2008 for firms using IFRS, from company web sites and the website of the "Borsa Italiana", the Italian Stock Exchange.
In addition, it was emphasized that the research was under the auspices of a well-known university, widely recognized as trustworthy, so that firms could be confident that sensitive information would not be disclosed.

Sample
For this research, the population is the 253 Italian companies listed on the Milan Stock Exchange that are explicitly charged with monitoring and assuring compliance with Law 262/2005.Our data refers to 2008, the first year of the implementation of Law 262/2005.
In order to find out the email addresses of CFOs, we contacted personal assistants by telephone and the questionnaire was sent to these addresses.We received 39 answers with a response rate of 15.42% of the population.

Model
The model allows us to define a global score for ICFR Maturity assessment (Second order score), and assists in evaluating the effect on the global score of three different dimensions: capability in detecting significant Subsidiaries, capability in detecting significant accounts and capability in associating accounts with process (First order score).The global score measures the influence of these three dimensions on the ICFR Maturity (Figure 1).Each of these dimensions aims to account for the quality of a company for a specific aspect of the ICFR Maturity assessment.All together they affect the global quality of audit for a given company.
Following AS5 (PCAOB), Paragraph 29 (To identify significant accounts and disclosures and their relevant assertions, the auditor should evaluate the qualitative and quantitative risk factors related to the financial statement line items and disclosures) we account for both quantitative and qualitative aspects in assessing company capability in detecting significant Subsidiaries and accounts and in associating accounts with process.
A list of the indicators used to measure each of the three sub-dimensions (or first-order scores) is provided in Table 2.

Capability in Detecting Significant Subsidiaries
In order to measure capability in detecting significant Subsidiaries we used six different indicators: four indicators measuring quantitative aspects (total asset, equity, sales and earnings before taxes); and two indicators measuring qualitative aspects (number of considered risk factors and the characteristics of Subsidiaries considered as significant).
In interviewing CFOs/CEOs we observed that they measure quantitative aspects using the same indicators typically used by the external auditor in the Materiality assessment.During the identification of significant Subsidiaries, in fact, companies tend to include in the scope the sum of Subsidiaries up to a threshold level.The financial statement accounts identified by this approach were classified into four indicators (n) based on Paragraph 29 (PCAOB): size and composition of the account (size); volume of activity, complexity, and homogeneity of the individual transactions processed through the accounts reflected in the disclosure (complexity); exposure to losses in the account (exposure to losses); possibility of significant contingent liabilities arising from the activities reflected in the account or disclosure (possibility of significant contingent liabilities).In order to measure quantitative factors we assigned to each company an ordinal score (1, 2, 3, 4) with decreasing threshold (> 10%, from 5% to 10%, from 2% to 5%, ≤ 2%).
We also observed two qualitative indicators.The first describes the risk factors considered by companies: business risk; type of contract, warranties, commitment; other factors (specified by each company, for example operational risk, reputational and delegation risk, specific activity risk, business unit risk, etc.).This variable has value 0 if the company does not use this measure and 1 (2 or 3) if the company selects one (two or three) risk factors.The second qualitative indicator takes the value of 1 if the scoping is performed for grouped subsidiaries and 0 otherwise.Individual scoping means that subsidiaries are analyzed at single entity level, and aggregate scoping means that subsidiaries are analyzed taking into account the relationship with the holding and other subsidiaries.If some of these relationships are important, even if a subsidiary itself is not quantitatively significant, it can still be included in the scoping and identified as significant.

Capability in Detecting Significant Accounts
Capability in detecting significant accounts is measured by three different indicators: the first two accounting for quantitative aspects (Balance sheet and Income statements) and the last one accounting for qualitative aspects (the number of considered risk factors).
The indicator number of "risk factors for accounts" is bounded between 0 and 4. A company shows a value of zero if it does not account for any risk factors and a value of 1 (2, 3 or 4) if it accounts for one (two, three or four) risk factors.We identify as important risk factors the following: extraordinary items, specific risk assessment in determination of the account, account volatility and company-specific factors such as nature of the account and complexity/volume of transaction.

Quality of the Association of the Accounts with Processes
To conclude, we measure the association of the accounts with processes by using two accounting indicators for qualitative aspects: the level of association and the evaluation of additional correlation between process.
The "level of association" is bounded between 0 and 2. Zero means that the company does not associate accounts with process; a score of 1 means that the accounts are associated only with the main process that modifies them (single base association); a score of 2 means that the accounts are associated with all the processes that modifies them, even if the modification is low (multiple base association).
The second indicator associated with the quality of the audit process is "additional correlation".This indicator measures the impact on the whole information system and is observed as a dichotomous variable.A company shows a value of 1 if additional correlation between processes is evaluated and 0 otherwise.Law 262/2005 requires the assessment of all documents that include financial information, not only the financial statement.The processes can impact not only on the account selected, but also on other accounts or other financial information in other documents.In this way, processes are correlated, in that different processes can impact on the same accounts.Qualitative indicators: • level of association 0 = not identified; 1 = single base association; 2 = multiple base association.

