Embed Size (px)
Citation preview
An Analytical Model for External Auditor Evaluation of the Internal Audit Function Using Belief Functions
Vikram Desai Ph.D Student
Kenneth G. Dixon School of Accounting University of Central Florida
Orlando, FL 32816 USA [email protected]
Robin W. Roberts
Burnett Eminent Scholar and Director Kenneth G. Dixon School of Accounting
University of Central Florida Orlando, FL 32816 USA
Rajendra Srivastava Ernst & Young Professor of Accounting and Director
Ernst & Young Center for Auditing Research and Advanced Technology School of Business
The University of Kansas Lawrence, KS 66045 USA
September 2006 Acknowledgements: We would like to thank participants at the 2005 ABO Section Mid-Year Meeting for their helpful comments on an earlier version of the paper.
An Analytical Model for External Auditor Evaluation of the Internal Audit Function Using Belief Functions
ABSTRACT
The primary purpose of this paper is to advance research in internal audit (IA) evaluation
by developing an IA assessment model that considers interrelationships among specific factors
used by external auditors when evaluating the strength of the IA function. The model is built on
three factors previously identified by auditing standards and prior academic research: Compe-
tence, Work Performance, and Objectivity (SAS 65 1991; Messier and Schneider 1988; Krish-
namoorthy 2002). Our model generates an overall judgment concerning the strength of the IA
function that can aid the external auditor in assessing the reliability of a client’s internal control
system. Because evaluating the IA function entails a process of gathering items of evidence per-
taining to each IA factor and aggregating the evidence to make an overall judgment, we develop
the IA assessment model using a conceptual framework based on the prior literature and develop
an analytical expression under the belief function framework. By using this framework, we
overcome limitations of prior research regarding the modelling of interrelationships among fac-
tors and regarding difficulties in application. The results of our analysis revealed that modelling
the “And” relationship is essential for assessing the strength of the IA function. As far as interre-
lationships are concerned, the analysis revealed that when the three factors have a strong or a
perfect relationship, the strength of the IA function remains high even if we have positive or
negative evidence about one of the factors. This result holds as long as we have high levels of
beliefs about the other two factors.
Keywords: Internal Audit, Belief Functions, Evidential Reasoning approach, Reliance Decision.
JEL descriptors: M42, C11, C51
1
An Analytical Model for External Auditor Evaluation of the Internal Audit Function Using Belief Functions
1. Introduction
The Sarbanes-Oxley Act of 2002 (hereafter SOX), has greatly enhanced the role of the
internal audit (IA) function. Section 302 of SOX requires management to certify the effective-
ness of disclosure controls and procedures with respect to firms’ quarterly and annual reports.
Section 404 of SOX requires firm management to document, evaluate, and report on the effec-
tiveness of internal control over financial reporting, and requires the external auditor to evaluate
and opine on management’s assessment of internal control. This requirement may increase ex-
ternal auditors’ reliance on the work of internal auditors when they perform the integrated audit
now required under AS No. 2 (PCAOB, 2004).
For the external auditor to rely on any work performed by the IA function, the external
auditor must assess the quality of the IA function (AICPA, 2003; PCAOB, 2004). The PCAOB
(2004) contends that the considerable flexibility that external auditors have in using the work of
the IA function should translate into a strong encouragement for companies to develop high-
quality IA functions. The stronger the IA function the more extensively the external auditor will
be able to use their work (PCAOB, 2004). Even prior to the Sarbanes-Oxley Act, external audi-
tors evaluated the strength of the IA function with the objective of assessing the strength of the
internal control structure of the client. SAS No. 65 described the relationship between external
auditors and internal auditors, outlining the various ways in which external auditors can enhance
their efficiency and effectiveness by utilizing the work of the internal auditors.
There is a substantial body of accounting literature that addresses specific questions
within the broad area of research concerning the external auditor’s evaluation of the IA func-
2
tion1. We limit our discussion to studies that focus most directly on the external auditor’s as-
sessment of three IA quality factors—internal auditor Objectivity, Competence, and Work Per-
formance.2 Early studies of this kind were aimed at gaining a better understanding of the relative
importance of each factor in the external auditor’s overall evaluation, however, they did not at-
tempt to understand the interrelationships between the factors and how the interactions between
them can help auditors gain an understanding of the internal control structure of the client
(Brown 1983; Abdel-Khalik et al. 1983; Schneider 1984, 1985a, 1985b; Margheim 1986; Mess-
ier and Schneider 1988; Edge and Farley 1991). Two more recent studies, Maletta (1993) and
Krishnamoorthy (2002), explicitly recognized the interrelationships among these factors.
Maletta (1993) examined the decisions of external auditors to use internal auditors as as-
sistants throughout the audit process. The study found that external auditors use a complex proc-
ess when deciding whether or not to use the internal auditors as assistants, and also that there is a
relationship among the three factors affecting the strength of the IA function: Competence, Work
Performance, and Objectivity. The results of the analysis indicated that when inherent risk is
high, auditors consider the Work Performance of the internal auditors only when Objectivity is
high. However, no interaction effects between Work Performance and Objectivity were observed
when inherent risk was low. Further, across all inherent risk conditions, Competence was the
most important factor, followed by Objectivity and Work Performance.
Krishnamoorthy (2002) studied how the three factors of Objectivity, Work Performance,
and Competence interact in determining the strength of the IA function. Specifically, the study
employed analytical methods based on Bayesian probability to model external auditors’ evalua-
tion of the IA function. The study recognized the limitations of prior research, which employed a
descriptive, experimental approach and had no formal model guiding the research. Krishnamoor-
3
thy (2002) argues that results from these studies have been mixed and inconclusive, at least in
part due to this limitation. He concluded that it is futile to attempt a rank ordering of the factors
since the factors are interrelated and no single factor can be used in isolation to make an evalua-
tion of the IA function by the external auditors. He advocated the use of cascaded inference
structures when evaluating the strength of the IA function.
The primary purpose of this paper is to advance prior research in internal audit (IA)
evaluation by developing an IA assessment model that better models the interrelationships
among the three specific factors used by external auditors when evaluating the strength of the IA
function (SAS 65 1991; Messier and Schneider 1988; Krishnamoorthy 2002). Our model gener-
ates an overall judgment concerning the strength of the IA function that can aid the external audi-
tor in assessing the reliability of a client’s internal control system. Because evaluating the IA
function entails a process of gathering items of evidence pertaining to each IA factor and aggre-
gating the evidence to make an overall judgment, we develop the IA assessment model using the
evidential network approach of Srivastava et al. (2006) under the belief function framework.
Our paper makes several contributions to the auditing literature. First, we use the belief-
function framework in developing our assessment model, which provides a broader framework
for representing uncertainties in evidence (see, e.g., Akresh et al. 1988; Srivastava et al. 2002).
Moreover, unlike the Bayesian framework, the belief-function framework does not require the
estimation of conditional probabilities. Krishnamoorthy (2002), in his discussion of a Bayesian
approach to assessing the strength of the IA function, recognized this limitation stating that, “it
might be extremely difficult for external auditors to articulate their beliefs as conditional prob-
abilities.” (pp. 102).
4
Secondly, unlike Krishnamoorthy (2002), we explicitly model the “And” relationship be-
tween the strength of the IA function and the three factors: Competence, Work Performance, and
Objectivity. Under the “And” relationship, the strength of IA function is considered to be high if
and only if all of the three factors are present. In fact, prior research (Gramling et al. (2004) sup-
ports the argument that there should be an “And” relationship between IA function and the three
factors. When we analyze the model of Krishnamoorthy (Equation A-5, p. 120, 2002), however,
we do not obtain the desired result. For example, under the condition where all of the three fac-
tors, Competence, Work Performance, and Objectivity, are absent, we should obtain a zero pos-
terior probability that the strength of IA function is high. But, the Krishnamoorthy model yields a
non-zero posterior probability.3 By not modelling the “And” relationship, the evaluation of the
strength of IA function using Krishnamoorthy model could be misleading.
