Accepted for publication in Contemporary Accounting Research (Forthcoming 2010)

An Analytical Model for External Auditor Evaluation of the

Internal Audit Function Using Belief Functions

Vikram Desai
Assistant Professor
Wilfred Laurier University
Waterloo, Ontario, Canada N2L 3C5
[email protected]

Robin W. Roberts
Burnett Eminent Scholar and Director
Kenneth G. Dixon School of Accounting
University of Central Florida
Orlando, FL 32816 USA
[email protected]

Rajendra Srivastava
Ernst & Young Professor of Accounting and Director
Ernst & Young Center for Auditing Research and Advanced Technology
School of Business
The University of Kansas
Lawrence, KS 66045 USA
[email protected]

Revised August 2009

Acknowledgements: We would like to thank participants at the 2005 ABO Section Mid-Year
Meeting, 2006 American Accounting Association Meeting, and research workshops at CUNY-
Baruch, the University of Central Florida, Wilfred Laurier University, and York University, for
their helpful comments on an earlier version of the paper.

Electronic copy available at: https://ssrn.com/abstract=1476431

 An Analytical Model for External Auditor Evaluation
of the Internal Audit Function Using Belief Functions

ABSTRACT

The purpose of this paper is to advance research in internal audit (IA) evaluation by developing

an IA assessment model that considers interrelationships among specific factors used by external auditors

to evaluate the strength of the IA function. The model is based on three factors identified by auditing

standards and by prior academic research: Competence, Work Performance, and Objectivity (SAS 65

1991; Messier and Schneider 1988; Krishnamoorthy 2002; PCAOB 2007). We develop an analytical

expression of the model using the belief function framework. By using this framework we overcome

limitations of prior research regarding the modelling of interrelationships among factors and regarding

difficulties in application. The results of our analysis revealed that modelling the “And” relationship is

essential for assessing the strength of the IA function. As far as interrelationships are concerned, the

analysis showed that when the three factors have a strong or a perfect relationship, the strength of the IA

function remains high even if there is positive or negative evidence about one of the factors. This result

holds as long as there are high levels of beliefs about the other two factors. Further, we demonstrate how

the quality of corporate governance affects the evaluation of the IA function and how a cost benefit analy-

sis can be applied to this framework to help determine the amount of external audit work to be carried out

for compliance with the Sarbanes-Oxley Act of 2002 (SOX) and the Public Company Accounting Over-

sight Board (PCAOB) standards. Our analysis revealed that the extent of external audit work to be carried

out by the external auditor depends on the strength of the IA function and the amount of litigation and

regulatory costs likely to be faced by the external auditor.

Keywords: Internal audit; Belief functions; Evidential reasoning approach; Reliance decision.

JEL descriptors: M42, C11, C51

Electronic copy available at: https://ssrn.com/abstract=1476431

 An Analytical Model for External Auditor Evaluation
of the Internal Audit Function Using Belief Functions

1. Introduction

The Sarbanes-Oxley Act of 2002 (hereafter SOX), significantly elevated the role of the

internal audit (IA) function (Gramling, 2004). Section 302 of SOX requires management to re-

port on and certify to the effectiveness of its internal control structure and procedures with re-

spect to the firm’s quarterly and annual reports. Section 404 of SOX requires management to

document, evaluate, and report on the effectiveness of internal control over financial reporting,

and requires the external auditor to evaluate and opine on management’s assessment of internal

control. In May 2007, the Public Company Accounting Oversight Board (PCAOB) revised their

guidance on auditing internal control by adopting Auditing Standard No. 5, An Audit of Internal

Control over Financial Reporting That is Integrated with an Audit of Financial Statements.

Through the adoption of this standard and its accompanying guidance, the PCAOB explicitly en-

courages external auditors to “use the work of others to a greater extent when the work is per-

formed by sufficiently competent and objective company personnel” (PCAOB 2007, p. 13). This

requirement may increase external auditors’ reliance on the work of internal auditors when they

perform the integrated audit and internal control assessment work now required by Auditing

Standard No. 5 (PCAOB, 2007). In addition, there is a growing importance placed on expanded

roles for the IA function in ensuring quality corporate governance (Antoine 2004).

Increased reliance on the internal audit function by regulators, corporate governance ac-

tors and financial market participants heightens its need to be better understood. Auditing Stan-

dard No. 5 requires external auditors to use a principles-based approach to determining when and

to what extent they can use the work of others (PCAOB 2007). Thus, auditor judgment in the

Electronic copy available at: https://ssrn.com/abstract=1476431

assessment of internal control has assumed an even larger role in the performance of the inte-

grated audit.

The purpose of this paper is to advance prior research in internal audit (IA) evaluation by

developing a comprehensive IA assessment model that incorporates the following features. First,

it explicitly models the interrelationships among the three specific factors: competence1, work

performance, and objectivity, used by external auditors when evaluating the strength of the IA

function (SAS 65 1991; Messier and Schneider 1988; Krishnamoorthy 2002). Second, it explic-

itly models the "And" relationship between the IA function and these three factors. The prior

model by Krishnamoorthy (2002) did not explicitly model the "And" relationship. Third, it pro-

vides a structured approach to gather and aggregate items of evidence pertaining to various IA

factors that finally yield an overall judgment concerning the strength of the IA function. This

judgment can aid the external auditor in assessing the reliability of a client’s internal control sys-

tem and, thus, determining the extent of reliance on the work of internal auditors. Fourth, it ex-

amines the effect of the quality of corporate governance on the evaluation of the IA function by

the external auditors. Cohen et al. (2007) suggested a potential link between governance quality,

including the audit committee, and the internal audit function. They argued that further research

is needed to examine how “the expertise of the internal audit function affects the ability to incor-

porate audit committee quality into the internal audit judgments” (p.175). Because evaluating the

IA function entails a process of gathering and aggregating uncertain items of evidence pertaining

to each IA factor, we develop the IA assessment model using the evidential reasoning approach

of Srivastava et al. (2007) under the Dempster-Shafer theory (hereafter DS) of belief functions

(Shafer 1976). As discussed later, DS theory is a better framework for representing uncertainties

Electronic copy available at: https://ssrn.com/abstract=1476431

associated with the items of evidence than the probability framework (Shafer and Srivastava

1990, see also Krishnamoorthy2 1993).

The model developed in this paper can be used for development of decision aids for ex-

ternal auditors for assessing the strength of the IA function due to its intuitive appeal and ease of

use. The external auditor can use the evidential diagram of the model to add and/or delete certain

items of evidence pertinent to specific IA factors in a structured way, as appropriate in the spe-

cific situation. In addition, the external auditor can incorporate the judgments, in terms of belief

masses on a scale 0-1 whether the corresponding IA factor is supported or negated, into the

model. Finally, the auditor can use the model to aggregate these belief masses to determine the

overall strength of IA function. For this purpose, we demonstrate a cost-benefit analysis that

can be used to determine the optimum level of reliance the external auditor may place on the in-

ternal audit function. Such an analysis gains additional importance in the light of the Sarbanes-

Oxley act and guidance by the PCAOB, which requires external auditors to increasingly rely on

the work of the IA function, with the goal of evaluating the internal controls in the organization.

The results of our analysis revealed that modelling the “And” relationship is essential for

assessing the strength of the IA function. As far as interrelationships are concerned, the analysis

revealed that when the three factors have a strong or a perfect relationship, the strength of the IA

function remains high even if we have negative evidence about one of the factors as long as we

have high levels of positive evidences about the other two factors. Further, we found that the

quality of corporate governance has a significant impact on the strength of the IA function and

may be considered by the external auditors in their evaluation of the IA function. The cost-

benefit analysis revealed that the amount of litigation and regulatory costs expected to be in-

Electronic copy available at: https://ssrn.com/abstract=1476431

curred by the external auditor would influence the level of reliance on the IA function and con-

sequently, on the amount of external audit work performed in order to comply with SOX.

The rest of the paper is organized as follows: The next section provides the background

and motivation for our analytical study. Section 3describes the proposed internal audit evaluation

model and its extensions relative to the key frameworks in prior research as an evidential net-

work. Section 4 describes the results of the sensitivity analyses and also, the effects of the inter-

relationships between the factors on the assessment of the strength of the IA function. Section 5

presents the findings of the cost-benefit analysis and its implications and the final section pre-

sents the conclusions and limitations of our study. Appendix A provides an introduction to belief

functions.

2. Background and Motivation

Gramling et al. (2004) synthesized the literature on internal auditing to guide future

thinking and research on the new and expanding roles that the IA function can play in helping

ensure quality corporate governance. They concluded that in the past, responses to financial re-

porting scandals did not necessarily focus on the role of the IA function. However, many are

looking to the IA function as part of the solution to a perceived breakdown in the systems of

business reporting, internal control, and ethical behaviour (Bailey, Gramling, and Ramamoorti

2003). Accordingly, there is a need for increased understanding about how the IA function inter-

acts with the audit committee, management, and the external auditors to achieve quality corpo-

rate governance (Tapestry Networks 2004).

For the external auditor to rely on any work performed by the IA function, the external

auditor must assess the quality of the IA function (AICPA 2003; PCAOB 2007). The PCAOB

(2007) contends that the considerable flexibility that external auditors have in using the work of

Electronic copy available at: https://ssrn.com/abstract=1476431

the IA function should translate into a strong encouragement for companies to develop a high-

quality IA function. The stronger the IA functions the more extensively the external auditor will

be able to use their work (PCAOB 2007). Even prior to SOX, external auditors evaluated the

strength of the IA function with the objective of assessing the strength of the internal control

structure of the client. SAS No. 65 described the relationship between external auditors and in-

ternal auditors, outlining the various ways in which external auditors can enhance their efficiency

and effectiveness by utilizing the work of the internal auditors.

There is a substantial body of accounting literature that addresses specific questions

within the broad area of research concerning the external auditor’s evaluation of the IA func-

tion3. We limit our discussion to studies that focus most directly on the external auditor’s as-

sessment of three IA quality factors—internal auditor objectivity, competence, and work per-

formance. Early studies of this kind were aimed at gaining a better understanding of the relative

importance of each factor in the external auditor’s overall evaluation, however, they did not at-

tempt to understand the interrelationships between the factors and how the interactions between

them can help auditors gain an understanding of the internal control structure of the client

(Brown 1983; Abdel-Khalik et al. 1983; Schneider 1984, 1985a, 1985b; Margheim 1986; Mess-

ier and Schneider 1988; Edge and Farley 1991). Two more recent studies, Maletta (1993) and

Krishnamoorthy (2002), explicitly recognized the interrelationships among these factors.

Maletta (1993) examined the decisions of external auditors to use internal auditors as as-

sistants throughout the audit process. This study found that external auditors use a complex proc-

ess when deciding whether or not to use the internal auditors as assistants, and also that there is a

relationship among the three factors affecting the strength of the IA function (competence, work

performance, and objectivity). The results of the analysis indicated that when inherent risk is

Electronic copy available at: https://ssrn.com/abstract=1476431

high, auditors consider the work performance of the internal auditors only when objectivity is

high. However, no interaction effects between work performance and objectivity were observed

when inherent risk was low. Further, across all inherent risk conditions, competence was the

most important factor, followed by objectivity and work performance.

