Is PCAOB Standard No. 5 Impairing Auditor Objectivity? Free

In 2007, the Public Company Accounting Oversight Board (PCAOB) issued Auditing Standard No. 5 (AS5), An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial Statements, in which it states, “For purposes of the audit of internal control … the auditor may use the work performed by, or receive direct assistance from, internal auditors, company personnel (in addition to internal auditors), and third parties under the direction of management” (PCAOB 2007a, 17). As noted by Brody (2012), AS5 encourages external auditors to rely more on the work of internal auditors to reduce the costs of complying with Section 404 of the Sarbanes-Oxley Act (SOX) (U.S. House of Representatives 2002a). From the PCAOB's perspective, external auditors' reliance on the work of internal auditors can enhance audit efficiency without compromising audit effectiveness (PCAOB 2007b).

During development of the standard, several commentators stated that “the proposed standard did not go far enough in encouraging auditors to use the work of others” (PCAOB 2007a, 13). Since its implementation, however, concerns have surfaced about this section of the standard. PCAOB inspections over the past few years have found deficiencies related to external auditors' use of internal audit work under AS5 (Franzel 2015; PCAOB 2013a). When discussing the PCAOB inspection results, Franzel (2015, para. 21–22) stated that “the issue is serious when the external auditors' use of internal audit work does not meet PCAOB standards and results in insufficient evidence to support the external audit opinion” and “such scenarios … should be of great concern to an audit committee in its oversight of both the internal and external audit functions.” The inspection results also led the PCAOB to include the topic “Using the Work of Others” in its Staff Audit Practice Alert No. 11 (PCAOB 2013a). PCAOB Chairman James Doty noted that given the importance of internal controls, external auditors should pay attention to the alert in planning and executing the audit (PCAOB 2013b). Concerns have also been expressed by audit firms, which are openly afraid that following the standard may expose them to increased legal liability. In point of fact, research by Arel, Jennings, Pany, and Reckers (2012) found that judges assigned more liability to auditors who relied on the work of internal auditors than auditors who performed the work themselves.

By urging external auditors to rely on the work of internal auditors, a presumption is made that both external and internal auditors can remain objective. But, is this a reasonable assumption? The ability of auditors to remain impartial has been questioned for many years; in fact, numerous studies have empirically investigated the objectivity of both internal auditors (e.g., Brody and Kaplan 1996; Ahlawat and Lowe 2004; Brody and Lowe 2000) and external auditors (e.g., Haynes, Jenkins, and Nutt 1998; Jenkins and Haynes 2003; Salterio 1996; Salterio and Koonce 1997; Trompeter 1994). Based on results of this body of research, auditors as a whole appear to have difficulty remaining objective. However, all of these studies were performed around the time that major changes were occurring in the internal audit environment (i.e., the revised definition of internal auditing by the Institute of Internal Auditors [IIA]) and prior to changes in the external audit environment (i.e., the implementation of the Sarbanes-Oxley Act of 2002 [U.S. House of Representatives 2002a]). In the intervening years, internal auditors may have adapted to their expanded role of auditor and consultant, learning to be more objective over time. In addition, restrictions placed on the scope of external auditors' work by SOX have reduced the auditor/client conflict of interest assumed to be a major barrier to objectivity.

This article provides evidence that urging external auditors to rely on the work of internal auditors is still problematic. While SOX seems to have had a positive effect on external auditors' objectivity, issues remain with respect to the objectivity of internal auditors. The expanded definition of internal auditing implemented by the IIA has created an employee/employer conflict of interest similar to the auditor/client conflict experienced by external auditors pre-SOX. This article discusses the fact that there are significant implications with respect to external auditors' reliance on the work of the internal auditor and highlights that standard setters do not appear to have given adequate consideration to these issues.

Research conducted prior to SOX reinforced what everyone feared—external auditors had a tendency to bow to the wishes of their audit clients. For example, Haynes et al. (1998) conducted an experiment where practicing auditors were told that they had been hired to perform an inventory valuation task for an audit client. The client was identified as either buying or selling a subsidiary. After being provided with identical financial information, auditors were asked to evaluate the likelihood that a material portion of the subsidiary's inventory was obsolete. Results indicate that auditors working for the buying company found inventory more likely to be obsolete (which, in the best interest of their client, would drive the sales price down) than auditors working for the selling company.

