The effect of internal auditors’ engagement in risk management consulting on external auditors’ reliance decision
In our paper, published in the European Accounting Review, Marko Čular, Tina Vuko and I investigated whether external auditors rely on the internal auditors if they are involved in consulting services on enterprise risk management (ERM). In recent years, professional bodies have encouraged external auditors to use the work of the internal audit function. To determine whether their work can be used for a statutory audit, external auditors must evaluate the objectivity, competence, and work quality of the internal audit function. Evaluating the internal auditors’ objectivity is particularly challenging when it engages in consulting on risk management. And this practice is quite common: more than half of the respondents (57%) of the Institute of Internal Auditors Common Body of Knowledge (CBOK, 2015) global practitioner survey indicated that they provide advice and consulting services on risk management activities. If providing consulting, internal auditors’ objectivity can be severely impaired if not safeguarded by a strong audit committee. We investigated the importance of audit committee effectiveness in external auditors’ reliance on the internal audit function if it engages in ERM consulting.
We conducted an experiment involving 92 external auditors. We found that external auditors’ reliance on the internal audit function is highest when the latter provides risk management consulting under the supervision of a strong audit committee. It is lower if the internal audit function provides only assurance (under either a weak or strong audit committee) and lowest if it provides consulting under a weak audit committee. The external auditors’ perception of internal auditors’ objectivity depended on the effectiveness of the audit committee. Our findings imply that audit committee’s effectiveness in overseeing the internal auditors’ work is more important to the external auditors than the type of services the internal auditors provide. External auditors seem to consider the internal audit function’s engagement in ERM consulting as a professional desire to make risk management more efficient, which aligns the interests of the two auditors. The external auditors also appear to value a more strategic understanding of processes and risks when internal auditors provide consulting. Moreover, current developments in the internal audit profession suggest that internal auditors who do not provide some form of consulting services and demonstrate value added to an organization may be seen as less advanced and competent (IIA, 2011; IIA, 2018).
Understanding the external auditors’ reliance decisions when the internal audit function engages in ERM consulting is important for several reasons. First, expectations for effective risk management have increased considerably since the financial crisis, and this responsibility has been placed on boards of directors (Viscelli, Beasley, & Hermanson, 2017). As boards perform this work mainly through their audit committees, they often turn to chief audit executives to act as ERM lead actors (Arena, Arnaboldi, & Azzone, 2010; Beasley, Clune, & Hermanson, 2005; Fraser & Henry, 2007). Second, external auditors’ reliance on the internal audit function has several positive effects, which could be jeopardized by the internal auditors’ growing involvement in ERM and perceived objectivity impairment on external auditor side. The cooperation between external auditors and the internal audit function can benefit external auditors by providing a better understanding of internal controls, improved timing, and higher efficiency (Abbott, Parker, & Peters, 2012; Prawitt, Sharp, & Wood, 2011). The internal audit function benefits from more efficient internal and external audit processes, minimized audit duplication, external auditors’ expertise in areas where internal audit needs support (Quick & Henrizi, 2018), and knowledge transfer from similar businesses (Endaya, 2014). The advantages of external and internal auditors’ cooperation ultimately benefit firms through higher-quality statutory audits and reduced audit prices (Felix & Gramling, 2001; Messier, Reynolds, Simon, & Wood, 2011). Thus, our study can help audit committees understand how their characteristics, work intensity, and focus on the internal auditors’ role delineation regarding consulting services contribute to external and internal auditors cooperation.
Read our paper at: https://www.tandfonline.com/doi/full/10.1080/09638180.2020.1723667
References
Abbott, L. J., Parker, S., & Peters, G. F. (2012). Audit fee reductions from internal audit provided assistance: The incremental impact of internal audit characteristics. Contemporary Accounting Research, 29(1), 94-118.
Arena, M., Arnaboldi, M., & Azzone, G. (2010). The organizational dynamics of enterprise risk management. Accounting, Organizations and Society, 35(7), 659-675.
Beasley, M., Clune, R., & Hermanson, D. R. (2005). Enterprise risk management: An empirical analysis of factors associated with the extent of implementation. Journal of Accounting and Public Policy, 24(6), 521-531.
Bame-Aldred, C. W., Brandon, D. M., Messier Jr, W. F., Rittenberg, L. E., & Stefaniak, C. M. (2013). A summary of research on external auditor reliance on the internal audit function. Auditing: A Journal of Practice & Theory, 32 (sp1), 251-286.
The Institute of Internal Auditors Research Foundation (2015). Who owns risk? A look at internal audit’s changing role, Altamonte Springs, Florida: The Institute of Internal Auditors. Retrieved from: https://www.iia.nl/SiteFiles/Publicaties/IIARF%20CBOK%20Who%20Owns%20Risk%20October%202015.pdf.
Endaya, K. A. (2014). Coordination and cooperation between internal and external auditors. Research Journal of Finance and Accounting, 5(9), 76-80.
Felix Jr, W. L., & Gramling, A. A. (2001). The contribution of internal audit as a determinant of external audit fees and factors influencing this contribution. Journal of Accounting Research, 39(3), 513-534.
Fraser, I., & Henry, W. (2007). Embedding risk management: Structures and approaches. Managerial Auditing Journal, 22(4), 392-409.
Institute of Internal Auditors (2011). A call to action: Stakeholders’ perspectives on internal auditing. Retrieved from: https://na.theiia.org/iiarf/Public%20Documents/A-Call-to-Action-Stakeholders Perspectives-on-Internal-Auditing.pdf
Institute of Internal Auditors (2018). Why conformance matters (position paper). Retrieved from: https://global.theiia.org/about/about-internal-auditing/Public%20Documents/Why-Conformance-Matters. pdf
Messier Jr., W. F., Reynolds, J. K., Simon, C. A., & Wood, D. A. (2011). The effect of using the internal audit function as a management training ground on the external auditor's reliance decision. The Accounting Review, 86(6), 2131-2154.
Prawitt, D. F., Sharp, N. Y., & Wood, D. A. (2011). Reconciling archival and experimental research: Does internal audit contribution affect the external audit fee? Behavioral Research in Accounting, 23(2), 187-206.
Quick, R., & Henrizi, P. (2018). Experimental evidence on external auditor reliance on the internal audit. Review of Managerial Science, 1-34.
Viscelli, T. R., Beasley, M. S., & Hermanson, D. R. (2016). Research insights about risk governance: Implications from a review of ERM research. SAGE Open, 6(4).
Sergeja Slapničar, the University of Queensland, Australia