Krishnamoorthy (2002) studied how the three factors interact in determining the strength

of the IA function. Specifically, the study employed analytical methods based on Bayesian prob-

ability to model external auditors’ evaluation of the IA function. The study recognized the limita-

tions of prior studies, which had employed a descriptive, experimental approach and had no for-

mal model guiding the research. Krishnamoorthy (2002) argues that results from these studies

have been mixed and inconclusive, at least in part due to this limitation. He concluded that it is

futile to attempt a rank ordering of the factors since the factors are interrelated and no single fac-

tor can be used in isolation to make an evaluation of the IA function by the external auditors. He

advocated the use of cascaded inference structures when evaluating the strength of the IA func-

tion.

As mentioned earlier, we develop our model using the evidential reasoning approach of

Srivastava et al. (2007) under the DS theory of belief functions. Our paper makes several contri-

butions to the auditing literature. First, we use the DS theory of belief functions to develop our

assessment model, which provides a broader framework for representing uncertainties in evi-

dence (see, e.g., Akresh et al. 1988; Gordon and Shortliffe 1990; Shafer and Srivastava 1990).

Moreover, unlike the Bayesian framework, the DS theory does not require the estimation of con-

ditional probabilities. Krishnamoorthy (2002), in his discussion of a Bayesian approach to as-

sessing the strength of the IA function, recognized this limitation stating that, “it might be ex-

tremely difficult for external auditors to articulate their beliefs as conditional probabilities.” (pp.

Electronic copy available at: https://ssrn.com/abstract=1476431

102). Under DS theory, these judgments are not conditional; decision makers assess them, on a

scale 0-1, whether the evidence supports or negates the hypothesis or assertion under investiga-

tion. In addition, there is empirical evidence both in auditing (Harrison et al. 2002) and in psy-

chology (Curley and Golden 1994) that decision makers think in terms of belief functions. For

example, Harrison et al. (2002) were able to model 100 percent of auditors’ (seniors and manag-

ers) judgments of uncertainty using belief functions whereas only 20 percent of these judgments

could be modeled using a probability framework. Also, the DS theory of belief functions is a

broader framework than the Bayesian framework. The Bayesian framework is a special case of

the belief-function framework (Shafer and Srivastava 1990). Therefore, judgments which can be

modeled in the Bayesian framework can always be modeled in the belief-function framework,

but not vice versa. For example, Curley and Golden (1994) found that business students serving

as jurors to analyze a case with four possible suspects and up to four pieces of evidence pertain-

ing to the suspects assigned belief masses to subsets that were logically consistent with the DS

theory of belief functions.

Second, unlike Krishnamoorthy (2002), we explicitly model the “And” relationship be-

tween the strength of the IA function and the three factors (competence, work performance, and

objectivity). Under the “And” relationship, the strength of IA function is considered to be high if

and only if all of the three factors are present. In fact, prior research (Gramling et al. 2004) sup-

ports the argument that there should be an “And” relationship between IA function and the three

factors. When we analyze the model of Krishnamoorthy (Equation A-5, p. 120, 2002), however,

we do not obtain the desired result. For example, under the condition where all of the three fac-

tors are absent, we should obtain a zero posterior probability that the strength of IA function is

high. But, the Krishnamoorthy model yields a non-zero posterior probability.4 By not modelling

Electronic copy available at: https://ssrn.com/abstract=1476431

the “And” relationship, the evaluation of the strength of IA function using the Krishnamoorthy

model leads to counter-intuitive results in certain cases. However, it should be pointed out that

such counter-intuitive results are consistent with counter-intuitive results in other models and

contexts when the Bayesian framework is used in prior research. The use of DS theory to explic-

itly model the "And" relationship is another advantage of belief functions over the Bayesian

framework as used by Krishnamoorthy.

Third, in response to the call by Gramling et al. (2004), our study explicitly acknowl-

edges and incorporates into the analysis the interrelationships among the IA quality factors.

Gramling et al. (2004) encouraged this line of research because they recognized a gap in research

concerning the processes by which the external auditors combine evidence on the three factors

when deciding whether or not to rely on the work of the internal auditors. They concluded that

additional research needs to provide insights into the relative importance of the IA function qual-

ity factors and “explore the inter-relationships among the quality factors” (p. 236). They empha-

sized that the relative importance of a quality factor is likely to be contingent on the level of the

other quality factors. Having modelled the interrelationships explicitly, our paper provides an

opportunity to analyze the results for various special conditions such as no relationships, weak

relationships, and strong relationships among specific factors.

Further, the interrelationships among the factors enable the external auditor to satisfy the

“And” relationship between the factors and derive the strength of the IA function even if we have

little or no knowledge about one or two of the factors. For instance, under the 'And' relationship,

if the external auditor obtains positive evidence about competence and work performance but no

evidence about objectivity, the level of belief that the IA function is of high quality would be

zero because of the requirement that the IA function would be of high quality if and only if all

10

Electronic copy available at: https://ssrn.com/abstract=1476431

three factors are present. However, due to the interrelationships between the factors, even though

there is no direct evidence about the presence of objectivity, the auditor can still make assess-

ments about the strength of the IA function because of the derived beliefs about objectivity due

to the interrelationship between work performance and objectivity. That is, if the work perform-

ance of the internal auditor is satisfactory, it can be inferred that the internal auditor is objective

due to the relationship between work performance and objectivity.

Finally, Cohen et al. (2007) argued that the quality of corporate governance could play a

pivotal role in the evaluation of the IA function by the external auditors. Certain factors in the

governance structure such as audit committee quality and effectiveness, independence and finan-

cial literacy of the audit committee, and the level of communication between the IA function and

the audit committee could have a significant influence on the work performance and objectivity

of the IA function, thereby affecting the strength of the IA function. An important contribution of

this paper is therefore to incorporate the quality of corporate governance into the model for

evaluating the strength of the IA function by the external auditors.

3. IA Function Evaluation Model

In this section, we first develop a conceptual framework for assessing the IA function

based on the factors described in SAS 65 (AICPA 1991), PCAOB AS No. 5 (PCAOB 2007) and

prior academic research (Messier and Schneider 1988; Krishnamoorthy 2002). Next, we develop

an analytical model based on this conceptual framework under the DS theory of belief functions

for evaluating the strength of the IA function. Figure 1 depicts this conceptual framework where

the rounded boxes represent the factors or variables that determine whether the IA function is

strong or weak. We know from prior literature (e.g., see Krishnamoorthy 2002) that the strength

of IA function depends upon competence, work performance, and objectivity. This dependence

11

Electronic copy available at: https://ssrn.com/abstract=1476431

is modelled in Figure 1 as a logical “And” between the strength of IA function S and the three

factors C, W, and O, represented through a hexagonal box with “And” connecting all these fac-

tors. As considered in the prior literature (e.g., see Krishnamoorthy 2002), we assume these fac-

tors to be binary in nature, i.e., each factor takes two possible values. For example, the strength

of the IA function (S) takes two values: strong and weak, represented by SS and SW, respectively.

The competence factor (C) can assume two possible values: the internal auditors are either com-

petent or not competent, represented by CY and CN, respectively. In a similar fashion, the work

performance (W) of internal auditors may be satisfactory or unsatisfactory (WS and WU) and in-

ternal auditors may be objective (OY) or not objective (ON). The “And” relationship in Figure 1

implies that the strength of the internal audit function is strong (SS) if and only if the internal

auditors are competent (CY), work performance is satisfactory (WS), and they are objective (OY).

In terms of set notations, we can write this relationship as SS = CY∧WS∧OY.

-- Insert Figure 1 Here --

Furthermore, we expect the three factors, C, W, and O, to be interrelated. For example,

work performance (W) is expected to depend upon competence (C), i.e. a competent internal

auditor is expected to exhibit better work performance. Similarly, one can also expect work per-

formance (W) to be dependent on objectivity (O) since an objective and independent auditor is

more likely to make judgments that improve work performance (Krishnamoorthy 2002). How-

ever, professional standards, for instance SAS 65 and prior literature, do not predict a relation-

ship between internal auditor competence and objectivity, and therefore, we assume them to be

unrelated. These interrelationships are modelled in Figure 1 through hexagonal boxes labelled R1

and R2. R1 depicts the relationship between C and W, and R2 depicts the relationship between W

12

Electronic copy available at: https://ssrn.com/abstract=1476431

and O. As described later, the strength of these relationships can be expressed in terms of pa-

rameters r1 and r2, where 0≤ r1≤ 1 and 0≤ r2≤ 1. A value of zero implies that there is no relation-

ship and a value of 1.0 implies that there is a perfect relationship. Each of these relationships is

bi-directional in its influence. That is, in the case of R1, for example, if there is a belief, say 0.9,

that the internal auditor is competent, then work performance will be satisfactory with a belief

0.9*r1 in absence of any other evidence. In a similar way, if there is a belief, say 0.8, that the

work performance of an internal auditor is satisfactory, then the internal auditor is competent

with a belief 0.8*r1 again in absence of any other evidence. Conversely, if the internal auditor is

not competent, say with a belief 0.6, then work performance will be unsatisfactory with a belief

0.6*r1 in absence of any other evidence. Similarly, in the case of R2, if the internal auditor is ob-

jective, say with a belief 0.7, then work performance will be satisfactory with a belief 0.7*r2 in

absence of any other evidence. On the other hand, if there is a belief, say 0.6, that the work per-

formance of an internal auditor is satisfactory, then the internal auditor would be objective with a

belief 0.6*r2.

The rectangular boxes in Figure 1 represent items of evidence pertinent to various IA fac-

tors as represented by direct linkages between items of evidence and the factors. In order to de-

termine the overall strength of the IA function, one must gather the relevant items of evidence as

indicated in Figure 1, evaluate the level of support each item of evidence provides to the corre-

sponding factor(s), and then aggregate these assessments of support to determine the overall

level of support for the strength of the IA function. Table 1 provides the definitions of the factors

influencing the strength of the IA function along with a detailed description of the types of evi-

dence used to provide support to the corresponding factors.

--Insert Table 1 here--

13

Electronic copy available at: https://ssrn.com/abstract=1476431

 In order to develop an analytical model for assessing the strength of the internal audit

function based on the conceptual framework5 described in Figure 1, we use the results of Theo-

rem 1 of Srivastava et al. (2007). Their Theorem 1 determines the overall beliefs on a binary va-

riable, say Z, that is related to three other binary variables, say A, B, and C, through a logical

“And” relationship. Also, their results incorporate all the interrelationships, between A and B,

between B and C, and between C and A. These relationships are assumed to be bi-directional as

in our case. Their general formulation is similar to our problem, except they consider one item of

evidence for each variable A, B, and C. In our case, we have three items of evidence for each

factor (see Figure 1). However, we can use their results in (14)-(16) (Srivastava et al. 2007, p.

