Traditionally, the key parties involved in maintaining effective corporate governance have included company management, the board of directors (including the audit committee), and the external auditors. In the post–Sarbanes-Oxley Act of 2002 (SOX) world, internal auditors have increasingly assumed a larger role in corporate governance. For example, Deloitte notes that “if not for the internal audit profession, the business landscape would likely be littered with significantly more disclosures of material weaknesses and revelations of noncompliance with the [Sarbanes-Oxley] Act” (“Optimizing the Role of Internal Audit in the Sarbanes-Oxley Era,” Second Edition, Deloitte Development LLC, 2006, http://bit.ly/2TliPy8).
Investors have mandated disclosures that help them in assessing the quality of the traditional corporate governance parties. Examples of these required disclosures include management’s discussion and analysis (MD&A), audit committee reports, and external audit opinions. Investors, however, typically are only able to obtain information related to a company’s internal audit through voluntary corporate disclosures.
Academic research has begun to investigate voluntary disclosures related to internal audit. A survey of this research provides valuable information related to assessing the need for and benefits of increased internal audit transparency, and this research has potentially important implications for management and audit committees.
The Need for Internal Audit Reporting
In “The Need for an Internal Auditor Report to External Stakeholders to Improve Governance Transparency,” Deborah S. Archambeault, F. Todd DeZoort, and Travis P. Holt provide the first study investigating the need for increased internal audit transparency (Accounting Horizons, December 2008, pp. 375–388, http://bit.ly/2CN7wb4). To do this, they reviewed the current internal audit research literature and conducted semistructured interviews with three financial analysts, four active audit committee members, five internal auditors (including three chief audit executives), and six policymakers [two each from the AICPA, the Institute of Internal Auditors (IIA), and the SEC] about the potential costs and benefits associated with increased internal auditor reporting.
Archambeault, DeZoort, and Holt reported that anticipated benefits of internal audit disclosures include increased investor understanding of the function of internal audit and its governance role. They also noted that the increased internal auditor accountability that comes with greater transparency has the potential to increase internal auditor diligence. In addition, they suggested that greater transparency may lead to companies increasing their investment in internal audit.
Archambeault, DeZoort, and Holt also detailed three possible cost considerations related to increased internal audit reporting. First, they noted the potential for increased legal exposure as a result of increased disclosure. Next, they noted concerns related to increased information load for investors, as some may not understand how to use the information. Finally, they noted that additional reporting costs might be a concern. The cost concerns were not, however, considered to be problematic by those interviewed.
After discussing the costs and benefits of increased internal auditor reporting, Archambeault, DeZoort, and Holt proposed a model for an internal audit report. The model report consisted of five sections providing information related to the composition, responsibilities, reporting structure, activities, and resource allocations related to internal audit. They also discussed the ramifications of providing a purely descriptive report versus an opinion-based report.
Financial Reporting Credibility Effects
In “The Effects of Internal Audit Report Disclosure on Investor Confidence and Investment Decisions,” Holt and DeZoort investigated whether increased internal auditor transparency affected investor confidence in the reliability of financial reporting and investing-recommendation decisions (International Journal of Auditing, April 2009, pp. 61–77, http://bit.ly/2B8LEa9). Their sample consisted of 111 graduate business students serving as proxies for nonprofessional investors. Each participant read a case that included commonly provided financial disclosures. The researchers then manipulated the presence or absence of a descriptive internal audit report that detailed the composition, responsibilities, and activities of internal audit similar to the model report suggested by Archambeault, DeZoort, and Holt. They also manipulated whether the company had high or low fraud risk factors.
Holt and DeZoort found that the internal audit reports increased investor perceptions of the credibility of financial reporting and the effectiveness of company oversight. These findings were particularly pronounced in companies with high fraud risk. They also found that the effects of increased credibility and oversight effectiveness led to investors being more likely to recommend investing in the companies disclosing the internal audit reports. Finally, the investors found the internal audit report to be just as useful in their decision making as audit committee reports, MD&A, and management reports on internal controls.
Holt and DeZoort found that the internal audit reports increased investor perceptions of the credibility of financial reporting and the effectiveness of company oversight.
The Effects of Internal Audit Reporting Structure and Role
In “The Effects of Internal Audit Role and Reporting Relationships on Investor Perceptions of Disclosure Credibility,” Holt examined whether information about the reporting structure and the primary activities of internal audit affected investor perceptions of disclosure credibility (Managerial Auditing Journal, October 2012, pp. 878–898, http://bit.ly/2G7lyaS). His sample consisted of 84 MBA students serving as proxies for nonprofessional investors. Each participant read a case that included summary financial information and an internal audit report from a fictionalized company. Holt then manipulated whether the company’s chief audit executive reported functionally to the audit committee and administratively to the CEO, versus reporting both functionally and administratively to the CFO. He also manipulated whether internal audit performed primarily consulting activities designed to add value to the company or performed primarily compliance and financial audits.
