Serving Two Masters: The Association between ... - AAA Digital Library

Accounting Horizons Vol. 24, No. 1 2010 pp. 1–24

American Accounting Association DOI: 10.2308/acch.2010.24.1.1

Serving Two Masters: The Association between Audit Committee Internal Audit Oversight and Internal Audit Activities Lawrence J. Abbott, Susan Parker, and Gary F. Peters SYNOPSIS: In this paper, we investigate the association between the audit committee’s oversight of the internal audit function 共IAF兲 and the nature of IAF activities. The importance of internal controls and of the roles of both the audit committee and the internal audit function in monitoring control activities have grown in recent years. Despite the importance of these topics, relatively little regulatory or best practices guidance addresses the distribution of IAF activities and amount of audit committee involvement with the IAF. We hypothesize that when the balance of oversight over the IAF lies with the audit committee 共vis-à-vis management兲, the committee will steer the IAF toward a more internal-controls-oriented focus. Our hypothesis is based on the existing practice guidance in this area and the relative incentives of management and the audit committee. To test our hypothesis, we survey 134 chief internal auditors from Fortune 1000 firms regarding the amount of internal audit resources allocated across internal audit activities in fiscal year 2005. We then construct a composite measure of audit committee oversight contingent on the relative control that the audit committee has over IAF vis-à-vis management. Our composite measure is derived from three key facets of the audit committee/internal audit relationship: reporting duties, termination rights, and budgetary control. Consistent with our hypothesis, we document a strong, positive association between our audit committee oversight variable and the amount of IAF budget allocated to internal-controls-based activities.

INTRODUCTION his study examines the association between the activities performed by the internal audit function 共hereafter, IAF兲 and the extent of audit committee oversight of the IAF. Two primary concerns motivate our study. First, relatively little regulatory or best practices guidance relates to the distribution of IAF activities, and virtually no current research has been done about these activities. We believe this topic to be important because current New York Stock Exchange listing rules require registrants to maintain an IAF, increasing the pervasiveness of

T

Lawrence J. Abbott is an Associate Professor at the University of Wisconsin–Milwaukee, Susan Parker is an Associate Professor at Santa Clara University, and Gary F. Peters is an Associate Professor at the University of Arkansas. Submitted: December 2007 Accepted: September 2009 Published Online: March 2010 Corresponding author: Lawrence J. Abbott Email: [email protected]

1

2

Abbott, Parker, and Peters

internal audit. The second motivation concerns the relatively incomplete set of audit-committeerelated regulations. In particular, the Sarbanes-Oxley Act of 2002 共SOX兲共U.S. House of Representatives, Committee on Financial Services 2002兲 requires audit committee oversight of internal controls over financial reporting and also mandates reporting on a registrant’s internal controls. However, SOX is silent on internal audit, a key participant in both the financial reporting process and the internal control structure. Moreover, SOX does not address internal audit’s reporting relationship with the audit committee or the audit committee’s duties concerning internal audit resources. In response to SOX and the associated increase in audit committee responsibilities, the Institute of Internal Auditors 共IIA 2003a兲 issued a commentary on standards relating to public company audit committees. In it, the IIA states the audit committee should expect the IAF to examine and evaluate the adequacy and effectiveness of the organization’s systems of internal control. To ensure that internal auditors carry out these internal control responsibilities, the audit committee should review and approve the IAF’s staffing schedules and financial budgets. By doing so, the audit committee can determine whether budget limitations impede the ability of the IAF to execute its audit plans. These sentiments are echoed by the Public Company Accounting Oversight Board 共PCAOB 2004兲 and other audit stakeholders 共KPMG 2008; Ernst & Young 2006; Jefferson Wells 2004兲. In particular, the PCAOB’s Auditing Standard No. 2 共effective during our sample period兲 highlights the importance of the adequacy of internal audit activity and whether the IAF reports directly to the audit committee in assessing control risk for the entity 共PCAOB 2004兲. The use of the IAF in meeting heightened audit committee oversight expectations may conflict with management’s IAF objectives 共Gray 2004; Hermanson 2002兲. More specifically, management may view the IAF as a means of achieving operational goals and generating cost savings 共Anderson 2003; Hermanson and Rittenberg 2003兲. In contrast, an audit committee’s litigational and reputational concerns can engender a demand for the IAF to focus its efforts on evaluating financial-statement-related internal controls 共Krishnan 2005; Braiotta 2000; Reinstein et al. 1984兲. While the CEO and CFO bear the ultimate responsibility for internal controls, these individuals have distinct financial reporting and compensation-related incentives that are not necessarily present for audit committee members 共Ernst & Young 2006兲. Thus, instances may occur in which the two primary consumers of IAF resources may disagree with respect to the allocation of those resources 共Anderson 2003; Hermanson and Rittenberg 2003; Raghunandan et al. 1998兲. Consequently, we posit that the extent to which the audit committee can direct IAF resources toward activities that reduce their reputational and litigational exposures depends on its oversight of the IAF. In this paper, we examine the association between audit committee oversight and the amount of IAF resources allocated to internal-controls-based activities. To address our research question, we obtained 134 useable survey responses from Fortune 1000 chief internal auditors 共hereafter, CIAs兲 regarding their interactions with audit committees and their budget allocations for fiscal year 2005. We construct our audit committee oversight variable based on the relative amount of IAF control that the audit committee possesses vis-à-vis management. This continuous variable is based on three critical facets of the IAF/audit committee relationship: reporting lines, termination rights, and budgetary control. Note that each facet can range from being the sole domain of upper management to the sole domain of the audit committee—thus the need to measure the relative degree of control between these two potentially conflicting IAF supervisors. Consistent with our prediction, we find that the percentage of the IAF budget devoted to internal-controls-based activities is positively related to our measure of the audit committee’s oversight. The evidence provided herein indicates a positive association between the audit committee’s oversight and a more controls-based IAF focus. In doing so, our study contributes to the literature in four distinct ways. First, we extend Carcello et al. 共2005兲, which explored the determinants of

Accounting Horizons American Accounting Association

March 2010

Serving Two Masters

3

the IAF budget, including company risk, ability to pay, and audit characteristics. Carcello et al. 共2005兲 found a positive association between the size of the IAF budget and a dichotomous variable representing whether the audit committee reviewed the budget. We examine 共in addition to budget size兲 the allocation of the IAF budget, and utilize a finer measure of the degree of audit committee involvement with the budget process. Second, we provide initial post-SOX data regarding the breakdown of internal audit activities, an area with sparse prior evidence. We find that a substantial percentage 共in excess of 40 percent兲 of in-house IAF budgets is allocated to areas unrelated to internal control, such as special consulting projects and assisting the external auditor in the financial statement audit. Moreover, we provide evidence on the allocation of outside service provider 共hereafter, OSP兲 hours, on which prior evidence is also limited. Third, we provide initial empirical evidence on the degree of audit committee oversight, in addition to its impact on the allocation of IAF resources. Such post-SOX evidence is important to policymakers, as SOX has increased the expectations, legal exposure, and responsibilities of the audit committee, while remaining silent as to the audit committee’s relationship with the IAF 共Gramling and Hermanson 2006兲. We find that the mean overall measure of our audit committee oversight variable is approximately 48 percent, suggesting that the audit committee is a near-equal partner with management. Finally, we create a new, relatively straightforward measure of audit committee oversight, which extends Carcello et al.’s 共2005兲 dichotomous treatment. For example, although more than 97 percent of our respondents agreed that the audit committee reviews the IAF’s budget 共compared with 50 percent in Carcello et al. 2005兲, 40 percent disagreed or strongly disagreed with the statement “the audit committee determines Internal Audit’s budget,” suggesting that a more detailed measure may better capture the extent of audit committee oversight of the IAF. Our study is subject to a number of caveats. First, it is important to note that the companies in our survey were actively engaged in initial compliance with the internal controls requirements of SOX during our sample period 共2005兲. Thus, both the audit committee and management were likely to be especially sensitive to controls and liability issues. As a result, our results may not apply to firms not subject to SOX internal control requirements or to later periods in which SOX compliance has matured. Second, our results are not meant to imply that controls-based activities represent the optimal use of the IAF, nor does our evidence suggest that management is interested in using the IAF as a means of achieving financial and operational goals exclusively. We note that prior research is scant on the nature of internal audit activities and what constitutes an appropriate mix. To whit, several professional and regulatory groups recognize the significant differences between IA departments in terms of size, nature, and focus 共Ernst & Young 2006; Jefferson Wells 2004; IIA 2002a兲. Third, as noted by many practitioner publications, opinion diverges considerably about how “good” governance uses the IAF, and this divergence likely varies from firm to firm 共KPMG 2008; Deloitte 2006兲.1 Thus, higher levels of our audit committee IAF oversight variable should not necessarily be interpreted as indicative of better governance. To sum up, our purpose is to provide evidence on IAF activities and the IAF-audit committee relationship to better understand the IAF’s role in a post-SOX environment. The remainder of this paper is organized as follows. The next section reviews prior literature and develops our hypothesis. Succeeding sections discuss sample selection, followed by research design and results. Our final section concludes.

