Cloud-Computing Risk Disclosure and ICFR Material Weakness: The Moderating Role of Accounting Reporting Complexity

ABSTRACT Regulators have expressed concerns over management's ability to maintain effective ICFR when adopting cloud-computing services (PCAOB 2015), as well as the auditor's ability to cope with such changes (PCAOB 2015, 2017). Further, the complexity of the client's accounting concepts, proxied by their XBRL taxonomy, could adversely impact financial reporting quality. We investigate the association between a firm's disclosure of cloud-computing risks and its likelihood of disclosing a material weakness, moderated by its level of accounting reporting complexity. We find that, for firms that identify cloud-computing as a significant risk, the external auditor is less likely to issue a material weakness when the firm uses a greater number of customized XBRL tags. We also find that the external auditor is more likely to issue a material weakness for firms that do not identify cloud-computing as a significant risk to their operations when they use a greater number of customized XBRL tags. Data Availability: Data are publicly available from sources identified in the paper.