132) directly to obtain the desired analytical model for the overall belief that the strength of the

audit function is strong or weak by substituting the strength of the internal audit function (S) for

Z, competence (C) for A, work performance (W) for B, and objectivity (O) for C and setting r3 =

0, i.e., there is no relationship between C and O as argued earlier in our case. Thus, from (15)

and (16) of Srivastava et al. (2007) we obtain the following beliefs for SS and SW: in terms of the

overall belief masses at C, W, and O, respectively, represented by the following sets of belief

masses6: { m C+ , m C− , m ΘC }, { m +W , m −W , m ΘW }, and { m O+ , m O− , m OΘ }.

Bel(SS) = [ mC+ m +W mO+ + r1 mΘ + + +r

C m W mO
+ + Θ + (r + r –r r ) m + mΘ m +
2 mC m W mO 1 2 1 2 C W O

+ r1r2( m C+ mΘ Θ Θ + Θ Θ Θ +
W m O + m C m W m O + m C m W m O )]/K. (1)

Bel (SW) = 1 − ( m C+ + mΘ + Θ + Θ
C ) ( m W + m W ) ( m O + m O )/K, (2)

The symbol K is the renormalization constant and is defined as:

K = 1− r1 mΘ
O
( mC+ m −W + m C− m +W ) − r2 mΘ
C
( m +W m O− + m −W mO+ )
− r1r2 m Θ
W
( mC+ m O− + m C− mO+ ) − r1( m C− m +W m O+ + mC+ m −W mO− )
− r2( mC+ m +W mO− + mC− m −W m O+ ) − (r1+ r2 − r1r2)( m C+ m −W m O+ + mC− m +W mO− ) (3)

14

Electronic copy available at: https://ssrn.com/abstract=1476431

Various m-values and the interrelationships are defined in Table 2.

----- Insert Table 2 about here -----

The m-values used in (1)-(3) are the overall belief masses for the three factors C, W, and

O. Based on the conceptual framework in Figure 1, these belief masses are determined by evalu-

ating three different items of evidence in each case. In other words, these m-values are the result

of combining three individual judgements about beliefs whether each of the factors are present or

absent or satisfactory or unsatisfactory. Let us express the individual judgment based on each of

the three items of evidence for the competence factor through the following sets of m-values:

Evidence 1: m1 (CY), m1 (CN), m1 ({CY, CN})

Evidence 2: m2 (CY), m2(CN), m2({CY, CN})

Evidence 3: m3(CY), m3(CN), m3({CY, CN})

The combined or the overall m-values for C can be determined by combining the above three

sets of m-values using Dempster’s rule. Using Srivastava’s (2005, Equation 10-13) approach for

combining m-values defined on a binary variable yields directly the following set of overall m-

values:

3 3 3
m C+ = 1 − ∏ (1 − mi (CY ))/K C , m C− = 1 − ∏ (1 − mi (C N ))/K C , m ΘC = ∏ mi ({CY ,C N }) / K C ,
i=1 i=1 i=1

3 3 3
Where K C = ∏ (1 − mi (CY )) + ∏ (1 − mi (C N )) − ∏ mi ({CY , C N }) . (4)
i=1 i=1 i=1

Similar to (4) above, we can write the overall m-values for work performance (W) and

objectivity (O) in terms of the individual judgment about m-values related to the four items of

evidence (see Figure 1) as:

4 4 4
m +W = 1 − ∏ (1 − mi (WS ))/K W , m −W = 1 − ∏ (1 − mi (WU ))/K W , m ΘW = ∏ mi ({WS ,WU }) / K W ,
i=1 i=1 i=1

15

Electronic copy available at: https://ssrn.com/abstract=1476431

 4 4 4
Where K W = ∏ (1 − mi (WS )) + ∏ (1 − mi (WU )) − ∏ mi ({WS , WU }) . (5)
i=1 i=1 i=1

and

4 4 4
m O+ = 1 − ∏ (1 − mi (O Y ))/K O , m O− = 1 − ∏ (1 − mi (O N ))/K O , m ΘO = ∏ mi ({O Y ,O N }) / K O ,
i=1 i=1 i=1

4 4 4
where K O = ∏ (1 − mi (O Y )) + ∏ (1 − mi (O N )) − ∏ mi ({O Y , O N }) . (6)
i=1 i=1 i=1

Equation (1) along with (4)-(6) provides a general model for evaluating the strength of IA

function in terms of the belief that the strength of IA function is strong. This formula is a func-

tion of the individual judgement about the m-values related to the three factors and the strength

of the interrelationships, r1 and r2. The first term in (1) arises directly because of the logical

“And” relationship between S and the three factors C, W, and O. The next three terms in (1) are

included because, due to interrelationships among factors, even if we do not know about one fac-

tor we can conclude that the factor is present based on the presence of the other two factors. The

last term in (1) represents the situation where we do not have information about two of the fac-

tors but because of the interaction, the knowledge of the presence of one factor can provide the

knowledge about the presence of the other two factors.

Equation (1) is a general analytical model that is based on a rigorous framework under

the DS theory of belief functions. The main advantage of such an analytical model is that it pro-

vides a tool to perform various kinds of analyses that may be relevant in the situation of interest.

For example, one can analyze the impact of one factor on the other factors as a function of the

strength of interrelationships. We present three examples of such analyses below as special cases

and perform a sensitivity analysis in the next section.

16

Electronic copy available at: https://ssrn.com/abstract=1476431

Case 1: No interrelationship between factors

For this case we assume r1 and r2 to be zero, i.e., r1 = r2 = 0 which yields K =1 and belief

that the strength of IA Function is strong becomes:

Bel (SS) = mC+ m +W mO+ .

As one can see from above, the belief that IA function is strong is the product of the three

belief masses that the auditor is competent, the work performance is satisfactory, and the auditor

is objective. This result makes intuitive sense because of the logical “And” relationship between

S (the strength of IA function) and three factors C, W, and O. Under the present situation, if any

one, two or all of the factors take complementary values then Bel (SS) will be zero.

Case 2: No knowledge about work performance and the two interrelationships are of the
same strength

For this case we set r1 = r2 = r, and m ΘW = 1, which yields the following expressions for

Bel (SS) and K:

Bel (SS) = [ r(2−r) m C+ m O+ + r2( m C+ m OΘ + mCΘ mO+ )]/K, and

K = 1 − r2( m C+ m O− + mC− mO+ ).

Again, the above expression for Bel (SS) makes logical sense. We know that under the "And"

relationship between the strength of IA function (S) and the three IA factors, C, W, and O, the IA

function will be strong if and only if all the three factors are present, i.e., when the internal audi-

tor is competent and objective, and work performance is satisfactory. This means that, in the

situation where we have no knowledge about work performance, i.e., m +W = 0, m −W = 0, as as-

sumed in the present case, the belief that the IA function is strong should be zero. However, be-

cause of the interrelationship between C and W, and between O and W, the belief in C and O

feeds into W and thus fulfilling the requirement of the "And" rule, yielding a non-zero belief for

17

Electronic copy available at: https://ssrn.com/abstract=1476431

the IA function to be strong as evident from the above expression of Bel(SS). The first term in

Bel(SS) represents the first order effect; because of the interrelationships, the knowledge that the

internal auditor is competent and is objective (i.e., m C+ >0, and m O+ >0) makes the belief that work

performance is satisfactory non-zero and thus yields a finite belief that the strength of IA func-

tion is strong. The second term is due to the second order interaction where we have knowledge

about only one variable, either C or O. This knowledge provides information about W and the

third variable either O or C, through the interrelationships. Hence, it generates a finite belief to-

wards the strength of the IA function being strong. The overall belief, Bel (SS), will be the high-

est for r = 1, i.e., for the perfect relationship.

Case 3: No knowledge about work performance and objectivity

For this case we assume that the external auditor has no knowledge about the work per-

formance and objectivity of the internal auditor, i.e., m +W = 0, m −W = 0, and m ΘW =1 and m O+ = 0,

m O− = 0, and m ΘO =1. These values yield K =1 and the belief that strength of IA function is strong

becomes:

Bel (SS) = r1r2 m C+ .

The above expression of Bel (SS) again makes logical sense. It suggests that even if we do not

know about two of the three factors (say, W and O), because of the interrelationships, the direct

knowledge about the presence of one of the factors (in this case C) can permit to infer about the

other two factors (W and O) and thus leading to a non zero belief that the strength of IA function

is strong. This is the second order of effect of interaction on the overall belief, Bel (SS).

18

Electronic copy available at: https://ssrn.com/abstract=1476431

4. Sensitivity Analysis

As mentioned earlier, one can perform various kinds of analyses using the analytical

model derived in (1) regarding the strength of IA function. For illustration purposes, we perform

four kinds of sensitivity analyses in this section. The first one deals with determining the impact

of objectivity on the strength of IA function. The second one deals with determining the impact

of work performance on the strength of the IA function. The third sensitivity analysis is per-

formed to determine the impact of interrelationships on the IA function. The fourth sensitivity

analysis is performed to determine the impact of the quality of corporate governance on the

strength of the IA function.

The Effect of Objectivity on the Strength of the IA function

In practice, it is very difficult for the external auditor to obtain direct evidence for all

three IA evaluation factors (Krishnamoorthy 2002). It may be relatively easier for the external

auditor to obtain evidence about the competence of the internal auditors. For instance, if the in-

ternal auditors are professionally certified by AICPA or IIA, the external auditors can assign a

high level of belief for the competence of the auditors. The same is the case when the internal

auditors have a long record of professional experience in the auditing industry.

When evaluating the objectivity of the IA function, independence (i.e. the function’s re-

porting relationship within the firm) is cited by external auditors as the most important criterion

(Clark et al. 1980, 1981; Brown 1983; Messier and Schneider 1988). DeZoort et al. (2001)

document that the primary role of the IA function and its compensation structure were perceived

by external auditors as affecting IA function objectivity. While in the post-SOX environment it

might be possible for the external auditor to obtain evidence about these criteria, it can be argued

that finding evidence about the objectivity of the IA function depends on the nature of the or-

19

Electronic copy available at: https://ssrn.com/abstract=1476431

ganization and the relationship between the external auditor and the client. Brody, Golen, and

Reckers (1998) investigated the importance of external auditors’ conflict management styles

(i.e., work around IA function style, deny problem style), recent experiences with material ad-

justments, and perceived communication barriers between clients and the audit firm in external

auditors’ decision to rely on the IA function. They found that conflict management styles and

perceived communication barriers were significant in explaining reliance decisions. Further,

Felix et al. (2005) also found that the provision of non-audit services also influences the reliance

decision of the external auditors. Specifically, they found that when non-audit services are not

provided to a client, internal audit quality and the level of internal–external audit coordination

significantly affects the reliance decision.

