Research on the Influence of Mandatory Internal Control Auditing on Corporate Risk-taking Capacity

The mandatory internal control (ICFR) audit system, which has been implemented since 2012, is an important institutional innovation in the capital market and has a close relationship with the internal management of enterprises, while its relationship with corporate Risk-taking ability has received less attention from scholars. This paper uses the data of listed companies in Shanghai and Shenzhen from 2009 to 2019, and utilizes the Notice on the Implementation of Enterprise Internal Control Regulation System in 2012 for Main Board Listed Companies in Categories and Batches issued in 2012 as a quasi-natural experiment to test the impact of mandatory ICFR auditing on enterprise Risk-taking ability through multiple time point Differences-in-Differences method. It is found that mandatory ICFR audits significantly improve firms' Risk-taking ability, and this positive effect is more pronounced for non-state-owned enterprises with higher information transparency and a higher degree of separation of powers. The paper further investigates the mechanism of financing constraints in which the results show that mandatory ICFR auditing enhances firms' Risk-taking ability by reducing the degree to which firms are subject to financing constraints.


Introduction
Internal control (ICFR) auditing is an important component of business management that can affect all aspects of business performance, information quality, and agency costs. For a firm's operating performance, maintaining effective internal control is likely to result in less volatile and more stable economic returns for the firm (Feng & Li et al., 2015;Zhang, 2007). In terms of information quality, ICFR auditing can have a significant effect on the control of financial statement quality, which affects investors' investment decisions in the firm (Caramanis & Lennox, 2008;Krishnan, 2003;Cheng et al., 2013). As well, for modern firms with agency cost problems due to the separation of powers, the effectiveness of ICFR auditing affects the level of losses arising from agency problems Zhang, 2007;Engel et al., 2006). ICFR auditing is one of the most important tools to assess the effectiveness of internal control, but it has been controversial, especially as to whether ICFR auditing should be mandatory for enterprises. The focus of debate is also on how mandatory ICFR auditing affects a company's risk-bearing capacity.
On the one hand, mandatory ICFR auditing may attract more analysts' attention for the firm (Caramanisa & Lennox, 2008), prompting the firm to be more active in internal control management, which leads to higher quality of its internal control (Altamuroa & Beatty, 2010), thus effectively suppressing certain occurrence of unexpected events which brings adverse effects to the enterprise (Fang, Hongxing et al., 2015), which makes the level of idiosyncratic risk of the enterprise lower and plays a role in improving the ability of the enterprise to bear risks.
On the other hand, mandatory ICFR auditing may increase the costs and burdens of firms in terms of operation and management (Zhang, 2007), making shareholders' investment decisions more prudent and having a negative impact on firm performance (Hu et al., 2009), and firms' operating performance fluctuates too much, which will then fall into a vicious circle (Ashbaugh-Skaife et al., 2008), thus acting as a disincentive to corporate Risk-taking ability.
Based on the above analysis, this paper addresses the following two questions: first, does mandatory ICFR auditing help improve firms' Risk-taking ability? Second, through what mechanism does the impact of mandatory ICFR auditing on firms' Risk-taking ability pass through? The main contributions of this paper are: first, the existing literature has focused more on whether mandatory ICFR auditing can effectively improve the quality of accounting information and its impact on the audit cost of enterprises, but little attention has been paid to the relationship between mandatory ICFR auditing and enterprise Risk-taking, and this paper fills the gap in this regard; second, this paper takes the Second, this paper uses the exogenous event of the mandatory ICFR auditing policy released in 2012 as a quasi-natural experiment and adopts the multi-temporal double difference method to conduct an empirical test, which can avoid the problem of endogeneity to a certain extent; Third, the intermediary mechanism established in this paper is also relatively novel in terms of financing constraints, which can better describe the resistance suffered by firms in the process of financing process and thus may affect their ability to take risks.
The rest of the paper is broadly as follows: the second part reviews the literature related to mandatory ICFR auditing and corporate Risk-taking; the third part explores the mechanisms by which mandatory ICFR auditing affects corporate Risk-taking; the fourth part gives the data sources and empirical methods of this paper; the fifth part shows the empirical test and sixth part gives the final conclusions and insights.