1

The diversity of what constitutes best practices with respect to IAF use and corporate governance will likely also vary between countries because of different regulatory and litigation environments. We thank an anonymous reviewer for this insight.

Accounting Horizons

March 2010 American Accounting Association

4


PRIOR RESEARCH AND HYPOTHESIS DEVELOPMENT Audit Committees and Internal Audit To effectively execute their corporate governance duties, audit committees rely in part on the IAF 共Gramling and Hermanson 2006; IIA 2003b, 2002a, 2002b; McHugh and Raghunandan 1994兲. Many corporate governance observers point to a symbiotic relationship between the IAF and the audit committee, with effective audit committees heightening the status of internal audit and the IAF aiding audit committees in avoiding financial misstatement 共e.g., McHugh and Raghunandan 1994兲. However, research has yet to explore how an IAF can accomplish this, though some recent studies suggest that improving the quality of internal controls is likely to reduce the incidence of financial misstatement 共Ge and McVay 2005; Krishnan 2005; Verschoor 2002; POB 2000兲. Consequently, it appears reasonable that an audit committee may view the IAF as well equipped to provide internal control assurance and, in turn, wish to have internal audit allocate relatively more of its resources toward internal control evaluation. However, the ability of an IAF to satisfy the audit committee’s concerns may be constrained by budgetary limitations and competition with management for the direction of scarce resources 共Jefferson Wells 2004; Anderson 2003; Hermanson and Rittenberg 2003; Quarles 1994; Pei and Davis 1989兲. Most directly, budgetary restrictions can result in reduced testing of controls, as well as reduced geographic audit coverage 共POB 2000兲. Indirectly, an IAF that spends relatively less time on internal controls may not see the return on investment in related specialized training programs, including those for electronic data processing 共hereafter, EDP兲 auditing. Thus the audit committee has an incentive to support the allocation of resources to internal control activities. Carcello et al.’s 共2005兲 study most closely addresses the above issues. These authors document a positive association between audit committees that reviewed internal audit’s budget and the size of that budget. Carcello et al. 共2005兲 find that only 59 percent of the chief internal auditors surveyed stated that audit committees reviewed internal audit’s annual budget. This may indicate the audit committee’s reluctance to challenge management on the resources allocated to internal audit. In particular, management may endeavor to have internal audit direct more attention to operational audits and other consulting-related “value-added” services 共Gray 2004; Anderson 2003; Hermanson and Rittenberg 2003兲. Moreover, management may be reluctant to grant additional resources to internal control activities that will not necessarily generate immediate cost savings 共Gray 2004; Anderson 2003; Hermanson and Rittenberg 2003兲. This suggests that management and the audit committee may have conflicts concerning not only the IAF’s budget, but also the focus of the IAF’s activities. The current study extends the prior literature by investigating the associations between audit committee oversight 共vis-à-vis management oversight兲 and resources devoted to specific IAF activities. Hypothesis Development Abbott and Parker 共2000兲 posit that audit committees wish to avoid financial misstatement for two reasons. First are reputational capital enhancement/preservation concerns. More specifically, audit committee directors may view the directorate as a means of enhancing their reputations as experts in decision control, which is likely a function of good internal controls 共Srinivasan 2005; Beasley 1996兲. Although audit committee service increases the reputational capital of these directors, it may also exacerbate the reputational damage should a financial misstatement occur 共Srinivasan 2005兲. The second reason concerns director liability, which is also a function of the likelihood of financial misstatement. As a consequence, audit committees take steps to heighten overall audit quality 共including both internal and external audit efforts兲 to reduce the risk of material financial misstatement 共Abbott and Parker 2000; Carcello and Neal 2000兲.


March 2010

Serving Two Masters

5

In addition, Coffee 共2005兲 suggests that the litigation vulnerability of the audit committee is materially altered by the additional internal control information that audit committees receive post-SOX. This issue is particularly important if the firm receives an adverse internal controls report, because any subsequent decline in stock price or financial reporting issue will bring the audit committee’s actions related to the adverse report under intense scrutiny. Thus we expect heightened emphasis by the audit committee on either preventing material control weaknesses or reacting proactively to increase internal controls subsequent to an adverse report. One means of reducing both the likelihood of misstatements and of an adverse internal control opinion is increasing the quality of a firm’s internal control structure 共Ge and McVay 2005; Krishnan 2005; Verschoor 2002; Eilifsen and Messier 2000兲. We posit that the use of internal audit can increase the quality of the internal control structure in two ways. First, the IAF can devote significant resources to internal control evaluation and, in cases of weaknesses, improvement thereof 共IIA 2002a兲. Second, the pervasiveness of enterprise resource planning 共hereafter, ERP兲 systems in generating financial statements creates a demand for increased reliance on and testing of EDP-related application controls by internal audit 共Chan 2004; Lightle and Vallario 2003兲. This, in turn, increases the demand for internal control and EDP audit specialists. Both internal control evaluation and EDP auditing would fall under the classification of controls-based activities. On the other hand, management may not see the value-added aspect of controls-related activities and divert IAF focus away from such activities and more toward IAF activities that produce immediate, contemporaneous cost savings 共Gray 2004; Anderson 2003兲. This is because management 共usually in the form of the CEO/CFO兲 has financial reporting and compensationrelated incentives that are not present 共or not present in the same degree兲 for audit committee members. For example, in terms of financial reporting incentives, Graham et al. 共2005兲 find that the majority of managers would avoid initiating a positive NPV project if it meant falling short of the current quarter’s consensus earnings.2 In sum, we argue that the evaluation of an audit committee’s effectiveness is heavily weighted toward the strength of the company’s internal control structures and financial reporting environment, and no mention is made of responsibilities for the firm’s economic performance. As such, audit committee members do not have the same degree of economic incentives as management with respect to earnings per share or the pursuit of risk-taking activities that promote growth. However, the audit committee member does receive personal benefit from the minimization of downside risk with respect to internal controls. Thus we hypothesize that an audit committee with relatively more IAF oversight will be able to demand relatively greater IAF focus on internal control. This leads to our hypothesis 共stated in alternative form兲: Ha: Higher levels of audit committee oversight of the IAF 共compared with management’s level of IAF oversight兲 will be associated with a higher percentage of IAF resources devoted to internal-controls-based activities. Although the above hypothesis reflects the incentives facing the audit committee and management, the trade-offs do not necessarily imply optimal uses of the IAF. Rather, the current hypothesis is tested to determine whether certain governance structures may result in differential IAF emphasis. Although professional and regulatory organizations 共such as the IIA, PCAOB, and others兲 emphasize the benefits of audit committee oversight of the IAF, we are not aware of any discussion about anticipated outcomes related to such oversight. 2

These views are consistent with survey results of Ernst & Young 共2006兲. In a survey of 148 international corporate board members, they find evidence that audit committee members emphasize and respond to distinctly different 共compared with management兲 considerations of company risk.

