serving two masters: the association between audit committee internal audit oversight and internal...

TgdE

LAo

Accounting Horizons American Accounting AssociationVol. 24, No. 1 DOI: 10.2308/acch.2010.24.1.12010pp. 1–24

Serving Two Masters: The Associationbetween Audit Committee Internal AuditOversight and Internal Audit Activities

Lawrence J. Abbott, Susan Parker, and Gary F. Peters

SYNOPSIS: In this paper, we investigate the association between the audit commit-tee’s oversight of the internal audit function �IAF� and the nature of IAF activities. Theimportance of internal controls and of the roles of both the audit committee and theinternal audit function in monitoring control activities have grown in recent years. De-spite the importance of these topics, relatively little regulatory or best practices guid-ance addresses the distribution of IAF activities and amount of audit committee involve-ment with the IAF. We hypothesize that when the balance of oversight over the IAF lieswith the audit committee �vis-à-vis management�, the committee will steer the IAF to-ward a more internal-controls-oriented focus. Our hypothesis is based on the existingpractice guidance in this area and the relative incentives of management and the auditcommittee.

To test our hypothesis, we survey 134 chief internal auditors from Fortune 1000firms regarding the amount of internal audit resources allocated across internal auditactivities in fiscal year 2005. We then construct a composite measure of audit commit-tee oversight contingent on the relative control that the audit committee has over IAFvis-à-vis management. Our composite measure is derived from three key facets of theaudit committee/internal audit relationship: reporting duties, termination rights, and bud-getary control. Consistent with our hypothesis, we document a strong, positive asso-ciation between our audit committee oversight variable and the amount of IAF budgetallocated to internal-controls-based activities.

INTRODUCTIONhis study examines the association between the activities performed by the internal auditfunction �hereafter, IAF� and the extent of audit committee oversight of the IAF. Twoprimary concerns motivate our study. First, relatively little regulatory or best practices

uidance relates to the distribution of IAF activities, and virtually no current research has beenone about these activities. We believe this topic to be important because current New York Stockxchange listing rules require registrants to maintain an IAF, increasing the pervasiveness of

awrence J. Abbott is an Associate Professor at the University of Wisconsin–Milwaukee, Susan Parker is anssociate Professor at Santa Clara University, and Gary F. Peters is an Associate Professor at the Universityf Arkansas.

Submitted: December 2007Accepted: September 2009

Published Online: March 2010Corresponding author: Lawrence J. Abbott

Email: [email protected]

irscHarr

taeesai�2hd

fla�afiWhptrqaI

owCyIbrmdpa

oi

2 Abbott, Parker, and Peters

AA

nternal audit. The second motivation concerns the relatively incomplete set of audit-committee-elated regulations. In particular, the Sarbanes-Oxley Act of 2002 �SOX� �U.S. House of Repre-entatives, Committee on Financial Services 2002� requires audit committee oversight of internalontrols over financial reporting and also mandates reporting on a registrant’s internal controls.owever, SOX is silent on internal audit, a key participant in both the financial reporting process

nd the internal control structure. Moreover, SOX does not address internal audit’s reportingelationship with the audit committee or the audit committee’s duties concerning internal auditesources.

In response to SOX and the associated increase in audit committee responsibilities, the Insti-ute of Internal Auditors �IIA 2003a� issued a commentary on standards relating to public companyudit committees. In it, the IIA states the audit committee should expect the IAF to examine andvaluate the adequacy and effectiveness of the organization’s systems of internal control. Tonsure that internal auditors carry out these internal control responsibilities, the audit committeehould review and approve the IAF’s staffing schedules and financial budgets. By doing so, theudit committee can determine whether budget limitations impede the ability of the IAF to executets audit plans. These sentiments are echoed by the Public Company Accounting Oversight BoardPCAOB 2004� and other audit stakeholders �KPMG 2008; Ernst & Young 2006; Jefferson Wells004�. In particular, the PCAOB’s Auditing Standard No. 2 �effective during our sample period�ighlights the importance of the adequacy of internal audit activity and whether the IAF reportsirectly to the audit committee in assessing control risk for the entity �PCAOB 2004�.

The use of the IAF in meeting heightened audit committee oversight expectations may con-ict with management’s IAF objectives �Gray 2004; Hermanson 2002�. More specifically, man-gement may view the IAF as a means of achieving operational goals and generating cost savingsAnderson 2003; Hermanson and Rittenberg 2003�. In contrast, an audit committee’s litigationalnd reputational concerns can engender a demand for the IAF to focus its efforts on evaluatingnancial-statement-related internal controls �Krishnan 2005; Braiotta 2000; Reinstein et al. 1984�.hile the CEO and CFO bear the ultimate responsibility for internal controls, these individuals

ave distinct financial reporting and compensation-related incentives that are not necessarilyresent for audit committee members �Ernst & Young 2006�. Thus, instances may occur in whichhe two primary consumers of IAF resources may disagree with respect to the allocation of thoseesources �Anderson 2003; Hermanson and Rittenberg 2003; Raghunandan et al. 1998�. Conse-uently, we posit that the extent to which the audit committee can direct IAF resources towardctivities that reduce their reputational and litigational exposures depends on its oversight of theAF.

In this paper, we examine the association between audit committee oversight and the amountf IAF resources allocated to internal-controls-based activities. To address our research question,e obtained 134 useable survey responses from Fortune 1000 chief internal auditors �hereafter,IAs� regarding their interactions with audit committees and their budget allocations for fiscalear 2005. We construct our audit committee oversight variable based on the relative amount ofAF control that the audit committee possesses vis-à-vis management. This continuous variable isased on three critical facets of the IAF/audit committee relationship: reporting lines, terminationights, and budgetary control. Note that each facet can range from being the sole domain of upperanagement to the sole domain of the audit committee—thus the need to measure the relative

egree of control between these two potentially conflicting IAF supervisors. Consistent with ourrediction, we find that the percentage of the IAF budget devoted to internal-controls-basedctivities is positively related to our measure of the audit committee’s oversight.

The evidence provided herein indicates a positive association between the audit committee’sversight and a more controls-based IAF focus. In doing so, our study contributes to the literaturen four distinct ways. First, we extend Carcello et al. �2005�, which explored the determinants of

ccounting Horizons March 2010merican Accounting Association

t�rsibtic�

apa�opcaIdtI

iolacripmb2afivpu

ad

1

Serving Two Masters 3

A

he IAF budget, including company risk, ability to pay, and audit characteristics. Carcello et al.2005� found a positive association between the size of the IAF budget and a dichotomous variableepresenting whether the audit committee reviewed the budget. We examine �in addition to budgetize� the allocation of the IAF budget, and utilize a finer measure of the degree of audit committeenvolvement with the budget process. Second, we provide initial post-SOX data regarding thereakdown of internal audit activities, an area with sparse prior evidence. We find that a substan-ial percentage �in excess of 40 percent� of in-house IAF budgets is allocated to areas unrelated tonternal control, such as special consulting projects and assisting the external auditor in the finan-ial statement audit. Moreover, we provide evidence on the allocation of outside service providerhereafter, OSP� hours, on which prior evidence is also limited.

Third, we provide initial empirical evidence on the degree of audit committee oversight, inddition to its impact on the allocation of IAF resources. Such post-SOX evidence is important toolicymakers, as SOX has increased the expectations, legal exposure, and responsibilities of theudit committee, while remaining silent as to the audit committee’s relationship with the IAFGramling and Hermanson 2006�. We find that the mean overall measure of our audit committeeversight variable is approximately 48 percent, suggesting that the audit committee is a near-equalartner with management. Finally, we create a new, relatively straightforward measure of auditommittee oversight, which extends Carcello et al.’s �2005� dichotomous treatment. For example,lthough more than 97 percent of our respondents agreed that the audit committee reviews theAF’s budget �compared with 50 percent in Carcello et al. 2005�, 40 percent disagreed or stronglyisagreed with the statement “the audit committee determines Internal Audit’s budget,” suggestinghat a more detailed measure may better capture the extent of audit committee oversight of theAF.

