Internal and external auditors : their judgements and perceptions on internal control, based on a payroll system
Internal control evaluation is an area in which IAs and EAs interface. IAs review internal controls which are evaluated, and often relied upon, by EAs. It is now mandatory for UK listed companies to report in their annual reports whether they are complying with the Cadbury Code and, if not, why not.IAs are likely to be involved in the preparation of the internal control report since they are responsible for reviewing internal control. EAs have the responsibility of reviewing the internal control report. So, cooperation between the two groups of auditors is important. Both should be interested in any systematic differences which may exist between their judgement patterns.This study investigated this similarity assumption. Specifically, it examined whether IAs made similar judgements to EAs by means of a mailed questionnaire using a pre-answered internal control questionnaire (ICQ) for a payroll internal control system.This is, to the researcher's knowledge, the first empirical study to investigate such possible differences in the UK, and it must be treated as preliminary and exploratory.The answers to 8 internal control procedures (ICPs) were varied to produce 8 different cases. Each auditor received 8 cases which comprised: (a) 6 cases which were similar for all the EAs and IAs and (b) 2 cases which were similar for a pair of auditors (one EA and one IA). The 2 cases further contained: (i) 1 case which followed a 1/4 replicate of 2 8 design and (ii) 1 case which was the repeat of the case in (1).The 6 similar cases were able to test for "judgement consensus" amongst all auditors; that is to find out whether the auditors gave a similar rating to the 6 cases. One of the 6 cases had all the 8 ICPs present and this represented the "ICQ approach" as the case was presented using an ICQ. In addition to that, the same case was presented in two other ways to test for similarity of judgements of auditors using different techniques/approaches of evaluation.The first was the "control objectives" (CO) approach which is a control matrix with the 8 ICPs presented on the rows and 5 "control objectives" presented as columns. The auditors were required to match the ability of each ICP to achieve the 5 control objectives and they were then required to rate the ability of the overall internal control system to achieve the control objectives.The second presentation was the "control risk" (CR) approach which also had all the 8 ICPs presented on the rows and one column for the control risk rating. The auditors were required to rate the extent of "control risk" for each ICP. "Control risk" is the ability of each ICP to prevent or detect material errors from occurring. The auditors were also required to rate the "control risk" for the overall internal control system, that is the ability of the overall internal control system to prevent or detect "material errors" from occurring.There were two purposes for the 2 similar cases: (a) the case which followed the experimental design was to determine the judgement model of EAs and IAs as a group and (b) the repeat case was to test for "judgement consistency" amongst individual auditors, that is to find out whether the individual auditor gave a similar rating to the 2 cases. A judgement model, based on Kempthorne's 1/4 replicate of 28 design was determined for each group of auditors using 64 EAs' and 64 IAs' ratings. In this design, all main effects and all 28, two-cue interactions were estimable. Three-cue interactions were not intended to be measured as previous studies had indicated that they account for no or negligible interaction. The purpose of this design was so that the effects of a number of different variables could be investigated simultaneously. The judgement model was analysed by means of analysis of covariance with the personal profiles of auditors (experience, educational and position level) as covariates and the ICPs as the other independent variables.Overall, the findings indicate that there was no significant difference in judgement consensus between and within each group of EAs and IAs. The two groups were also consistent in their ratings when given similar cases to evaluate. Visually, it can be seen that EAs tend to give higher ratings to all the cases. In other words there may be a tendency for EAs to place a higher degree of reliance upon particular controls than would IAs, but it was found to be not statistically significant.There was also no significant difference found between both groups of auditors using different techniques or approaches of evaluation. They were closest in their ratings when they used the "ICQ" approach, followed by the "CO" approach and then the "CR" approach.The final judgement models of both groups of auditors were also quite similar. Both groups of auditors considered the same five ICPs (which consist of two "accounting" and three "administrative" control procedures). Consistent with previous studies, the two separation of duties procedures were found to be important in influencing the auditor's judgement.Comparing the research findings with the US results (Bailey, 1981; Landry, 1987 and Moore, 1993), it appears that there is greater judgement consensus between UK's IAs and EAs than between US's IAs and EAs. This is likely to be accounted for by a greater degree of similarity of professional qualifications and background of UK's IAs and EAs than may have been the case in the US. However, this belief deserves further study.Another implication of the findings is that there is an even stronger justification for IAs and EAs to rely on each other's work in the UK than would appear to be the case in the US. Thus, a directors' internal control report (the preparation of which IAs have had a significant input) can be relied upon more confidently by EAs.