Accounting Horizons


6


SAMPLE SELECTION Our survey questionnaire 共see excerpts provided in the Exhibits兲 was mailed to Fortune 1000 共in terms of total sales兲 companies, after excluding banks.3 Consistent with much prior internal audit research 共Carcello et al. 2005; Raghunandan et al. 1998; Scarbrough et al. 1998兲, our survey was directed to CIAs. In survey questions #1–#3 共Exhibit 1兲, CIAs were requested to provide details concerning the hours expended by outside service providers 共hereafter, OSPs兲 and the in-house internal audit department, as well as the distribution of those hours across 10 typical IA activities for fiscal year 2005. Survey questions #6a–6i 共Exhibit 2兲 asked respondents to provide a Likert-scale level of agreement with statements concerning internal audit reporting responsibility, termination rights, and budgetary oversight. Note that survey questions #6a–6i in the exhibit are differentiated by source of oversight: CFO, CEO, and audit committee. In this manner, respon-

EXHIBIT 1 Survey Questions Related to IAF Activities 1. During fiscal 2005, approximately how many hours were devoted to internal audit services by: OUTSIDE SERVICE PROVIDERS 共OSPs兲 _______ hours INTERNAL PROVIDERS ________ hours 2. Of the total internal audit hours provided by the outside service provider共s兲 as indicated in question 1, please give the approximate percentage distribution of activities 共please note that the percentages should add to 100%兲: Activity Description

% of Hours

Financial statement audits of subsidiaries Special consulting projects Compliance auditing Risk management activities Assisting external auditor in financial statement audit

Activity Description

% of Hours

EDP auditing Internal control evaluation Section 404-related work Fraud audits Operational audits/Other 共explain兲

3. Of the total internal audit hours provided by the in-house internal audit department during 2005 per question 1, please give the approximate percentage distribution of activities 共please note the percentages should add to 100%兲: Activity Description Financial statement audits of subsidiaries Special consulting projects Compliance auditing Risk management activities Assisting external auditor in financial statement audit

3

% of Hours

Activity Description

% of Hours

EDP Auditing Internal control evaluation Section 404-related work Fraud audits Operational audits/Other 共explain兲

Consistent with Carcello et al. 共2005兲, banks are excluded because they do not possess inventory and have unique regulatory environments.


March 2010

Serving Two Masters

7

EXHIBIT 2 Survey Questions Related to Audit Committee Oversight 6. Please indicate your level of agreement with the following statements: 共1 ⫽ strongly disagree; 2 ⫽ disagree; 3 ⫽ neutral; 4 ⫽ agree; 5 ⫽ strongly agree兲. Level of Agreement (circle one number)

Statement a. Internal audit reports to the Audit Committee b. Internal audit reports to the Chief Financial Officer 共CFO兲 c. Internal audit reports to the Chief Executive Officer 共CEO兲 d. The Audit Committee has authorization to terminate the Chief Internal Auditor e. The CFO has authorization to terminate the Chief Internal Auditor f. The CEO has authorization to terminate the Chief Internal Auditor g. The Audit Committee determines Internal Audit’s annual budget h. The CFO determines Internal Audit’s annual budget i. The CEO determines Internal Audit’s annual budget

1 1 1 1 1 1 1 1 1

2 2 2 2 2 2 2 2 2

3 3 3 3 3 3 3 3 3

4 4 4 4 4 4 4 4 4

5 5 5 5 5 5 5 5 5

dents are afforded the flexibility to delineate their perception of oversight among the three potential overseers. The first survey was sent in July 2006 and resulted in a total of 72 usable responses. A follow-up mailing was conducted in September 2006 and produced an additional 62 usable responses. This leads to our final sample size of 134 observations. Table 1 provides details of the industry membership of the 134 respondents, compared with the industry profile of the original nonbank population of Fortune 1000 companies. Per Table 1, our sample appears to be representative of the Fortune 1000 population of firms, except for a slight underrepresentation of the energy and manufacturing sectors and an overrepresentation of professional, commercial services, and education firms. RESEARCH DESIGN We employ a multivariate regression approach similar to that of Carcello et al. 共2005兲, who use an agency-based framework to describe the demand for internal audit services. We augment their regression model with our test variable, as well as additional control variables. Our regression framework is summarized as follows: IACONTROL% = b0 + b1AC_OVRSGHT + b2SIZE + b3LEVERAGE + b4INVRATIO + b5FORSALE + b6GROWTH + b7OPCASH + b8RDINTENSE + b9MW + b10MANAGE + ␧,

共1兲

where: IACONTROL% ⫽ percentage of total IA budget devoted to internal controls-related activities; AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management 共CEO and CFO兲; SIZE ⫽ natural log of total assets 共in millions兲; LEVERAGE ⫽ ratio of total long-term debt to total assets; INVRATIO ⫽ ratio of inventory to total assets;

Accounting Horizons


8


TABLE 1 Sample Selection Results

Related TwoDigit SIC Codes

# of Sample Firms

% of Sample

# of Fortune 1000 Firmsa

15–17 20–33 10–14, 46, 49 60–64, 67 48, 73, 78, 79, 84

4 28 14 12 14

3.0 20.9 10.4 9.0 10.4

23 174 122 62 84

2.9 21.6 15.2 7.7 10.5

34–39 72, 80, 83

18 4

13.4 3.0

135 15

16.8 1.8

75, 76, 82, 87, 89

8

6.0

12

1.5

65, 70 50–59 40–42, 44, 45, 47 1, 2, 7, 8, 99

0 28 4 0 134

0.0 20.9 3.0 0.0 100.0

4 142 30 0 803

0.5 17.7 3.8 0.0 100.0

Focus Industry Construction Consumer Product and Food Energy Financial Services Information and Communication Manufacturing Personal Services and Healthcare Professional, Commercial Services, Education Real Estate Retail and Wholesale Transportation All Other Totals

% of Fortune 1000 Firmsa

a Fortune 1000 firms that are banks are excluded from both the population and the sample as these firms face additional regulation unique to their industry and do not have significant inventory accounts 共making the model unfit for regression purposes兲. The remaining 803 nonbank Fortune 1000 firms act as our sampling population.

FORSALE ⫽ foreign sales as a percentage of total sales; GROWTH ⫽ three-year rate of sales growth; OPCASH ⫽ operating cash flow scaled by total assets; RDINTENSE ⫽ R&D expenditures as a percentage of total sales; MW ⫽ 1 if company reported a material internal control weakness during the prior two years, 0 otherwise; and MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise. Our hypothesis addresses the association between audit committee oversight and the nature of IAF activities. Our dependent variable, IACONTROL%, measures the percentage of total internal audit budget 共both outsourced and in-house兲 devoted to controls-based activities. We classify the following as controls-based: EDP auditing, internal control evaluation, Section 404 testing, fraud auditing, risk management activities, and compliance auditing.4 We exclude special consulting projects, financial statement audits of subsidiaries, operational audits, and incidences in which the external auditor is assisted in the financial statement audit. These activities do not directly address 4

We include fraud auditing as a controls-related activity because at least a portion of a fraud audit would be devoted to investigating and correcting a control lapse. Risk management activities are included within controls-related activities because the COSO framework includes risk management as a key component of internal control. Compliance auditing is included as it typically entails testing adherence to firm-level internal control policies and procedures. Additional sensitivity testing of the underlying activities is discussed in the results section.


March 2010

Serving Two Masters

9

internal controls and may be seen as a means of generating immediate cost savings, especially in terms of assisting the financial statement auditor 共Felix et al. 2001兲.5 IACONTROL% captures the percentage of total internal audit budgets devoted to controlsrelated activities. The numerator of IACONTROL% is the sum of two products: The sum of controls-related activity percentages for the OSP multiplied by the total number of OSP hours, and the sum of controls-based percentages for the in-house internal audit department multiplied by the total number of in-house internal audit hours. The denominator of IACONTROL% is the sum of the OSP hours and in-house internal audit hours. Consequently, IACONTROL% is bounded by 1 and 0. A mathematical representation of IACONTROL% is: 兵关共⌺Internal control %s for OSP兲 ⴱ 共OSP hours兲兴 + 关共⌺Internal control %s for in-house IAF兲 ⴱ 共IAF hours兲兴其兵OSP hours + in-house IAF hours其

.