Thirdly, in response to the call by Gramling et al. (2004), our study explicitly acknowl-
edges and incorporates into the analysis the interrelationships among the IA quality factors.
Gramling et al. (2004) encouraged this line of research because they recognized a gap in research
concerning the processes by which the external auditors combine evidence on the three factors
when deciding whether or not to rely on the work of the internal auditors. Having modelled the
interrelationships explicitly, our paper provides an opportunity to analyze the results for various
special conditions such as no relationships, weak relationships, and perfect relationships among
specific factors.
Finally and most importantly, the model developed in this paper can be effectively used
by external auditors as a decision aid for assessing the strength of the IA function due to its intui-
tive appeal and ease of use. Our paper can assist them in determining the extent to which they
want to rely on the internal auditors’ work. We believe that our paper is the first to develop a
5
decision aid for this purpose. The results of our analysis revealed that modelling the “And” rela-
tionship is essential for assessing the strength of the IA function. As far as interrelationships are
concerned, the analysis revealed that when the three factors have a strong or a perfect relation-
ship, the strength of the IA function remains high even if we have positive or negative evidence
about one of the factors. This result holds true as long as we have high levels of beliefs about the
other two factors.
The rest of the paper is organized as follows: Section II briefly reviews the belief func-
tion framework. Section III describes the proposed internal audit evaluation model and its exten-
sions relative to the key frameworks in prior research as an evidential network. Section IV de-
scribes the results of the sensitivity analyses and also, the effects of the interrelationships be-
tween the factors on the assessment of the strength of the IA function. Section V discusses our
findings and Section VI presents the implications and limitations of our study.
2. Introduction to Belief Functions
There are several publications where an introduction to belief functions has appeared.
Shafer (1976) remains the classic reference on belief functions, however, discussions of belief
functions may also be found in Srivastava (1993), Srivastava and Shafer (1992), Srivastava and
Mock (2000, 2002), and Yager et al. (1994). For the convenience of readers, we provide a brief
introduction here as well.
The belief-function framework is a broader framework for representing uncertainties as-
sociated with items of evidence than probability. The probability framework does not provide a
natural and logical way to model uncertainties encountered in the real world. In contrast, the
Dempster-Shafer (hereafter, DS) theory of belief functions provides a more flexible and adapt-
able framework for modelling such uncertainties (see, e.g., Akresh et al. (1988), Gordon and
6
Shortliffe, (1990); Shafer and Srivastava, (1990); Srivastava and Mock, (2000)). Moreover, there
is empirical evidence showing that people think in terms of belief functions when making judg-
ment about uncertainties. For example, in an auditing context, Harrison et al. (2002) found that
80% of the uncertainty judgments could be modelled only using belief functions. Also, in psy-
chology, Curley and Golden (1994) found that uncertainty judgments by participants in their
study were logically consistent with the belief function framework.
Essentially, under the probability framework, we assign uncertainty in terms of prob-
ability mass, P, to each possible value of a variable where all such masses add to one. For exam-
ple, suppose there are n possible values, a1, a2 …an, of variable ‘A’ forming a mutually exclusive
and exhaustive set. Under the probability framework we assign probability mass to each value of
the variable, i.e., P (ai) ≥ 0, such that i
n
i=1P(a ) 1=∑ . However, under the belief-function frame-
work, we assign uncertainty, represented by m-values (belief masses, i.e., basic probability as-
signment function by Shafer (1976) to not only singletons but to all other possible subsets includ-
ing the entire frame Θ = {a1, a2 ….an} such that the sum of all these m-values equals one,
i.e., . The belief-function framework reduces to the probability framework when
the only non-zero m-values are for the singletons.
n
Xm(X) 1
⊆Θ=∑
Belief Function
Belief in a subset B of a frame Θ determines the total belief one has in B based on the
evidence represented through m-values. It is defined as:
X BBel(B) = m(X)
⊆∑ ,
7
where X represents a set of elements of Θ. Let us consider the following example for illustration.
Suppose we have a mixed item of evidence pertaining to a specific quality factor of the IA func-
tion, say Competence, with the internal auditor either being “competent” or “not competent”,
with the following distribution of belief masses: m(competent) = 0.6, m(not competent) = 0.3,
m(Θ) = 0.1, where Θ = {competent, not competent}. These m-values imply that, based on the
evidence, we have 0.6 level of support, on a scale of 0-1, that the internal auditor is competent,
0.3 level of support that he is not, and 0.1 level of support that he is either competent or not
competent (i.e., representing ignorance). Based on the above example, the belief that the internal
auditor is competent is Bel(competent) = m(competent) = 0.6, the belief that the internal auditor
is not competent is Bel(not competent) = m(not competent) = 0.3, and the belief that the internal
auditor is either competent or not competent is Bel({competent, not competent}) = m(competent)
+ m(not competent) + m({competent, not competent}) = 0.6 + 0.3 + 0.1 = 1.0.
Plausibility Function
Plausibility in a subset B of a frame Θ defines the degree to which B is plausible in the
light of the evidence. In mathematical terms, one can define plausibility in B as:
X BPl(B) = m(X)
∩ ≠∅∑ .
For the above example, plausibility that the internal auditor is competent is Pl (compe-
tent) = m(competent) + m({competent, not competent}) = 0.6 + 0.1 = 0.7, and plausibility that
the internal auditor is not competent is Pl (not competent) = m(not competent) + m({competent,
not competent}) = 0.3 + 0.1 = 0.4. One can express complete ignorance or lack of opinion about
B by assigning zero belief mass to ‘B’ that it is true, zero belief to ‘~B’ that ‘B’ is not true, and
1.0 to the entire frame {B, ~B}, i.e., m(B) = 0, m(~B) = 0, and m({B, ~B}) = 1.0. In other words,
8
complete ignorance in B is expressed as Bel(B) = 0, and Bel(~B) = 0, i.e., Pl(B) = 1, and Pl(~B)
= 1. The certainty in B is expressed as Bel(B) = 1, which is similar to P(B) = 1.
Dempster’s Rule
Dempster’s rule Shafer (1976) is the fundamental rule for combining multiple independ-
ent items of evidence under the belief function framework. This rule is similar to Bayes’ rule un-
der probability theory. In fact, Dempster’s rule becomes Bayes’ rule under the condition where
belief masses are assigned only to the singletons as mentioned earlier. For the case of two items
of evidence, represented by two sets of belief masses, m1 and m2, one can write the combined set
of m-values using Dempster’s rule as:
1 2B1 B2=B
m(B) = m (B1)m (B2)∩∑ /K,
where K is the renormalization constant defined as:
1 2B1 B2=
K = 1 m (B1)m (B2)∩ ∅
− ∑ .
The second term in K represents conflict. Under the situation when two items of evidence com-
pletely conflict with each other, i.e., K = 0, the two items of evidence are not combinable. Let us
consider the following example to illustrate Dempster’s rule.
Let us assume that we have two independent items of evidence related to a variable A
with two values, ‘a’ that it is true, and ‘~a’ that it is not true with the following m-values:
Evidence 1: m1(a) = 0.6, m1(~a) = 0.1, m1({a, ~a}) = 0.3,
Evidence 2: m2(a) = 0.3, m2(~a) = 0.2, m2({a, ~a}) = 0.5.
From the definition of the renormalization constant K is given by:
K = 1 – [m1(a)m2(~a) + m1(~a)m2(a)] = 1 – [0.6x0.2 + 0.1x0.3] = 0.85.