The work of Haynes et al. (1998) served to strengthen what the public believed: external auditors were finding it more and more difficult to remain objective during the course of an audit. But why? Historically, the answer has revolved around the provision of nonaudit services. Non-audit services had always been part of an audit firm's offerings. However, with market saturation, the proportion of auditing revenue to nonaudit revenue for SEC clients decreased from 6:1 in 1990 to 1.5:1 in 1999 (Public Oversight Board 2002). As the ratio of nonaudit fees to audit fees increased, auditors' incentives to please the client also increased. A conflict of interest arose between remaining objective and retaining lucrative nonaudit fees (Bierstaker, Houston, and Wright 2006).

The conflict of interest inherent in the auditor/client relationship eventually led to several audit failures in the late 1990s and early 2000s. These failures convinced standard setters that formal standards were necessary to prevent audit firms from functioning as both auditors and consultants for the same client. Section 201 of SOX put a stop to audit firms performing certain nonaudit services for their audit clients. Section 201 specifically prohibits auditors from providing “any expert services unrelated to the audit” (U.S. House of Representatives 2002b). By implementing these restrictions, standard setters greatly reduced the conflict between auditor objectivity and client retention caused by financial incentives. Auditors were no longer placed in a position of deciding whether to agree with a client's preferred, but erroneous, accounting treatment to avoid losing the audit relationship.

Over a decade has passed since the implementation of SOX Section 201. Because we are beyond the initial “shake out” period expected of any type of audit reform, reevaluation of auditor objectivity seems appropriate. Recently, Brody, Haynes, and White (2014) examined whether auditor objectivity has improved. The authors argue that providing certain nonaudit services only to nonaudit clients aligns auditors' and clients' goals (Brody et al. 2014). Using the same scenario as the one used in the pre-SOX experiment (Haynes et al. 1998), the authors found encouraging results. Auditors consulting for the buying company and auditors consulting for the selling company agreed on the likelihood that inventory was obsolete. These results indicate that external auditors are now more objective in their judgments than when they experienced a high degree of conflict of interest.

Although external auditors appear to have gained objectivity, relying on the work of internal auditors still carries risks. One of these risks is that internal auditors' judgments and decisions may contain bias. If internal auditors' judgments are biased, then external auditors are likely incorporating that bias into their own judgments. This brings up the following questions: Are internal auditors objective? Should external auditors have to assume the responsibility of placing reliance on their work?

Just prior to the implementation of SOX, the IIA began to emphasize the need for internal auditors to increase “value-added” activities. In 1999, the IIA expanded its definition of internal auditing to include “independent, objective assurance and consulting activit[ies]” (IIA 2011a; emphasis added). Portions of AS5, which sought to clarify AS2 (PCAOB 2004) and reduce excessive audit work, may have assisted in this call by instructing external auditors to focus on high risk areas of internal controls and to eliminate unnecessary procedures (PCAOB 2007a). This, in turn, has allowed internal auditors to concentrate more on nonaudit services. A 2009 poll conducted by Protiviti indicated that as a result of the updated regulations issued in 2007 (PCAOB Release 2007-005A), about 50 percent of internal audit departments reported that they were able to decrease the time they spent complying with SOX and “rebalance” the extra time between traditional audit work and strategic nonaudit services (Protiviti 2009).

The new IIA definition has been controversial. Does involving internal auditors in consulting activities allow them to add value by helping management achieve the company's objectives (Chapman 2001; Dickins and O'Reilly 2009; Grant, Park, and Wheeler 2009; PricewaterhouseCoopers 2010; Stewart and Subramaniam 2010) or does it heighten the conflict of interest problem that SOX reduced for external auditors (Galloway 1995; Kawashima 2007; Paape, Scheffe, and Snoep 2003; Rodgers 2003)? Research supports the latter. At the time the new definition was being developed, Brody and Lowe (2000) tested the same subsidiary acquisition scenario used in the external auditor experiments. They found that, like external auditors at that time, internal auditors' judgments favored the best interest of their employer. Auditors whose employer was buying the subsidiary judged inventory obsolescence as more likely than auditors whose employer was selling the subsidiary.

Since the initial revision of the internal auditor definition, practice guides and advisories have attempted to reinforce how important it is to remain objective when providing both audit and nonaudit services (IIA 2011a, 2011b). The International Professional Practices Framework (IPPF) states that internal auditors should remain objective and not assume management responsibilities when performing consulting services (IIA 2011b). Furthermore, Practice Advisory 1120-1 states that consulting engagements must not be operational in nature to ensure the objectivity of internal auditor consultants (IIA 2009). However, even after cautioning internal auditors extensively about the importance of objectivity, the study by Brody et al. (2014) found that they still cannot remain objective when presented with the subsidiary acquisition experimental scenario; that is, internal auditors consulting for the company buying the subsidiary continued to evaluate inventory obsolescence as more likely than those consulting for the company selling the subsidiary.