Our audit committee oversight 共AC_OVRSGHT兲 variable is designed to capture the degree of IAF oversight the audit committee has relative to upper management 共CEO and CFO兲. Thus, it can range from 0 共i.e., no oversight over the IAF兲 to 1 共i.e., total oversight over the IAF兲.6 From the answers to survey question 6, we construct the ratio of the total agreement points for the audit committee, divided by the total agreement points for the audit committee, CFO, and CEO. To illustrate, if the CIA answers “5” 共i.e., strongly agree兲 to all questions 6a–6i, then the audit committee is seen as an equal tri-partner with the CEO and CFO. Our AC_OVRSGHT variable would receive a value of 0.33, denoting 33 percent relative oversight of the internal audit function, vis-à-vis management. If, however, the CIA strongly disagrees with any relationship with the CEO/CFO 共i.e., responding with a “1” to questions 6b, 6c, 6e, 6f, 6h, 6i兲, while strongly agreeing with all audit committee relationships 共i.e., responding with a “5” to questions 6a, 6d, 6g兲, our AC_OVRSGHT variable equals 1, denoting full internal audit oversight by the audit committee.7 Consistent with Carcello et al. 共2005兲, our control variables are generally agency-based, as an increase in agency costs necessitates greater monitoring. We posit that an IAF focus on controls is consistent with its role in ensuring the efficacy of the management control systems 共Carcello et al. 2005; Ramamoorti 2003兲. Consequently, we predict a positive association between our agency cost proxies, SIZE 共natural log of total assets in billions兲 and LEVERAGE 共ratio of total long-term debt to total assets兲, and our dependent variable. The need for better monitoring increases with firm complexity 共Carcello et al. 2005; Ramamoorti 2003兲, and we expect a positive association between our proxy for firm complexity, INVRATIO 共ratio of total inventory to total assets兲, and our dependent variable. In a related note, as a firm becomes more decentralized, there is a concomitant 5

6

7

The audit committee’s desire for reliable financial reporting may be served by increased IAF assistance with the financial statement audit. However, the results of Felix et al. 共2001兲 suggest that direct assistance rendered by the internal auditors has the effect of decreasing the external audit fees because of a reduction in audit effort. Thus direct assistance by the IAF does not result in an overall increase in audit scope. Although resources devoted to assisting the external auditors can result in cost savings, we hypothesize the audit committee will have a stronger preference 共compared with management兲 for less assistance with the financial statement audit 共when traded-off against internal control works兲, resulting in an overall larger audit scope. Recognizing the level of control over the internal audit department as a three-pronged function of reporting, termination, and budget rights is also consistent with the PricewaterhouseCoopers 共PwC兲 survey of audit committee chairpersons. For example, PwC observed that “even with direct reporting to the Audit Committee Chairman, there was recognition that 共internal audit兲 independence is threatened if 共the audit committee兲 does not have an active involvement in the career path and reward of the Head of Internal Audit, as well as in the funding of the function” 共PwC 2006兲. Survey responses to questions 6a–6i can range from 1–5, but are recalibrated to a scale of 0–4 By doing so, our AC_OVRSGHT variable captures the intuition behind the relative oversight over the internal audit function. For example, if the CIA strongly disagrees 共agrees兲 with a statement concerning the audit committee’s 共CFO/CEO兲 reporting, hiring, and budgetary roles 共i.e., responds with a “1” to questions 6a, 6d, and 6g兲, the resulting AC_OVRSGHT score will be 0. Without such recalibration, the AC_OVRSGHT value would be 关共1 ⫹ 1 ⫹ 1兲/共1 ⫹ 5 ⫹ 5 ⫹ 1 ⫹ 5 ⫹ 5 ⫹ 1 ⫹ 5 ⫹ 5兲兴 or 0.099.

Accounting Horizons


10


demand for management control systems that utilize accounting-based information 共Ditello 2004; Ramamoorti 2003兲. Our proxy for decentralization is FORSALE, which is defined as the foreign sales as a percentage of total sales. We expect a positive coefficient estimate for our FORSALE variable. Beasley 共1996兲 posits that firms experiencing rapid growth rates may experience deterioration in controls, spurring the audit committee to press for more controls-oriented work. This would suggest a positive association between our growth proxy, GROWTH 共three-year growth rate in sales兲, and our dependent variable. The desire for cost savings 共and focus away from internal control on the part of IA兲 is proxied with OPCASH, or cash flow from operations scaled by total assets. Consistent with Carcello et al. 共2005兲, we expect a positive coefficient estimate for this variable. In terms of our additional test variables, Ditello 共2004兲 notes that excessive emphasis on management control systems may have a deleterious effect on innovation. Consequently, for knowledge-intense firms, we may observe a de-emphasis on internal controls. We proxy for knowledge-intensity with RDINTENSE, defined as the ratio of R&D expenditures to total sales. We expect a negative coefficient estimate for this variable. We add a dichotomous variable, MW, contingent on the presence of a reportable material internal control weakness.8 In particular, firms reporting an internal control weakness may direct resources toward the remediation of those weaknesses. We expect a positive association between our MW variable and the percentage of controls-based activity because the IAF may be used to improve and eliminate such weaknesses. Finally, we add a dichotomous variable, MANAGE, depending on whether internal audit is a training ground for future management positions.9 We include this variable as such career arrangements may induce the IAF to promote well-rounded entry into the management sphere by focusing on the operational aspects of the business 共Quarles 1994兲. As such, we expect a negative coefficient estimate on our MANAGE variable. RESULTS Table 2 presents descriptive statistics for our 134 firms. Panel A of Table 2 provides a breakdown of the size of budgets and hours allocated to in-house internal audit functions and OSP internal audit services 共approximately 75 percent of sample firms use an OSP兲. In-house IAF budgets are large, with a mean 共median兲 of 34,873 共20,000兲 hours. In contrast, OSP hours are much smaller, with a mean 共median兲 budget of 4,123 共2,000兲. Panels B and C of Table 2 present the allocation of OSP and in-house internal audit hours devoted to specific activities. We find substantial differences in the allocation amounts between OSPs and in-house internal audit departments. OSP budgets are dominated by Section 404-related activities 共with a mean 关median兴 of 51.25 percent 关60 percent兴 of budgeted OSP hours兲 and assisting the external auditor with the financial statement audit 共with a mean 关median兴 of 15.20 percent 关15 percent兴 of budgeted OSP hours兲. This may speak to the specialization on the part of OSPs in response to the Sarbanes-Oxley Act. In comparison, there is much greater variety of in-house internal audit activities, with the most dominant activity also being Section 404-related work, albeit at a much lower concentration 共a mean 关median兴 of 20.50 percent 关20 percent兴 of budgeted in-house IA hours兲. Also a considerable proportion of IAF hours 共approximately 40 percent兲 are devoted to noncontrols-based activities. This suggests that even in the post-SOX environment, noninternal-control activities remain important. Panel D shows the breakdown of the

8 9

MW is coded “1” if one or more internal control weaknesses were reported by management under SOX Section 302 or by the auditor under SOX Section 404 in either 2004 or 2005. Information on this variable was obtained via our survey. The survey question was phrased as follows: “Is internal audit used as a training ground for future management positions?”


March 2010

Panel A: Size of Internal Audit Budgets Including Outside Service Provider (OSP) Hours (n ⴝ 134) Variable Name Mean Median

25th %

75th %

Total OSP-Provided Hours Total In-House IAF Hours Total Combined IAF Hours

2,000 20,000 22,000

0 8,000 12,000

5,000 37,750 43,000

Median

25th %

75th %

4,123 34,873 38,995

Panel B: Breakdown of Outside Service Provider (OSP) Internal Audit Activities (n ⴝ 98) % of OSP Hours Devoted to: Mean 1.00 3.00 1.25 1.25 15.20 11.35 12.75 51.25 0.50 0.22 78.35

0.00 0.00 0.00 0.00 15.00 10.00 15.00 60.00 0.00 0.00 80.00

0.00 0.00 0.00 0.00 5.00 5.00 5.00 15.00 0.00 0.00 57.50

0.00 0.00 0.00 0.00 25.00 15.00 15.00 90.00 0.00 0.00 95.00

Panel C: Breakdown of In-House Internal Audit Activities (n ⴝ 134) % of In-House Internal Audit Hours Devoted to:

Mean

Median

25th %

75th %

Financial Statement Audits of Subsidiaries Special Consulting Projects Compliance Auditing Risk Management Activities Assisting External Auditor in Financial Statement Audit EDP Auditing

10.15 9.00 1.00 1.00 15.75 18.50

10.00 10.00 0.00 0.00 15.00 15.00

0.00 5.00 0.00 0.00 5.00 10.00

15.00 15.00 0.00 0.00 25.00 25.00 (continued on next page)

11


Financial Statement Audits of Subsidiaries Special Consulting Projects Compliance Auditing Risk Management Activities Assisting External Auditor in Financial Statement Audit EDP Auditing Internal Control Evaluation Section 404-Related Work Fraud Audits Operational Audits Internal Control Activitiesa