The combined m-values using Dempster’s rule are given by:
9
m(a) = [m1(a)m2(a) + m1(a)m2({a, ~a}) + m1({a, ~a})m2(a)]/K
= [0.6x0.3 + 0.6x0.5 + 0.3x0.3]/0.85 = 0.57/0.85 = 0.6706
m(~a) = [m1(~a)m2(~a) + m1(~a)m2({a, ~a}) + m1({a, ~a})m2(~a)]/K
= [0.1x0.2 + 0.1x0.5 + 0.3x0.2]/0.85 = 0.1529
m({a, ~a}) = m1({a, ~a})m2({a, ~a})/K = 0.3x0.5/0.85 = 0.1765.
Thus, the combined m-values are: m(a) = 0.6706, m(~a) = 0.1529, and m({a, ~a}) = 0.1765.
3. IA Function Evaluation Model
In this section, we first develop a conceptual framework for assessing the IA function
based on the factors described in SAS 65 (AICPA, 1991) and prior academic research (Messier
and Schneider, 1988; Krishnamoorthy, 2002). Next, we develop an analytical model based on
this conceptual framework under the Dempster-Shafer theory of belief functions for evaluating
the strength of the IA function. Figure 1 depicts this conceptual framework where the rounded
boxes represent the factors or variables that determine whether the IA function is strong or weak.
We know from the prior literature (e.g., see Krishnamoorthy, 2002) that the strength of IA func-
tion depends upon Competence (C), Work Performance (W), and Objectivity (O). This depend-
ence is modelled in Figure 1 as a logical “And” between the strength of IA function S and the
three factors C, W, and O, represented through a hexagonal box with “And” connecting all these
factors. As considered in the prior literature (e.g., see Krishnamoorthy 2002), we assume these
factors to be binary in nature, i.e., each factor takes two possible values. For example, the
strength of the IA function (S) takes two values: strong and weak, represented by SS and SW, re-
spectively. The Competence factor(C) can assume two possible values: the internal auditors are
either competent or not competent, represented by CY and CN, respectively. In a similar fashion,
10
the Work Performance (W) of internal auditors may be satisfactory or unsatisfactory (WS and
WU) and internal auditors may be objective (OY) or not objective (ON). The “And” relationship in
Figure 1 implies that the strength of the internal audit function is strong (SS) if and only if the
internal auditors are competent (CY), Work Performance is satisfactory (WS), and they are objec-
tive (OY). In terms of set notations, we can write this relationship as SS = CY∧WS∧OY.
-- Insert Figure 1 Here --
Furthermore, we expect the three factors, C, W, and O, to be interrelated. For example,
the Work Performance (W) is expected to depend upon Competence (C), i.e. a competent inter-
nal auditor is expected to exhibit better Work Performance. Similarly, one can also expect Work
Performance (W) to be dependent on Objectivity (O) since an objective and independent auditor
is more likely to make judgments that improve Work Performance (Krishnamoorthy 2002).
However, professional standards, for instance SAS 65 and prior literature, do not predict a rela-
tionship between internal auditor Competence (C) and Objectivity (O), and therefore, we assume
them to be unrelated. These interrelationships are modelled in Figure 1 through hexagonal boxes
labelled R1 and R2. R1 depicts the relationship between C and W, and R2 depicts the relationship
between W and O. Each of these relationships is bi-directional in its influence. That is, in the
case of R1, for example, if there is a belief that the internal auditor is competent, then his Work
Performance will be satisfactory. In a similar way, if there is a belief that the Work Performance
of an internal auditor is satisfactory, then he is assumed to be competent. Conversely, if the in-
ternal auditor is not competent, his Work Performance will be unsatisfactory. Similarly, in the
case of R2, if the internal auditor is objective, his Work Performance will be satisfactory. On the
other hand, if there is a belief that the Work Performance of an internal auditor is satisfactory,
then he is assumed to be objective. As described later, the strength of these relationships can be
11
expressed in terms of parameters r1 and r2, where 0≤ r1≤ 1 and 0≤ r2≤ 1. A value of zero implies
that there is no relationship and a value of 1.0 implies that there is a perfect relationship. In gen-
eral, a relationship of strength ‘r’ under the belief function-framework implies that if one factor
in the relationship is true with certainty then the other factor is true with belief ‘r’ and vice versa.
The rectangular boxes in Figure 1 represent items of evidence pertinent to various factors
as represented by direct linkages between items of evidence and the factors. In order to deter-
mine the overall strength of the IA function, one needs to gather the relevant items of evidence as
indicated in Figure 1, evaluate the level of support each item of evidence provides to the corre-
sponding factor(s), and then aggregate these assessments of support to determine the overall
level of support for the strength of the IA function. Table 1 provides the definitions of the factors
influencing the strength of the IA function along with a detailed description of the types of evi-
dence used to provide support to the corresponding factors.
--Insert Table 1 here--
In order to develop an analytical model for assessing the strength of the internal audit
function based on the conceptual framework described in Figure 1, we use the results of Theo-
rem 1 of Srivastava et al. (2006, forthcoming). Their Theorem 1 determines the overall beliefs on
a binary variable, say Z, that is related to three other binary variables, say A, B, and C, through a
logical “And” relationship. Also, their results incorporates all the interrelationships, between A
and B, between B and C, and between C and A. These relationships are assumed to be bi-
directional as in our case. Their general formulation is similar to our problem, except they con-
sider one item of evidence for each variable A, B, and C. In our case, we have three items of evi-
dence for each factor (see Figure 1). However, we can use their results in (14)-(16) directly to
obtain the desired analytical model for the overall belief that the strength of the audit function is
12
strong or weak by substituting the strength of the internal audit function (S) for Z, Competence
(C) for A, Work Performance (W) for B, and Objectivity (O) for C and setting r3 = 0, i.e., there is
no relationship between C and O as argued earlier in our case. Thus, from (15) and (16) of
Srivastava et al (2006) we obtain the following beliefs for SS and SW: in terms of the overall be-
lief masses at C, W, and O, respectively, represented by the following sets of belief masses4:
{ }, { }, and {+C Cm , m , m−
CΘ
WΘ
O+W Wm , m , m− +
O Om , m , m− Θ }.
Bel(SS) = [ + rWC Om m m+ + +1 WC Om m mΘ + + + r2 WCm m mO
+ + Θ + (r1+ r2 – r1r2) WC Om m m+ Θ +
+ r1r2( WC Om m m+ Θ Θ+ WC Om m mΘ + Θ + WCm m mO
Θ Θ + )]/K. (1)
Bel(SW) = 1− ( + )(Cm+CmΘ
Wm+ + WmΘ )( Om+ + OmΘ )/K, (2)
The symbol K is the renormalization constant and is defined as:
K = 1− r1 OmΘ ( +Cm+Wm−
Cm−Wm+ ) − r2 CmΘ ( Wm+
Om− + Wm−Om+ )
− r1r2 WmΘ ( +Cm+Om−
Cm−Om+ ) − r1( Cm−
Wm+Om+ + Cm+
Wm−Om− )
− r2( + Cm+Wm+
Om−Cm−
Wm−Om+ ) − (r1+ r2 −r1r2)( Cm+
Wm−Om+ + Cm−
Wm+Om− ) (3)
Various m-values and the interrelationships are defined in Table 2.
----- Insert Table 2 about here -----
The m-values used in (1)-(3) are the overall belief masses for the three factors C, W, and
O. Based on the conceptual framework in Figure 1, these belief masses are determined by evalu-
ating three different items of evidence in each case. In other words, these m-values are the result
of combining three individual judgements about beliefs whether each of the factors are present or
absent or satisfactory or unsatisfactory. Let us express the individual judgment based on each of
the three items of evidence for Competence factor through the following sets of m-values.