Our study is subject to a number of caveats. First, it is important to note that the companiesn our survey were actively engaged in initial compliance with the internal controls requirementsf SOX during our sample period �2005�. Thus, both the audit committee and management wereikely to be especially sensitive to controls and liability issues. As a result, our results may notpply to firms not subject to SOX internal control requirements or to later periods in which SOXompliance has matured. Second, our results are not meant to imply that controls-based activitiesepresent the optimal use of the IAF, nor does our evidence suggest that management is interestedn using the IAF as a means of achieving financial and operational goals exclusively. We note thatrior research is scant on the nature of internal audit activities and what constitutes an appropriateix. To whit, several professional and regulatory groups recognize the significant differences

etween IA departments in terms of size, nature, and focus �Ernst & Young 2006; Jefferson Wells004; IIA 2002a�. Third, as noted by many practitioner publications, opinion diverges consider-bly about how “good” governance uses the IAF, and this divergence likely varies from firm torm �KPMG 2008; Deloitte 2006�.1 Thus, higher levels of our audit committee IAF oversightariable should not necessarily be interpreted as indicative of better governance. To sum up, oururpose is to provide evidence on IAF activities and the IAF-audit committee relationship to betternderstand the IAF’s role in a post-SOX environment.

The remainder of this paper is organized as follows. The next section reviews prior literaturend develops our hypothesis. Succeeding sections discuss sample selection, followed by researchesign and results. Our final section concludes.

The diversity of what constitutes best practices with respect to IAF use and corporate governance will likely also varybetween countries because of different regulatory and litigation environments. We thank an anonymous reviewer for thisinsight.

ccounting Horizons March 2010American Accounting Association

A

I1aagsi2er

b�Datpc

msstao2tsaats

H

taeBtvhafi


AA

PRIOR RESEARCH AND HYPOTHESIS DEVELOPMENTudit Committees and Internal Audit

To effectively execute their corporate governance duties, audit committees rely in part on theAF �Gramling and Hermanson 2006; IIA 2003b, 2002a, 2002b; McHugh and Raghunandan994�. Many corporate governance observers point to a symbiotic relationship between the IAFnd the audit committee, with effective audit committees heightening the status of internal auditnd the IAF aiding audit committees in avoiding financial misstatement �e.g., McHugh and Ra-hunandan 1994�. However, research has yet to explore how an IAF can accomplish this, thoughome recent studies suggest that improving the quality of internal controls is likely to reduce thencidence of financial misstatement �Ge and McVay 2005; Krishnan 2005; Verschoor 2002; POB000�. Consequently, it appears reasonable that an audit committee may view the IAF as wellquipped to provide internal control assurance and, in turn, wish to have internal audit allocateelatively more of its resources toward internal control evaluation.

However, the ability of an IAF to satisfy the audit committee’s concerns may be constrainedy budgetary limitations and competition with management for the direction of scarce resourcesJefferson Wells 2004; Anderson 2003; Hermanson and Rittenberg 2003; Quarles 1994; Pei andavis 1989�. Most directly, budgetary restrictions can result in reduced testing of controls, as well

s reduced geographic audit coverage �POB 2000�. Indirectly, an IAF that spends relatively lessime on internal controls may not see the return on investment in related specialized trainingrograms, including those for electronic data processing �hereafter, EDP� auditing. Thus the auditommittee has an incentive to support the allocation of resources to internal control activities.

Carcello et al.’s �2005� study most closely addresses the above issues. These authors docu-ent a positive association between audit committees that reviewed internal audit’s budget and the

ize of that budget. Carcello et al. �2005� find that only 59 percent of the chief internal auditorsurveyed stated that audit committees reviewed internal audit’s annual budget. This may indicatehe audit committee’s reluctance to challenge management on the resources allocated to internaludit. In particular, management may endeavor to have internal audit direct more attention toperational audits and other consulting-related “value-added” services �Gray 2004; Anderson003; Hermanson and Rittenberg 2003�. Moreover, management may be reluctant to grant addi-ional resources to internal control activities that will not necessarily generate immediate costavings �Gray 2004; Anderson 2003; Hermanson and Rittenberg 2003�. This suggests that man-gement and the audit committee may have conflicts concerning not only the IAF’s budget, butlso the focus of the IAF’s activities. The current study extends the prior literature by investigatinghe associations between audit committee oversight �vis-à-vis management oversight� and re-ources devoted to specific IAF activities.

ypothesis DevelopmentAbbott and Parker �2000� posit that audit committees wish to avoid financial misstatement for

wo reasons. First are reputational capital enhancement/preservation concerns. More specifically,udit committee directors may view the directorate as a means of enhancing their reputations asxperts in decision control, which is likely a function of good internal controls �Srinivasan 2005;easley 1996�. Although audit committee service increases the reputational capital of these direc-

ors, it may also exacerbate the reputational damage should a financial misstatement occur �Srini-asan 2005�. The second reason concerns director liability, which is also a function of the likeli-ood of financial misstatement. As a consequence, audit committees take steps to heighten overalludit quality �including both internal and external audit efforts� to reduce the risk of materialnancial misstatement �Abbott and Parker 2000; Carcello and Neal 2000�.


mprahr

oKcstsoie

tpmrmtt

tmawHd

ta

ahIod

2


A

In addition, Coffee �2005� suggests that the litigation vulnerability of the audit committee isaterially altered by the additional internal control information that audit committees receive

ost-SOX. This issue is particularly important if the firm receives an adverse internal controlseport, because any subsequent decline in stock price or financial reporting issue will bring theudit committee’s actions related to the adverse report under intense scrutiny. Thus we expecteightened emphasis by the audit committee on either preventing material control weaknesses oreacting proactively to increase internal controls subsequent to an adverse report.

One means of reducing both the likelihood of misstatements and of an adverse internal controlpinion is increasing the quality of a firm’s internal control structure �Ge and McVay 2005;rishnan 2005; Verschoor 2002; Eilifsen and Messier 2000�. We posit that the use of internal audit

an increase the quality of the internal control structure in two ways. First, the IAF can devoteignificant resources to internal control evaluation and, in cases of weaknesses, improvementhereof �IIA 2002a�. Second, the pervasiveness of enterprise resource planning �hereafter, ERP�ystems in generating financial statements creates a demand for increased reliance on and testingf EDP-related application controls by internal audit �Chan 2004; Lightle and Vallario 2003�. This,n turn, increases the demand for internal control and EDP audit specialists. Both internal controlvaluation and EDP auditing would fall under the classification of controls-based activities.

On the other hand, management may not see the value-added aspect of controls-related ac-ivities and divert IAF focus away from such activities and more toward IAF activities thatroduce immediate, contemporaneous cost savings �Gray 2004; Anderson 2003�. This is becauseanagement �usually in the form of the CEO/CFO� has financial reporting and compensation-

elated incentives that are not present �or not present in the same degree� for audit committeeembers. For example, in terms of financial reporting incentives, Graham et al. �2005� find that

he majority of managers would avoid initiating a positive NPV project if it meant falling short ofhe current quarter’s consensus earnings.2

In sum, we argue that the evaluation of an audit committee’s effectiveness is heavily weightedoward the strength of the company’s internal control structures and financial reporting environ-

ent, and no mention is made of responsibilities for the firm’s economic performance. As such,udit committee members do not have the same degree of economic incentives as managementith respect to earnings per share or the pursuit of risk-taking activities that promote growth.owever, the audit committee member does receive personal benefit from the minimization ofownside risk with respect to internal controls.

Thus we hypothesize that an audit committee with relatively more IAF oversight will be ableo demand relatively greater IAF focus on internal control. This leads to our hypothesis �stated inlternative form�:

Ha: Higher levels of audit committee oversight of the IAF �compared with management’slevel of IAF oversight� will be associated with a higher percentage of IAF resourcesdevoted to internal-controls-based activities.

Although the above hypothesis reflects the incentives facing the audit committee and man-gement, the trade-offs do not necessarily imply optimal uses of the IAF. Rather, the currentypothesis is tested to determine whether certain governance structures may result in differentialAF emphasis. Although professional and regulatory organizations �such as the IIA, PCAOB, andthers� emphasize the benefits of audit committee oversight of the IAF, we are not aware of anyiscussion about anticipated outcomes related to such oversight.

These views are consistent with survey results of Ernst & Young �2006�. In a survey of 148 international corporate boardmembers, they find evidence that audit committee members emphasize and respond to distinctly different �comparedwith management� considerations of company risk.