Literature Review
The existing domestic and international studies on mandatory ICFR auditing are relatively abundant, but they have not yet reached a conclusion. Section 404 of the Sarbanes-Oxley Act (SOX) issued in 2002 in the United States mandates internal control auditing and management evaluation of financial reporting for U.S. listed companies, which has pioneered the precedent of mandatory ICFR auditing and stimulated the research interest of foreign scholars.
Some foreign scholars have a positive view of the effect of this policy. Hoitash et al. (2009), from the perspective of audit effectiveness, found that the effectiveness of the audit committee's work is significantly related to the quality of internal control only when the ICFR audit provisions are stricter; Feng & Li et al. (2009), from the perspective of the forecast accuracy of financial information argued that stricter internal controls not only have a positive impact on the earnings of financial reports, but may also affect the internal reports used by management to form forecasts (e.g., earnings expectations); after this, Feng & Li et al. (2015), in terms of firm operating performance, found that maintaining effective ICFR audits led to higher inventory turnover and less inventory impairment, and as a result, firms were perceived to operate more efficient. However, another part of foreign scholars believe that the effect of the policy is not clear and even brings negative effect for enterprises. Zhang (2007) analyzed the policy from the perspective of enterprise cost and found that SOX404 mandating enterprises to perform internal control testing will impose net private cost on the company, meanwhile, enterprises who delay the implementation of ICFR audit as much as possible within the scope allowed by the provision will be very beneficial to firms would be very beneficial, especially for SMEs; Engel et al. (2006), Ashbaugh-Skaife et al. (2008) conducted a study from the perspective of cost-benefit ratio and raised the question of whether the costs incurred to make ICFR audits compliant exceeded the benefits, and ultimately found that firms audited by ICFR compared to unaudited firms The costs paid are not proportional to the benefits received and the quality of internal control even deteriorates gradually, a view further supported by Schroeder & Shepardson (2016).
Therefore, after China released the "Chinese version of SOX404" policy in 2012, domestic scholars have also conducted intense discussions and studies about it. In terms of accounting information quality, Lei et al. (2013) found that internal control auditing can significantly improve the quality of a company's accounting surplus, and Zhang and Ma (2020) also corroborated this view by more strictly delineating mandatory, voluntary ICFR auditing; Wang (2020) focused on corporate R&D and innovation, and further found that mandatory ICFR auditing not only stimulates enterprises' desire to innovate, but also helps promote the country's macroeconomic development. However, at the same time, there are still scholars who take the opposite view of the effect of this policy; Fang and Duan (2012), in terms of the role of audit opinions, discovered that mandatory ICFR auditing led to almost no difference in the market response to the qualified and unavailable opinions issued, which did not give full play to the proper role of auditing; Wang and Wang (2017), on the other hand, looked at the audit cost perspective, concluding that a more stringent ICFR audit system would increase the burden of audit costs on firms.
After combing through the relevant literature, it is found that the impact of mandatory ICFR auditing policy on firms is mainly focused on the areas of accounting surplus quality, audit costs and operating performance, while there are fewer studies on whether it has an impact on firms' Risktaking ability. Only Cheng et al. (2013) focused on the impact of effective ICFR on firms' investment efficiency, and Fang and Chen (2015) explored the question of whether high-quality ICFR can effectively respond to firms' idiosyncratic risks on this basis.
However, most of the above-mentioned studies are discussed at the level of ICFR research, and there is still a certain distance from ICFR auditing, especially mandatory ICFR auditing, and there is no direct correlation with corporate Risk-taking ability. Therefore, this paper focuses on establishing a direct link between the two and conducts an empirical study on mandatory ICFR auditing and the Risk-taking ability of enterprises.