External auditors may find it difficult to determine whether the recommendations of the

internal audit department are being implemented by senior management within the organization.

For instance, Brody and Lowe (2000) found that internal auditors tended to take positions that

were in the best interests of the company, rather than make objective assessments when evaluat-

ing their findings. Also, Plumlee (1985) found that internal auditors who reviewed control sys-

tems perceived internal controls to be stronger, and the effects of any malfunctions to be less se-

vere, than internal auditors who did not have a role in the internal control design. Therefore, it

follows that the evaluation of the strength of the IA function will depend on the ability of the ex-

ternal auditor to obtain evidence about the objectivity of the IA function.

Figure 2 shows the assessed strength of the IA function for differing beliefs about the

levels of objectivity of the internal auditors. We first plot the strength of the IA function in an

organization with a highly competent internal audit department (say, m C+ = 0.9) with a very good

history of work performance (say, m +W = 0.9). We then assume a moderate level of relationship

20

Electronic copy available at: https://ssrn.com/abstract=1476431

between competence and work performance (r1= 0.5) and between work performance and objec-

tivity (r2= 0.5). Next, we vary the belief in objectivity from 0 to 1 in increments of 0.10. Here,

we consider two scenarios. In the first scenario, the external auditors might have positive evi-

dence about the objectivity of the auditors. For instance, the external auditors might be aware

that the internal auditors have direct access to, and report directly to, the audit committee. In the

second scenario, they may find evidence that makes them question the objectivity of the auditors.

This evidence, for example, could be that the incentive compensation of the internal auditors is

dependent on the company’s stock price.

--Insert Figure 2 Here--

As illustrated in Figure 2, the strength of the IA function is moderate (0.45) in an organi-

zation even when the internal auditors are found to be competent and their work is found to be of

high quality, since there is no evidence about the objectivity of the auditors. However, the

evaluation of the strength of the IA function increases rapidly as the external auditor is able to

gain more insight about the objectivity of the auditors. Also, it is to be noted that if the internal

auditors are not found to be objective, in cases where the external auditors have negative evi-

dence about the objectivity of the auditors, competence and work performance have negligible

effects on the evaluation of the strength of the IA function.

The Effect of Work Performance on the Strength of the IA function

The assessment of the work performance of the internal auditors can also pose difficulties

for the external auditors if, for example, they are faced with an IA function that does not readily

share its work with the external auditors. For instance, Campbell (1993) concluded that the reli-

ance decision was contingent on whether the auditor’s experience with the IA function was satis-

factory. She also found that the level of client interest in having coordination between the exter-

21

Electronic copy available at: https://ssrn.com/abstract=1476431

nal and internal auditors was a significant determinant of the reliance decision, albeit only when

there was prior satisfactory experience with the IA function. Also, Felix et al. (2001) found that

the availability of the IA function was a significant determinant of the reliance decision made by

the external auditors. If the external auditors do not get access to all of the relevant working pa-

pers and programs of the internal audit function, or if the internal auditors are not very detailed

when documenting their work, it could be very difficult to assess their work performance. For

instance, if the audit techniques used are not sophisticated or if the sampling techniques are not

documented, the external auditors cannot assign a high level of belief for the work of the internal

auditors. Recent regulations, such as SOX, have sought to remedy such a situation. Thus, a high

level of interest exists regarding the impact of different levels of beliefs about work performance

on external auditors’ evaluation of the strength of the IA function, given a high level of belief in

the competence and objectivity of internal auditors.

Figure 3 analyzes the effect of work performance on the strength of the IA function. In

Figure 3, we set the levels of competence and objectivity at 0.9 and r1 and r2 at 0.5. Then we vary

the level of belief for work performance from 0 to 1 with increments of 0.10. In this analysis, as

before, we consider both positive and negative beliefs about work performance.

-- Insert Figure 3 Here --

It can be seen that even with no evidence about work performance, the strength of the IA

function is moderately high at 0.652 and increases rapidly as evidence about internal auditors’

work performance is gathered. This result shows that belief in the strength of the IA function is

affected more adversely by a lack of knowledge about the objectivity of the internal auditors, as

seen in Figure 2, than by a lack of knowledge about their work performance. The reason for this

22

Electronic copy available at: https://ssrn.com/abstract=1476431

result will be discussed in the final section. Furthermore, when the work of the internal auditors

is found to be sub-standard, the belief in the strength of the IA function is reduced considerably.

The Effect of Interrelationships between the Factors

The strength of the relationships between the factors of competence, work performance,

and objectivity is an empirical question and can only be ascertained from the expert opinions of

the external auditors in practice. However, the question is important, because different strengths

of interrelationships will have different impacts on the evaluation of the strength of the IA func-

tion. One of the limitations of the Krishnamoorthy (2002) study was the assumption of a perfect

relationship between the factors, considered by the external auditors in determining the strength

of the IA function (e.g., P (~W/~C, O, H) = 1; P (W/~C, O, H) = 0). As mentioned earlier, this

assumption may lead to an overestimation or underestimation of the strength of the IA function.

Our model provides for different strengths of interrelationships between the factors affecting the

strength of the IA function, which provides a more realistic scenario. For instance, an external

auditor may assign a belief value of 0.9 to the objectivity of an internal auditor. However he/she

may not necessarily believe that the quality of internal audit work is as strong and consequently

he/she may assign the work performance factor a belief value of 0.3 based on the evidence about

the objectivity of the internal auditor, implying a weak relationship between work performance

and objectivity.

Maletta (1993) reported that under low inherent risk conditions, the IA function quality

factor interactions were not significant determinants of the reliance decision, but when inherent

risk was high, he found that objectivity and work performance had a significant interactive effect

on the reliance decision. Also, Krishnamoorthy (2001) found that when the audit procedure reli-

ability was low, the work performance evaluation was not contingent on the competence or ob-

23

Electronic copy available at: https://ssrn.com/abstract=1476431

jectivity of the internal auditors. However, when audit procedure reliability was high, the evalua-

tion of work performance was contingent upon the competence and objectivity of the internal

auditors. To study the sensitivity of the strength of the IA function to different values of interre-

lationships, we assign beliefs of 0.9 to competence and work performance and vary the belief for

objectivity for both positive and negative evidence, based on four different relationship strengths.

Each of the four strengths is described below:

r1= r2 = 0 = No relationship

r1= r2 = 0.2 = Weak relationship

r1= r2 = 0.8 = Strong relationship

r1= r2 = 1.0 = Perfect relationship

Figure 4 shows the sensitivity of the strength of the IA function to different strengths of

interrelationships when there is positive evidence about one of the factors, whereas Figure 5 pre-

sents the analyses with negative evidence about one of the factors.

-- Insert Figure 4 Here --

The top line in Figure 4 represents the maximum strength of all the relationships, i.e. it

assumes a perfect relationship between competence and work performance and between work

performance and objectivity. It can be seen that the strength of the IA function is always high in

the case of a perfect relationship between the factors, even when we have no information about

one of the factors. As the relationships get weaker, the strength of the IA function declines. In

fact, when there is no relationship between the factors, the external auditors cannot assess the

strength of the IA function if they do not have information for at least one of the factors.

-- Insert Figure 5 Here --

24

Electronic copy available at: https://ssrn.com/abstract=1476431

 The interesting finding in part of Figure 5, where we assess the sensitivity of the strength

of the IA function to negative evidence about one of the factors, is in the case of a perfect or a

strong relationship between the factors. It can be seen that the strength of the IA function is as-

sessed to be high, even when we continue to obtain more negative evidence about one of the fac-

tors accompanied by positive beliefs about the other two factors, until negative evidence about

one of the factors equals the positive beliefs of the other factors (i.e. m C+ = 0.9, m +W = 0.9, m O− =

0.9). Once the negative belief about one of the factors (objectivity) exceeds 0.9 given that posi-

tive belief about both competence and objectivity is 0.9, the strength of the IA function falls

sharply from 0.908 to 0, in the case of the perfect relationship. This result makes intuitive sense.

If the auditors are absolutely sure that the objectivity of the auditors is impaired, they will per-

ceive the IA function to be very weak, even if they have high levels of beliefs about the internal

auditors’ competence and work performance. And this is in spite of the fact that they think the

work performance and objectivity are perfectly correlated.

The Effect of Quality of Corporate Governance on the Strength of the IA function

The importance of the IA function to the overall governance structure of a firm has

grown significantly since the passage of SOX (Asare et al. 2003; COSO 2004). Due to SOX and

related regulation, audit committee charters of most public companies have information regard-

ing the relationship between the audit committee and the internal auditor that is accessible to ex-

ternal auditors as they make their IA function evaluations. Cohen et al. (2007) have placed re-

newed emphasis on the role of the IA function in helping fulfil the monitoring function of the

board and the audit committee. They also argued that certain factors in the governance structure

may also affect the work of the IA function including the quality and effectiveness of the audit

committee. Asare et al. (2003) found that internal auditors’ fraud risk assessments and planning

25

Electronic copy available at: https://ssrn.com/abstract=1476431

judgements are affected by management incentives as well as by the independence and financial

expertise of the audit committee. Further, Felix et al. (2005) concluded that when external audi-

tors do not provide non-audit services, they are more apt to consider the quality of the IA func-

tion. However, when the external auditors provide non-audit services, perceived client pressure

appears to influence the reliance decision such that the quality of the IA function and coordina-

tion issues do not affect the level of reliance. To sum up, the quality of corporate governance, as

evidenced by factors such as audit committee quality (e.g., financial literacy of the audit commit-

tee, number and duration of audit committee meetings, the percentage of independent directors,

the level of communication between the audit committee) appears to have a direct influence of

on the work performance and objectivity of the IA function. For instance, the higher the quality

of corporate governance, the higher the external auditors’ belief that the work performance and

objectivity of the IA function is satisfactory and vice versa.

In this section, therefore, we measure the effect of the quality of corporate governance on

the evaluation of the IA function by the external auditors. We argue that the quality of corporate

governance might also affect the interrelationships between the three factors in the model. For

instance, a high quality of corporate governance might cause the external auditors to place a

higher value on the relationship between competence and work performance or between work

performance and objectivity. For instance, when the audit committee is of high quality, the ex-

ternal auditor might perceive a stronger relationship between competence and work performance

and/or between objectivity and work performance.

Figure 6 shows the effect of quality of corporate governance on the strength of the IA

function. In Figure 6, first we set the level of belief for competence at 0.9, i.e., m C+ = 0.9, and the

level of belief for work performance and objectivity from other pieces of evidence at 0.1. Then,

26

Electronic copy available at: https://ssrn.com/abstract=1476431

we vary the level of positive belief for the quality of corporate governance from 0 to 1 in incre-

ments of 0.10. Further, in the case of negative belief about the quality of corporate governance,

we again assume the competence to be high at 0.9, i.e., m C+ = 0.9, and the belief that the work

performance is satisfactory and the belief that the IA function is objective are set at 0.1 from

other items of evidence. Then we vary the level of negative belief for the quality of corporate

governance from 0 to 1 in increments of 0.1. When we have positive evidence about the quality

of corporate governance, we set r1 = r2 = 0.8. When we have negative evidence about the quality

of corporate governance, we set r1 = r2 = 0.2.