�awdiaLtd

3

1

2

A

F

SCRA

3

A

F

SCRA


AA

SAMPLE SELECTIONOur survey questionnaire �see excerpts provided in the Exhibits� was mailed to Fortune 1000

in terms of total sales� companies, after excluding banks.3 Consistent with much prior internaludit research �Carcello et al. 2005; Raghunandan et al. 1998; Scarbrough et al. 1998�, our surveyas directed to CIAs. In survey questions #1–#3 �Exhibit 1�, CIAs were requested to provideetails concerning the hours expended by outside service providers �hereafter, OSPs� and then-house internal audit department, as well as the distribution of those hours across 10 typical IActivities for fiscal year 2005. Survey questions #6a–6i �Exhibit 2� asked respondents to provide aikert-scale level of agreement with statements concerning internal audit reporting responsibility,

ermination rights, and budgetary oversight. Note that survey questions #6a–6i in the exhibit areifferentiated by source of oversight: CFO, CEO, and audit committee. In this manner, respon-

Consistent with Carcello et al. �2005�, banks are excluded because they do not possess inventory and have uniqueregulatory environments.

EXHIBIT 1

Survey Questions Related to IAF Activities

. During fiscal 2005, approximately how many hours were devoted to internal audit services by:OUTSIDE SERVICE PROVIDERS �OSPs� _______ hoursINTERNAL PROVIDERS ________ hours

. Of the total internal audit hours provided by the outside service provider�s� as indicated in question 1,please give the approximate percentage distribution of activities �please note that the percentages shouldadd to 100%�:

ctivity Description% of

Hours Activity Description% of

Hours

inancial statement audits ofsubsidiaries

EDP auditing

pecial consulting projects Internal control evaluationompliance auditing Section 404-related workisk management activities Fraud auditsssisting external auditor infinancial statement audit

Operational audits/Other�explain�

. Of the total internal audit hours provided by the in-house internal audit department during 2005 perquestion 1, please give the approximate percentage distribution of activities �please note the percentagesshould add to 100%�:

ctivity Description% of

Hours Activity Description% of

Hours

inancial statement audits ofsubsidiaries

EDP Auditing

pecial consulting projects Internal control evaluationompliance auditing Section 404-related workisk management activities Fraud auditsssisting external auditor infinancial statement audit

Operational audits/Other�explain�


dt

fsintea

uts

w

6

S

abcdefghi


A

ents are afforded the flexibility to delineate their perception of oversight among the three poten-ial overseers.

The first survey was sent in July 2006 and resulted in a total of 72 usable responses. Aollow-up mailing was conducted in September 2006 and produced an additional 62 usable re-ponses. This leads to our final sample size of 134 observations. Table 1 provides details of thendustry membership of the 134 respondents, compared with the industry profile of the originalonbank population of Fortune 1000 companies. Per Table 1, our sample appears to be represen-ative of the Fortune 1000 population of firms, except for a slight underrepresentation of thenergy and manufacturing sectors and an overrepresentation of professional, commercial services,nd education firms.

RESEARCH DESIGNWe employ a multivariate regression approach similar to that of Carcello et al. �2005�, who

se an agency-based framework to describe the demand for internal audit services. We augmentheir regression model with our test variable, as well as additional control variables. Our regres-ion framework is summarized as follows:

IACONTROL% = b0 + b1AC_OVRSGHT + b2SIZE + b3LEVERAGE + b4INVRATIO

+ b5FORSALE + b6GROWTH + b7OPCASH + b8RDINTENSE + b9MW

+ b10MANAGE + � , �1�

here:IACONTROL% � percentage of total IA budget devoted to internal controls-related activities;AC_OVRSGHT � relative oversight of internal audit by the audit committee vis-à-vis management

�CEO and CFO�;SIZE � natural log of total assets �in millions�;

LEVERAGE � ratio of total long-term debt to total assets;INVRATIO � ratio of inventory to total assets;

EXHIBIT 2

Survey Questions Related to Audit Committee Oversight

. Please indicate your level of agreement with the following statements: �1 � strongly disagree; 2 �disagree; 3 � neutral; 4 � agree; 5 � strongly agree�.

tatement

Level ofAgreement(circle onenumber)

. Internal audit reports to the Audit Committee 1 2 3 4 5

. Internal audit reports to the Chief Financial Officer �CFO� 1 2 3 4 5

. Internal audit reports to the Chief Executive Officer �CEO� 1 2 3 4 5

. The Audit Committee has authorization to terminate the Chief Internal Auditor 1 2 3 4 5

. The CFO has authorization to terminate the Chief Internal Auditor 1 2 3 4 5. The CEO has authorization to terminate the Chief Internal Auditor 1 2 3 4 5. The Audit Committee determines Internal Audit’s annual budget 1 2 3 4 5. The CFO determines Internal Audit’s annual budget 1 2 3 4 5. The CEO determines Internal Audit’s annual budget 1 2 3 4 5


Iafape

4

F

CCEFI

MP

P

RRTAT

a


AA

FORSALE � foreign sales as a percentage of total sales;GROWTH � three-year rate of sales growth;OPCASH � operating cash flow scaled by total assets;

RDINTENSE � R&D expenditures as a percentage of total sales;MW � 1 if company reported a material internal control weakness during the prior

two years, 0 otherwise; andMANAGE � 1 if internal audit is used as a training ground for future management

positions, 0 otherwise.

Our hypothesis addresses the association between audit committee oversight and the nature ofAF activities. Our dependent variable, IACONTROL%, measures the percentage of total internaludit budget �both outsourced and in-house� devoted to controls-based activities. We classify theollowing as controls-based: EDP auditing, internal control evaluation, Section 404 testing, fraududiting, risk management activities, and compliance auditing.4 We exclude special consultingrojects, financial statement audits of subsidiaries, operational audits, and incidences in which thexternal auditor is assisted in the financial statement audit. These activities do not directly address

We include fraud auditing as a controls-related activity because at least a portion of a fraud audit would be devoted toinvestigating and correcting a control lapse. Risk management activities are included within controls-related activitiesbecause the COSO framework includes risk management as a key component of internal control. Compliance auditingis included as it typically entails testing adherence to firm-level internal control policies and procedures. Additionalsensitivity testing of the underlying activities is discussed in the results section.

TABLE 1

Sample Selection Results

ocus IndustryRelated Two-

Digit SIC Codes# of Sample

Firms% of

Sample

# ofFortune

1000Firmsa

% ofFortune

1000Firmsa

onstruction 15–17 4 3.0 23 2.9onsumer Product and Food 20–33 28 20.9 174 21.6nergy 10–14, 46, 49 14 10.4 122 15.2inancial Services 60–64, 67 12 9.0 62 7.7nformation and

Communication48, 73, 78, 79, 84 14 10.4 84 10.5

anufacturing 34–39 18 13.4 135 16.8ersonal Services andHealthcare

72, 80, 83 4 3.0 15 1.8

rofessional, CommercialServices, Education

75, 76, 82, 87, 89 8 6.0 12 1.5

eal Estate 65, 70 0 0.0 4 0.5etail and Wholesale 50–59 28 20.9 142 17.7ransportation 40–42, 44, 45, 47 4 3.0 30 3.8ll Other 1, 2, 7, 8, 99 0 0.0 0 0.0otals 134 100.0 803 100.0

Fortune 1000 firms that are banks are excluded from both the population and the sample as these firms face additionalregulation unique to their industry and do not have significant inventory accounts �making the model unfit for regressionpurposes�. The remaining 803 nonbank Fortune 1000 firms act as our sampling population.


it

rcttta

OoracicwvCwA

ic2cdfibd

5

6

7


A

nternal controls and may be seen as a means of generating immediate cost savings, especially inerms of assisting the financial statement auditor �Felix et al. 2001�.5

IACONTROL% captures the percentage of total internal audit budgets devoted to controls-elated activities. The numerator of IACONTROL% is the sum of two products: The sum ofontrols-related activity percentages for the OSP multiplied by the total number of OSP hours, andhe sum of controls-based percentages for the in-house internal audit department multiplied by theotal number of in-house internal audit hours. The denominator of IACONTROL% is the sum ofhe OSP hours and in-house internal audit hours. Consequently, IACONTROL% is bounded by 1nd 0. A mathematical representation of IACONTROL% is:

��Internal control %s for OSP� � �OSP hours�� + ��Internal control %s for in-house IAF� � �IAF hours��

�OSP hours + in-house IAF hours�.