Serving Two Masters

Accounting Horizons

TABLE 2 Descriptive Data—Internal Audit Function (IAF) Activities per Survey Responses

Mean

Median

25th %

75th %

Internal Control Evaluation Section 404-Related Work Fraud Audits Operational Audits Internal Control Activitiesa

15.90 20.50 3.20 5.63 59.90

15.00 20.00 0.00 5.00 60.00

10.00 15.00 0.00 0.00 0.33

25.00 35.00 5.00 10.00 80.00

12


Panel C: Breakdown of In-House Internal Audit Activities (n ⴝ 134) % of In-House Internal Audit Hours Devoted to:

Panel D: Breakdown of Combined [Outside Service Provider (OSP) and In-House IAF] Internal Audit Activities (n ⴝ 134) % of Combined Internal Audit Hours Devoted to: Mean Median 25th % Financial Statement Audits of Subsidiaries Special Consulting Projects Compliance Auditing Risk Management Activities Assisting External Auditor in Financial Statement Audit EDP Auditing Internal Control Evaluation Section 404-Related Work Fraud Audits Operational Audits Internal Control Activitiesa

9.25 8.75 1.05 1.05 15.15 17.75 15.00 24.25 2.75 5.00 61.85

9.00 10.00 0.00 0.00 15.00 14.25 15.00 25.00 0.00 5.00 65.00

0.00 5.00 0.00 0.00 5.00 9.75 10.00 15.00 0.00 0.00 37.50

75th % 15.00 15.00 0.00 0.00 25.00 22.50 25.00 40.00 5.00 10.00 82.50

a Internal control activities include compliance auditing, risk management activities, EDP auditing, internal control evaluation, Section 404-related work, and fraud audits. Excluded are financial statement audits of subsidiaries, special consulting projects, assisting the external auditor in financial statement audit, and operational audits.


March 2010

Serving Two Masters

13

combined in-house and OSP internal audit activities. In general, the allocations mirror that of Panel C because the amounts of OSP hours are small relatively to those provided by the in-house IAF.10 Table 3 presents our descriptive statistics for our test and control variables. Panel A of Table 3 provides detailed information concerning our test variable, AC_OVRSGHT. AC_OVRSGHT exhibits considerable variation, with a mean 共median兲 value of 0.48 共0.44兲. This suggests that the audit committee is generally seen as a nearly equal partner. We find that for the lower 25 percent of our firms, the audit committee has relatively little oversight over the IAF with a value of 0.28. On the other hand, the 75th percentile value of AC_OVRSGHT is 0.65. In terms of the breakdown of IAF-audit committee relations, audit committees appear to have a much greater degree of reporting oversight 共with a mean 关median兴 agreement of 4.65 关5兴 with the statement that IA reports to the audit committee兲 than budgetary control 共with a mean 关median兴 agreement of 3.11 关3兴 with the statement that the audit committee determines the IAF’s budget兲. In terms of reporting relationships, internal audit appears to be reporting to both the audit committee and the CFO or CEO. This could indicate a “solid line” or functional relationship with the audit committee and a “dotted line” or administrative relationship with the CFO or CEO. In terms of our control variables, we note that our firms, by design, are very large, profitable, and growing. In particular, the mean 共median兲 of total assets is $12.86 billion 共$5.49 billion兲, whereas operating cash flows, on average, represent 10.34 percent of total assets. The mean 共median兲 sales growth rate is 30.60 percent 共34.95 percent兲. Given their Fortune 1000 status, we also observe a meaningful degree of globalization among our sample firms, with a mean 共median兲 FORSALE value of 14.4 percent 共15.75 percent兲. Sixteen percent of our sample firms had material internal control weaknesses, which is consistent with prior research in this area 共Ge and McVay 2005兲. Finally, slightly less than two-thirds of our sample respondents use IA as a training ground for future management positions. Although significant variation generally appears in our independent variables, Pearson pairwise correlations between independent variables appear to be quite low, as reported in Table 4. Table 5 presents our univariate tests, comparing the 67 sample firms with an IACONTROL% greater or equal to the median of 65 percent to the 67 sample firms with an INCONTROL% lower than the median IACONTROL% value of 65 percent. We document a statistically significant difference in our subsample means for AC_OVRSGHT. For those IAFs spending relatively more time on internal control activity, the AC_OVRSGHT value is 0.597 共suggesting the audit committee has more oversight of the IAF than upper management兲. This compares with an AC_OVRSGHT value of 0.358 共suggesting a more limited audit committee oversight role of the IAF兲 for IAFs spending less than the median time on control activities. This result provides univariate support for our hypothesis. We also document statistically significant univariate differences for our SIZE, LEVERAGE, INVRATIO, RDINTENSE, GROWTH, MW, and MANAGE variables between the two subsamples. We fail to document statistically significant differences in our OPCASH and FORSALE variables, however. Table 6 presents our multivariate regression results. Our coefficient estimate on our test variable, AC_OVRSGHT, is positive and highly significant, which is consistent with our hypothesis. This confirms our hypothesized relation between audit committee oversight and IAF activities. We believe that audit committee oversight can affect the focus on internal audit activities through several mechanisms. First, during the review of the IAF’s initial program and budget, the

10

Respondents made very little use of the “other” category. Less than 3 percent of respondents used this category and for very small allocation percentages. Answers were generally in the form of “administration” or “annual employee evaluations.” Consequently, our survey design appears to capture much of the array of different IAF activities.

Accounting Horizons


14


TABLE 3 Descriptive Data—Explanatory Variables Panel A: Likert-Scale Internal Audit Oversight Response Data Degree of Agreement with Following Survey Statements Mean

25th %

75th %

5.00 4.00 2.00 5.00

4.00 1.00 1.00 4.00

5.00 5.00 4.00 5.00

2.72

4.00

1.00

3.00

2.78

4.00

1.00

3.00

3.11

3.00

2.00

4.00

3.38

4.00

2.00

4.00

2.55

3.00

1.00

4.00

0.48

0.44

0.28

0.65

Panel B: Remaining Control Variable Descriptive Data Variable

Mean

Median

25th %

75th %

ASSETS LEVERAGE INVRATIO FORSALE GROWTH OPCASH RDINTENSE MW MANAGE

12.86 0.25 0.14 14.40 30.60 0.10 0.01 0.16 0.65

5.49 0.25 0.15 15.75 34.95 0.09 0.00 0.00 1.00

2.63 0.12 0.05 5.24 13.15 0.05 0.00 0.00 0.00

14.98 0.35 0.22 25.58 73.59 0.14 0.00 0.00 1.00 (continued on next page)


March 2010

Median

4.65 3.19 2.46 4.51

IA reports to the Audit Committee IA reports to the CFO IA reports to the CEO Audit Committee has authorization to terminate the Chief Internal Auditor The CFO has authorization to terminate the Chief Internal Auditor The CEO has authorization to terminate the Chief Internal Auditor The Audit Committee determines Internal Audit’s annual budget The CFO determines Internal Audit’s annual budget The CEO determines Internal Audit’s annual budget AC_OVRSGHTa

Variable Definitions: ASSETS ⫽ total assets 共in billions兲; LEVERAGE ⫽ ratio of total long-term debt to total assets; INVRATIO ⫽ ratio of inventory to total assets; FORSALE ⫽ foreign sales as a percentage of total sales; GROWTH ⫽ three-year rate of sales growth; OPCASH ⫽ operating cash flow scaled by total assets; RDINTENSE ⫽ R&D expenditures as a percentage of total sales; MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise; and MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.

Serving Two Masters

Accounting Horizons

a AC_OVRSGHT is defined as the sum of the three Likert-scale responses to the three audit committee-IA statements divided by the sum of all nine Likert-scale responses concerning IA/CEO/CFO/Audit Committee relationships per survey questions 6a–6i.

