JIS Senior Editors' Blog

Journal of Information Systems

This is a public blog  publicRSS

blog entry

    Forthcoming paper: The Effect of Frequency and Automation of...
    blog entry posted March 18, 2016 by Roger S Debreceny, tagged research 
    Forthcoming paper: The Effect of Frequency and Automation of Internal Control Testing on External Auditor Reliance on the Internal Audit Function
    intro text:

    A forthcoming paper in JIS authored by Dr Maia Farkas at California State University, San Marcos and Dr Rina Hirsch from Hofstra University is entitled The Effect of Frequency and Automation of Internal Control Testing on External Auditor Reliance on the Internal Audit Function. Here is a summary of the paper.


    Maia Farkas

    Dr Maia Farkas

    Rina Hirsch

    Dr Rina Hirsch




    Over the last two decades, audits of publicly traded companies have become increasingly onerous and costly, in large part due to extensive control testing mandated by the Sarbanes-Oxley Act of 2002. For this reason, increasing audit efficiency has become more and more important. One way to improve audit efficiency is for the external auditor to rely on a strong internal audit function (IAF). Furthermore, management benefits from improved audit efficiency by way of lower audit fees, ensuring compliance with regulations, enhancing risk assessments, and ensuring the adequacy and functioning of internal controls.


    Using an experiment with experienced external auditors as participants, we examine a setting in which the external auditor identifies poor work performance by the IAF and management implements an internal control testing remediation strategy that varies on two characteristics: automation and frequency. The level of automation can vary from no automation (entirely manual) to complete automation (entirely information technology based). The frequency of internal control testing can vary from periodic testing to continuous testing. We investigate whether the following remediation strategies are effective in improving external auditors’ perceptions of IAF competence, work performance, and objectivity as well as subsequent reliance decision: automated controls testing conducted on a real-time basis (akin to continuous controls monitoring or CCM), automated controls testing conducted on a weekly basis (akin to Audit Command Language or ACL), and manual controls testing conducted by internal auditors on a weekly basis.


    Our results indicate that the frequency characteristic of the remediation strategies indeed affects external auditors’ perceptions of competence, work performance, and objectivity, while the automation characteristic of the internal control testing remediation strategies does not impact these perceptions of the strength of the IAF. Contrary to our expectations, external auditors appear to improve reliance on the IAF when the internal control testing is performed less frequently as opposed to more frequently. We suggest that management may not need to invest in expensive continuous controls monitoring technologies to improve reliance subsequent to a shortcoming in the IAF’s work performance if improved reliance (and hence lower audit fees) are its ultimate goal.

    Interestingly, all three remediation strategies are effective at improving assessments of the IAF’s poor work performance as well as external auditors’ reliance on the internal auditors. Thus, some benefit will accrue to management, regardless of the strategy employed. These results provide useful information to management, enabling them to maximize the benefits associated with having a higher quality IAF. Furthermore, our results are informative to standard setters that are interested in how external auditors assimilate information cues.