ur audit committee oversight �AC_OVRSGHT� variable is designed to capture the degree of IAFversight the audit committee has relative to upper management �CEO and CFO�. Thus, it canange from 0 �i.e., no oversight over the IAF� to 1 �i.e., total oversight over the IAF�.6 From thenswers to survey question 6, we construct the ratio of the total agreement points for the auditommittee, divided by the total agreement points for the audit committee, CFO, and CEO. Tollustrate, if the CIA answers “5” �i.e., strongly agree� to all questions 6a–6i, then the auditommittee is seen as an equal tri-partner with the CEO and CFO. Our AC_OVRSGHT variableould receive a value of 0.33, denoting 33 percent relative oversight of the internal audit function,

is-à-vis management. If, however, the CIA strongly disagrees with any relationship with theEO/CFO �i.e., responding with a “1” to questions 6b, 6c, 6e, 6f, 6h, 6i�, while strongly agreeingith all audit committee relationships �i.e., responding with a “5” to questions 6a, 6d, 6g�, ourC_OVRSGHT variable equals 1, denoting full internal audit oversight by the audit committee.7

Consistent with Carcello et al. �2005�, our control variables are generally agency-based, as anncrease in agency costs necessitates greater monitoring. We posit that an IAF focus on controls isonsistent with its role in ensuring the efficacy of the management control systems �Carcello et al.005; Ramamoorti 2003�. Consequently, we predict a positive association between our agencyost proxies, SIZE �natural log of total assets in billions� and LEVERAGE �ratio of total long-termebt to total assets�, and our dependent variable. The need for better monitoring increases withrm complexity �Carcello et al. 2005; Ramamoorti 2003�, and we expect a positive associationetween our proxy for firm complexity, INVRATIO �ratio of total inventory to total assets�, and ourependent variable. In a related note, as a firm becomes more decentralized, there is a concomitant

The audit committee’s desire for reliable financial reporting may be served by increased IAF assistance with thefinancial statement audit. However, the results of Felix et al. �2001� suggest that direct assistance rendered by theinternal auditors has the effect of decreasing the external audit fees because of a reduction in audit effort. Thus directassistance by the IAF does not result in an overall increase in audit scope. Although resources devoted to assisting theexternal auditors can result in cost savings, we hypothesize the audit committee will have a stronger preference�compared with management� for less assistance with the financial statement audit �when traded-off against internalcontrol works�, resulting in an overall larger audit scope.Recognizing the level of control over the internal audit department as a three-pronged function of reporting, termination,and budget rights is also consistent with the PricewaterhouseCoopers �PwC� survey of audit committee chairpersons.For example, PwC observed that “even with direct reporting to the Audit Committee Chairman, there was recognitionthat �internal audit� independence is threatened if �the audit committee� does not have an active involvement in thecareer path and reward of the Head of Internal Audit, as well as in the funding of the function” �PwC 2006�.Survey responses to questions 6a–6i can range from 1–5, but are recalibrated to a scale of 0–4 By doing so, ourAC_OVRSGHT variable captures the intuition behind the relative oversight over the internal audit function. For ex-ample, if the CIA strongly disagrees �agrees� with a statement concerning the audit committee’s �CFO/CEO� reporting,hiring, and budgetary roles �i.e., responds with a “1” to questions 6a, 6d, and 6g�, the resulting AC_OVRSGHT score willbe 0. Without such recalibration, the AC_OVRSGHT value would be ��1 � 1 � 1�/�1 � 5 � 5 � 1 � 5 � 5 � 1 � 5� 5�� or 0.099.


dRsvrwicav

mkkWcrwcFtmoc

bibm

dOaapOiwbpe

8

9


AA

emand for management control systems that utilize accounting-based information �Ditello 2004;amamoorti 2003�. Our proxy for decentralization is FORSALE, which is defined as the foreign

ales as a percentage of total sales. We expect a positive coefficient estimate for our FORSALEariable. Beasley �1996� posits that firms experiencing rapid growth rates may experience dete-ioration in controls, spurring the audit committee to press for more controls-oriented work. Thisould suggest a positive association between our growth proxy, GROWTH �three-year growth rate

n sales�, and our dependent variable. The desire for cost savings �and focus away from internalontrol on the part of IA� is proxied with OPCASH, or cash flow from operations scaled by totalssets. Consistent with Carcello et al. �2005�, we expect a positive coefficient estimate for thisariable.

In terms of our additional test variables, Ditello �2004� notes that excessive emphasis onanagement control systems may have a deleterious effect on innovation. Consequently, for

nowledge-intense firms, we may observe a de-emphasis on internal controls. We proxy fornowledge-intensity with RDINTENSE, defined as the ratio of R&D expenditures to total sales.e expect a negative coefficient estimate for this variable. We add a dichotomous variable, MW,

ontingent on the presence of a reportable material internal control weakness.8 In particular, firmseporting an internal control weakness may direct resources toward the remediation of thoseeaknesses. We expect a positive association between our MW variable and the percentage of

ontrols-based activity because the IAF may be used to improve and eliminate such weaknesses.inally, we add a dichotomous variable, MANAGE, depending on whether internal audit is a

raining ground for future management positions.9 We include this variable as such career arrange-ents may induce the IAF to promote well-rounded entry into the management sphere by focusing

n the operational aspects of the business �Quarles 1994�. As such, we expect a negative coeffi-ient estimate on our MANAGE variable.

RESULTSTable 2 presents descriptive statistics for our 134 firms. Panel A of Table 2 provides a

reakdown of the size of budgets and hours allocated to in-house internal audit functions and OSPnternal audit services �approximately 75 percent of sample firms use an OSP�. In-house IAFudgets are large, with a mean �median� of 34,873 �20,000� hours. In contrast, OSP hours areuch smaller, with a mean �median� budget of 4,123 �2,000�.

Panels B and C of Table 2 present the allocation of OSP and in-house internal audit hoursevoted to specific activities. We find substantial differences in the allocation amounts betweenSPs and in-house internal audit departments. OSP budgets are dominated by Section 404-related

ctivities �with a mean �median� of 51.25 percent �60 percent� of budgeted OSP hours� andssisting the external auditor with the financial statement audit �with a mean �median� of 15.20ercent �15 percent� of budgeted OSP hours�. This may speak to the specialization on the part ofSPs in response to the Sarbanes-Oxley Act. In comparison, there is much greater variety of

n-house internal audit activities, with the most dominant activity also being Section 404-relatedork, albeit at a much lower concentration �a mean �median� of 20.50 percent �20 percent� ofudgeted in-house IA hours�. Also a considerable proportion of IAF hours �approximately 40ercent� are devoted to noncontrols-based activities. This suggests that even in the post-SOXnvironment, noninternal-control activities remain important. Panel D shows the breakdown of the

MW is coded “1” if one or more internal control weaknesses were reported by management under SOX Section 302 orby the auditor under SOX Section 404 in either 2004 or 2005.Information on this variable was obtained via our survey. The survey question was phrased as follows: “Is internal auditused as a training ground for future management positions?”


ses

PV 25th % 75th %

T 0 5,000T 8,000 37,750T 12,000 43,000

P% 25th % 75th %

F 0.00 0.00S 0.00 0.00C 0.00 0.00R 0.00 0.00A 5.00 25.00E 5.00 15.00I 5.00 15.00S 15.00 90.00F 0.00 0.00O 0.00 0.00I 57.50 95.00

P%H 25th % 75th %

F 0.00 15.00S 5.00 15.00C 0.00 0.00R 0.00 0.00A 5.00 25.00E 10.00 25.00

(continued on next page)

ServingTw

oM

asters11

Accounting

Horizons

March

2010A

merican

Accounting

Association

TABLE 2

Descriptive Data—Internal Audit Function (IAF) Activities per Survey Respon

anel A: Size of Internal Audit Budgets Including Outside Service Provider (OSP) Hours (n � 134)ariable Name Mean Median

otal OSP-Provided Hours 4,123 2,000otal In-House IAF Hours 34,873 20,000otal Combined IAF Hours 38,995 22,000

anel B: Breakdown of Outside Service Provider (OSP) Internal Audit Activities (n � 98)of OSP Hours Devoted to: Mean Median

inancial Statement Audits of Subsidiaries 1.00 0.00pecial Consulting Projects 3.00 0.00ompliance Auditing 1.25 0.00isk Management Activities 1.25 0.00ssisting External Auditor in Financial Statement Audit 15.20 15.00DP Auditing 11.35 10.00

nternal Control Evaluation 12.75 15.00ection 404-Related Work 51.25 60.00raud Audits 0.50 0.00perational Audits 0.22 0.00

nternal Control Activitiesa 78.35 80.00

anel C: Breakdown of In-House Internal Audit Activities (n � 134)of In-House Internal Audit

ours Devoted to: Mean Median


P%H 25th % 75th %

I 10.00 25.00S 15.00 35.00F 0.00 5.00O 0.00 10.00I 0.33 80.00

P 134)%A 25th % 75th %

F 0.00 15.00S 5.00 15.00C 0.00 0.00R 0.00 0.00A 5.00 25.00E 9.75 22.50I 10.00 25.00S 15.00 40.00F 0.00 5.00O 0.00 10.00I 37.50 82.50

a lated work, and fraud audits. Excludederational audits.