Evidence 1: m1(CY), m1(CN), m1({CY, CN})
Evidence 2: m2(CY), m2(CN), m2({CY, CN})
13
Evidence 3: m3(CY), m3(CN), m3({CY, CN})
The combined or the overall m-values for C can be determined by combining the above three
sets of m-values using Dempster’s rule. Using Srivastava’s (2005, Equation 10-13) approach for
combining m-values defined on a binary variable yields directly the following set of overall m-
values;
m = , , , C Y C
3
ii=1
1 1 m (C ) /K( )+ − −∏ C N
3
ii=1
m = 1 1 m (C ) /K( )− − −∏ C Y N C
3
ii=1
m = m ({C ,C }) / KΘ ∏
Y N
3
ii=1
1 1 m (W ) /K( )+ − −∏ W U
3
ii=1
m = 1 1 m (W ) /K( )− − −∏ W S U W
3
ii=1
m = m ({W ,W }) / KΘ ∏
S U
3
ii=1
m = 1 1 m (O ) /K( )+ − −∏ O N
3
ii=1
1 1 m (O ) /K( )− − −∏ O Y N O
3
ii=1
m ({O ,O }) / KΘ ∏
Y N
C
where . (4) C Y N
3 3 3
i i ii=1 i=1 i=1
K = 1 m (C ) 1 m (C ) m ({C , C })( ) ( )− + − −∏ ∏ ∏
Similar to (4) above, we can write the overall m-values for Work Performance (W) and
Objectivity (O) in terms of the individual judgment about m-values related to the three items of
evidence as:
m = , , , W S W W
where . (5) W S U
3 3 3
i i ii=1 i=1 i=1
K = 1 m (W ) 1 m (W ) m ({W , W })( ) ( )− + − −∏ ∏ ∏
and
O Y O , m = , m = , O
where . (6) O Y N
3 3 3
i i ii=1 i=1 i=1
K = 1 m (O ) 1 m (O ) m ({O , O })( ) ( )− + − −∏ ∏ ∏
Equation (1) along with (4)-(6) provides a general model for evaluating the strength of IA
function in terms of the belief that the strength of IA function is strong. This formula is a func-
tion of the individual judgement about the m-values related to the three factors and the strength
14
of the interrelationships, r1 and r2. The first term in (1) arises directly because of the logical
“And” relationship between S and the three factors C, W, and O. The next three terms in (1) are
due to the fact that even if we do not know about one factor but because of the interrelationships
one can conclude about the presence of this factor based on the presence of the other two factors.
The last term in (1) represent the situation where we do not have information about two of the
factors but because of the interaction again, the knowledge of the presence of one factor can pro-
vide the knowledge about the presence of the other two factors. Next, we present some special
cases of the general model.
Case 1: No Interrelationship between Factors
For this case we assume r1 and r2 to be zero, i.e., r1 = r2 = 0 which yields K =1 and belief
that the strength of IA Function is strong becomes:
Bel(SS) = WC Om m m+ + + .
As we can see from above, the belief that IA function is strong is the product of the three
belief masses that the auditor is competent, the Work Performance is satisfactory, and the auditor
is objective. This result makes intuitive sense because of the logical “And” relationship between
S (the strength of IA function) and three factors C, W, and O. Under the present situation, if any
one, two or all of the factors take complementary values then Bel(SS) will be zero.
Case 2: No Knowledge about Work Performance and the two Interrelationships are of the same strength
For this case we set r1 = r2 = r, and WmΘ = 1, which yields the following expressions for
Bel (SS) and K:
Bel (SS) = [ r(2−r) + rC Om m+ + 2( C O C Om m m m+ Θ Θ+ + )]/K, and
K = 1 − r2( ). C O C Om m m m+ − − ++
15
Again the above expression for Bel(SS) makes logical sense. Since we do not have any knowl-
edge about the Work Performance of the internal auditor, we have Wm+ = 0, = 0, and Wm−WmΘ =1.
The first term in the above equation of Bel(SS) is due to the fact that we have the knowledge that
the internal auditor is competent and also is objective (i.e., Cm+ >0, and Om+ >0) and because of
the interrelationships between C and W, and W and O, one believes that Work Performance is
satisfactory and thus a finite belief 5 that the strength of IA function is strong. The second term is
due to the second order interaction where we have knowledge about only one variable, either C
or O. This knowledge provides information about W and the third variable either O or C, through
the interrelationships. Hence, it generates a finite belief towards the strength of the IA function
being strong. The overall belief, Bel(SS), will be the highest for r = 1, i.e., for the perfect rela-
tionship.
Case 3: No Knowledge about Work Performance and Objectivity
For this case we assume that Wm+ = 0, Wm− = 0, and WmΘ =1 and Om+ = 0, = 0, and Om−OmΘ
=1. These values yield K =1 and the belief that strength of IA function is strong becomes:
Bel (SS) = r1r2 Cm+ .
The above expression of Bel (SS) again makes logical sense. It suggests that even if we do not
know about two of the three factors (say, W and O), because of the interrelationships, the direct
knowledge about the presence of one of the factors (in this case C) can permit to infer about the
other two factors (W and O) and thus leading to a non zero belief that the strength of IA function
is strong.
16
4. Sensitivity Analysis
The purpose of this section is to study the effects of changes in the beliefs of the factors
and the interrelationships among the factors on the evaluation of the strength of the IA function.
This analysis is performed using the model developed in (1).
The Effect of Objectivity on the Strength of the IA function
In practice, it is very difficult for the external auditor to obtain direct evidence for all of
the three factors; Competence, Work Performance, and Objectivity (Krishnamoorthy 2002). It
may be relatively easier for the external auditor to obtain evidence about the Competence of the
internal auditors, however. For instance, if the internal auditors are professionally certified by
AICPA or IIA, the external auditors can assign a high level of belief for the Competence of the
auditors. The same is the case when the internal auditors have a long record of professional ex-
perience in the auditing industry. However, the task of assessing the Objectivity of the internal
auditors depends on the level of transparency in the organization of the client and other factors.
Brody, Golen, and Reckers (1998) investigated the importance in the reliance decision of exter-
nal auditors’ conflict management styles (i.e., work around IA function style, deny problem
style), recent experiences with material adjustments, and perceived communication barriers be-
tween clients and the audit firm. They found that conflict management styles and perceived
communication barriers, which can be explained by the level of transparency in the client or-
ganization, were significant in explaining reliance decisions. Further, Felix et al. (2005) also
found that provision of nonaudit services also influences the reliance decision of the external
auditors. The main finding was that when nonaudit services are not provided to a client, internal
audit quality and the level of internal–external audit coordination significantly affects the reli-
ance decision. The external auditors may not know the level of independence enjoyed by the in-
17
ternal auditors in the organization and therefore may not be able to effectively assign any belief
to the Objectivity of the auditors. For instance, it is very difficult for the external auditors to find
out whether the internal auditors have easy access to the audit committee or whether the internal
auditors have the ability to investigate any activity in the organization.
The external auditors also may find it very difficult to ascertain whether the recommen-
dations of the internal audit department are being implemented by senior management within the
organization. For instance, Brody and Lowe (2000) found that internal auditors tended to take a
position that was in the best interests of the company, rather than make objective assessments
when evaluating their findings. Therefore, it follows that the evaluation of the strength of the IA
function will depend on the extent of transparency, or openness, in the auditee organization,
which eventually influences the level of Objectivity of the auditors.
Table 3 and Figure 2 show the assessed strength of the IA function for differing levels of
transparency, that is, differing beliefs about the levels of Objectivity of the internal auditors. We
first plot the strength of the IA function in an organization with a highly competent internal audi-
tor department (say, = 0.9) with a very good history of Work Performance (say, = 0.9).
We then assume a moderate level of relationship between Competence and Work Performance
(r
+Cm +
Wm
1= 0.5) and between Work Performance and Objectivity (r2= 0.5). Next, we vary the belief in
Objectivity from 0 to 1 in increments of 0.10. Here, we will consider two scenarios. In the first
scenario, the external auditors might have positive evidence about the Objectivity of the auditors.