Data Analysis
We applied a PLS Path Modeling approach (Tenenhaus et al., 2005;Esposito Vinzi et al., 2010) to compute the first order scores and the global score as well as to assess the effect of each activity on the global score.PLS Modelling was originally proposed by Herman Wold (1975) as an alternative approach to Structural Equation Modeling (SEM) (Bollen, 1989;Wong & Law, 1999).Recently, Trinchera et al. (2008) proposed using PLS Path Modeling as an alternative approach to compute systems of composite indicators.
A composite indicator is a mathematical combination of single indicators that represents different dimensions of a concept the description of which is the objective of analysis (Nardo et al., 2005).Often the several indicators used in the construction of a composite indicator express different aspects of a complex phenomenon, and can thus be conceptually split into blocks of indicators.Each block can be summarized by a single composite indicator, which is considered causative with respect to a second-order composite indicator.
The theoretical model used for defining both the first-order and second-order composite indicators can be pictured using a Path diagram such as the one in Figure 1.In such diagrams, ellipses represent the latent variables and rectangles represent indicators, also known as manifest variables.The direction of the arrows in the Path diagram defines the direction of the relation, i.e. variables (either latent or manifest) receiving the arrow are to be considered as endogenous variables in the specific relationship.
One of the most important advantages of using PLS Path Modelling for building a system of composite indicators is that it provides two kinds of weights: one measuring the impact of each indicator on the corresponding first-order composite indicator, the other measuring the impact of each first-order composite indicator on the second-order one.These two levels help us to understand the importance of each indicator in building the associated first-order composite indicators, as well as identifying the main drivers in computing the second-order composite indicator.Thus, the second-order composite indicator can be seen as a complex indicator (Trinchera et al. 2008) accounting for all the first-order dimensions.
PLS Path Modelling is an iterative algorithm that makes it possible to estimate a system of weights to apply to each indicator to define first-order latent variables scores (i.e.first-order composite indicators) as well as the so-called path-coefficients measuring the impact of each first-order latent variable score on the second-order latent variable score (i.e. the complex-indicator).The estimation process starts with a random set of weights for each indicator and iterates the estimation until the convergence on the weights is achieved.PLS Path Modelling solutions (i.e. the weights the algorithm provides) maximize a function of the sum of the covariance among connected latent variables.In our model, this means that the estimated weights to be applied to the indicators maximize the sum of covariance between the ICFR Maturity and the quality of three activities defining the first-order dimensions.
For technical details on the estimation algorithm see Esposito Vinzi et al. (2010).

