CIOs need to pay attention to IT asset management as well as reporting, as IT assets are governed by the SOX Act (Sutton and Arnold, 2005). Since CIOs need to grasp the bigger picture
including contract management, asset life cycles, and discretionary spending by IT staff, the more experienced CIO a firm has, the more likely (s)he can better manage IT project priorities to meet the internal control and reporting requirements of that firm, especially when changes in IT systems take time to implement (Armstrong and Sambamurthy, 1999). In other words, longer tenured CIOs better understand the firm's overall operation systems, as well as the weak aspects of the IT process from their prior experience. Thus they can focus more on those aspects to prevent IT problems from happening, or even if problems happen, they can quickly respond to the problems and correct them before they are reported. In essence, the tenure of a CIO may not only help ensure that IT strategy is aligned with the company's overall business strategy, but also efficiently and effectively help avoid IT control weakness. Therefore, our second set of hypotheses is: H2a. Companies with a CIO position are less likely to have IT control material weakness in the ICOFR.H2b. Companies with longer tenured CIOs are less likely to have IT control material weakness in the ICOFR.