For instance, the external auditors might be aware that the internal auditors have direct access to,
and report directly to, the audit committee. In the second scenario, they may find evidence,
which makes them question the Objectivity of the auditors. This evidence, for example, could be
18
in the form of the incentive compensation of the internal auditors being dependent on stock
prices.
--Insert Table 3 and Figure 2 Here--
As illustrated in Table 3 and Figure 2, the strength of the IA function is moderate (0.45)
in a closed organization even when the internal auditors are found to be competent and their
work is found to be of high quality, since there is no evidence about the Objectivity of the audi-
tors. However, the evaluation of the strength of the IA function increases rapidly as the external
auditor is able to gain more insight about the Objectivity of the auditors. Also, it is to be noted
that if the internal auditors are not found to be objective, in cases where the external auditors
have negative evidence about the Objectivity of the auditors, Competence and Work Perform-
ance have negligible effect on the evaluation of the strength of the IA function.
The Effect of Work Performance on the strength of the IA function
The assessment of the Work Performance of the internal auditors can also pose some dif-
ficulties for the external auditors, if they are faced with an IA function that does not readily share
its work with the external auditors. For instance, Campbell (1993) concluded that the reliance
decision was contingent on whether the auditor’s experience with the IA function was satisfac-
tory. She also found that the level of client interest in having coordination between the external
and internal auditors was a significant determinant of the reliance decision, albeit only when
there was prior satisfactory experience with the IA function. Also, Felix et al. (2001) found that
the availability of the IA function was a significant determinant of the reliance decision made by
the external auditors. If the external auditors do not get access to all of the relevant working pa-
pers and programs of the internal audit department, or if the internal auditors are not very de-
tailed in the process of documenting their work, it could be very difficult to assess the Work Per-
19
formance of the internal auditors. For instance, if the audit techniques used are not sophisticated
or if the sampling technique is not documented, the external auditors cannot assign a high level
of belief for the work of the internal auditors. Recent regulations, such as the Sarbanes-Oxley
act, have sought to remedy such a situation. Therefore, interest exists in observing the impact of
different levels of beliefs about Work Performance on the strength of the IA function, given a
high level of belief in Competence and Objectivity in the auditors.
Table 4 and Figure 3 analyze the effect of Work Performance on the strength of the IA
function. In Figure 3, we set the levels of Competence and Objectivity at 0.9 and r1 and r2 at 0.5.
Then we vary the level of belief for Work Performance from 0 to 1 with increments of 0.10. In
this analysis, as before, we consider both positive and negative beliefs about Work Performance.
-- Insert Table 4 and Figure 3 Here --
It can be seen that even with no evidence about Work Performance, the strength of the IA
function is moderately high at 0.652 and increases rapidly as we get to know more and more
about the Work Performance of the internal auditors. This shows that belief in the strength of the
IA function is affected more adversely by lack of knowledge about the Objectivity of the audi-
tors, as seen in Figure 2, than by lack of knowledge about the Work Performance of the internal
auditors. The reason for the same is that beliefs about Objectivity and Competence feed into the
belief for Work Performance, due to the two relationships, R1 and R2. Furthermore, when the
work of the internal auditors is found to be sub-standard, the belief in the strength of the IA func-
tion goes down considerably.
The Effect of Interrelationships between the Factors
The strength of the relationships between the factors of Competence, Work Perform-
ance, and Objectivity is an empirical question and can only be ascertained from the expert opin-
20
ions of the external auditors in practice. However, the question is important, because different
strengths of interrelationships will have different impacts on the evaluation of the strength of the
IA function. One of the limitations of the Krishnamoorthy (2002) study was the assumption of a
perfect relationship between the factors, considered by the external auditors in determining the
strength of the IA function (e.g., P (~W/~C, O, H) = 1; P (W/~C, O, H) = 0). As mentioned ear-
lier, this assumption may lead to an overestimation or underestimation of the strength of the IA
function. Our model provides for different strengths of interrelationships between the factors af-
fecting the strength of the IA function which provides a more realistic scenario. For instance, an
external auditor may assign a belief value of 0.9 to the Objectivity of an internal auditor. How-
ever he may not necessarily believe that the quality of his work is that high and consequently the
Work Performance factor may get a belief value of 0.3 based on the evidence about the Objectiv-
ity of the internal auditor, implying a weak relationship between Work Performance and Objec-
tivity.
Maletta (1993) reported that under low inherent risk conditions, the IA function quality
factor interactions were not significant determinants of the reliance decision, but when inherent
risk was high, he found that Objectivity and Work Performance had a significant interactive ef-
fect on the reliance decision. Also, Krishnamoorthy (2001) found that when the audit procedure
reliability was low, the Work Performance evaluation was not contingent on the Competence or
Objectivity of the internal auditors. However, when audit procedure reliability was high, the
evaluation of Work Performance was contingent on the Competence and Objectivity of the inter-
nal auditors. To study the sensitivity of the strength of the IA function to different values of in-
terrelationships, we assign the beliefs of 0.9 to Competence and Work Performance and vary the
21
belief for Objectivity for both positive and negative evidence, based on four different relation-
ship strengths. Each of the four strengths is described in Table 5 below.
-- Insert Table 5 Here --
Table 6 and Figure 4 shows the sensitivity of the strength of the IA function to different
strengths of interrelationships when there is positive evidence about one of the factors, whereas
Table 7 and Figure 5 present the analyses with negative evidence about one of the factors.
-- Insert Table 6 and Figure 4 Here --
The top line in Figure 4 represents the maximum strength of all the relationships, i.e. it
assumes perfect relationship between Competence and Work Performance and between Work
Performance and Objectivity. It can be seen that the strength of the IA function is always high in
the case of a perfect relationship between the factors, even when we have no information about
one of the factors. As the relationships get weaker, the strength of the IA function declines. In
fact, when there is no relationship between the factors, the external auditors cannot assess the
strength of the IA function if they do not have information for at least one of the factors.
-- Insert Table 7 and Figure 5 Here --
The interesting finding in part of Figure 5, where we assess the sensitivity of the strength
of the IA function to negative evidence about one of the factors, is in the case of a perfect or a
strong relationship between the factors. It can be seen that the strength of the IA function is as-
sessed to be high, even when we have more and more negative belief about one of the factors
accompanied by positive beliefs about the other two factors, until negative evidence about one of
the factors equals the positive beliefs of the other factors (i.e. = 0.9, = 0.9, +Cm +
Wm Om− = 0.9).
Once the negative belief about one of the factors (Objectivity) exceeds 0.9 given that positive
belief about both Competence and Objectivity is 0.9, the strength of the IA function falls sharply
22
from 0.908 to 0, in the case of the perfect relationship. This result makes intuitive sense. If the
auditors are absolutely sure that the Objectivity of the auditors is impaired, they will perceive the
IA function to be very weak, even if they have high levels of beliefs about the internal auditors’
Competence and Work Performance. And this is in spite of the fact that they think the Work Per-
formance and Objectivity are perfectly co-related.
5. Discussion and Conclusions
In this paper, we developed an analytical model based on the conceptual framework de-
picted in Figure 1 for evaluating the strength of the IA function using the belief function frame-
work. This approach uses the factors identified by prior research for evaluating the strength of
the IA function and provides a theoretical model of the decision process.
The most significant contribution of this paper is that it provides external auditors with a
decision aid for evaluating the strength of the IA function, without the limitation of the Bayesian
framework, which requires the estimation of conditional probabilities. Furthermore, it models the
“And” relationship between the factors influencing the strength of the IA function, analyzes the
sensitivity of the strength of the IA function to differing levels of beliefs in Objectivity and Work
Performance and to differing strengths of relationships between the three factors determining the
strength of the IA function.