-- Insert Figure 6 Here --

The line representing the legend “CG-POS” in Figure 6 represents the belief in the

strength of the IA function at varying levels of positive evidence about the quality of corporate

governance with 0.9 degree of belief in competence ( m C+ = 0.9), and a low level of positive be-

lief of 0.1 in work performance and objectivity from evidential sources other than quality of cor-

porate governance. It can be seen that when the external auditors have limited knowledge about

the quality of corporate governance, the strength of the IA function is moderate at 0.64. How-

ever, as the belief in the quality of corporate governance increases from 0 to 1, the belief in the

strength of the IA function also increases substantially from 0.64 to almost 1.

The line representing the legend “CG-NEG” in Figure 6 represents the belief in the

strength of the IA function at varying levels of negative evidence about the quality of corporate

governance with 0.9 degree of belief in competence ( m C+ = 0.9), and a low level of positive be-

lief of 0.1 in work performance and objectivity from evidential sources other than the quality of

corporate governance.

27

Electronic copy available at: https://ssrn.com/abstract=1476431

 The observations in this scenario are very interesting. It can be seen that even though we

have positive beliefs, although a low level of 0.1, about work performance and objectivity from

evidential sources other than the quality of corporate governance and positive belief about com-

petence, the belief in the strength of the IA function is quite low at 0.08 when we have no know-

ledge about the quality of corporate governance. The reason is that when external auditors perce-

ive the quality of corporate governance to be low, they perceive the strength of the interrelation-

ships between the factors to be low (r1 = r2 = 0.2). Further, as the negative belief about the quali-

ty of corporate governance increases from 0 to 1, the belief in the strength of the IA function de-

creases from 0.08 to 0. The results appear to support the assertion that the quality of corporate

governance is bound to have a substantial influence on the evaluation of the strength of the IA

function by the external auditors.

5. Implications and Cost-Benefit Analysis

In this section we illustrate the usefulness of our IA function evaluation model as an ex-

ternal auditor gathers and assesses evidence to determine whether or not a client’s internal con-

trols are SOX compliant. In addition, we work through an example to demonstrate how a cost-

benefit analysis can be employed to determine the optimum level of reliance the external auditor

can place on the internal audit function. Such an analysis gains additional importance in the light

of SOX and guidance provided by the PCAOB, which requires external auditors to rely increas-

ingly on the work of the internal audit department.

Practice Implications

Research has documented that the IA function can complete in excess of 25% of the audit

work necessary to complete the external audit (Abdel-Khalik et al. 1983; Schneider 1985b;

Campbell 1993; Maletta and Kida 1993; Maletta 1993; Felix et al. 2001). Furthermore, recent

28

Electronic copy available at: https://ssrn.com/abstract=1476431

audit guidance encourages external auditors to design their audits such that more reliance can be

placed on the work of client personnel (PCAOB 2007). The stronger the IA function, the higher

the extent of reliance by external auditors on the work performed by the IA function. Research

has also documented an impact of involvement of the IA function in the financial statement audit

of a client on reduction of external audit fees (Felix et al. 2001).

More recently, the importance of reliance on IA function by external auditors has been

highlighted by the PCAOB (AS No. 5 2007; see also Gramling et al. 2004, and Sneller and Lan-

gendijk 2007). Gramling et al. (2004, p.197) state "The IAF's work may affect the nature, timing,

and extent of the annual audit work, including procedures the external auditor performs when

obtaining an understanding of the entity's internal control, when assessing risk, and when gather-

ing substantive evidence." The analysis presented here provides a systematic and structured ap-

proach to determining the extent of reliance that external auditors should place on the IA func-

tion in their internal control assessment regarding SOX compliance.

Let us illustrate the usefulness of our approach by considering an example. Suppose the

external auditor is evaluating the internal controls of a company for SOX compliance. He/She

needs to gather enough competent evidential matter to gain a high level, say a 0.95 level of con-

fidence on a scale 0 to 1, that the internal controls are SOX compliant. There are two sources of

evidence. He/She can depend on the IA function or he/she can perform audit procedures to

gather his/her own evidence. Suppose that based on the evaluation of the strength of the IA func-

tion, the external auditor determines that he/she can rely on the client’s IA function at a medium

level, say 0.7, on a scale of 0 to1, that the internal controls are SOX compliant. The critical ques-

tion then becomes “What level of confidence does the external auditor need from his/her own

direct evidence in order to have an overall confidence level of 0.95?” The answer can be

29

Electronic copy available at: https://ssrn.com/abstract=1476431

achieved by computing backwards using Dempster's rule which yields a belief of 0.83 (a me-

dium-high level of support) to be achieved from the external audit evidence. The extent, timing

and nature of evidence will determine the level of support; the more competent and extensive the

procedure the greater the support. If the external auditor decides to rely on the IA function at a

much higher level, say 0.9, then the desired level of support from the external audit evidence will

have to be 0.5, a much smaller value. In the extreme case, suppose that the external auditor finds

that the IA function is very strong and he/she can fully rely on IA function, i.e., he/she assigns

0.95 level of support to internal controls being in SOX compliance just based on the evaluation

of the strength of the IA function. This implies that the level of belief needed from external audit

evidence is zero, which means that the external auditor does not need to collect any direct evi-

dence or perform any audit procedures. However, as demonstrated in the following example,

such reliance is not feasible because of the cost associated with the external audit engagement.

----- Insert Figure 7 here ------

In our example, panel A in Figure 7 depicts the variation of cost of an external audit

given different levels of reliance on external audit tasks. It will be more costly to gather audit

evidence if more reliance is to be placed on external audit evidence. If no reliance is placed on

external audit evidence, the audit cost will be zero. We have assumed the following form of the

external audit cost: AC = a*BelEA(i)/[1-Exp(-b*(1-BelEA(i))], where 'a' and 'b' together deter-

mines the magnitude and the rate of change of the cost. BelEA(i) determines the level of belief the

external auditor assigns based on the external audit (described by the sub-script EA) that internal

controls are SOX compliant as represented by 'i'. The cost function AC defined above increases

exponentially as the desired belief in 'i' increases (see panel A in Figure 7). However, as one can

see from panel B in Figure 7, the external audit cost decreases as the reliance on the IA function

30

Electronic copy available at: https://ssrn.com/abstract=1476431

increases. The cost becomes zero if the external auditor decides to fully depend on the IA func-

tion. However, as discussed below, such reliance is questionable.

Cost- Benefit Analysis

In this section, we demonstrate that the external auditor cannot and perhaps should not

depend on the internal auditor completely or even at a very high level. The level of reliance de-

pends on the cost of the audit, audit fees obtained, and litigation and regulatory costs. Conceptu-

ally this makes sense. For example, if there were no litigation and regulatory costs to the external

auditor, then relying completely on the internal auditor's work would not create problems for the

external auditor. Let us define the following symbols for our analysis.

AC = Audit Cost of the external auditor defined as: AC = a*BelEA(i)/[1-Exp(-b*(1-BelEA(i))].

AF = Audit Fee charged by the external auditor, assume 'ρ' to be the profit margin, i.e. AF =
(1 + ρ)*AC.

LC = Litigation costs and regulatory costs such as professional liability insurance premiums,
out of court settlements, and auditor independence compliance systems.

FB = Future benefits computed as the present value of the next five year annual cash flow of
(AF -AC) discounted at 'r'.

x = Annuity factor based on the five year discounted yearly cash flow at the rate of r.

BelEA(i) = Belief that internal controls are SOX compliant, i.e., the belief that 'i' is true based
on the external audit (EA).

Bel(i) = Overall belief that the internal controls are SOX compliant. This belief is the combi-
nation of the belief from the external audit evidence and the evidence from the internal
audit.

Suppose the external auditor decides to attest to a client’s SOX compliance when he/she

has an overall belief of Bel(i). This overall belief usually can be assumed to be high, say 0.95, for

deciding to attest to the client’s compliance. However, there is still a risk of [1- Bel(i)] that the

internal controls may not be SOX compliant. In such a situation, the expected value of the bene-

31

Electronic copy available at: https://ssrn.com/abstract=1476431

fit to the external auditor should be greater than or equal to zero in order for the auditor to attest

to SOX compliance. This condition can be expressed as (see Sun et al. 2006 for expected value

calculation under belief functions):

(AF - AC)Bel(i) + (AF - AC - LC - FB)[1 - Bel(i)] ≥ 0. (7)

The first term above represents the benefit given that the auditor is confident that the in-

ternal controls are SOX compliant and the second term represents the net benefits given that the

internal controls are not SOX compliant. After using the definition of AF and FB in terms of AC

(i.e., AF = (1+ρ)*AC and FB = (AF-AC)*x = ρ*x*AC), we obtain the following condition from

(7):

AC ≥ LC*[1 - Bel(i)]/[ρ*(1-x*(1 - Bel(i))]. (8)

For the external auditor to attest to a client’s SOX compliance based partly on the work

of the IA function and partly on his/her own work, the external audit cost AC has to meet the

above condition in (8). Since AC depends on the reliance the auditor wants to place on his/her

own work, and in turn on the IA function, it is not possible to satisfy the condition in (8) for any

arbitrary level of reliance on the work of the IA function. For example, as seen from Figure 8, if

the auditor decides that the IA function is excellent and he/she can fully rely on the IA, i.e.,

he/she can obtain a high level of assurance from the internal auditor alone that the internal con-

trols are SOX compliant. At an assurance level of, say 0.95, the external auditor does not need to

perform any audit procedures. The cost of external audit for this case will be zero but the condi-

tion in (8) will not be met. Therefore, even though the IA function is excellent, the auditor cannot

depend completely on the IA function alone; the auditor must collect some of his/her own evi-

dence to get enough belief, BelEA(i), to satisfy the condition in (8). Thus, there is an equilibrium

32

Electronic copy available at: https://ssrn.com/abstract=1476431

value to which the external auditor can rely on the internal audit function, i.e., a maximum value

of belief, BelEA(i), that the internal controls are SOX compliant. This equilibrium value is deter-

mined by solving (8) for a given overall belief.

----- Insert Figure 8 here ------

Figure 8 represents a graph of the equilibrium beliefs for a 0.95 overall belief for various

levels of litigation and regulatory costs, LC. It is clear that when there are no litigation and regu-

latory costs then the external auditor can depend completely on the internal auditor given that the

level of belief obtained from IA is that high, i.e., 0.95. However, as LC increases the level of re-

liance put on the internal auditor decreases and the level of reliance on the external auditor’s own

work increases. In the extreme, when the litigation and regulatory costs are extraordinarily high,

no matter how high the external auditor’s beliefs about the strength of the IA function, the exter-

nal auditor will not rely on work of the IA function.