Theoretical Analysis
There are many complex transmission mechanisms and causes between ICFR auditing and firms' Risk-taking ability, and this paper focuses on the mediating effect of financing constraints.
First, ICFR auditing may alleviate the degree of financing constraints on firms. The establishment of a sound ICFR auditing system and information disclosure system will effectively alleviate the problem of information asymmetry and mitigate the agency problem brought about by the separation of powers (Ashbaugh-Skaife et al., 2008; Engel et al., 2006), and the essential cause of the financing constraint is precisely the problem of information asymmetry and principal-agent (Gu and Xie , 2018), and thus mandatory ICFR auditing affects the degree of corporate financing constraints.
Second, firms with lower financing constraints are likely to have higher Risk-taking capacity. Firms with fewer financing constraints will have lower financing costs and therefore higher investment efficiency (Almeida & Campello, 2013), and the increased efficiency will lead to fewer firm-specific factors, unexpected situations, and therefore the easier it will be to do a better job of identifying, assessing, and responding to internal control deficiencies, thus reducing the negative impact caused by firm-specific factors ( Cheng et al., 2013;Fang and Chen, 2015), which in turn reduces the level of firm-specific risks and therefore increases the firm's ability to take risks.
Through the above theoretical analysis, this paper proposes the following two hypotheses. H1: Other things being equal, mandatory ICFR auditing is positively related to a firm's ability to take risks; H2: Other things being equal, mandatory ICFR auditing promotes a firm's ability to take risks by suppressing the extent to which the firm is subject to financing constraints.

Sample and Data
In this paper, the A-share listed companies in Shanghai and Shenzhen stock exchanges from 2009 to 2019 are used as the initial sample, and the data are obtained from the CSMAR database. According to the existing literature, the sample of financial and insurance companies, the sample of ST, * ST and PT companies, and the sample of companies with missing data are excluded, and finally 21,405 observations are obtained over 11 years. In addition, in order to mitigate the impact of outliers on the empirical results, all continuous variables in this paper are subject to a 1% winsorize.

Model Setting and Variable Setting
This paper adopts the Difference-to-Difference method to test the impact of the Notice on the Implementation of Enterprise Internal Control Standard System for Main Board Listed Companies in 2012 by Batch on enterprise Risk-taking ability for the following reasons: The application of this method requires two basic conditions: first, the occurrence of external events; second, the experimental group affected by the events and the control group not affected by the events can be distinguished. For the first requirement, the policy is jointly formulated by the Ministry of Finance and the Securities and Futures Commission, which is an exogenous event for listed companies; for the second requirement, the companies enforced under this policy are bound to be affected by the event and can be regarded as the experimental group, while the rest of the companies are naturally regarded as the control group. Therefore, in this paper, the DID model is set as follows , , , Where Risk denotes the Risk-taking ability of the firm, the volatility of the firm's total net asset margin (ROA) over the past three years is used as a measure of the firm's Risk-taking ability by referring to the method of John et al. (2008) and Faccio et al. (2011). First, the individual ROA is adjusted by subtracting the average ROA of the same industry in the same year in order to eliminate the effects of the economic cycle and the industry in which it is located, and second, the adjusted ROA is then used for the calculation of earnings volatility. Each symbol is defined as follows, EBIT is the enterprise's earnings before interest and tax, Asset is the enterprise's total assets at the end of the period, Risk is the enterprise's Risk-taking capacity, T is the observation time period, and this paper chooses three years as the observation time in the vicinity; i is the i-th listed company, j is the j-th industry classification, and t is the t-th year. Then the specific formula is.
Meanwhile, due to the nature of batch implementation of the mandatory ICFR auditing policy released in 2012, this paper further adopts a DID model with multi-period quasi-natural scenario design. For the multiperiod DID model, referring to Purnan&am & Weagley (2016), the Post of listed companies in the experimental group affected by the policy and subsequent years are assigned to 1, and the rest are all assigned to 0. Specifically, in the quasi-natural experiment of this paper, listed state-owned holding companies take the lead in implementing ICFR auditing since 2012, some nonstate-owned main board listed companies that meet specific requirements join them since 2013, and the remaining main board listed companies are included in the scope of implementation since 2014, and listed companies that are not in the above scope are then classified into the control group. The coefficient of the interaction term Post×Treat then naturally reflects the impact of the policy (i.e., mandatory ICFR auditing) on firms' Risk-taking ability, and if the research hypothesis of this paper holds, the expected coefficient β_3 should be significantly positive.
To control for the effects of other factors, referring to previous literature Engel et al., 2007;Caramanisa & Lennox, 2008;Hu, 2010), this paper chooses to include the following control variables (X_(i,t)) in the model : firm size, financial leverage, firm growth, current ratio sustainable growth rate, and fixed asset size. In addition, we control for industry and year effects. Table 1 below shows the definitions of the variables. Variable Definition Corporate Risk-taking capacity, volatility of industry-adjusted ROA over the last three years Firm size, firm's total assets at the end of the period, taking the natural logarithm Financial leverage, total liabilities at the end of the period/total assets at the end of the period Company growth, the growth rate of the company's operating income Current ratio, ending current assets/ending current liabilities Sustainable growth rate, return on net assets * retention rate / (1 -return on net assets x retention rate) Fixed asset size, total fixed assets at the end of the period / total assets at the end of the period Year dummy variable, controlling for year Industry dummy variable, controlling for industry

