Lori Kopp
Associate Professor, University of Lethbridge, Canada.Internal Control Assessment and Interference Effect
Both International Standards on Auditing and U.S. Generally
Accepted Auditing Standards require risk based audits, where audit
effort is concentrated on accounts and financial statement assertions
where the risk of material misstatement is high. Since the risk of
material misstatement is a joint assessment of inherent and control risk,
assessing this risk requires the auditor to acquire an understanding of
the auditee’s internal control systems. Controls may mitigate some of
the risks that would otherwise lead to material misstatements, while
significant internal control deficiencies arising from absent, poorly
designed, or poorly executed controls increase the risk of material
misstatement.
The process of identifying risks at the transaction level is an
important early step in the design of internal control systems. That is, a
determination must be made of what could go wrong in the initiation,
authorization, recording, processing and reporting of transactions.
However, current standards and practice vary regarding when risks are
identified during internal control evaluations performed within the
external audit. In this paper, we are particularly interested in the effect
of assessing risks before identifying internal controls, compared to the
effect of identifying internal controls before assessing risks. Using
interference theory, we hypothesize that risk assessment performed by
the auditor before investigating the client’s internal control systems will
lead to a more complete identification of sources of internal control
deficiencies.
In our experiment, auditors identifying risks first identified more,
and more important, internal control deficiencies than did participants
identifying controls first, although the number of risks identified was
not significantly different between the two groups. Overall, our results
suggest that audit efficiency and effectiveness depend on the sequence
in which internal control evaluation subtasks are performed.