Holt found that investors perceived company financial disclosures to be more credible when internal audit was structured so that the chief audit executive reported to both the audit committee and the CEO, as opposed to simply reporting to the CFO. He also found that the effects of increased credibility associated with internal audit reporting were not affected by whether internal audit performed consulting work versus audit work.
Disclosure Effects on Internal Auditor Judgments
In “The Effects of Internal Audit Report Type and Reporting Relationship on Internal Auditors’ Risk Judgments,” Douglas M. Boyle, F. Todd DeZoort, and Dana R. Hermanson investigated the effects of increased internal auditor reporting on internal auditor judgments as opposed to investor decision-making (Accounting Horizons, September 2015, pp. 695–718, http://bit.ly/2MDpTno). Their sample included 108 experienced internal auditors recruited from the IIA. Each participant read a case for a fictionalized company that included background company information and an internal audit report. The researchers manipulated two pieces of information in the internal audit report. First, half of the participants received a descriptive internal audit report similar to the model report provided by Archambeault, DeZoort, and Holt, while the other half received an internal audit report that also included a clean audit opinion from internal audit on the effectiveness of internal controls over the revenue cycle. Second, half of the internal audit reports noted that the internal auditors reported primarily to the CFO, while the other half noted that they reported primarily to the audit committee chair.
Boyle, DeZoort, and Hermanson found that internal auditors made more conservative fraud risk judgments when the disclosures contained an audit opinion versus the purely descriptive disclosures. In addition, disclosures that detailed a reporting relationship primarily to the audit committee chair also resulted in more conservative fraud risk judgments. Disclosures with both an audit opinion and a reporting relationship to the audit committee chair resulted in higher control risk assessments from internal auditors. Purely descriptive internal audit reports did not, however, affect internal auditors’ fraud or control risk assessments.
Control Assurance Provided by Internal Auditor
In “An Examination of Nonprofessional Investor Perceptions of Internal and External Auditor Assurance,” Holt examined whether opinions on the remediation of material weaknesses in internal controls provided by an internal auditor affect investor judgment and decision making (Behavioral Research in Accounting, forthcoming, 2018, http://bit.ly/2sU5u4b). The study’s sample consisted of 236 non-professional investors. The experimental case described previously disclosed material weaknesses in internal controls that had been remediated during the previous quarter. Half of the cases included account-specific material weaknesses, while the remaining half included pervasive material weaknesses over the company’s entire system. In addition, the cases contained one of three manipulations in the audit opinion related to the remediation of the internal control material weaknesses (i.e., no audit opinion, internal auditor provided opinion, external auditor opinion). Holt noted that examining audit opinions on the quarterly remediation of internal control material weaknesses is useful because PCAOB Auditing Standard 4, Reporting on Whether a Previously Reported Material Weakness Continues to Exist, allows for, but does not require, auditor-provided assurance surrounding the remediation.
Holt found that nonprofessional investors found material weakness remediation disclosures to be more credible when they included an audit opinion over the remediation, regardless of whether it was provided by external or internal auditors. While he noted that investor perceptions of disclosure credibility were higher for externally provided audit opinions than for internally provided opinions, these credibility differences did not translate into differences in investment likelihood decisions between disclosures with external assurance versus internal assurance. Finally, he found that investor perceptions of credibility and investing likelihood surrounding audited disclosures were lowest in situations involving pervasive material weakness remediations that were assured by internal audit.
The research suggests that disclosing the results of internal audit’s compliance and audit results may be viewed favorably by external stakeholders.
Implications
Overall, a review of the accounting research suggests that increased transparency of effective internal audit functions has the potential to increase investor perceptions of financial reporting credibility. The research also suggests that disclosing the results of internal audit’s compliance and audit results may be viewed favorably by external stakeholders. Finally, there is some evidence that the accountability effects of increased internal audit transparency may lead to more conservative judgments from internal auditors.
These findings have important implications for management and audit committees. First, the findings highlight that external stakeholders understand the critical role that internal audit plays in effective corporate governance. This is particularly relevant for management making resource allocation decisions. Second, the results shed light on the potential benefits of providing increased disclosure surrounding the composition and activities of internal audit. These findings are important because much of the research highlights activities that are already being completed by internal audit but not being disclosed to external stake-holders. For example, many internal audit functions currently engage in internal control testing that serves a basis for management’s assessments of internal control effectiveness.
As with any disclosures, proper care should be taken to carefully assess any potential cost concerns, such as increased legal liability related to voluntary disclosures. But overall, the research suggests that increased internal audit reporting provides a fruitful avenue for consideration of increased disclosures.