Descriptive Statistics
The variables used for the survey were measured with data collected with questionnaires.Table 3 summarizes the descriptive statistics.
With reference to the identification of significant Subsidiaries, the questionnaire verified the use of both quantitative and qualitative indicators.With reference to the kind of factors used to identify the most important companies, 34 out of the 39 sampled companies (i.e.87.18%) use both quantitative and qualitative factors, while 5 of them (12.82%)use only quantitative, and none use only qualitative factors.
Among the sampled companies, 41.03% use only one accounting measures to identify the most important firms, 38.46% use two accounting measures, 12.82% use three accounting measures and only 7.69% use four accounting measures to identify the firms.Total assets is the most widely used measure (70.97%), while earnings before taxes the least (35.48%).Equity and sales are used respectively by 41.93% and 45.16% of the sampled companies.Most of the companies use a materiality threshold between 2% and 5% (80.64%).
We test the results of previous studies (Botha and Gloeck 1998;Livatino et al. 2000;Livatino et al. 2007;Maione 2004;Pecchiari 2003;Russo 2004;Tartaglia Polcini 1996) on the use of percentage in materiality evaluation.Moreover, results allow us to contribute to the literature by showing that companies use a wide range of materiality thresholds that are different both in magnitude and in terms of accounts selected from the balance sheet and the income statement.Most of the sampled companies use multiple materiality thresholds for equity, total assets and sales.Unlike previous studies (Bernstein 1967;Boatsoman and Robertson 1974;Dyer 1975;Emery et al. 1981;Firth 1979;Friedberg et al. 1989;Frishkoff 1970;Iselin and Iskandar 1999;Messier 1981;Messier et al. 2005;Moriarity and Barron 1976;Pattillo 1976;Robinson and Fertuck 1985;Woolsey 1954Woolsey , 1973)), in our sample data, net profit does not seems to have a key role in the evaluation of materiality.
As for the risk profiles considered in the selection of relevant Subsidiaries, 64.52% of the companies in the sample consider only the risk level of the Subsidiaries activity and 35.48% consider only the risk level of contracts signed by the Subsidiaries, guarantees and commitments.A percentage of 22.58% use other risk factors, such as: type and complexity of operations; the presence of organizational changes; the absence of the auditor; business combinations.
The variable "Scoping" in Table 3 refers to the way the companies select relevant Subsidiaries i.e. without considering the relations with the other subsidiaries (individual selection), or by taking into account these relations (aggregate selection).A percentage of 61.53% of the sample perform individual selection of the relevant Subsidiaries, while 38.47% take into account relationships between subsidiaries.
Most companies in the sample (87.50%) use both quantitative and qualitative factors for identifying relevant accounts, while 12.50% use only quantitative factors.For quantitative factors, most companies select accounts from both the income statement and the balance sheet.In particular 30.77% of companies use a materiality threshold lower than or equal to 2%, while 53.85% of them use a materiality threshold between 2% and 5%, 25.64% use a threshold from 5% to 10% and only 5.13% of companies use a materiality threshold higher than 10%.With respect to qualitative factors, 41.03% of companies claim to select relevant accounts by including the level of risk in the determination of its value.A percentage of 15.39% of companies consider whether the selection of relevant account has been affected by extraordinary factors.Finally, 5.13% of companies consider other factors in selecting relevant subsidiaries, such as: the high number and complexity of transactions reflected in the statement; the complexity of the processes that affect the account; the risk of operating activities; influence on the accounts of business combinations.
Once the significant companies and accounts have been selected, a firm has to identify the processes that influence the accounts and define a set of controls to be applied for each process.46.67% of companies in the sample associate each account with all processes that influence it; 26.67% associate each account with processes that primarily enliven them; and 26.67% associate accounts with processes analytically.
After associating accounts and processes, 36.67% of the sample firms make a further investigation to identify other processes that may affect financial information.

Results
Figure 1 shows the path analysis in a path diagram, and Tables 4, 5, 6 and 7 show the results of our study.
Figure 1  ID_A.Of the two, income statement has a higher impact on ID_A, confirming Hp1b.Confirming previous results, (Botha and Gloeck 1998;Iselin and Iskandar,1999;Iselin and Iskandar,2000;Messier et al. 2005), we also find that the number of risk factors considered has a significant impact on defining the ID_A score.However, unlike what we expected, this impact is negative.The more risk factors are considered, the lower is capability in identifying relevant accounts.This too may reflect problems relating to the initial implementation of the new law.Qualitative risk factors are important because accounting information includes discretionary evaluations, which are permitted by accounting standards.Examples of qualitative risk factors which prove to be significant are extraordinary items, specific risk assessment in determination of the account, account volatility, selection of all the accounting sheets underlying the valuation process, nature of the account, complexity/volume of transactions.We corroborate the finding of Mayper et al. (1989) that auditors first evaluate the type of weakness (qualitative) and next measure the potential effects on financial statement value (quantitative).

Factors affecting the capability in the association of accounts with processes (ASS)
Both those variables show a positive correlation with ASS, and of the two, the level of association shows the highest weight in defining ASS (see Table 4).This is consistent with Hp1c: the level of association is the key factor in defining the ASS score.As shown in Figure 1 and the hypotheses put forward in Section 3, we assume that the analyzed dimensions of ICFR Maturity have a positive impact on ICFR Maturity.Moreover, following HP2b, we expect capability in identifying relevant accounts to be the most important driver for ICFR Maturity.
To assess the importance of each dimension of ICFR Maturity we use the regression coefficients linking the independent latent variable scores to the ICFR Maturity (i.e. the path coefficients) and the contribution of each dimension to explain the ICFR Maturity (i.e. the contribution to the R 2 ).In PLS Path Modelling the R 2 associated with second order latent variable is equal to one by construction.
The results in Table 5 show that all dimensions are significant (p-values <0.001) and show a positive effect on ICFR Maturity.Hp2a is verified.We can thus conclude that each audit cycle phase analyzed positively affects the maturity of ICFR.
Looking at the magnitude of the correlation coefficients (Table 5), it is clear that the identification of accounts (ID_A) is the most closely correlated dimension with the ICFR Maturity, followed by the identification of subsidiaries (ID_S) and the association of accounting with processes (ASS).This is coherent with the magnitude of the path coefficients.Moreover, 43.785% of ICFR Maturity variability is explainined by the identification of accounts.We can thus conclude that Hp2b is verified: capability in identifying significant accounts is the most important driver for ICFR Maturity.We compute the scores for each of three dimensions, as well as the global score for ICFR Maturity for each company in the sample.All the scores are centered and scaled to unit variance.The higher the score on one of the three dimensions, the better the performance of a company on the related aspect.Moreover, the higher the ICFR Maturity score, the higher is the ICFR Maturity of the company.Positive value on a score means that the company has a performance higher than the mean.These scores can be thus used to rank companies according to the different aspects of the Audit process as well as ICFR Maturity.Table 6 shows the scores for industry and their distribution compared to the mean for industry.In particular, we divide these measurements between "Manufacturing and service industry" and "Finance industry".
Most of the companies classified as "Manufacturing and service industry" have a score above the mean value for each activity."Finance industry" companies, on the other hand, only show scores above the mean for the Association accounts with processes.Note.MSI and FI specify respectively "Manufacturing and Service Industry" and "Finance Industry".
To test Hp3 we compare the mean values of the three dimension scores and the ICFR Maturity for "Manufacturing and service industry" and "Finance industry" using a t-test.Figure 2 shows these mean values.Significant results are related to the phase of identifying subsidiaries and the overall evaluation of ICFR Maturity (Table 7).For both these variables, our findings are that the financial industry has a lower ICFR Maturity, which confirms Hp3.The lower ICFR Maturity of financial firms may be due to the complexity of the sector, which makes the early stages of internal control over financial reporting more complicated.