6. Discussion and Conclusions

In this paper, we developed an analytical model for evaluating the strength of the IA

function using the belief function framework based on the conceptual framework depicted in

Figure 1. This approach uses factors identified by professional guidance and prior research for

evaluating the strength of the IA function and provides a theoretical model of the decision proc-

ess. One of the contributions of this paper is that it enables external auditors to evaluate the

strength of the IA function, without the limitation of the Bayesian framework, which requires the

estimation of conditional probabilities. Furthermore, it models the “And” relationship between

the factors influencing the strength of the IA function, and it analyzes the sensitivity of the

strength of the IA function to differing levels of beliefs in objectivity and work performance, to

differing strengths of relationships between the three factors determining the strength of the IA

33

Electronic copy available at: https://ssrn.com/abstract=1476431

function, and to differing levels of belief about in quality of corporate governance. The inclusion

of the quality of corporate governance in the model brings added relevance to our research be-

cause the importance of the IA function to the overall governance structure of a firm has grown

significantly since the passage of SOX (Asare et al. 2003; COSO 2004). We believe that this

evaluation approach can clarify and aid in external auditors’ evaluation of the IA function as it is

specified in PCAOB auditing standards.

Results of the sensitivity analyses reveal that objectivity is an important factor in the

evaluation of the strength of the IA function. Even when high levels of belief in the competence

and work performance of internal auditors are present, the strength of the IA function is found to

be very low when there is no information about the level of objectivity of the internal auditors.

On the other hand, the strength of the IA function is found to be moderately high when high lev-

els of belief in the objectivity and competence are present and there is no information about the

work performance of the IA function.

The reason for these findings is due to the nature of the interrelationships between the

factors influencing the strength of the IA function. Prior Research (Krishnamoorthy 2002; Mess-

ier and Schneider 1988) documented the absence of any relationship between competence and

objectivity. Therefore, beliefs about competence do not directly give us any derived beliefs about

the objectivity of the IA function although beliefs about work performance feed directly into be-

liefs about the objectivity of the IA function. Conversely, due to the presence of direct relation-

ships between work performance and competence (R1) and between work performance and ob-

jectivity (R2), beliefs about competence and objectivity feed directly into beliefs about the work

performance of the IA function. It can therefore be argued that finding evidence about the objec-

tivity of the IA function is crucial for the external auditor to arrive at an assessment of the quality

34

Electronic copy available at: https://ssrn.com/abstract=1476431

of the IA function7. This finding is contrary to the results in prior empirical studies, which con-

cluded that objectivity is not as important as work performance and competence (Brown 1983;

Schneider 1985; Margheim 1986; Maletta 1993). Our findings differ from prior work because

these studies did not model the inter-relationships between the three factors.

As far as interrelationships are concerned, the analysis revealed that when the three fac-

tors have a strong or a perfect relationship, the strength of the IA function remains high even if

we have positive or negative evidence about one of the factors (as long as we have high levels of

beliefs about the other two factors). However, this strong belief dips to zero as soon as the nega-

tive belief about objectivity is 1. That is, the external auditors are then absolutely sure that the

objectivity of the internal auditors is impaired.

Further, the analysis of the effect of the quality of corporate governance on the strength

of the IA function revealed that even when the external auditors have positive beliefs about com-

petence, work performance, and objectivity, they cannot consider the IA function to be strong if

they have no knowledge or negative knowledge about the quality of corporate governance. This

is because low quality of corporate governance not only adversely affects beliefs in work per-

formance and objectivity but also adversely impacts the strength of the interrelationships be-

tween the three factors in the model.

Finally, the cost-benefit analysis demonstrates how litigation and regulatory costs influ-

ence the extent of reliance the external auditor can place on the work of the IA function based on

an evaluation of the strength of the IA function. If expectations of litigation and regulatory costs

are high, the external auditor is less likely to rely on the work of the IA function even if the

evaluation of the strength of the IA function is high. In such a scenario, the external auditor is

more likely to rely on his/her own external audit work to ensure that internal controls are SOX

35

Electronic copy available at: https://ssrn.com/abstract=1476431

compliant. On the other hand, if the external auditor expects low to zero litigation and regulatory

costs, he/she may be more likely to rely on the work of the IA function, thereby incurring lower

audit costs.

In addition to the usual limitations that accompany similar studies, the first major limita-

tion of the study is the lack of empirical evidence available to support the findings of the model.

Second, the factors in the model are assumed to be discrete and binary. Third, for simplicity rea-

sons we did not consider mixed evidence in our analysis. Fourth, we have assumed that each

item of evidence supports only one factor and thus making it easier to develop an analytical

model for evaluating the IA function. Such an analytical model is not easily derivable if we as-

sume that some items of evidence pertain to more than one factor; one would need to use com-

puter software such as Auditor’s Assistant developed by Shafer, Shenoy and Srivastava (1988).

Fifth, as is common in all modelling papers, the results of the analyses are based on the various

assumptions that drive the models and should be interpreted accordingly. Lastly, this research

develops a normative model and therefore does not take into account contextual or environ-

mental factors that might alter the predictions of the model.

36

Electronic copy available at: https://ssrn.com/abstract=1476431

Appendix A

Introduction to Dempster-Shafer Theory of Belief functions

There are several publications where an introduction to belief functions has appeared.

Shafer (1976) remains the classic reference on belief functions, however, discussions of belief

functions may also be found in Srivastava (1993), Srivastava and Shafer (1992), Srivastava and

Mock (2000, 2002), Yager et al. (1994), and Sun et al. (2006). However, for the convenience of

readers, we provide a brief introduction here as well.

Essentially, under the probability framework, we assign uncertainty in terms of probabil-

ity mass, P, to each possible value of a variable where all such masses add to one. For example,

suppose there are n possible values, a1, a2 …an, of variable ‘A’ forming a mutually exclusive and

exhaustive set. Under the probability framework we assign probability mass to each value of the

n
variable, i.e., P (ai) ≥ 0, such that ∑ P(a i ) = 1 . However, under the belief-function framework,
i=1

we assign uncertainty, represented by m-values (belief masses, i.e., basic probability assignment

function by Shafer 1976) to not only singletons but to all other possible subsets including the en-

tire frame Θ = {a1, a2 ….an} such that the sum of all these m-values equals one,

n
i.e., ∑ m(X) =
X ⊆Θ
1 . The belief-function framework reduces to the probability framework when

the only non-zero m-values are for the singletons.

To illustrate the above concepts, let us consider the following example. Suppose the ex-

ternal auditor has gathered evidence about the competence of the internal auditor. After evaluat-

ing the evidence, the external auditor believes that the internal auditor is competent, represented

by c, with a confidence level of 0.6, on a scale of 0-1, a medium level of belief. Moreover, the

external auditor thinks that the evidence does not provide any support in favour of the internal

37

Electronic copy available at: https://ssrn.com/abstract=1476431

auditor being incompetent, represented by ~c. Under belief functions, we can write the above

judgment in terms of belief masses as: m(c) = 0.6, and m(~c) = 0. The unassigned mass of 0.4 is

associated with the entire frame {c, ~c}. In other words, the remaining uncertainty is assigned to

the entire frame {c, ~c} as m({c, ~c}) = 0.4, such that m(c) + m(~c) + m({c, ~c}) = 1. The unas-

signed part of belief mass represents ignorance. Such a distribution of uncertainty is not possible

under probability framework. Once we assign a mass of 0.6 to the value 'c' then, by definition,

0.4 is assigned to its negation, '~c'. There are many real world situations where such partial igno-

rance is common. Probability framework is not appropriate to model such uncertainties (see, e.g.,

Srivastava and Mock 2005).

Belief Function

Belief in a subset B of a frame Θ determines the total belief one has in B based on the

evidence represented through m-values. It is defined as:

Bel(B) = ∑ m(X) ,
X⊆ B

Where X represents a set of elements of Θ. Let us consider an example similar to the one used

earlier for illustration. Suppose this time we have a mixed item of evidence, just for illustrative

purpose, pertaining to 'Competence' of the internal auditor with the following distribution of be-

lief masses: m(c) = 0.6, m(~c) = 0.3, m({c, ~c}) = 0.1. These m-values imply that, based on the

evidence, we have 0.6 level of support, on a scale of 0-1, that the internal auditor is competent,

0.3 level of support that he/she is not competent, and 0.1 level of support that he/she is either

competent or not competent, representing ignorance. Based on the above example, the belief that

the internal auditor is competent is Bel(c) = m(c) = 0.6, the belief that the internal auditor is not

competent is Bel(~c) = m(~c) = 0.3, and by definition the belief that the internal auditor is either

38

Electronic copy available at: https://ssrn.com/abstract=1476431

competent or not competent is Bel({c, ~c}) = 1 (i.e., Bel({c, ~c}) = m(c) + m(~c) + m({c, ~c}) =

0.6 + 0.3 + 0.1 = 1.0).

Dempster’s Rule

Dempster’s rule is the fundamental rule for combining multiple independent items of evi-

dence under the belief-function framework. This rule is similar to Bayes’ rule under probability

theory. In fact, Dempster’s rule becomes Bayes’ rule under the condition where belief masses are

assigned only to the singletons as mentioned earlier. To illustrate Dempster's rule let us consider

a simple example with two independent items of evidence as given below pertaining to the qual-

ity factor Competence (C) with two values, c and ~c, as described earlier (see Table 1 for more

details).

Evidence 1: Evidence concerning auditor qualifications and training.

Evidence 2: Evidence of auditor tacit knowledge.

Suppose the external auditor's judgments about the level of support obtained from each of

the above items of evidence are given in terms of the following set of belief masses, i.e., m-

values:

Evidence 1: m1(c) = 0.6, m1(~c) = 0.3, m1({c, ~c}) = 0.1,

Evidence 2: m2(c) = 0.3, m2(~c) = 0.2, m2({c, ~c}) = 0.5.

The above distributions of belief masses are considered for illustrative purpose. Although

it is an empirical question, Shafer (1976) has argued that an item of evidence encountered in the

real world, usually, is either positive or negative, seldom mixed, i.e., the evidence usually pro-

vides support in favour of the variable or against the variable but not both.

In order to combine the above two items of evidence, we use Dempster's rule. Conceptu-

ally, Dempster's rule suggests that when you have two independent items of evidence pertaining

39

Electronic copy available at: https://ssrn.com/abstract=1476431

to an assertion, the assertion is true under the following conditions: 1) when both items of evi-

dence are telling us that the assertion is true, or 2) when one item of evidence is telling us that

the assertion is true and the other one is simply ambiguous about it. In our case where we have

two items of evidence, the combined m-values using Dempster's rule can be mathematically ex-

pressed in the following form (See, e.g., Srivastava 1993):

m(B) = ∑
B1∩B2=B
m1 (B1)m 2 (B2) /K,

Where B, B1 and B2 are subsets of the frame of the variable, which is {c, ~c} in our case, i.e.,

B ⊆ ({c}, {~c}, {c, ~c}) and also B1 ⊆ ({c}, {~c}, {c, ~c}), and B2 ⊆ ({c}, {~c}, {c, ~c}). K is

the renormalization constant defined as:

K = 1− ∑
B1∩ B2=∅
m1 (B1)m 2 (B2) .