12A

bbott,Parker,andPeters

Accounting

Horizons

March

2010A

merican

Accounting

Association

anel C: Breakdown of In-House Internal Audit Activities (n � 134)of In-House Internal Audit

ours Devoted to: Mean Median



anel D: Breakdown of Combined [Outside Service Provider (OSP) and In-House IAF] Internal Audit Activities (n �of Combined Internal

udit Hours Devoted to: Mean Median




Internal control activities include compliance auditing, risk management activities, EDP auditing, internal control evaluation, Section 404-reare financial statement audits of subsidiaries, special consulting projects, assisting the external auditor in financial statement audit, and op

cPI

3eaoOortttTl

aw�aFi2fdl

gtdttGIsStF

vett

1


A

ombined in-house and OSP internal audit activities. In general, the allocations mirror that ofanel C because the amounts of OSP hours are small relatively to those provided by the in-houseAF.10

Table 3 presents our descriptive statistics for our test and control variables. Panel A of Tableprovides detailed information concerning our test variable, AC_OVRSGHT. AC_OVRSGHT

xhibits considerable variation, with a mean �median� value of 0.48 �0.44�. This suggests that theudit committee is generally seen as a nearly equal partner. We find that for the lower 25 percentf our firms, the audit committee has relatively little oversight over the IAF with a value of 0.28.n the other hand, the 75th percentile value of AC_OVRSGHT is 0.65. In terms of the breakdownf IAF-audit committee relations, audit committees appear to have a much greater degree ofeporting oversight �with a mean �median� agreement of 4.65 �5� with the statement that IA reportso the audit committee� than budgetary control �with a mean �median� agreement of 3.11 �3� withhe statement that the audit committee determines the IAF’s budget�. In terms of reporting rela-ionships, internal audit appears to be reporting to both the audit committee and the CFO or CEO.his could indicate a “solid line” or functional relationship with the audit committee and a “dotted

ine” or administrative relationship with the CFO or CEO.In terms of our control variables, we note that our firms, by design, are very large, profitable,

nd growing. In particular, the mean �median� of total assets is $12.86 billion �$5.49 billion�,hereas operating cash flows, on average, represent 10.34 percent of total assets. The mean

median� sales growth rate is 30.60 percent �34.95 percent�. Given their Fortune 1000 status, welso observe a meaningful degree of globalization among our sample firms, with a mean �median�ORSALE value of 14.4 percent �15.75 percent�. Sixteen percent of our sample firms had material

nternal control weaknesses, which is consistent with prior research in this area �Ge and McVay005�. Finally, slightly less than two-thirds of our sample respondents use IA as a training groundor future management positions. Although significant variation generally appears in our indepen-ent variables, Pearson pairwise correlations between independent variables appear to be quiteow, as reported in Table 4.

Table 5 presents our univariate tests, comparing the 67 sample firms with an IACONTROL%reater or equal to the median of 65 percent to the 67 sample firms with an INCONTROL% lowerhan the median IACONTROL% value of 65 percent. We document a statistically significantifference in our subsample means for AC_OVRSGHT. For those IAFs spending relatively moreime on internal control activity, the AC_OVRSGHT value is 0.597 �suggesting the audit commit-ee has more oversight of the IAF than upper management�. This compares with an AC_OVRS-HT value of 0.358 �suggesting a more limited audit committee oversight role of the IAF� for

AFs spending less than the median time on control activities. This result provides univariateupport for our hypothesis. We also document statistically significant univariate differences for ourIZE, LEVERAGE, INVRATIO, RDINTENSE, GROWTH, MW, and MANAGE variables betweenhe two subsamples. We fail to document statistically significant differences in our OPCASH andORSALE variables, however.

Table 6 presents our multivariate regression results. Our coefficient estimate on our testariable, AC_OVRSGHT, is positive and highly significant, which is consistent with our hypoth-sis. This confirms our hypothesized relation between audit committee oversight and IAF activi-ies. We believe that audit committee oversight can affect the focus on internal audit activitieshrough several mechanisms. First, during the review of the IAF’s initial program and budget, the

0 Respondents made very little use of the “other” category. Less than 3 percent of respondents used this category and forvery small allocation percentages. Answers were generally in the form of “administration” or “annual employee evalu-ations.” Consequently, our survey design appears to capture much of the array of different IAF activities.


PDF th % 75th %

I 4.00 5.00I 1.00 5.00I 1.00 4.00A 4.00 5.00

T 1.00 3.00

T 1.00 3.00

T 2.00 4.00

T 2.00 4.00

T 1.00 4.00

A 0.28 0.65

PV th % 75th %

A 2.63 14.98L 0.12 0.35I 0.05 0.22F 5.24 25.58G 3.15 73.59O 0.05 0.14R 0.00 0.00M 0.00 0.00M 0.00 1.00


14A


Accounting

Horizons

March

2010A

merican

Accounting

Association

TABLE 3

Descriptive Data—Explanatory Variables

anel A: Likert-Scale Internal Audit Oversight Response Dataegree of Agreement withollowing Survey Statements Mean Median 25

A reports to the Audit Committee 4.65 5.00A reports to the CFO 3.19 4.00A reports to the CEO 2.46 2.00udit Committee has authorization to terminatethe Chief Internal Auditor

4.51 5.00

he CFO has authorization to terminate theChief Internal Auditor

2.72 4.00

he CEO has authorization to terminate theChief Internal Auditor

2.78 4.00

he Audit Committee determines InternalAudit’s annual budget

3.11 3.00

he CFO determines Internal Audit’s annualbudget

3.38 4.00

he CEO determines Internal Audit’s annualbudget

2.55 3.00

C_OVRSGHTa 0.48 0.44

anel B: Remaining Control Variable Descriptive Dataariable Mean Median 25

SSETS 12.86 5.49EVERAGE 0.25 0.25NVRATIO 0.14 0.15ORSALE 14.40 15.75ROWTH 30.60 34.95 1PCASH 0.10 0.09DINTENSE 0.01 0.00W 0.16 0.00ANAGE 0.65 1.00

a um of all nine Likert-scale responses

V

ServingTw

oM

asters15

Accounting

Horizons

March

2010A

merican

Accounting

Association

AC_OVRSGHT is defined as the sum of the three Likert-scale responses to the three audit committee-IA statements divided by the sconcerning IA/CEO/CFO/Audit Committee relationships per survey questions 6a–6i.

ariable Definitions:ASSETS � total assets �in billions�;

LEVERAGE � ratio of total long-term debt to total assets;INVRATIO � ratio of inventory to total assets;FORSALE � foreign sales as a percentage of total sales;GROWTH � three-year rate of sales growth;OPCASH � operating cash flow scaled by total assets;

RDINTENSE � R&D expenditures as a percentage of total sales;MW � 1 if company reported a material internal control weakness during prior two years, 0 otherwise; and

MANAGE � 1 if internal audit is used as a training ground for future management positions, 0 otherwise.