Conclusions
Materiality assessment plays a key role in audit procedures, which ensure the reliability of ICFR.This paper analyzes the effects of materiality assessment on ICFR Maturity and tests: 1) the relevance of qualitative and quantitative factors in evaluating the materiality in specific phases of ICFR; 2) the relative importance of Identifying Subsidiaries, Identifying Significant Accounts, Associating Accounts with Process; 3) different levels of ICFR Maturity between industries.
Literature and auditing standards of materiality mainly agree that both quantitative and qualitative factors must be used, but there is no consensus on the specific factors or measures.To measure materiality in internal controls over financial reporting, we select factors from frameworks that regulate the audit cycle.
Among quantitative factors, we find that Italian listed companies use a non-standard range of items from the income statement (sales, net income) and the balance sheet (total asset, net equity), and assign different percentages to selecting Subsidiaries, accounts and processes according to the materiality principle.Qualitative factors are used by most Italian listed companies to select Subsidiaries and significant accounts, and to associate account with processes, and they are very important in defining materiality.Qualitative risk factors are relevant, especially, for Identifying Subsidiaries, and they are more important than quantitative risk factors in Identify Significant Account.
We find that most of the selected factors (Identify Subsidiaries, Identify significant account, Associate account with process) are important and show a direct relation with ICFR Maturity.Among these factors, identifying significant accounts is the most important factor to be considered in the assessment of the ICFR Maturity.Finally, we find that the financial industry, which is more complex and better regulated, has a lower ICFR Maturity than the manufacturing and services industry.
The paper contributes to improving literature on the use of the materiality principle in the assessment of audit risks and ICFR Maturity.It uses an innovative methodological approach based on a structural equation model, path diagrams and private data collected directly from Italian listed companies.Specifically, the results show that qualitative and quantitative factors drive the implementation of the materiality principle and directly affect the ICFR Maturity.Factors have different effects on the identification of Subsidiaries, Significant account and on the association between account with processes.
Implications of these results may be useful for academics, regulators, auditors and firms.Academics may be interested in testing the findings in other countries to establish whether the materiality principle is mainly used with qualitative or quantitative factors or both.They also may be interested in testing the results for the other phases of the audit cycle (testing, reporting, remediation), as well as the phases reported here.
Regulators may consider whether it is opportune to improve auditing standards related to materiality, perhaps introducing more stringent requirements on quantitative factors (specifying percentages and items to use) and qualitative factors (indicating specific elements the company must evaluate).
Auditors and firms may find the results useful for improving ICFR Maturity.Possible limitations of the research are related to the selection of qualitative and quantitative factors, the selection of phases of the audit cycle, and the sample used.Identifying Subsidiaries, identifying significant accounts, associating account with process are all relevant factors in the audit cycle phase, but many other factors and phases could be significant too.Finally, the sample included a limited number of Italian listed companies and the questionnaire was submitted in only the first year of application of a new regulation on ICFR.

Table 1 .
Sample selection

Table 2 .
The variables of Subsidiaries, Accounts and Processes activities

Table 3 .
Quantitative and qualitative measures: Descriptive statistics

Table 4 .
Indicator weights in computing the latent scores

Table 5 .
Path coefficients and impact on R 2

Table 6 .
Mean score for Industry

Table 7 .
T-test on mean