The results of this study are important for audit firms to consider in planning, implementing, and documenting their assessment of internal controls.  Findings suggest that auditors are influenced by knowing management’s classification of the ICFR issue before making their assessment. The authors suggest this “knowledge bias” impairs independence and could also reduce audit effectiveness, impact tests of controls, and the reliance of others’ work (i.e., internal auditors).  There are additional implications for other parts of the audit (e.g., auditing estimates) where the audit client presents information that may bias an “independent assessment” of the account(s) being audited. However, as findings in this study suggest, requiring auditors to consider and explicitly document the potential impact the deficiency may have on the financial statements may reduce the impact of such knowledge biases.

Earley, C. E., Hoffman, V.B., and J. R. Joe. 2008. Reducing Management’s Influence on Auditors’ Judgments: An Experimental Investigation of SOX 404 Assessments. The Accounting Review 83 (6) 1461-1485

Under Section 404 of the Sarbanes-Oxley Act (SOX), both client management and the external auditors must evaluate the effectiveness of internal controls over financial reporting (ICFR).  Since management has to test and evaluate its internal controls, the external auditors may be testing and evaluating internal controls after management.  Knowledge of management’s conclusions as to the effectiveness of internal controls may bias the auditors’ judgment in evaluating the effectiveness of ICFR.  This paper examines whether auditors are influenced by this knowledge bias in their assessment of ICFR.  Also, the paper examines whether auditors’ explicit documentation of potential financial statement impact helps reduce any effect of knowledge bias. 

The authors collected their evidence via experimental cases administered to in-charge auditors from one of the Big 4 accounting firms. At the time of the experiment, the participants had completed at least one year of SOX 404 audit procedures for their clients. Data was collected prior to August 2007.  Participants were provided several control deficiencies and asked to evaluate their significance. Participants were either provided management’s assessment (either more or less severe) or not provided management’s assessment at all. Additionally, some participants were asked to consider and explicitly document the potential impact the deficiency could have on the financial statements, if the deficiency was not corrected.

• The authors’ find that when auditors are provided management’s assessment of ICFR issues, their classifications of control deficiencies are different than when they are not provided management’s assessments.
• Auditors are more influenced when management’s classification was “less severe” and was more favorable to management (i.e., Significant Deficiency compared to a Material Weakness), suggesting that the auditors do not “discount” management’s assessments that favor the client.
• Overall, auditors change their assessment of the control deficiency after having to consider and explicitly document the impact the control deficiencies may have on the financial statements.  This suggests that such “knowledge biases” may be reduced by having auditors consider and explicitly document potential consequences.