RDNTENSE MW MANAGE

AALIFGOR 1.00M 0.03 1.00M 0.05 �0.07 1.00

*

Vdents’ Likert scale answers concerning

16A


Accounting

Horizons

March

2010A

merican

Accounting

Association

TABLE 4

Pearson Pairwise Correlations

ACOVRSGHT ASSETS LEVERAGE INVRATIO FORSALE GROWTH OPCASH I

C_OVRSGHT 1.00SSETS �0.07 1.00EVERAGE �0.02 �0.09 1.00NVRATIO 0.05 �0.01 0.17* 1.00ORSALE 0.03 0.11 �0.06 0.09 1.00ROWTH 0.10 0.06 0.05 0.07 0.12* 1.00PCASH �0.06 0.11 0.13* 0.06* 0.08* �0.14 1.00DINTENSE �0.03 0.01 �0.08* �0.04 0.13 0.16* 0.05W 0.09** �0.05 �0.03 �0.05 �0.08 0.08 �0.04ANAGE 0.03 0.01 0.04 0.01 0.07 0.05 0.10

, ** p-value � 0.10, 0.05, respectively.

ariable Definitions:AC_OVRSGHT � relative oversight of internal audit by the audit committee vis-à-vis management �CEO and CFO�. Measured by respon

Internal Audit reporting relationships, termination rights, and budgetary oversight. See text for calculation;ASSETS � total assets �in billions�;

LEVERAGE � ratio of total long-term debt to total assets;INVRATIO � ratio of inventory to total assets;FORSALE � foreign sales as a percentage of total sales;GROWTH � three-year rate of sales growth;OPCASH � operating cash flow scaled by total assets;



aagcitac

cwT

V

A **A *L *I *FG **OR *M *M *O

*

V


A

udit committee can voice its concerns over the amount of hours allocated to internal controlsctivities, the nature of its program, and internal audit’s scope and/or geographic coverage �Ra-hunandan et al. 1998�. Second, during the review of results of internal audit’s activities, the auditommittee can request the IAF to take actions to improve the existing internal control structure orncrease the amount of coverage on higher-risk areas �Carcello et al. 2005�. Finally, during nego-iations with management over the IAF’s program and budget, the CIA can indirectly utilize theudit committee as a bargaining tool and communicate the audit committee’s internal controloncerns to the CFO or CEO �Abbott et al. 2007�.

Consistent with Carcello et al. �2005�, we document positive, statistically significant coeffi-ient estimates on our SIZE, LEVERAGE, and INVRATIO. In keeping with our univariate results,e document a statistically significant, negative �positive� coefficient estimate on our RDIN-ENSE �GROWTH� variable. We also find support for our MW and MANAGE variables, as our

TABLE 5

Univariate Comparisons

ariable Name

Mean Valuefor 67

Firms aboveIACONTROL%

Median

Mean Valuefor 67

Firms belowIACONTROL%

Median Difference

Mann-WhitneyStatistic

C_OVRSGHT 0.597 0.358 0.239 10.551*SSETS 15.252 10.468 4.784 6.056*EVERAGE 0.287 0.213 0.074 5.364*NVRATIO 0.178 0.102 0.076 7.889*ORSALE 13.733 15.066 �1.333 0.648ROWTH 40.254 20.847 19.407 8.994*PCASH 0.095 0.107 �0.012 1.076DINTENSE 0.007 0.010 �0.003 6.995*W 0.194 0.119 0.075 5.499*ANAGE 0.552 0.746 �0.194 6.846*bservations 67 67

, **, *** p-value � 0.10, 0.05, and 0.01, respectively.

ariable Definitions:IACONTROL% � percentage of internal audit hours �both in-house provided and provided by outside service

providers� devoted to internal control activities per survey questions #1–#3. Included in this amountare hours devoted to compliance auditing, risk management activities, EDP auditing, internalcontrol evaluation, Section 404-related work, and fraud audits. Excluded are all other activities persurvey questions #2 and #3;

AC_OVRSGHT � relative oversight of internal audit by the audit committee vis-à-vis management �CEO and CFO�.Measured by respondents’ Likert scale answers concerning Internal Audit reporting relationships,termination rights, and budgetary oversight. See text for calculation;

ASSETS � total assets �in billions�;LEVERAGE � ratio of total long-term debt to total assets;

INVRATIO � ratio of inventory to total assets;FORSALE � foreign sales as a percentage of total sales;GROWTH � three-year rate of sales growth;OPCASH � operating cash flow scaled by total assets;

RDINTENSE � R&D expenditures as a percentage of total sales;MW � 1 if company reported a material internal control weakness during prior two years, 0 otherwise;

andMANAGE � 1 if internal audit is used as a training ground for future management positions, 0 otherwise.


cao

IV

IASLIFGORMMOR

*

V


AA

oefficient estimates are in the predicted directions and are statistically significant. We fail to findstatistically significant association for our OPCASH and FORSALE variables. Nonetheless, the

verall R2 of our regression model is 50 percent, suggesting a good model fit.

TABLE 6

OLS Regression Results

IACONTROL% = b0 + b1AC_OVRSGHT + b2SIZE + b3LEVERAGE + b4INVRATIO

+ b5FORSALE + b6GROWTH + b7OPCASH + b8RDINTENSE + b9MW

+ b10MANAGE + �

ndependentariable

ExpectedSign

Model 1: Total Internal AuditHours (In-house Internal

Audit Function � OutsideService Provider Hours)

Model 2: In-house InternalAudit Function Hours Only

CoefficientEstimate t-statistic


ntercept �0.965 �1.806 �0.965 �1.806C_OVRSGHT � 3.588 4.339*** 3.988 4.884***IZE � 0.922 2.034** 0.811 1.537**EVERAGE � 0.768 2.005** 0.492 1.998**NVRATIO � 1.663 2.777*** 2.114 3.050***ORSALE � �0.249 �0.579 �0.822 �0.222ROWTH � 0.003 2.105** 0.005 2.333**PCASH � �0.089 �0.775 �0.104 �0.826DINTENSE � �3.655 �2.555*** �4.824 �2.798***W � 0.727 1.912** 1.085 2.554**ANAGE � �1.222 �1.774** �1.519 �1.849**bservations 134 1342 0.5002 0.5701

, **, *** p-value � 0.10, 0.05, and 0.01, respectively, significance levels �one-tailed if in predicted direction�.

ariable Definitions:IACONTROL% � percentage of hours devoted to internal controls-related activities per survey questions #2 and #3.

Included in this amount are hours devoted to compliance auditing, risk management activities,EDP auditing, internal control evaluation, Section 404-related work, and fraud audits. Excluded areall other activities per survey questions #1–#3;

AC_OVRSGHT � relative oversight of internal audit by the audit committee vis-à-vis management �CEO and CFO�.Measured by respondents’ Likert scale answers concerning Internal Audit reporting relationships,termination rights, and budgetary oversight. See text for calculation;

SIZE � natural log of total assets �in billions�;LEVERAGE � ratio of total long-term debt to total assets;

INVRATIO � ratio of inventory to total assets;FORSALE � foreign sales as a percentage of total sales;GROWTH � three-year rate of sales growth;OPCASH � operating cash flow scaled by total assets;

RDINTENSE � R&D expenditures as a percentage of total sales;MW � 1 if company reported a material internal control weakness during prior two years, 0 otherwise;

andMANAGE � 1 if internal audit is used as a training ground for future management positions, 0 otherwise.


tor2

ctretnsasp

dmodag

A

eefevs

n�bGqsGo

1


A

Outsourced internal audit hours represent approximately 32 percent of the total. Furthermore,hose outsourced hours are heavily concentrated in internal control activities. To assess whetherur results were influenced by the heavy concentration of OSP hours on internal control issues, weeran our regressions using only the in-house IAF data. These results are found in Table 6, model, and are qualitatively similar to those using total hours.

Prior research provides little guidance as to the categorization of certain IAF activities asontrols-related, and we acknowledge that our categorization is exploratory in nature. To addresshis, we ran regressions on the six most common and pervasive individual in-house IAF activitieseported. Table 7 presents the results of those individual activity regressions. Consistent with ourxpectations, we find that the percentage of the in-house IAF budget allocated to assistance withhe external audit of the financial statements and financial statement audits of subsidiaries areegatively associated with the level of audit committee oversight, as is the percentage devoted topecial consulting projects. Conversely, the percentage of in-house IAF budget allocated to EDPuditing, internal control evaluation, and Section 404 work are all individually positively andignificantly associated with our test variable. These results are robust to the inclusion of OSP-rovided hours and their respective allocation percentages.

In unreported tests, we also used additional alternative definitions of our IACONTROL%ependent variable. First, we deleted amounts allocated to Section 404 activities as this may beore a function of the regulatory environment than of audit committee oversight. In these tests,

ur results also remain qualitatively similar. Second, we created another “controls-related” depen-ent variable that excludes activities that may not fit the classic definition of control-relatedctivities such as fraud audits, risk management, and compliance audits. Results from these re-ressions are substantively the same as those reported in Table 6.

dditional Sensitivity AnalysisWe performed a number of additional sensitivity analyses. First, we added several additional

xplanatory variables to our model. These additional variables, primarily extracted from Carcellot al. �2005�, included the issuance of securities, industry classification �i.e., dichotomous variablesor inclusion in the financial, service, or utility industries�, number of reportable segments, pres-nce of a restatement in any of the prior three years, audit fees, and return on assets. Theseariables were added to the regressions both singly and together. These additional variables weretatistically insignificant and did not qualitatively alter our results.