Results of the sensitivity analyses reveal that Objectivity is an important factor in the
evaluation of the strength of the IA function. Even when high levels of belief in the Competence
and Work Performance of the internal auditors are present, the strength of the IA function is
found to be very low when there is no information about the level of Objectivity of the internal
auditors. One reason for the finding could be the level of difficulty in obtaining evidence about
the Objectivity of the internal auditors. Since it is very difficult for the external auditors to obtain
23
evidence about the Objectivity of the auditors, they rely on the factors of Competence and Work
Performance, which are relatively easier to assess. The second reason could be that the external
auditors might be assuming a perfect or a strong relationship between Work Performance and
Objectivity. Therefore, when they find the Work Performance of the internal auditors to be of
high quality, they assume that the internal auditors must be highly objective in the performance
of their duties. Another finding from the analytical analyses was that when internal auditors were
found to be highly competent and objective, the strength of the audit function was perceived to
be quite high even when there is no evidence about the Work Performance of the auditors. This
finding is intuitively appealing because Work Performance is related to both Competence and
Objectivity and therefore the external auditors will expect high quality work from an objective
and competent auditor.
As far as interrelationships are concerned, the analysis revealed that when the three fac-
tors have a strong or a perfect relationship, the strength of the IA function remains high even if
we have positive or negative evidence about one of the factors (as long as we have high levels of
beliefs about the other two factors.) Thus, for instance, if we know that internal auditors are
highly competent and their Work Performance is highly satisfactory, the strength of the IA func-
tion is perceived to be high even when we have negative evidence about the Objectivity of the
auditors, up to a certain level. However, this strong belief dips to zero as soon as the negative
belief about Objectivity is 1. That is, the external auditors are then absolutely sure that the Objec-
tivity of the internal auditors is impaired.
6. Implications and Limitations
The findings of this research have several implications for audit judgment research, in
experimental or archival settings, when examining external auditors’ evaluation of the internal
24
audit function. The need for such empirical studies has gained greater urgency in the light of re-
cent regulations such as the Sarbanes-Oxley act, which require external auditors to rely more and
more on the work of the internal audit department, with the goal of evaluating the internal con-
trols in the organization. The importance of each of the three factors, and the interrelationships,
can be explicitly considered when designing experiments. Specific hypotheses can also be devel-
oped to test the predictions of the models developed in this paper.
Further, the findings from this study can be used to develop a theoretical framework for
the extent of reliance by external auditors on the work performed by the IA function of a client,
based on an evaluation of the strength of the IA function. This framework would determine
thresholds for the extent of reliance on the IA function by the external auditors based on varying
strengths of the IA function. While, realistic determination of thresholds would require empirical
testing and expert judgments of external auditors, our study aims at providing a starting point
towards the determination of such thresholds. For instance, if the external auditors, after com-
bining all the evidence about the factors influencing the IA function using the belief function de-
cision aid, find the strength of the IA function to be 0.8, they might decide to rely on the work of
the IA function and reduce their work substantially. Research has documented that the IA func-
tion can complete in excess of 25% of the audit work necessary to complete the external audit
(Abdel-Khalik et al., 1983; Schneider, 1985b; Campbell, 1993; Maletta and Kida, 1993; Maletta,
1993; Felix et al., 2001). The stronger the IA function, the higher the extent of reliance by exter-
nal auditors on the work performed by the IA function. Some research has concluded that even
when the strength of the IA function is low, external auditors still place reliance on the work of
the IA function (Schneider, 1985b). Research has also documented an impact of involvement of
the IA function in the financial statement audit of a client on external audit fees (Felix et al.,
25
2001). For example, if involvement by the IA function in the financial statement audit were to
increase from no involvement to 26.57% of the financial statement audit, the audit fee would de-
crease by approximately 18% or $215,961.5.
In terms of the extent of reliance, Abdel-Khalik et al. (1983) found that the average per-
centage of budgeted external audit hours performed by the IA function ranged from 32.5% when
the IA function reported to the controller, to 42% when the IA function reported to the audit
committee. Further, Schneider (1985b) found than, on average, external auditors reduced budg-
eted external audit hours in the revenue cycle by approximately 38% as a result of relying on the
work of the IA function. For the lowest quality IA function profile, he noted that the average re-
duction was 14.4%, while for the highest quality IA function profile; the average reduction was
50.6%. In contrast, Margheim (1986) found that external auditors did not reduce total budgeted
audit hours (i.e. no reliance on the IA function), relative to having no IA function, when the IA
function was perceived to have low Competence/Work Performance. He did find, however, that
for scenarios where the IA function was present, total budgeted audit hours declined by 18.7% as
Competence/Work Performance increased from a low level to a high level. Further, Maletta and
Kida (1993) found that external auditors reduced their work in the accounts receivable area by up
to 28% depending on the strength of the IA function. Therefore, the belief function framework
proposed by our paper provides a systematic and well-defined decision aid to the external audi-
tors to determine the extent of reliance on the work of the IA function, based on an evaluation of
the strength of the IA function.
Table 8 provides the theoretical framework setting the thresholds for the extent of reli-
ance by the external auditors, given the strength of the IA function
--Insert Table 8 here--
26
As can be seen from the table, the extent of reliance by the external auditors on the work
performed by the IA function would depend on the strength of the IA function. For instance, say
the external auditors combine all the evidence about the IA function quality factors and find that
the internal auditors are highly competent ( = 0.8) , their Work Performance is satisfactory
( = 0.8), and they find the internal auditors to be highly objective in the performance of their
work( = 0.8). Further, based on previous knowledge about the client possessed by the exter-
nal auditors, the latter assign a moderate level of relationship between the three factors (r
+Cm
+Wm
+Om
1 = r2 =
0.5). After inputting all this information in the belief function framework, the external auditors
find that the strength of the IA function is 0.8, implying that they have positive evidence that the
quality of the IA function is excellent, they can place around 40 to 50% reliance on the work of
the IA function. This reliance could take the form of reduced budgeted audit hours or reduced
audit procedures including control testing, substantive testing, and analytical testing. It is hard to
imagine that the external auditors would place more than 50% reliance on the work of the IA
function even if they find the IA function to be extremely strong.
In addition to the usual limitations that accompany similar studies, the first major limita-
tion of the study is the lack of empirical evidence available to support the findings of the model.
Second, the factors in the model are assumed to be discrete and binary. Third, for simplicity rea-
sons we did not consider mixed evidence in our analysis. Lastly, this research develops a norma-
tive model and therefore does not take into account contextual or environmental factors, which
might alter the predictions of the model.
27
Endnotes
1. See Gramling et al. (2004) for an extensive review of research related to the internal audit function.
2. Competence has been defined as the educational level and professional experience of the internal auditor
and other such factors. Objectivity has been defined as the organizational status of the internal auditor and
organizational policies affecting the independence of the internal auditor. Work Performance has been de-
fined as the assessment of internal control, risk assessment, and substantive procedure performed by the in-
ternal auditor.
3. We assume to have definite knowledge that the internal auditor is not competent (λc1 = 0, λc2 = 0), the
work performance is poor (λw1 = 0, λw2 = 0), and objectivity is low (λo1 = 0, λo2 = 0). These values yield
the following expression for the likelihood ratio given in Equation A-5 of Krishnamoorthy (2002, p. 120):
Likelihood ratio = P(~c|h)P(~o|h)/P(~c|~h)P(~o|~h). For the above situation, and Case HLM of Krish-
namoorthy (p. 102, 2002), the likelihood ratio becomes 1/12, which yields a value of 1/13 for the posterior
probability that the strength of IA function is high given the prior odds to be one, i.e., P(h)/P(~h) = 1. How-
ever, under the “And” relationship, one would expect this posterior probability to be zero for the above
situation.
4. represents the belief mass that the internal auditor is competent, i.e., , represents
the belief mass that the internal auditor is not competent, i.e.,
+Cm +
Y Cm(C ) = m Cm−
N Cm(C ) = m− , and represents the ig-
norance part of the belief mass, i.e., CmΘ
Y N Cm({C ,C }) = mΘ . Similarly, , +S Wm(W ) = m U Wm(W ) = m− ,
and and and S U Wm({W , W }) = mΘ +Y Om(O ) = m N Om(O ) = m− , and Y N Om({O ,O }) = mΘ .
