Auditors' Internal Control over Financial Reporting Decisions: Analysis, Synthesis, and Research Directions

Abstract

SUMMARY We synthesize the literature on auditors' evaluation of, and reporting on, internal control over financial reporting (ICOFR), as required by the Sarbanes-Oxley Act. The purpose of the synthesis is (1) to provide information on how and how well auditors perform the task, which serves as feedback to the Public Company Accounting Oversight Board on implementation issues and problems related to auditors' application of the professional standards on ICOFR; and (2) to identify gaps in the current literature and fruitful areas of future research. Consistent with Auditing Standard No. 5, we delineate five phases of the ICOFR audit: (1) planning; (2) scoping; (3) testing; (4) evaluation; and (5) reporting. We structure our synthesis using a framework that classifies the determinants of performance in each phase into five broad areas: (a) the auditor's attributes, (b) the client's attributes, (c) the interaction between the auditor and the client, (d) task attributes, and (e) environmental attributes. Key contributions include providing an ICOFR tasks taxonomy, proposing a model of the determinants of performance for each task, evaluating auditors' performance of the tasks in our taxonomy, highlighting findings and gaps of importance to regulators, and providing a road map for future research.

Enterprise Risk Management and the Financial Reporting Process: The Experiences of Audit Committee Members, CFOs, and External Auditors

“…The findings indicate that an important issue for future research and auditing standard setters is to examine whether further consideration of ERM will aid auditors in arriving at more accurate risk assessments to appropriately determine the nature and extent of audit testing both for financial reporting and internal control evaluation (Asare et al. ; Kochetova‐Kozloski and Messier ). Moreover, an emphasis on understanding ERM from a strategic perspective may potentially strengthen financial reporting by allowing CFOs and auditors to more effectively assess the appropriateness of valuations and estimates such as obsolescence in inventory.…”

The Unintended Consequences of Material Weakness Reporting on Auditors' Acceptance of Aggressive Client Reporting

“…Second, the SEC and PCAOB have criticized auditors for reporting too few material weaknesses in ICFR (Croteau 2013;Franzel 2014). While evidence supports the concern that companies are undeservedly receiving clean ICFR audit opinions (Rice and Weber 2012;Asare et al 2013), our findings suggest regulators should carefully consider how to achieve improved ICFR reporting without sacrificing financial reporting quality. We do not advise regulators to stop encouraging the reporting of material weaknesses in ICFR, as material weaknesses provide Downloaded from http://meridian.allenpress.com/doi/pdf/10.2308/accr-52610 by guest on 11 July 2020 valuable information to capital markets on financial reporting quality.…”

“…First, auditors have been required to attest to the effectiveness of certain public clients' ICFR since 2004. Empirical research on implications of ICFR evaluation and reporting is limited, despite calls from research and practice to examine auditor effectiveness in ICFR audit tasks (Asare et al 2013;CAQ 2018) and concerns from regulators that auditors have difficulty integrating ICFR and financial statement audits (PCAOB 2009;Bhaskar, Schroeder, and Shepardson 2019). We extend prior research that suggests auditors do not always effectively modify substantive testing in response to ICFR deficiencies (Hammersley et al 2011;Mauldin and Wolfe 2014) by showing material weaknesses in ICFR affect outcomes of substantive testing, such as what corrective adjustments to require.…”

Managing group audit risk in a multicomponent audit setting

“…They ask how the auditor should address the risk associated with these unsampled components. As noted by Asare et al (2013), neither the qualitative nor quantitative research literature to date provides a mechanism to help auditors plan the scope of their procedures in the audit situation where it is impractical to audit all but an insignificant portion of the group entity, as is commonly encountered today in large, complex engagements. 11 Existing models and approaches do not specifically address the risk that arises when some significant (alone or in the aggregate) components will not be tested, and do not illustrate any allocation of materiality to the components that are proposed to be examined only through analytical procedures and thus do not consider any risks associated with unexamined components.…”