15


16


TABLE 4 Pearson Pairwise Correlations AC OVRSGHT AC_OVRSGHT ASSETS LEVERAGE INVRATIO FORSALE GROWTH OPCASH RDINTENSE MW MANAGE

1.00 ⫺0.07 ⫺0.02 0.05 0.03 0.10 ⫺0.06 ⫺0.03 0.09** 0.03

ASSETS 1.00 ⫺0.09 ⫺0.01 0.11 0.06 0.11 0.01 ⫺0.05 0.01

LEVERAGE

1.00 0.17* ⫺0.06 0.05 0.13* ⫺0.08* ⫺0.03 0.04

INVRATIO

1.00 0.09 0.07 0.06* ⫺0.04 ⫺0.05 0.01

FORSALE

1.00 0.12* 0.08* 0.13 ⫺0.08 0.07

GROWTH

1.00 ⫺0.14 0.16* 0.08 0.05

OPCASH

RD INTENSE

MW

MANAGE

1.00 0.05 ⫺0.04 0.10

1.00 0.03 0.05

1.00 ⫺0.07

1.00

*, ** p-value ⬍ 0.10, 0.05, respectively.

March 2010


Variable Definitions: AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management 共CEO and CFO兲. Measured by respondents’ Likert scale answers concerning Internal Audit reporting relationships, termination rights, and budgetary oversight. See text for calculation; ASSETS ⫽ total assets 共in billions兲; LEVERAGE ⫽ ratio of total long-term debt to total assets; INVRATIO ⫽ ratio of inventory to total assets; FORSALE ⫽ foreign sales as a percentage of total sales; GROWTH ⫽ three-year rate of sales growth; OPCASH ⫽ operating cash flow scaled by total assets; RDINTENSE ⫽ R&D expenditures as a percentage of total sales; MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise; and MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.

Serving Two Masters

17

TABLE 5 Univariate Comparisons

Variable Name

Mean Value for 67 Firms above IACONTROL% Median

Mean Value for 67 Firms below IACONTROL% Median

AC_OVRSGHT ASSETS LEVERAGE INVRATIO FORSALE GROWTH OPCASH RDINTENSE MW MANAGE Observations

0.597 15.252 0.287 0.178 13.733 40.254 0.095 0.007 0.194 0.552 67

0.358 10.468 0.213 0.102 15.066 20.847 0.107 0.010 0.119 0.746 67

Difference 0.239 4.784 0.074 0.076 ⫺1.333 19.407 ⫺0.012 ⫺0.003 0.075 ⫺0.194

MannWhitney Statistic 10.551*** 6.056** 5.364** 7.889** 0.648 8.994*** 1.076 6.995** 5.499** 6.846**

*, **, *** p-value ⬍ 0.10, 0.05, and 0.01, respectively. Variable Definitions: IACONTROL% ⫽ percentage of internal audit hours 共both in-house provided and provided by outside service providers兲 devoted to internal control activities per survey questions #1–#3. Included in this amount are hours devoted to compliance auditing, risk management activities, EDP auditing, internal control evaluation, Section 404-related work, and fraud audits. Excluded are all other activities per survey questions #2 and #3; AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management 共CEO and CFO兲. Measured by respondents’ Likert scale answers concerning Internal Audit reporting relationships, termination rights, and budgetary oversight. See text for calculation; ASSETS ⫽ total assets 共in billions兲; LEVERAGE ⫽ ratio of total long-term debt to total assets; INVRATIO ⫽ ratio of inventory to total assets; FORSALE ⫽ foreign sales as a percentage of total sales; GROWTH ⫽ three-year rate of sales growth; OPCASH ⫽ operating cash flow scaled by total assets; RDINTENSE ⫽ R&D expenditures as a percentage of total sales; MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise; and MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.

audit committee can voice its concerns over the amount of hours allocated to internal controls activities, the nature of its program, and internal audit’s scope and/or geographic coverage 共Raghunandan et al. 1998兲. Second, during the review of results of internal audit’s activities, the audit committee can request the IAF to take actions to improve the existing internal control structure or increase the amount of coverage on higher-risk areas 共Carcello et al. 2005兲. Finally, during negotiations with management over the IAF’s program and budget, the CIA can indirectly utilize the audit committee as a bargaining tool and communicate the audit committee’s internal control concerns to the CFO or CEO 共Abbott et al. 2007兲. Consistent with Carcello et al. 共2005兲, we document positive, statistically significant coefficient estimates on our SIZE, LEVERAGE, and INVRATIO. In keeping with our univariate results, we document a statistically significant, negative 共positive兲 coefficient estimate on our RDINTENSE 共GROWTH兲 variable. We also find support for our MW and MANAGE variables, as our

Accounting Horizons


18


TABLE 6 OLS Regression Results IACONTROL% = b0 + b1AC_OVRSGHT + b2SIZE + b3LEVERAGE + b4INVRATIO + b5FORSALE + b6GROWTH + b7OPCASH + b8RDINTENSE + b9MW + b10MANAGE + ␧ Model 1: Total Internal Audit Hours (In-house Internal Audit Function ⴙ Outside Service Provider Hours) Independent Variable Intercept AC_OVRSGHT SIZE LEVERAGE INVRATIO FORSALE GROWTH OPCASH RDINTENSE MW MANAGE Observations R2

Expected Sign ⫹ ⫹ ⫹ ⫹ ⫹ ⫹ ⫹ ⫺ ⫹ ⫺

Coefficient Estimate ⫺0.965 3.588 0.922 0.768 1.663 ⫺0.249 0.003 ⫺0.089 ⫺3.655 0.727 ⫺1.222 134 0.5002

t-statistic ⫺1.806 4.339*** 2.034** 2.005** 2.777*** ⫺0.579 2.105** ⫺0.775 ⫺2.555*** 1.912** ⫺1.774**

Model 2: In-house Internal Audit Function Hours Only Coefficient Estimate ⫺0.965 3.988 0.811 0.492 2.114 ⫺0.822 0.005 ⫺0.104 ⫺4.824 1.085 ⫺1.519 134 0.5701

t-statistic ⫺1.806 4.884*** 1.537** 1.998** 3.050*** ⫺0.222 2.333** ⫺0.826 ⫺2.798*** 2.554** ⫺1.849**

*, **, *** p-value ⬍ 0.10, 0.05, and 0.01, respectively, significance levels 共one-tailed if in predicted direction兲. Variable Definitions: IACONTROL% ⫽ percentage of hours devoted to internal controls-related activities per survey questions #2 and #3. Included in this amount are hours devoted to compliance auditing, risk management activities, EDP auditing, internal control evaluation, Section 404-related work, and fraud audits. Excluded are all other activities per survey questions #1–#3; AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management 共CEO and CFO兲. Measured by respondents’ Likert scale answers concerning Internal Audit reporting relationships, termination rights, and budgetary oversight. See text for calculation; SIZE ⫽ natural log of total assets 共in billions兲; LEVERAGE ⫽ ratio of total long-term debt to total assets; INVRATIO ⫽ ratio of inventory to total assets; FORSALE ⫽ foreign sales as a percentage of total sales; GROWTH ⫽ three-year rate of sales growth; OPCASH ⫽ operating cash flow scaled by total assets; RDINTENSE ⫽ R&D expenditures as a percentage of total sales; MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise; and MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.

coefficient estimates are in the predicted directions and are statistically significant. We fail to find a statistically significant association for our OPCASH and FORSALE variables. Nonetheless, the overall R2 of our regression model is 50 percent, suggesting a good model fit.