This result is not surprising. As far back as 1997, Bazerman, Morgan, and Loewenstein argued that the conflict of interest inherent in all auditor/client arrangements leads to what is called a “self-serving” bias. Auditors can unconsciously confuse what is “fair” or “right” with what is in their own personal best interest, thereby distorting their interpretation of evidence. According to Bazerman et al. (1997), the only way to reduce or eliminate the self-serving bias is to change the relationship by removing the conflict of interest.

Before the IIA's revised definition, internal auditors experienced little conflict of interest with their employers. Under the new definition, however, they may hesitate to suggest corrective action to line managers during an audit to stay in the good graces of their consulting “client.” In addition, they may want to produce “positive” results for top management, thereby continuing to add value and “ensur[ing] that management continues to use their consulting services” (DeZoort, Houston, and Peters 2001, 263). They now face a similar conflict of interest as that experienced by external auditors pre-SOX. In fact, because internal auditors more closely identify with their employers than external auditors identify with their clients (Stefaniak, Houston, and Cornell 2012), the conflict may be stronger than that experienced by external auditors.

The IIA has failed to consider the possibility of the unconscious bias identified by Bazerman et al. (1997); that is, the bias created by the simple reality that internal auditors can now assume conflicting roles for the same company. They appear to ignore the fact that giving internal auditors both assurance and consulting responsibilities creates concerns of advocacy (Ahlawat and Lowe 2004). The absence of standards directly addressing the conflict of interest that threatens internal auditor objectivity and the continued focus on specific operations related to assurance services provide evidence that the IIA lacks sensitivity to the problem (Brody et al. 2014).

Although the conflict of interest in the auditor/client relationship is never completely eliminated because of the fee (salary) arrangement, the PCAOB has reduced the conflict of interest for external auditors with SOX Section 201. The results of Brody et al. (2014) find that external auditors appear to have an increased sensitivity to objectivity in the post-SOX era. Thus, it appears that this particular goal of SOX has been realized. No longer relying on a single client for revenues, external auditors have been relieved of the tremendous pressure placed on them to please the client at any cost. In the end, external auditors are better able to maintain their objectivity when performing audits.

However, external auditors still face the risks associated with potential biases. As part of the planning process, the PCAOB encourages reliance by external auditors on the work of internal auditors to achieve enhanced audit efficiency. Among the factors to be considered in deciding whether it is appropriate to rely on internal auditors' work is an assessment of the usefulness of their work (Brody 2012). Integral to that assessment is an evaluation of the competence and objectivity of the client's internal audit group (Brody 2012). The IIA's move to include consulting in the definition of internal auditing has increased the conflict of interest between internal auditors and their employers, which, in turn, has increased the risk to external auditors of relying on biased information.

If external auditors rely on the work of internal auditors whose judgments are biased, then they are also in danger of making poor judgments. As long as internal auditors' workload extends beyond assurance services, their objectivity is likely to suffer. This suggests that external auditors should be placing less, not more, reliance on decisions made by internal auditors. The U.K. has already recognized and eliminated the problem. In June 2014, the United Kingdom's Financial Reporting Council implemented a standard that prohibits external auditors from relying on work performed by internal auditors during an audit (McCollum 2013). The PCAOB must become more aware that its continued push toward reliance on the work of internal auditors may be a problem for external auditors who are ultimately responsible for errors in the financial statement audit (Franzel 2015; Brody et al. 2014).

In addition, the IIA should become more sensitive to the fact that placing internal auditors in the position of wearing “two hats”—auditor and consultant—increases the likelihood that they will become advocates for management's position. The IIA needs to ask if it is appropriate for internal auditors to give up their objectivity and follow the expanded role they have been given. At a minimum, the profession needs to consider physically separating the internal audit and the consulting portions of the audit function. Under this arrangement, the audit staff would report to top management and the audit committee while the consulting staff would report to their clients. Thus, the conflict of interest would be reduced while the company would continue to reap the benefits of both types of services (Brody et al. 2014). If action is not taken to reduce the conflict of interest in the current internal audit environment, then external auditors may end up with the same negative consequences of audit failure that plagued them in the late 1990s and early 2000s.