5. Remember that because of the “And” relationship, the only way the strength of the IA function will be
strong is that we have all the factors present, i.e., the auditor is competent, work performance is satisfac-
tory, and the auditor is objective. Even if we do not have the direct evidence that the work performance is
satisfactory, the knowledge that the auditor is competent and has objectivity, one can infer that the work
performance would be satisfactory. This is what is being captured in the model.
28
References
Abdel-khalik, R., D. Snowball, and J. H. Wragge. 1983. The effects of certain internal audit vari-ables on the planning of external audit programs. The Accounting Review (April): 215-227.
Akresh, A. D., J. K. Loebbecke, and W. R. Scott. 1988. Audit approaches and techniques. In Research Opportunities in Auditing: The Second Decade, edited by A. R. Abdel-khalik and Ira Solomon. Sarasota, FL: AAA, 13-55.
American Institute of Certified Public Accountants (AICPA). 1991. The auditor’s consideration of the internal audit function in an audit of financial Statements. Statement on Auditing Stan-dards No. 65. New York, NY: AICPA.
American Institute of Certified Public Accountants (AICPA). 2003. Statements on Auditing Stan-dards. New York, NY: AICPA
Brody, R.G., S.P. Golen, and P.M.J. Reckers. 1998. An empirical investigation of the interface be-tween internal and external auditors. Accounting and Business Research (Summer):160-171
Brody, R.G., and D.J. Lowe. 2000. The new role of the internal auditor: implications for internal auditor Objectivity. International Journal of Auditing 4:169-176.
Brown, P. R. 1983. Independent auditor judgment in the evaluation of the internal audit functions. Journal of Accounting Research 21(Autumn): 444-455.
Campbell, A. 1993. Internal audit reliance in the continuing audit engagement. Internal Auditing (Summer): 56-66.
Curly, S.P., and J. I. Golden. 1994. Using belief functions to represent degrees of belief. Organiza-tional Behavior and Human Decision Processess 58:271-303.
Edge, W. R., and A. A. Farley. 1991. External auditor evaluation of the internal audit function. Ac-counting and Finance: 69-83.
Felix, W. L. Jr., A.A. Gramling, and M.J. Maletta. 2001. Coordinating total audit coverage: The relationship between internal and external auditors.Altamonte Springs, FL: The Institute of Internal Auditors. Inc.
Felix, W.L. Jr., A.A. Gramling, and M. J. Maletta. 2005. The influence of nonaudit service reve-nues and client pressure on external auditors’ decisions to rely on Internal Audit. Contem-porary Accounting Research. 22:31-53
Gordon, J., and E.H. Shortliffe. 1990. The Dempster-Shafer theory of evidence. In Readings in Un-certain Reasoning . California: Morgan Kaufmann Publishers Inc.
Gramling, A.A, M. Maletta, A. Schneider, and B. Church.2004. The role of the internal audit func-tion in corporate governance : A synthesis of the extant internal auditing literature and di-rections for future research. Journal of Accounting Literature. 23: 193-244.
29
Harrison, K., R.P. Srivastava, and R.D. Plumlee.2002. Auditors’ evaluations of uncertain audit evi-dence: Belief functions versus probabilities. In Srivastava, R.P., and T. J. Mock, eds. Belief functions in business decisions. Physica- Verlag:161-183.
Krishnamoorthy, G. 2001. A cascaded inference model for evaluation of the internal audit report. Decision Sciences 32 (Summer): 499-520.
Krishnamoorthy, G. 2002. A Multistage Approach to External Auditors’ Evaluation of the Internal Audit Function. Auditing: A Journal of Practice and Theory (Spring): 95-121.
Maletta, M. J. 1993. An examination of auditors’ decisions to use internal auditors as assistants: The effect of inherent risk. Contemporary Accounting Research (Spring): 508-525.
Maletta, M. J., and D. T. Kida. 1993. The effect of risk factors on auditors’ configural information processing. The Accounting Review. 68 (July): 681-691.
Margheim, L. L. 1986. Further evidence on external auditors’ reliance on internal auditors. Journal of Accounting Research (Spring): 194-205.
Messier, W. F., Jr., and A. Schneider. 1988. A hierarchical approach to the external auditor’s evaluation of the internal auditing function. Contemporary Accounting Research (Spring): 337-353.
Public Company Accounting Oversight Board (PCAOB). 2004. Auditing Standard No.2(AS 2) – An Audit of Internal Control Over Financial Reporting Performed in Conjunction with An Audit of Financial Statements.
Schneider, A. 1984. Modeling external auditors’ evaluations of internal auditing. Journal of Ac-counting Research (Autumn): 657-678.
Schneider, A. 1985a. The reliance of external auditors on the internal audit function. Journal of Accounting Research (Autumn): 911-919.
Schneider, A. 1985b. Consensus among auditors in evaluating the internal audit function. Account-ing and Business Research (Autumn): 297-301.
Shafer, G. 1976. A mathematical theory of evidence. Princeton University Press
Shafer, G., and R. P. Srivastava. 1990. The bayesian and belief-function formalisms: a general perspective for auditing. Auditing: A Journal of Practice and Theory. (Supplement): 110-148
Srivastava, R. P., and G. R. Shafer. 1992. Belief-function formulas for audit risk. The Accounting Review (April): 249-283.
Srivastava, R. P. 1993. Belief functions and audit decisions. Auditors Report, Vol. 17, No. 1, (Fall): 8-12.
30
31
Srivastava, R. P., S. K. Dutta, and R. Johns. 1996. An expert system approach to audit planning and evaluation in the belief function framework. International Journal of Intelligent Sys-tems in Accounting, Finance and Management, Vol. 5, No.3: 165-183.
Srivastava, R. P., and T.J. Mock. 2000. Belief function in accounting behavioral research. Ad-vances in Accounting Behavioral Research 3:225-242
Srivastava, R. P., and T.J. Mock.2002. Belief functions in Business Decisions, Physical – Verlag, Heidelberg, Springler-Verlag Company,
Srivastava, R. P., and H. Lu. 2002. Structural analysis of audit evidence using belief functions, Fuzzy Sets and Systems, Vol. 131, No. 1 (October); 107-120.
Srivastava, R. P. 2005. Alternative form of dempster’s rule for binary variables. International Journal of Intelligent Systems, Vol. 20, No. 8 (August): 789-797.
Srivastava, R.P., T.J. Mock, and J. Turner. 2006. Analytical formulas for risk assessment for a class of problems where risk depends on three interrelated variables. International Jour-nal of Approximate Reasoning (forthcoming).
Yager, R.R., J. Kacprzyk,; and M. Fedrizzi, 1994. Advances in the Dempster-Shafer Theory of Evi-dence. New York, NY: John Wiley and Sons: 71-95.
Figure 1: Analytical Model for Evaluating the Strength of the Internal Audit Function**
Evidence concerning auditor qualifications and training
** A rounded box represents a factor, a rectangle represents an item of evidence, and a hexagonal box represents a relationship.