March 2010

Serving Two Masters

19

Outsourced internal audit hours represent approximately 32 percent of the total. Furthermore, those outsourced hours are heavily concentrated in internal control activities. To assess whether our results were influenced by the heavy concentration of OSP hours on internal control issues, we reran our regressions using only the in-house IAF data. These results are found in Table 6, model 2, and are qualitatively similar to those using total hours. Prior research provides little guidance as to the categorization of certain IAF activities as controls-related, and we acknowledge that our categorization is exploratory in nature. To address this, we ran regressions on the six most common and pervasive individual in-house IAF activities reported. Table 7 presents the results of those individual activity regressions. Consistent with our expectations, we find that the percentage of the in-house IAF budget allocated to assistance with the external audit of the financial statements and financial statement audits of subsidiaries are negatively associated with the level of audit committee oversight, as is the percentage devoted to special consulting projects. Conversely, the percentage of in-house IAF budget allocated to EDP auditing, internal control evaluation, and Section 404 work are all individually positively and significantly associated with our test variable. These results are robust to the inclusion of OSPprovided hours and their respective allocation percentages. In unreported tests, we also used additional alternative definitions of our IACONTROL% dependent variable. First, we deleted amounts allocated to Section 404 activities as this may be more a function of the regulatory environment than of audit committee oversight. In these tests, our results also remain qualitatively similar. Second, we created another “controls-related” dependent variable that excludes activities that may not fit the classic definition of control-related activities such as fraud audits, risk management, and compliance audits. Results from these regressions are substantively the same as those reported in Table 6. Additional Sensitivity Analysis We performed a number of additional sensitivity analyses. First, we added several additional explanatory variables to our model. These additional variables, primarily extracted from Carcello et al. 共2005兲, included the issuance of securities, industry classification 共i.e., dichotomous variables for inclusion in the financial, service, or utility industries兲, number of reportable segments, presence of a restatement in any of the prior three years, audit fees, and return on assets. These variables were added to the regressions both singly and together. These additional variables were statistically insignificant and did not qualitatively alter our results. Second, to address the possibility that smaller IAFs focus on internal controls as a function of necessity 共given their relatively smaller budgets兲, we created a variable defined as total IAF budget 共including both in-house and outsourced IAF budgets兲/total sales. This variable was included as both a main effect 共i.e., as a stand-alone variable兲, as well as an interactive effect with AC_OVRSGHT. Neither of the two coefficient estimates was statistically significant and our results remained qualitatively unchanged. We also defined a variable measured as total in-house IAF budget/total sales. The variable was included as both a main effect, as well as interactive term with AC_OVRSGHT. As with the prior test, neither of the coefficient estimates was statistically significant, and our results remained qualitatively unchanged.11

11

We also replicated the results of Carcello et al. 共2005兲 with our AC_OVRSGHT variable, rather than the dichotomous audit committee review of the IA budget variable used by Carcello et al. 共2005兲. We find a significant positive relation between the size of internal audit budget 共in both dollars and hours兲 and our AC_OVRSGHT variable, which is generally consistent with Carcello et al. 共2005兲. However, our coefficient estimate in this regression was 0.022, suggesting that audit committee oversight has a slight impact on the size of the internal audit budget, but that such oversight has a more significant impact on the focus of the budget.

Accounting Horizons


20


TABLE 7 OLS Regression Results of Specific Activities IA_ACTIVITY% = b0 + b1AC_OVRSGHT + b2SIZE + b3LEVERAGE + b4INVRATIO + b5FORSALE + b6GROWTH + b7OPCASH + b8RDINTENSE + b9MW + b10MANAGE + ␧ Financial Statement Audits of Subsidiaries Independent Variables Intercept AC_OVRSGHT SIZE LEVERAGE INVRATIO FORSALE GROWTH OPCASH RDINTENSE MW MANAGE Observations

R2

Coefficient Estimate 0.882 ⫺1.002 0.811 0.005 0.882 1.025 0.005 0.104 0.647 1.772 ⫺1.884 134 0.2024

t-statistic 1.00 ⫺3.01*** 1.34 0.03 1.05 2.44** 0.43 1.53* 0.99 1.04 ⫺1.01

External Auditor Assistance Coefficient Estimate ⫺1.411 ⫺0.556 0.705 ⫺0.003 ⫺0.954 3.098 0.055 0.492 0.743 ⫺2.965 1.776 134 0.2303

t-statistic ⫺2.00 ⫺4.45*** 0.34 ⫺0.52 ⫺0.78 0.33 0.10 3.09*** 0.01 ⫺0.01 1.01

Special Consulting Projects Coefficient Estimate ⫺1.443 ⫺1.885 1.222 ⫺0.007 0.794 2.335 0.501 0.993 0.013 0.992 2.352 134 0.1776

t-statistic ⫺0.96 ⫺3.76*** 1.98** ⫺0.87 1.01 0.12 0.16 1.45* 0.78 1.08 1.54*

EDP Auditing Coefficient Estimate 0.656 4.055 1.015 0.702 2.055 4.878 0.008 ⫺0.885 1.995 2.702 ⫺1.323 134 0.5001

t-statistic 0.86 3.99*** 3.02*** 2.06** 3.66*** 0.88 2.10** ⫺0.40 0.01 1.69** ⫺2.09**

Internal Control Evaluations Coefficient Estimate ⫺1.225 3.668 0.939 0.313 2.668 0.555 0.003 ⫺0.885 ⫺4.977 1.002 ⫺2.111 134 0.5992

Section 404-Related Work Coefficient Estimate

t-statistic ⫺1.77 4.01*** 2.88** 2.04** 3.01*** 0.40 2.18** ⫺0.04 ⫺2.82** 2.87** ⫺1.90**

⫺1.093 2.776 0.062 ⫺0.078 1.728 0.012 0.008 ⫺1.476 ⫺4.886 0.998 ⫺1.756 134 0.4998

t-statistic ⫺1.559 4.103*** 3.022*** ⫺0.149 3.009*** 0.668 2.547** ⫺0.808 ⫺3.054*** 2.975*** ⫺1.652*

*, **, *** one-tailed p-value ⬍ 0.10, 0.05, and 0.01, respectively.

(continued on next page)


March 2010

Variable Definitions: IA_ACTIVITY% ⫽ percentage of in-house IAF hours devoted to each of the following IAF activities: financial statement audits of subsidiaries, external auditor assistance, special consulting projects, EDP auditing, internal control evaluations, and Section 404-related work. Obtained from survey question #3; AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management 共CEO and CFO兲. Measured by respondents’ Likert scale answers concerning internal audit reporting relationships, termination rights, and budgetary oversight. See text for calculation; SIZE ⫽ natural log of total assets 共in billions兲; LEVERAGE ⫽ ratio of total long-term debt to total assets; INVRATIO ⫽ ratio of inventory to total assets; FORSALE ⫽ foreign sales as a percentage of total sales;

GROWTH ⫽ three-year rate of sales growth; OPCASH ⫽ operating cash flow scaled by total assets; RDINTENSE ⫽ R&D expenditures as a percentage of total sales; MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise; and MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.

Serving Two Masters

Accounting Horizons

TABLE 7 (continued)

21


22


Finally, we conducted univariate tests for differences between early and late responders and found no significant differences between the two subsamples. We tested for significant differences between respondents and nonrespondents in the Fortune 1000 in terms of our Compustat-related variables as well as the incidence of material weaknesses under SOX 404, and the incidence of restatements. The differences were insignificant. CONCLUSION This paper examines the association between audit committee oversight of the IAF and the nature of internal audit activities. Motivation for the study is threefold. First, the regulatory and best practices guidance typically fails to explicitly delineate audit committee duties regarding the IAF. Second, little prior research has been done on either the nature of IAF activities or the relative degree of IAF-audit committee interaction vis-à-vis management. In particular, prior research has virtually ignored the potentially competing claims on IAF resources between management and the audit committee. Finally, little evidence exists concerning how audit committee incentives may have shaped the nature of IAF activities, despite increased calls to strengthen the relationship between the IAF and the audit committee. In this study, we hypothesize that the audit committee’s desire to avoid financial misstatement leads to an increased IAF focus on internal controls. However, the extent to which this is possible is determined by the audit committee’s oversight of the IAF. Our results from a survey of 134 chief internal auditors are consistent with our hypothesis. In particular, audit committees with greater IAF oversight are associated with larger percentages of IAF hours being allocated toward internal controls activities. Moreover, our results suggest that a significant number of Fortune 1000 companies have audit committees that appear to have little oversight of the IAF. This speaks to the relevance and timeliness of the recommendations of numerous parties concerning audit committee internal audit termination/hiring rights and budgetary controls. We also document significant differences in the allocation of IAF budgets across different activities, an area with very little prior research. We find that the majority of the IAF budget is devoted to internal controls activities, but the remainder 共allocated to noncontrols activities兲 is considerable. Our evidence indicates that outsourcing arrangements are quite prevalent, but are also quite specific. In particular, the majority of outsourcing hours were spent on Section 404related activities, with a lesser portion devoted to assisting the external auditor with the financial statement audit. Our results suggest that an audit committee’s demand for better internal controls may lead to greater IAF focus on internal controls. However, our ability to make causal connections is limited by at least five factors. First, and most importantly, our survey instrument captures the CIAs’ perception of audit committee oversight and may not indicate the complex relationships among the various IAF stakeholders. Second, our research design does not allow us to make causal inferences, only to document associations. Third, all of our survey respondents were subject to Section 404, and our results may not be generalizable to firms not yet subject to Section 404. Related to this, our sample period may reflect a not yet fully realized adjustment to Section 404. That is, as registrants adjusted to new expectations of internal controls reporting, they may have been disproportionately focused on internal controls, unrelated to our test variable. This may not hold true in future periods when Section 404 implementation is completed. Given that our results remained robust to the exclusion of Section 404 activities, we believe this concern is partially mitigated. In addition, although the significant associations might be more pronounced during the time period examined, we note that the directional associations are consistent with the underlying charges of the audit committee compared with management, irrespective of the time period examined. Fourth, response bias may reduce the generalizability of our results. Finally, endogeneity issues