Second, to address the possibility that smaller IAFs focus on internal controls as a function ofecessity �given their relatively smaller budgets�, we created a variable defined as total IAF budgetincluding both in-house and outsourced IAF budgets�/total sales. This variable was included asoth a main effect �i.e., as a stand-alone variable�, as well as an interactive effect with AC_OVRS-HT. Neither of the two coefficient estimates was statistically significant and our results remainedualitatively unchanged. We also defined a variable measured as total in-house IAF budget/totalales. The variable was included as both a main effect, as well as interactive term with AC_OVRS-HT. As with the prior test, neither of the coefficient estimates was statistically significant, andur results remained qualitatively unchanged.11

1 We also replicated the results of Carcello et al. �2005� with our AC_OVRSGHT variable, rather than the dichotomousaudit committee review of the IA budget variable used by Carcello et al. �2005�. We find a significant positive relationbetween the size of internal audit budget �in both dollars and hours� and our AC_OVRSGHT variable, which is generallyconsistent with Carcello et al. �2005�. However, our coefficient estimate in this regression was 0.022, suggesting thataudit committee oversight has a slight impact on the size of the internal audit budget, but that such oversight has a moresignificant impact on the focus of the budget.


TH + b7OPCASH

IV

ontrolions

Section 404-RelatedWork

t-statisticCoefficientEstimate t-statistic

I �1.77 �1.093 �1.559A 4.01*** 2.776 4.103***S 2.88** 0.062 3.022***L 2.04** �0.078 �0.149I 3.01*** 1.728 3.009***F 0.40 0.012 0.668G 2.18** 0.008 2.547**O �0.04 �1.476 �0.808R �2.82** �4.886 �3.054***M 2.87** 0.998 2.975***M �1.90** �1.756 �1.652*O 134

R 0.4998

*

Viaries, external auditor assistance,urvey question #3;dents’ Likert scale answers concerning


20A


Accounting

Horizons

March

2010A

merican

Accounting

Association

TABLE 7

OLS Regression Results of Specific Activities

IA_ACTIVITY% = b0 + b1AC_OVRSGHT + b2SIZE + b3LEVERAGE + b4INVRATIO + b5FORSALE + b6GROW

+ b8RDINTENSE + b9MW + b10MANAGE + �

ndependentariables

Financial StatementAudits of Subsidiaries

External AuditorAssistance

Special ConsultingProjects EDP Auditing

Internal CEvaluat





CoefficientEstimate

ntercept 0.882 1.00 �1.411 �2.00 �1.443 �0.96 0.656 0.86 �1.225C_OVRSGHT �1.002 �3.01*** �0.556 �4.45*** �1.885 �3.76*** 4.055 3.99*** 3.668IZE 0.811 1.34 0.705 0.34 1.222 1.98** 1.015 3.02*** 0.939EVERAGE 0.005 0.03 �0.003 �0.52 �0.007 �0.87 0.702 2.06** 0.313NVRATIO 0.882 1.05 �0.954 �0.78 0.794 1.01 2.055 3.66*** 2.668ORSALE 1.025 2.44** 3.098 0.33 2.335 0.12 4.878 0.88 0.555ROWTH 0.005 0.43 0.055 0.10 0.501 0.16 0.008 2.10** 0.003PCASH 0.104 1.53* 0.492 3.09*** 0.993 1.45* �0.885 �0.40 �0.885DINTENSE 0.647 0.99 0.743 0.01 0.013 0.78 1.995 0.01 �4.977W 1.772 1.04 �2.965 �0.01 0.992 1.08 2.702 1.69** 1.002ANAGE �1.884 �1.01 1.776 1.01 2.352 1.54* �1.323 �2.09** �2.111bservations 134 134 134 134 1342 0.2024 0.2303 0.1776 0.5001 0.5992

, **, *** one-tailed p-value � 0.10, 0.05, and 0.01, respectively.

ariable Definitions:IA_ACTIVITY% � percentage of in-house IAF hours devoted to each of the following IAF activities: financial statement audits of subsid

special consulting projects, EDP auditing, internal control evaluations, and Section 404-related work. Obtained from sAC_OVRSGHT � relative oversight of internal audit by the audit committee vis-à-vis management �CEO and CFO�. Measured by respon

internal audit reporting relationships, termination rights, and budgetary oversight. See text for calculation;SIZE � natural log of total assets �in billions�;

LEVERAGE � ratio of total long-term debt to total assets;INVRATIO � ratio of inventory to total assets;FORSALE � foreign sales as a percentage of total sales;

ServingTw

oM

asters21

Accounting

Horizons

March

2010A

merican

Accounting

Association

TABLE 7 (continued)

GROWTH � three-year rate of sales growth;OPCASH � operating cash flow scaled by total assets;



fbvr

nbIdvahb

licgi1tc

adcars

gbpve4trpiraetF


AA

Finally, we conducted univariate tests for differences between early and late responders andound no significant differences between the two subsamples. We tested for significant differencesetween respondents and nonrespondents in the Fortune 1000 in terms of our Compustat-relatedariables as well as the incidence of material weaknesses under SOX 404, and the incidence ofestatements. The differences were insignificant.

CONCLUSIONThis paper examines the association between audit committee oversight of the IAF and the

ature of internal audit activities. Motivation for the study is threefold. First, the regulatory andest practices guidance typically fails to explicitly delineate audit committee duties regarding theAF. Second, little prior research has been done on either the nature of IAF activities or the relativeegree of IAF-audit committee interaction vis-à-vis management. In particular, prior research hasirtually ignored the potentially competing claims on IAF resources between management and theudit committee. Finally, little evidence exists concerning how audit committee incentives mayave shaped the nature of IAF activities, despite increased calls to strengthen the relationshipetween the IAF and the audit committee.

In this study, we hypothesize that the audit committee’s desire to avoid financial misstatementeads to an increased IAF focus on internal controls. However, the extent to which this is possibles determined by the audit committee’s oversight of the IAF. Our results from a survey of 134hief internal auditors are consistent with our hypothesis. In particular, audit committees withreater IAF oversight are associated with larger percentages of IAF hours being allocated towardnternal controls activities. Moreover, our results suggest that a significant number of Fortune000 companies have audit committees that appear to have little oversight of the IAF. This speakso the relevance and timeliness of the recommendations of numerous parties concerning auditommittee internal audit termination/hiring rights and budgetary controls.

We also document significant differences in the allocation of IAF budgets across differentctivities, an area with very little prior research. We find that the majority of the IAF budget isevoted to internal controls activities, but the remainder �allocated to noncontrols activities� isonsiderable. Our evidence indicates that outsourcing arrangements are quite prevalent, but arelso quite specific. In particular, the majority of outsourcing hours were spent on Section 404-elated activities, with a lesser portion devoted to assisting the external auditor with the financialtatement audit.

Our results suggest that an audit committee’s demand for better internal controls may lead toreater IAF focus on internal controls. However, our ability to make causal connections is limitedy at least five factors. First, and most importantly, our survey instrument captures the CIAs’erception of audit committee oversight and may not indicate the complex relationships among thearious IAF stakeholders. Second, our research design does not allow us to make causal infer-nces, only to document associations. Third, all of our survey respondents were subject to Section04, and our results may not be generalizable to firms not yet subject to Section 404. Related tohis, our sample period may reflect a not yet fully realized adjustment to Section 404. That is, asegistrants adjusted to new expectations of internal controls reporting, they may have been dis-roportionately focused on internal controls, unrelated to our test variable. This may not hold truen future periods when Section 404 implementation is completed. Given that our results remainedobust to the exclusion of Section 404 activities, we believe this concern is partially mitigated. Inddition, although the significant associations might be more pronounced during the time periodxamined, we note that the directional associations are consistent with the underlying charges ofhe audit committee compared with management, irrespective of the time period examined.ourth, response bias may reduce the generalizability of our results. Finally, endogeneity issues


msI

bdrn

sstaoitaa

A

—

A

B

BC

—

CC

D

D

E

E

F

G


A

ay be at play. In particular, management that is highly concerned with internal controls mayimultaneously place more oversight over internal audit with the audit committee and direct moreAF focus toward internal controls.

Despite these concerns, we believe that future researchers can utilize our results to benchmarkoth internal audit resource allocations and the degree of audit committee oversight of the IAF. Inoing so, a more complete understanding of causality may be obtained. In addition, we urge futureesearchers to more fully explore the IAF-audit committee relationship to understand the determi-ants of the mix of IAF activities.