Descriptive Statistics and Correlation Test
Panel A in Table 2 below presents the results of descriptive statistics such as sample size, mean, standard deviation, minimum, and maximum values of corporate Risk-taking capacity and control variables. The results show that the total sample size is 21,406 and the mean value of Treat variable is 0.873, indicating that the majority of firms are influenced by policies. In addition, this paper also tested the correlations of the variables involved in the regression model, and the results are shown in Panel B of Table 2, where the DID variable denotes the interaction term Post×Treat, and the correlation coefficients between the variables are all at a low level, which means that there is no obvious problem of multicollinearity between the variables.

Policy Effect Test
The basic premise of the empirical study using the multi-temporal DID model is that before being affected by the policy, the experimental group and the control group have essentially the same trend of change, i.e., the experimental group and the control group must satisfy the parallel trend assumption. Figure 1 below shows that prior to the implementation of the policy, the confidence intervals for both the experimental and control groups contain zero or are in their vicinity, i.e., there is no significant systematic difference in the trend of change in Risk-taking capacity over time between the two groups. However, after the policy was implemented, the Risk-taking capacity of the experimental group was significantly higher than that of the control group, so this paper can use a multi-temporal DID model to test the effect of the policy on the Risk-taking capacity of firms.

Regression Results
First, this paper conducts an empirical test of multi-temporal DID on the full sample, on the basis of which the companies are also classified heterogeneously into state-owned enterprises and nonstate-owned enterprises according to the nature of ownership, into enterprises with high information transparency and enterprises with low information transparency according to the auditor's concern, and into enterprises with high separation of two powers and enterprises with enterprises with lower separation of powers. The regression results for the full sample and classification are shown in Table  3 below.
In the regression results of the full sample, the regression results of the main variable Post×Treat are significantly positive and significant at the 1% level, indicating that the level of Risk-taking has increased after the enterprises have been mandated to perform internal control audits, and hypothesis 1 is verified.
In the regression results of heterogeneity, it is found that the policy has a more significant impact on non-state enterprises, enterprises with higher information transparency and enterprises with higher degree of separation of powers, which further extends the findings of hypothesis 1 and provides some reference for later studies.
The results of regression analysis for all samples are presented in column A. The results of regression analysis for state-owned and non-state-owned enterprises are presented in column B according to the nature of property rights; the results of regression analysis for enterprises with higher and lower information transparency are presented in column C according to the degree of information transparency; the results of regression analysis for enterprises with higher and lower separation of powers are presented in column D according to the degree of separation of powers.   Note: *, **, *** denote significant at the 10%, 5% and 1% levels, respectively; figures in parentheses are t-values of two-tailed tests; standard errors are adjusted for firm-level Cluster clustering.  Note: *, **, *** denote significant at the 10%, 5% and 1% levels, respectively, and the numbers in parentheses are t-values of two-tailed tests with standard errors adjusted for firm-level clustering. To test the mediating effect of financing constraints between mandatory ICFR auditing and firms' Risk-taking ability, considering that the calculation of KZ index and WW index is prone to endogeneity problems (Hadlock & Pierce, 2013), this paper introduces SA index to measure the degree of financing constraints faced by firms, which only involves Size and Firm Age two exogenous variables, which are calculated as follows.