The second term in K represents conflict. Under the situation when two items of evidence com-

pletely conflict with each other, i.e., K = 0, the two items of evidence are not combinable. The

generalized version of Dempster's rule for more than two items of evidence is given in Shafer

(1976). Basically, under Dempster's rule, we cross multiply the two sets of m-values and collect

those terms that have common element equal to the element desired for combined m-values. The

terms that have conflicting elements, i.e., there is no common element, are thrown away and the

remaining m-values are renormalized to make the resultant m-values add to one.

For our example, we have the renormalization constant K as:

K = 1 – [m1(c)m2(~c) + m1(~c)m2(c)] = 1 – [0.6x0.2 + 0.3x0.3] = 0.79.

The combined m-values using Dempster’s rule as defined earlier are given by:

m(c) = [m1(c)m2(c) + m1(c)m2({c, ~c}) + m1({c, ~c})m2(c)]/K

= [0.6x0.3 + 0.6x0.5 + 0.1x0.3]/0.79 = 0.51/0.79 = 0.646.

40

Electronic copy available at: https://ssrn.com/abstract=1476431

 m(~c) = [m1(~c)m2(~c) + m1(~c)m2({c, ~c}) + m1({c, ~c})m2(~c)]/K

= [0.3x0.2 + 0.3x0.5 + 0.1x0.2]/0.79 = 0.23/0.79 = 0.291,

m({c, ~c}) = m1({c, ~c})m2({c, ~c})/K = 0.1x0.5/0.79 = 0.063.

Thus, the combined m-values are: m(c) = 0.646, m(~c) = 0.291, and m({c, ~c}) = 0.063. These

values suggest that, based on the two pieces of evidence, we have 0.646 level of belief that the in-

ternal auditor is competent, i.e., Bel(c) = 0.646, and 0.291 level of belief that the internal auditor is

not competent, i.e., Bel (~c) = 0.291, and 0.063 level of belief still remains unassigned, represent-

ing the ignorance.

41

Electronic copy available at: https://ssrn.com/abstract=1476431

 Endnotes

1. Competence has been defined as the educational level and professional experience of the

internal auditor and other such factors. Objectivity has been defined as the organizational

status of the internal auditor and organizational policies affecting the independence of the

internal auditor. Work Performance has been defined as the assessment of internal con-

trol, risk assessment, and substantive procedure performed by the internal auditor. These

definitions have been taken from SAS 65 (AICPA, 1991). PCAOB Auditing Standard

No.5 (2007) emphasizes objectivity and competence and implies that work performance

must also be taken into consideration.

2. In fact, prior literature in accounting/auditing has documented counter-intuitive results

from the use of Bayesian models in other contexts mainly because of improper modeling

of ignorance. See Krishnamoorthy (1993) for more discussion.

3. See Gramling et al. (2004) for an extensive review of research related to the internal audit

function.

4. We assume to have definite knowledge that the internal auditor is not competent (λc1 = 0,

λc2 = 0), the work performance is poor (λw1 = 0, λw2 = 0), and objectivity is low (λo1 = 0,

λo2 = 0). These values yield the following expression for the likelihood ratio given in

Equation A-5 of Krishnamoorthy (2002, p. 120): Likelihood ratio =

P(~c|h)P(~o|h)/P(~c|~h)P(~o|~h). For the above situation, and Case HLM of Krish-

namoorthy (p. 102, 2002), the likelihood ratio becomes 1/12, which yields a value of 1/13

for the posterior probability that the strength of IA function is high given the prior odds to

42

Electronic copy available at: https://ssrn.com/abstract=1476431

 be one, i.e., P(h)/P(~h) = 1. However, under the “And” relationship, one would expect

this posterior probability to be zero for the above situation.

5. The evidence ‘Quality of Corporate Governance’ affects both ‘Work Performance’ and

‘Objectivity’ which is represented as two separate items of evidence to derive the analyti-

cal formula. However, in principle, it is the same item of evidence. Treating this one

piece of evidence as two separate pieces of evidence for deriving analytical formulas is a

reasonably good approximation as demonstrated by Srivastava and Lu (2002) and also by

Srivastava and Li (2009). In fact, our sensitivity analysis for the first three cases would

not be affected by the above approximation because ‘Quality of Corporate Governance’

is not considered as a piece of evidence in these analyses.

6. m C+ represents the belief mass that the internal auditor is competent, i.e., m(CY ) = m C+ ,

m C− represents the belief mass that the internal auditor is not competent, i.e.,

m(C N ) = m C− , and m ΘC represents the ignorance part of the belief mass, i.e.,

m({CY , C N }) = m CΘ . Similarly, m(WS ) = m +W , m(WU ) = m −W , and m({WS , WU }) = m ΘW

and m(O Y ) = mO+ and m(O N ) = m O− , and m({O Y , O N }) = mOΘ .

7. It should be noted here that results of sensitivity analyses of competence will yield the

same results as the results of objectivity because competence also gets a diluted belief

from beliefs about objectivity. However, it can be argued that it is relatively easier to get

evidence about the competence of the IA function as evidence related to competence is

more objective and factual. For e.g. educational qualifications etc…

43

Electronic copy available at: https://ssrn.com/abstract=1476431

References

Abdel-Khalik, R., D. Snowball, and J. H. Wragge. 1983. The effects of certain internal audit vari-
ables on the planning of external audit programs. The Accounting Review (April): 215-227.

Akresh, A. D., J. K. Loebbecke, and W. R. Scott. 1988. Audit approaches and techniques. In
Research Opportunities in Auditing: The Second Decade, edited by A. R. Abdel-khalik and
Ira Solomon. Sarasota, FL: AAA, 13-55.

American Institute of Certified Public Accountants (AICPA). 1991. The auditor’s consideration of
the internal audit function in an audit of financial Statements. Statement on Auditing Stan-
dards No. 65. New York, NY: AICPA.

American Institute of Certified Public Accountants (AICPA). 2003. Statements on Auditing Stan-
dards. New York, NY: AICPA.

Antoine, R. 2004. Internal audit: Spotlight shines on its new role.

http://accounting.smartpros.com.remote.libproxy.wlu.ca/x45449.xml.

Asare, S. and A. Wright. 2003. A note on the interdependence between hypothesis generation
and information search in conducting analytical procedures. Contemporary Accounting
Research 20 (2): 235-251.

Bailey, A. D., Jr., A. A. Gramling, and S. Ramamoorti, editors. 2003. Research Opportunities in
Internal Auditing. Altamonte Springs, FL: Institute of Internal Auditors Research Foun-
dation.

Brody, R.G., S.P. Golen, and P.M.J. Reckers. 1998. An empirical investigation of the interface be-
tween internal and external auditors. Accounting and Business Research (Summer):160-
171.

Brody, R.G., and D.J. Lowe. 2000. The new role of the internal auditor: implications for internal
auditor objectivity. International Journal of Auditing 4:169-176.

Brown, P. R. 1983. Independent auditor judgment in the evaluation of the internal audit functions.
Journal of Accounting Research 21(Autumn): 444-455.

Campbell, A. 1993. Internal audit reliance in the continuing audit engagement. Internal Auditing
(Summer): 56-66.

Cohen, J., L. M. Gaynor, G. Krishnamoorthy and A. M. Wright. 2007. Auditor communication

with the audit committee and the board of directors: Policy recommendations and oppor-
tunities for future research. Accounting Horizons (June): 165-187.

Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2004. Internal

Controllntegrated Frame-Work. Jersey City, NJ: AICPA.

44

Electronic copy available at: https://ssrn.com/abstract=1476431

Clark, M., T. E. Gibbs, and R. B. Schroeder. 1980. Evaluating internal audit departments under
SAS No. 9: Criteria for judging competence, objectivity, and performance. The Woman
CPA (July): 8-11, 22.

Curly, S.P., and J. I. Golden. 1994. Using belief functions to represent degrees of belief. Organiza-
tional Behavior and Human Decision Processes 58:271-303.

DeZoort, F. T., R. W. Houston, and M. F. Peters. 2001. The impact of internal auditor compensa-
tion and role on external auditors' planning judgments and decisions. Contemporary Ac-
counting Research (Summer): 257-281.

Edge, W. R., and A. A. Farley. 1991. External auditor evaluation of the internal audit function. Ac-
counting and Finance: 69-83.

Felix, W. L. Jr., A.A. Gramling, and M.J. Maletta. 2001. Coordinating total audit coverage: The
relationship between internal and external auditors, Altamonte Springs, FL: The Institute of
Internal Auditors, Inc.

Felix, W.L. Jr., A.A. Gramling, and M. J. Maletta. 2005. The influence of non-audit service reve-
nues and client pressure on external auditors’ decisions to rely on Internal Audit. Contem-
porary Accounting Research. 22:31-53

Gordon, J., and E.H. Shortliffe. 1990. The Dempster-Shafer theory of evidence. In Readings in Un-
certain Reasoning. California: Morgan Kaufmann Publishers Inc.

Gramling, A.A, M. Maletta, A. Schneider, and B. Church.2004. The role of the internal audit func-
tion in corporate governance: A synthesis of the extant internal auditing literature and direc-
tions for future research. Journal of Accounting Literature. 23: 193-244.

Harrison, K., R.P. Srivastava, and R.D. Plumlee.2002. Auditors’ evaluations of uncertain audit evi-
dence: Belief functions versus probabilities. In Srivastava, R.P., and T. J. Mock, eds. Belief
functions in business decisions. Physica- Verlag:161-183.

Krishnamoorthy, G. 2001. A cascaded inference model for evaluation of the internal audit report.
Decision Sciences 32 (Summer): 499-520.

Krishnamoorthy, G. 1993. Discussion of Aggregation of Evidence in Auditing: A Likelihood Per-

spective. Auditing: A Journal of Practice and Theory, Vol 12 (Supplement): 161-166.

Krishnamoorthy, G. 2002. A Multistage Approach to External Auditors’ Evaluation of the Internal

Audit Function. Auditing: A Journal of Practice and Theory (Spring): 95-121.

Maletta, M. J. 1993. An examination of auditors’ decisions to use internal auditors as assistants:

The effect of inherent risk. Contemporary Accounting Research (Spring):508-525.

Maletta, M. J., and D. T. Kida. 1993. The effect of risk factors on auditors’ configural information
processing. The Accounting Review. 68 (July): 681-691.

45

Electronic copy available at: https://ssrn.com/abstract=1476431

Margheim, L. L. 1986. Further evidence on external auditors’ reliance on internal auditors. Journal
of Accounting Research (Spring): 194-205.