March 2010

Serving Two Masters

23

may be at play. In particular, management that is highly concerned with internal controls may simultaneously place more oversight over internal audit with the audit committee and direct more IAF focus toward internal controls. Despite these concerns, we believe that future researchers can utilize our results to benchmark both internal audit resource allocations and the degree of audit committee oversight of the IAF. In doing so, a more complete understanding of causality may be obtained. In addition, we urge future researchers to more fully explore the IAF-audit committee relationship to understand the determinants of the mix of IAF activities. Our results also speak to the need for regulators to consider the incentives of the various stakeholders when determining policy. Should policy makers consider expanding or restricting specific oversight roles, they should consider the concomitant effects on the internal audit function, and the differential incentives faced by the audit committee and executive management. In addition, as audit committees and managers jointly work or oversee the work of internal auditors, our results suggest that these two oversight participants should consider how their respective incentives potentially bias the focus of the internal audit department away from a mix of activities that optimally address the greater business risks of the company. Likewise, as external auditors assess the organizational status of the internal audit department, they may also wish to consider the apparent focus of internal audit as a potential indication of oversight control.

REFERENCES Abbott, L. J., and S. Parker. 2000. Audit committee characteristics and auditor choice. Auditing: A Journal of Practice & Theory 19 共2兲: 47–66. ——–, G. Peters, and D. Rama. 2007. Corporate governance, audit quality and the Sarbanes-Oxley Act: Evidence from internal audit outsourcing. The Accounting Review 82 共4兲: 803–835. Anderson, U. 2003. Assurance and Consulting Services. Research Opportunities in Internal Auditing. Altamonte Springs, FL: Institute of Internal Auditors Research Foundation. Beasley, M. S. 1996. An empirical analysis of the relation between the board of director composition and financial statement fraud. The Accounting Review 71 共4兲: 443–465. Braiotta, L. 2000. The Audit Committee Handbook. 2nd edition. New York, NY: John Wiley. Carcello, J. V., D. Hermanson, and K. Raghunandan. 2005. Factors associated with U.S. public companies’ investment in internal auditing. Accounting Horizons 19 共2兲: 69–84. ——–, and T. L. Neal. 2000. Audit committee characteristics and auditor reporting. The Accounting Review 75 共4兲: 453–467. Chan, S. 2004. Sarbanes-Oxley: The IT dimension. The Internal Auditor 共February兲: 31–33. Coffee, J. C., Jr. 2005. The scarlet letter: What happens after an adverse opinion on internal controls? The Corporate Governance Advisor 13 共1兲: 1–6. Deloitte. 2006. Optimizing the Role of Internal Audit in the Sarbanes-Oxley Era. 2nd ed. New York, NY: Deloitte Development LLC. Ditello, A. 2004. Dealing with uncertainty in knowledge-intensive firms: The role of management control systems as knowledge integration systems. Accounting, Organizations and Society 29 共December兲: 401–421. Eilifsen, A., and W. F. Messier. 2000. The incidence and detection of misstatements: A review and integration of archival research. Journal of Accounting Literature 19: 1–43. Ernst & Young. 2006. Board Members on Risk–Leveraging Frameworks for the Future. New York, NY: Ernst & Young LLC. Felix, W. L., A. A. Gramling, and M. J. Maletta. 2001. The contribution of internal audit as a determinant of external audit fees and factors influencing this contribution. Journal of Accounting Research 39 共December兲: 513–534. Ge, W., and S. McVay. 2005. The disclosure of material weaknesses in internal control after the SarbanesOxley Act. Accounting Horizons 19 共3兲: 137–158.

Accounting Horizons


24


Graham, J. R., C. R. Harvey, and S. Rajgopal. 2005. The economic implications of corporate financial reporting. Journal of Accounting and Economics 40 共1–3兲: 3–73. Gramling, A., and D. Hermanson. 2006. What role is your internal audit function playing in corporate governance? Internal Auditing 6: 37–39. Gray, G. L. 2004. Exploring the effects of the Sarbanes-Oxley Act on internal auditors. Working paper, California State University. Hermanson, D. R. 2002. The growing stature of internal auditing. Internal Auditing 17 共6兲: 43–44. ——–, and L. Rittenberg. 2003. Internal Audit and Organizational Governance. Research Opportunities in Internal Auditing. Altamonte Springs, FL: Institute of Internal Auditors Research Foundation. Institute of Internal Auditors 共IIA兲. 2002a. The IIA’s Recommendations to the Conference Committee on H.R. 3703. Altamonte Springs, FL: IIA. ——–. 2002b. Recommendations for Improving Corporate Governance. Altamonte Springs, FL: IIA. ——–. 2003a. The IIA’s Position Statement on Audit Committees. Altamonte Spring, FL: IIA. ——–. 2003b. The IIA’s Commentary Regarding PCAOB Rulemaking Docket No. 008. Altamonte Springs, FL: IIA. Jefferson Wells. 2004. The Right Stuff: Seven Key principles for Building an Effective Audit Committee. New York, NY: Jefferson Wells International. KPMG. 2008. The Audit Committee Journey: Charting Gains, Gaps, and Oversight Priorities: A Global View. Albany, NY: Audit Committee Institute–KPMG International. Krishnan, J. 2005. Audit committee quality and internal control: An empirical analysis. The Accounting Review 80 共2兲: 649–675. Lightle, S. S., and C. W. Vallario. 2003. Segregation of duties in ERP. Internal Auditor 共October兲: 27–29. McHugh, J., and K. Raghunandan. 1994. Internal auditors’ independence and interactions with audit committees: Challenges of form and substance. Advances in Accounting 12: 313–333. Pei, B. K., and F. G. Davis. 1989. The implications of organizational structure on internal auditor organizational-professional role stress: An exploration of linkages. Auditing: A Journal of Practice & Theory 8 共2兲: 101–115. PricewaterhouseCoopers LLP 共PwC兲. 2006. Views of Audit Committee Chairmen on the Effectiveness of Internal Audit. New York, NY: PricewaterhouseCoopers LLP. Public Company Auditing Oversight Board 共PCAOB兲. 2004. An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements. Auditing Standard No. 2. Washington, D.C.: PCAOB. Public Oversight Board 共POB兲. 2000. Panel on Audit Effectiveness: Report and Recommendations. Stamford, CT: POB. Quarles, R. 1994. An examination of promotion opportunities and evaluation criteria as mechanisms for affecting internal auditor commitment, job satisfaction and turnover intentions. Journal of Managerial Issues VI 共2兲: 176–194. Raghunandan, K., D. V. Rama, and P. Scarbrough. 1998. Accounting and auditing knowledge level of Canadian audit committees: Some empirical evidence. Journal of International Accounting, Auditing & Taxation 7 共2兲: 181–194. Ramamoorti, S. 2003. Internal Auditing: History, Evolution, and Prospects. Research Opportunities in Internal Auditing. Altamonte Springs, FL: Institute of Internal Auditors Research Foundation. Reinstein, A., J. Callaghan, and L. Braiotta, Jr. 1984. Corporate audit committees: Reducing directors’ legal liabilities. Journal of Urban Law 共Winter兲: 375–389. Scarbrough, D. P., D. V. Rama, and K. R. Raghunandan. 1998. Audit committee composition and interaction with internal auditing: Canadian evidence. Accounting Horizons 12 共1兲: 51–62. Srinivasan, S. 2005. Consequences of financial reporting failures for outside directors: Evidence from restatements. Journal of Accounting Research 43 共2兲: 291–334. U.S. House of Representatives, Committee on Financial Services. 2002. Sarbanes-Oxley Act of 2002. Public Law No. 107–204. Washington, D.C.: Government Printing Office. Verschoor, C. 2002. Reflections on the audit committee’s role. The Internal Auditor 2: 26–35.


March 2010