Mechanistic Test
0.043 0.037 0.04 The regression test of financing constraint as the dependent variable and the interaction term Post×Treat is conducted, and the results are shown in Table 4 below. It is found that the coefficient of the interaction term Post×Treat is significantly negative, which indicates that financing constraint is negatively related to the Risk-taking ability of enterprises, i.e., mandatory ICFR auditing enhances enterprises' Risk-taking ability by reducing the degree of financing constraint to which they are subjected. The hypothesis 2 of this paper is verified.  Note: The fictitious interaction term Post×Treat is abbreviated as DID_false, and the original correct interaction term Post×Treat is abbreviated as DID. column (1) presents the results of the placebo test, column (2) presents the results of the test with a replacement of ROA rolling period, and column (3) presents the results of the test with a replacement of the dependent variable description. *, **, and *** indicate significant at the 10%, 5%, and 1% levels, respectively, and the numbers in parentheses are t-values for two-tailed tests with standard errors adjusted for firm-level Cluster clustering.

Placebo test
The double difference determines the causal relationship between variables through some external policy influence, but it cannot be ignored that the DID test results may be caused by some chance factors and do not reflect the true causal relationship. In other words, the conclusions of this paper may still hold even without the policy influence introduced in 2012. Therefore, drawing on Wang and Kong (2016), this paper introduces a spurious policy introduction time, 2010, to observe whether the effect of the mandatory ICFR auditing reform still exists. The test results are shown in column (1) of Table 5 below, and the fictitious interaction term Post×Treat is recorded as DID_false when the policy year is set to 2010, at which time the regression test of the full sample is conducted again, and the coefficient of the fictitious interaction term is no longer significant, which should confirm that the conclusions of this paper are not due to the results driven by chance factors, making the conclusions of this paper more robust.
2. Replacing rolling period In the previous regression analysis, the measure of corporate Risk-taking ability is the moving average result of the adjusted ROA with a three-year period, the reason being that the maximum consecutive terms of the board of directors in China shall not exceed three terms, however, to ensure more reliable results of the empirical evidence and to avoid problems such as the three-year rolling period may happen to be staggered with the actual change of rhythm of each company, this paper reestablishes the industry-adjusted ROA with a four-year The new dependent variable Risk_4 is calculated and then regressed with the original interaction term Post×Treat, and the results are shown in column (2) of Table 5 below. The results show that the coefficient of the interaction term is still significant at the 5% level, and the findings of this paper are still robust and reliable.
3. Replacing dependent variable Since the measurement of corporate Risk-taking ability is complex and different scholars have adopted different approaches, in order to make the measurement chosen in this paper not to have a large chance, we borrow the approach of John et al. (2008) and replace the indicator of corporate Risk-taking ability with the moving average of the extreme difference of ROA for three consecutive years to calculate the new dependent variable Risk_ new, and then regress it with the interaction term, and the results are shown in column (3) of Table 5 below. The results show that the coefficient of the interaction term is still significant at the 1% level, and the findings of this paper are again verified.

Conclusions and Insights
In this paper, we use the Notice on the Implementation of Enterprise Internal Control Regulation System for Main Board Listed Companies in 2012 by Classification and Batch as a quasi-natural experiment, and take A-share listed companies in Shanghai and Shenzhen from 2009 to 2019 as the research sample, and use the multi-temporal double difference method to test whether mandatory ICFR auditing has an enhancement effect. The final study confirms that the Risk-taking ability of firms affected by the policy significantly increases relative to firms not covered by the policy, the mechanism of which is mainly that mandatory ICFR auditing enhances firms' Risk-taking ability by reducing the degree to which they are subject to financing constraints. The results also pass the robustness test, and the findings are more reliable and have some reference value for future research.
In the context that the implementation of ICFR auditing in China is later than that in foreign capital markets, it is necessary to study whether the policy can bring tangible benefits, and this paper makes some contributions in making enterprises more willing to accept ICFR auditing and improving the market attractiveness of ICFR auditing. However, it should be noted that after the classification of enterprises by characteristics, the market response of enterprises with low information transparency and low degree of separation of powers to this policy is obviously insufficient. On the other hand, enterprises with low separation of powers should also respond to the national call more consciously and actively fulfill their ICFR auditing obligations, which will also greatly benefit their own riskbearing capacity. At the same time, this paper is also helpful to the policy implementation department and the regulatory department, which can help them understand the role of mandatory ICFR auditing in the capital market more objectively and comprehensively, and it is also meaningful to enhance the macroscopic risk prevention and control in the capital market after each enterprise's own risk-bearing capacity is improved.