31
Evidence concerning audit planning and supervision
Evidence of auditor tacit knowledge• Experience or knowledge about company • Experience or knowledge about auditing the company
Evidence of internal audit effort
Evidence of execution of internal audit plan
Evidence of thoroughness and quality of internal audit report-ing
Evidence of managerial reporting relationship
Evidence of breadth and depth of investigatory scope
Evidence of recommendation implementation
Objectivity
Competence
Work Performance
R1
R2
Strength of In-ternal Audit
Function AND
Figure 2- Effect of Objectivity on the Strength of the IA function
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
1.1
1.2
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
Belief in Objectivity
Bel
ief i
n th
e St
reng
th o
f the
IA F
unct
ion
Strength -IA ( Positive Evidence)Strength -IA (Negative Evidence)
33
Figure 3 -Effect of Work Performance on the Strength of the IA function
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0
Belief in Work performance
Bel
ief i
n th
e St
reng
th o
f the
IA fu
nctio
n
Strength -IA ( Positive Evidence)Strength -IA (Negative Evidence)
34
Figure 4- Effect of Interrelationship- Positive Evidence
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
Belief in Objectivity
Bel
ief i
n St
reng
th o
f the
IA fu
nctio
n
r1=r2 =0r1=r2=0.2r1=r2=0.8r1=r2=1
35
Figure 5 - Effect of Interrelationship - Negative Evidence
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
0 0.2 0.4 0.6 0.8 1
Belief in Objectivity
Bel
ief i
n th
e st
reng
th o
f the
IA fu
nctio
n
r1=r2=0.0r1=r2=0.2r1=r2=0.8r1=r2=1.0
36
37
TABLE 1 Factors in assessing the strength of the IA function.
Factors Definition Evidence Description of Evidence
Competence Competence has been defined as the educa-tional level and professional experience of the internal auditor and other such factors.
1. Evidence concerning auditor qualifications and training. 2. Evidence of audit planning and supervision. 3. Evidence of auditor tacit knowledge.
1. Auditor qualification and training: • Educational Background • Certification • In-house training programme • Support for continuing education 2. Audit planning and supervision: • System of defined responsibilities • Review of procedures and working papers • Planning of work 3. Tacit knowledge: • Experience or knowledge about the company • Experience or knowledge about auditing the company
Work Performance Work Performance has been defined as internal control and risk assessment, and substantive procedures performed by the internal auditor.
1.Evidence of internal audit effort. 2. Evidence of execution of internal audit plan. 3. Evidence of thoroughness and quality of internal audit reporting.
1. Internal audit effort: • Time spent on audits • Number of items examined • Sampling techniques used • EDP audit techniques used 2. Execution of internal audit plan: • Number of areas audited • Number of audits completed versus number of audits
planned 3. Thoroughness and quality of internal audit reporting: • Completeness of audit programmes and working papers • Quantity and Quality of working papers documentation
Objectivity Objectivity has been defined as the organiza-tional status of the internal auditor and organ-izational policies affecting the independence of the internal auditor.
1. Evidence of managerial reporting relation-ship. 2. Evidence of breadth and scope of investiga-tory scope. 3. Evidence of recommendation implementa-tion.
1.Managerial reporting relationship: • Level to which IA reports • Level to which IA reports findings 2. Breadth and Scope: • Ability to investigate any area • Freedom from conflicting duties 3. Recommendation Implementation: • Disposition of recommendations • IAs access to audit committee
TABLE 2 Symbols and descriptions
Symbol Description S {SS, SW} S represents the strength of IA function. It has two values: SS represents
that the strength of IA functions is strong, and SW represents that the strength of IA function is weak.
C {CY, CN} C represents Competence of the internal auditor. It has two values: CY represents that the internal auditor is competent, and CN represents that the internal auditor is not competent.
W {WS, Wu} W represents Work Performance of the internal auditor. It has two values: WS represents that the Work Performance is satisfactory, and WU repre-sents that the Work Performance is unsatisfactory.
O {OY, ON} O represents the Objectivity of the internal auditor. It has two values: OY represents that the internal auditor is objective, and ON represents that the internal auditor is not objective.
R1, r1 R1 denotes the relational node between C and W and r1 represents its strength
R2, r2 R2 denotes the relational node between W and O and r2 represents its strength The basic belief mass (m-value) for the value of the variable in the paren-thesis from the evidence represented by the subscript. ..m (..)
This symbol represents the frame of a variable denoted by the subscript. For example, the frame of variable ‘C’ is represented as = {CCΘ Y, CN}. Θ ..
The belief mass that the internal auditor is competent. +Cm
The belief mass that the internal auditor is not competent. Cm− The belief mass that the internal auditor may or may not be competent. CmΘ The belief mass that the Work Performance of the internal auditor is satis-factory.
+Wm
The belief mass that the Work Performance of the internal auditor is un-satisfactory Wm−
The belief mass that the Work Performance bu the internal auditor may or may not be satisfactory. WmΘ
The belief mass that the internal auditor is objective +Om
The belief mass that the internal auditor is not objective. Om− The belief mass that the internal auditor may or may not be objective. OmΘ
Bel..(SS) The belief that the strength of the IA function is strong. Bel..(SW) The belief that the strength of the IA function is weak.
K A normalization constant
37
TABLE 3 Effect of Objectivity on the strength of the IA function r1 = r2 = 0.5; = 0.9; = 0.9 +
Cm +Wm
O Strength (IA)- Positive Evidence Strength(IA)- Negative Evidence
0 0.450 0.450
0.1 0.497 0.425
0.2 0.545 0.398
0.3 0.592 0.367
0.4 0.640 0.333
0.5 0.688 0.295
0.6 0.735 0.251
0.7 0.782 0.202
0.8 0.830 0.145
0.9 0.877 0.078
1 0.925 0.000
38
TABLE 4 Effect of Work Performance on the strength of the IA function r1 = r2 = 0.5; = 0.9; = 0.9 +
Cm +Om
W Strength (IA)- Positive Evidence Strength(IA)- Negative Evidence
0 0.652 0.652
0.1 0.677 0.631
0.2 0.702 0.607
0.3 0.727 0.578
0.4 0.752 0.543
0.5 0.777 0.501
0.6 0.802 0.449
0.7 0.828 0.383
0.8 0.852 0.295
0.9 0.877 0.175
1 0.902 0
39
40
TABLE 5 Description of strength of relationships between C, W, and O
Relationship Description
r1= r2 = 0 No relationship
r1= r2 = 0.2 Weak relationship
r1= r2 = 0.8 Strong relationship
r1= r2 = 1.0 Perfect relationship
TABLE 6 Effect of Inter-Relationships on the strength of the IA function (Positive Evidence)
+Cm = 0.9; = 0.9 +
Wm
r+Om 1= r2=0 r1= r2=0.2 r1= r2=0.8 r1= r2=1
0 0 0.169 0.763 0.990
0.1 0.080 0.238 0.784 0.991
0.2 0.162 0.308 0.806 0.992
0.3 0.243 0.377 0.827 0.993
0.4 0.324 0.446 0.848 0.994
0.5 0.405 0.515 0.869 0.995
0.6 0.486 0.584 0.890 0.996
0.7 0.567 0.653 0.911 0.997
0.8 0.648 0.722 0.932 0.998
0.9 0.729 0.792 0.954 0.999
1 0.810 0.860 0.975 0.999
41
TABLE 7 Effect of Inter-Relationships on the strength of the IA function (Negative Evidence)
+Cm = 0.9; = 0.9 +
Wm
Om− r1= r2=0 r1= r2=0.2 r1= r2=0.8 r1= r2=1
0 0 0.169 0.763 0.990
0.1 0 0.155 0.745 0.989
0.2 0 0.141 0.723 0.988
0.3 0 0.125 0.697 0.986
0.4 0 0.110 0.665 0.983
0.5 0 0.093 0.624 0.980
0.6 0 0.076 0.572 0.975
0.7 0 0.058 0.502 0.967
0.8 0 0.040 0.404 0.952
0.9 0 0.020 0.254 0.908
1 0 0.000 0.000 0.000
42
43
TABLE 8 Theoretical framework for the extent of reliance by external auditors on the work of the IA function
Strength Beliefs (IA) Quality Rating Extent of Reliance
0 – 0.2 Low 0 – 10%
0.2 – 0.4 High Low 10 – 20%
0.4 – 0.6 Moderate 20 – 30%
0.6 – 0.8 High 30 – 40%
0.8 – 1.0 Excellent 40 – 50%