Our results also speak to the need for regulators to consider the incentives of the varioustakeholders when determining policy. Should policy makers consider expanding or restrictingpecific oversight roles, they should consider the concomitant effects on the internal audit func-ion, and the differential incentives faced by the audit committee and executive management. Inddition, as audit committees and managers jointly work or oversee the work of internal auditors,ur results suggest that these two oversight participants should consider how their respectivencentives potentially bias the focus of the internal audit department away from a mix of activitieshat optimally address the greater business risks of the company. Likewise, as external auditorsssess the organizational status of the internal audit department, they may also wish to consider thepparent focus of internal audit as a potential indication of oversight control.

REFERENCES

bbott, L. J., and S. Parker. 2000. Audit committee characteristics and auditor choice. Auditing: A Journal ofPractice & Theory 19 �2�: 47–66.

—–, G. Peters, and D. Rama. 2007. Corporate governance, audit quality and the Sarbanes-Oxley Act:Evidence from internal audit outsourcing. The Accounting Review 82 �4�: 803–835.

nderson, U. 2003. Assurance and Consulting Services. Research Opportunities in Internal Auditing. Alta-monte Springs, FL: Institute of Internal Auditors Research Foundation.

easley, M. S. 1996. An empirical analysis of the relation between the board of director composition andfinancial statement fraud. The Accounting Review 71 �4�: 443–465.

raiotta, L. 2000. The Audit Committee Handbook. 2nd edition. New York, NY: John Wiley.arcello, J. V., D. Hermanson, and K. Raghunandan. 2005. Factors associated with U.S. public companies’

investment in internal auditing. Accounting Horizons 19 �2�: 69–84.—–, and T. L. Neal. 2000. Audit committee characteristics and auditor reporting. The Accounting Review

75 �4�: 453–467.han, S. 2004. Sarbanes-Oxley: The IT dimension. The Internal Auditor �February�: 31–33.offee, J. C., Jr. 2005. The scarlet letter: What happens after an adverse opinion on internal controls? The

Corporate Governance Advisor 13 �1�: 1–6.eloitte. 2006. Optimizing the Role of Internal Audit in the Sarbanes-Oxley Era. 2nd ed. New York, NY:

Deloitte Development LLC.itello, A. 2004. Dealing with uncertainty in knowledge-intensive firms: The role of management control

systems as knowledge integration systems. Accounting, Organizations and Society 29 �December�:401–421.

ilifsen, A., and W. F. Messier. 2000. The incidence and detection of misstatements: A review and integrationof archival research. Journal of Accounting Literature 19: 1–43.

rnst & Young. 2006. Board Members on Risk–Leveraging Frameworks for the Future. New York, NY: Ernst& Young LLC.

elix, W. L., A. A. Gramling, and M. J. Maletta. 2001. The contribution of internal audit as a determinant ofexternal audit fees and factors influencing this contribution. Journal of Accounting Research 39�December�: 513–534.

e, W., and S. McVay. 2005. The disclosure of material weaknesses in internal control after the Sarbanes-Oxley Act. Accounting Horizons 19 �3�: 137–158.


http://dx.doi.org/10.2308/aud.2000.19.2.47

http://dx.doi.org/10.2308/aud.2000.19.2.47

http://dx.doi.org/10.2308/accr.2007.82.4.803

http://dx.doi.org/10.2308/acch.2005.19.2.69


http://dx.doi.org/10.1111/j.1467-8683.2005.00397.x

http://dx.doi.org/10.1111/j.1467-8683.2005.00397.x

http://dx.doi.org/10.1016/j.aos.2003.12.001

http://dx.doi.org/10.1111/1475-679X.00026

http://dx.doi.org/10.2308/acch.2005.19.3.137

G

G

G

H—

I

———

J

K

K

LM

P

P

P

P

Q

R

R

R

S

S

U

V


AA

raham, J. R., C. R. Harvey, and S. Rajgopal. 2005. The economic implications of corporate financialreporting. Journal of Accounting and Economics 40 �1–3�: 3–73.

ramling, A., and D. Hermanson. 2006. What role is your internal audit function playing in corporategovernance? Internal Auditing 6: 37–39.

ray, G. L. 2004. Exploring the effects of the Sarbanes-Oxley Act on internal auditors. Working paper,California State University.

ermanson, D. R. 2002. The growing stature of internal auditing. Internal Auditing 17 �6�: 43–44.—–, and L. Rittenberg. 2003. Internal Audit and Organizational Governance. Research Opportunities in

Internal Auditing. Altamonte Springs, FL: Institute of Internal Auditors Research Foundation.nstitute of Internal Auditors �IIA�. 2002a. The IIA’s Recommendations to the Conference Committee on H.R.

3703. Altamonte Springs, FL: IIA.—–. 2002b. Recommendations for Improving Corporate Governance. Altamonte Springs, FL: IIA.—–. 2003a. The IIA’s Position Statement on Audit Committees. Altamonte Spring, FL: IIA.—–. 2003b. The IIA’s Commentary Regarding PCAOB Rulemaking Docket No. 008. Altamonte Springs,

FL: IIA.efferson Wells. 2004. The Right Stuff: Seven Key principles for Building an Effective Audit Committee. New

York, NY: Jefferson Wells International.PMG. 2008. The Audit Committee Journey: Charting Gains, Gaps, and Oversight Priorities: A Global

View. Albany, NY: Audit Committee Institute–KPMG International.rishnan, J. 2005. Audit committee quality and internal control: An empirical analysis. The Accounting

Review 80 �2�: 649–675.ightle, S. S., and C. W. Vallario. 2003. Segregation of duties in ERP. Internal Auditor �October�: 27–29.cHugh, J., and K. Raghunandan. 1994. Internal auditors’ independence and interactions with audit com-

mittees: Challenges of form and substance. Advances in Accounting 12: 313–333.ei, B. K., and F. G. Davis. 1989. The implications of organizational structure on internal auditor

organizational-professional role stress: An exploration of linkages. Auditing: A Journal of Practice &Theory 8 �2�: 101–115.

ricewaterhouseCoopers LLP �PwC�. 2006. Views of Audit Committee Chairmen on the Effectiveness ofInternal Audit. New York, NY: PricewaterhouseCoopers LLP.

ublic Company Auditing Oversight Board �PCAOB�. 2004. An Audit of Internal Control over FinancialReporting Performed in Conjunction with an Audit of Financial Statements. Auditing Standard No. 2.Washington, D.C.: PCAOB.

ublic Oversight Board �POB�. 2000. Panel on Audit Effectiveness: Report and Recommendations. Stamford,CT: POB.

uarles, R. 1994. An examination of promotion opportunities and evaluation criteria as mechanisms foraffecting internal auditor commitment, job satisfaction and turnover intentions. Journal of ManagerialIssues VI �2�: 176–194.

aghunandan, K., D. V. Rama, and P. Scarbrough. 1998. Accounting and auditing knowledge level ofCanadian audit committees: Some empirical evidence. Journal of International Accounting, Auditing& Taxation 7 �2�: 181–194.

amamoorti, S. 2003. Internal Auditing: History, Evolution, and Prospects. Research Opportunities in In-ternal Auditing. Altamonte Springs, FL: Institute of Internal Auditors Research Foundation.

einstein, A., J. Callaghan, and L. Braiotta, Jr. 1984. Corporate audit committees: Reducing directors’ legalliabilities. Journal of Urban Law �Winter�: 375–389.

carbrough, D. P., D. V. Rama, and K. R. Raghunandan. 1998. Audit committee composition and interactionwith internal auditing: Canadian evidence. Accounting Horizons 12 �1�: 51–62.

rinivasan, S. 2005. Consequences of financial reporting failures for outside directors: Evidence from re-statements. Journal of Accounting Research 43 �2�: 291–334.

.S. House of Representatives, Committee on Financial Services. 2002. Sarbanes-Oxley Act of 2002. PublicLaw No. 107–204. Washington, D.C.: Government Printing Office.

erschoor, C. 2002. Reflections on the audit committee’s role. The Internal Auditor 2: 26–35.


http://dx.doi.org/10.1016/j.jacceco.2005.01.002



http://dx.doi.org/10.1016/S1061-9518(98)90013-1

http://dx.doi.org/10.1016/S1061-9518(98)90013-1

http://dx.doi.org/10.1111/j.1475-679x.2005.00172.x

serving two masters: the association between audit committee internal audit oversight and internal...

Documents