Effects of reporting relationship and type of internal control deficiency on internal auditors’ internal control evaluations

Abstract

PurposeThis paper aims to explore whether an internal auditor’s evaluation of internal control deficiencies are influenced by the party with primary influence over the internal audit function and by the type of internal control deficiency.Design/methodology/approachA behavioral experiment is conducted with internal auditors as participants in a 2 × 2 between-subjects factorial design.FindingsResults indicate that internal auditors are less likely to evaluate a pervasive control deficiency related to “tone at the top” as a material weakness than a process-specific control deficiency. Furthermore, internal auditors are somewhat less likely to evaluate a process-specific internal control deficiency as a material weakness when management has primary influence over the internal audit function than when the audit committee has primary influence. It is also found that the best practice of internal audit oversight (i.e., primary oversight of internal auditors by the audit committee) may lead to potential internal under-reporting of instances where the audit committee represents a material weakness in internal control.Research limitations/implicationsLimitations of this research include lack of economic consequences (e.g. future pay and job loss) associated with the internal control decisions made by the participants; less concise information provided to the participants than would generally be available to them; and lack of generalizability of the findings beyond the specific company setting and internal control scenario portrayed in the case materials.Practical implicationsNot evaluating a pervasive control deficiency related to “tone at the top” as a material weakness seems to not fully align with relevant professional guidance and can possibly result in inaccurate internal information about the quality of internal controls. Furthermore, having an internal auditor’s evaluation of a process-specific internal control deficiency influenced by the party with primary influence over the internal audit function would not appear to align with relevant professional guidance. Finally, primary oversight by the audit committee of the internal auditors may lead to potential internal under-reporting of instances where the audit committee represents a material weakness in internal controls and, thus, possible communication of inaccurate internal control information.Originality/valueThis study is the first to address whether the party with primary influence over the internal audit function influences an internal auditor’s evaluation of internal control deficiencies.