Messier, W. F., Jr., and A. Schneider. 1988. A hierarchical approach to the external auditor’s
evaluation of the internal auditing function. Contemporary Accounting Research (Spring):
337-353.

Plumlee, R. D. 1985. The standard of objectivity for internal auditors: Memory and bias effects.
Journal of Accounting Research (Autumn): 683-699.

Public Company Accounting Oversight Board (PCAOB). 2007. Auditing Standard No. 5(AS 5) –
An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements. Washington, D.C.: PCAOB.

Schneider, A. 1984. Modeling external auditors’ evaluations of internal auditing. Journal of Ac-
counting Research (Autumn): 657-678.

Schneider, A. 1985a. The reliance of external auditors on the internal audit function. Journal of
Accounting Research (Autumn): 911-919.

Schneider, A. 1985b. Consensus among auditors in evaluating the internal audit function. Account-
ing and Business Research (Autumn): 297-301.

Shafer, G. 1976. A mathematical theory of evidence. Princeton University Press

Shafer, G., P.P. Shenoy and R. P. Srivastava. 1988. AUDITOR'S ASSISTANT: A Knowledge En-
gineering Tool For Audit Decisions. Proceedings of the 1988 Touche Ross University of
Kansas Symposium on Auditing Problems, May: 61-79.

Shafer, G., and R. P. Srivastava. 1990. The Bayesian and belief-function formalisms: a general per-
spective for auditing. Auditing: A Journal of Practice and Theory. (Supplement): 110-148

Sneller, L. and H. Langendijk. 2007. Sarbanes Oxley Section 404 Costs of Compliance: a Case
study. Corporate Governance, Vol. 15, No. 2 (March): 101-111.

Srivastava, R. P. 1993. Belief functions and audit decisions. Auditors Report, Vol. 17, No. 1, (Fall):
8-12.

Srivastava, R. P. 2005. Alternative form of dempster’s rule for binary variables. International
Journal of Intelligent Systems, Vol. 20, No. 8 (August): 789-797.

Srivastava, R. P. and Li, C. 2009. Systems Security Risk and Systems Reliability Formulas under
Dempster-Shafer Theory of Belief Functions. Journal Emerging Technologies in Account-
ing (forthcoming).

Srivastava, R. P., and T.J. Mock. 2000. Belief function in accounting behavioral research. Ad-
vances in Accounting Behavioral Research 3:225-242

46

Electronic copy available at: https://ssrn.com/abstract=1476431

Srivastava, R. P., and T.J. Mock.2002. Belief functions in Business Decisions, Physical – Verlag,
Heidelberg, Springler-Verlag Company,

Srivastava, R. P., and H. Lu. 2002. Structural analysis of audit evidence using belief functions,
Fuzzy Sets and Systems, Vol. 131, No. 1 (October); 107-120.

Srivastava, R.P. and T. J. Mock. 2005. Why We Should Consider Belief Functions in Audit Re-
search and Practice. The Auditor's Report, Vol. 28, No. 2, (March).

Srivastava, R. P., T. Mock, and J. Turner. 2007. Analytical Formulas for Risk Assessment for a
Class of Problems where Risk Depends on Three Interrelated Variables. International
Journal of Approximate Reasoning Vol. 45, pp. 123–151.

Srivastava, R. P., and G. R. Shafer. 1992. Belief-function formulas for audit risk. The Accounting
Review (April): 249-283.

Sun, L., R. P. Srivastava, and T. Mock. 2006. An Information Systems Security Risk Assessment
Model under Dempster-Shafer Theory of Belief Functions. Journal of Management In-
formation Systems, Vol. 22, No. 4: 109-142.

Tapestry Networks, (2004), The internal auditor’s perspective. InSights (July 6).

Yager, R.R., J. Kacprzyk, and M. Fedrizzi, 1994. Advances in the Dempster-Shafer Theory of Evi-
dence. New York, NY: John Wiley and Sons: 71-95.

47

Electronic copy available at: https://ssrn.com/abstract=1476431

 Figure 1 Analytical Model for Evaluating the Strength of the Internal Audit Function**

Evidence concerning auditor qualifications and training

Evidence concerning audit planning and supervision

Competence
Evidence of auditor tacit knowledge
• Experience or knowledge about company
• Experience or knowledge about auditing the
Electronic copy available at: https://ssrn.com/abstract=1476431

company
R1 Evidence of internal audit effort

Evidence of execution of internal audit plan

Evidence of thoroughness and quality of internal audit

reporting
Strength of Internal Work
AND
Audit Function Performance
Evidence of quality of corporate governance
• Number and duration of audit committee meetings
• Communication between IAF and audit committee
• Percentage of independent directors
• Financial literacy of the audit committee
R2
Evidence of managerial reporting relationship

Evidence of breadth and depth of investigatory scope

Evidence of recommendation implementation

Objectivity
Evidence of quality of corporate governance
• Number and duration of audit committee meetings
• Communication between IAF and audit committee
• Percentage of independent directors
• Financial literacy of the audit committee

** A rounded box represents a factor, a rectangle represents an item of evidence, and a hexagonal box represents a relationship. The definitions of the factors and
items of evidence have been incorporated from SAS 65. SAS No. 65 (AICPA, 1991) describes the IA function quality characteristics as comprising Competence
(e.g., educational level, certification), Objectivity (e.g., reporting relationship, party responsible for the IA function employment decisions), and Work Perfor-
mance (e.g. adequacy of audit programs, scope of work performed).

48
 Figure 2- Effect of Objectivity on the Strength of the IA function

1.2

1.1

1
Belief in the Strength of the IA Function

0.9

0.8

0.7

0.6 Strength -IA ( Positive Evidence)

0.5 Strength -IA (Negative Evidence)

0.4

0.3

0.2

0.1

0
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
Belief in Objectivity

49

Electronic copy available at: https://ssrn.com/abstract=1476431

 Figure 3 Effect of Work Performance on the Strength of the IA Function

0.9
Belief in the Strength of the IA Function

0.8

0.7

0.6

0.5

0.4

0.3

0.2

0.1

0
0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0

Belief in Work Performance

Strength -IA ( Positive Evidence) Strength -IA (Negative Evidence)

50

Electronic copy available at: https://ssrn.com/abstract=1476431

 Figure 4- Effect of Interrelationship- Positive Evidence

0.9
Belief in Strength of the IA function

0.8

0.7

0.6 r1=r2 =0
r1=r2=0.2
0.5
r1=r2=0.8
0.4 r1=r2=1

0.3

0.2

0.1

0
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
Belief in Objectivity

51

Electronic copy available at: https://ssrn.com/abstract=1476431

 Figure 5 Effect of Interrelationship - Negative Evidence

0.9
Belief in the strength of the IA function

0.8

0.7

0.6 r1=r2=0.0
r1=r2=0.2
0.5
r1=r2=0.8
0.4 r1=r2=1.0

0.3

0.2

0.1

0
0 0.2 0.4 0.6 0.8 1
Belief in Objectivity

52

Electronic copy available at: https://ssrn.com/abstract=1476431

 Figure 6 Effect of Quality of Corporate Governance

0.9
Belief in the Strength of the IA Function

0.8

0.7

0.6
CG-POS
0.5
CG-NEG
0.4

0.3

0.2

0.1

0
0 0.2 0.4 0.6 0.8 1
Belief in Quality of Corporate Governance

53

Electronic copy available at: https://ssrn.com/abstract=1476431

Figure 7: Cost of the audit for SOX compliance by the external auditor as a function of BelEA(i),
the belief that the internal controls are SOX compliant based on the external audit (EA, see panel
A) and as function of BelIA(i), the belief that the internal controls are SOX complaint based on
internal audit function (IA, see panel B) . The audit cost function (AC) is assumed to be of the
following form: AC = a*BelEA(i)/[1-Exp(-b*(1-BelEA(i))], with a = $100,000 and b = 10. The
parameters 'a' and 'b' together determine the magnitude and rate of change in the cost.

Panel A:
$300,000

$250,000
External Audit Cost

$200,000

$150,000

$100,000

$50,000

$0
0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0
Belief that Internal Controls are SOX Compliant based on External Audit

Panel B:

$300,000

$250,000
External Audit Cost

$200,000

$150,000

$100,000

$50,000

$0
0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0
Belief that Internal Controls are SOX Compliant based on IA Function

54

Electronic copy available at: https://ssrn.com/abstract=1476431

Figure 8: Dependence of External Auditor on Internal Auditor as a function of Litigation and
Regulatory Costs. The following values of various parameters are used for the graph: the dis-
count rate r = 0.15, the profit margin ρ = 0.2, the cost parameter a = $100,000 and b = 10. The
overall belief that the internal controls are SOX compliant = 0.95.

1.0
Belief that Internal Controls are

0.8
SOX Compliant

0.6

0.4

0.2

0.0
$0 $100,000 $200,000 $300,000 $400,000 $500,000 $600,000 $700,000 $800,000
Litigation and Regulatory Costs (LC)

Bel(IC SOX Comp-IAF) Bel(IC Sox Comp-Ext Audt) Overall Bel(IC Sox Comp)

55

Electronic copy available at: https://ssrn.com/abstract=1476431

 Table 1
Factors in assessing the strength of the IA function.

Factors Definition* Evidence Description of Evidence

Competence has been defined 1. Evidence concerning auditor 1. Auditor qualification and training:
as the educational level and qualifications and training. • Educational background
professional experience of 2. Evidence of audit planning and • Certification
Electronic copy available at: https://ssrn.com/abstract=1476431

Competence • In-house training programme

the internal auditor and other supervision.
• Support for continuing education
such factors. 3. Evidence of auditor tacit knowledge.
2. Audit planning and supervision:
• System of defined responsibilities
• Review of procedures and working papers
• Planning of work
3. Tacit knowledge:
• Experience or knowledge about the company
• Experience or knowledge about auditing the
company
1. Evidence of internal audit effort. 1. Internal audit effort:
Work performance has been
• Time spent on audits
defined as internal control 2. Evidence of execution of internal
and risk assessment, and • Number of items examined
Work Performance audit plan.
substantive procedures • Sampling techniques used
3. Evidence of thoroughness and • EDP audit techniques used
performed by the internal quality of internal audit reporting.
auditor. 2. Execution of internal audit plan:
• Number of areas audited
• Number of audits completed versus number of
audits planned
3. Thoroughness and quality of internal audit reporting:
• Completeness of audit programmes and working
papers
• Quantity and quality of working papers
documentation
4. Quality of corporate governance:
• Minutes of audit committee meetings
• Documentation of communication between IAF
and audit committee
• Verification of directors’ independence
• Education and experience of audit committee
members

56
 Table 1 - Continued
Factors in assessing the strength of the IA function.

Factors Definition* Evidence Description of Evidence

Objectivity has been defined 1. Evidence of managerial reporting 1.Managerial reporting relationship:
as the organizational status of relationship. • Level to which IA reports
the internal auditor and orga- 2. Evidence of breadth and scope of • Level to which IA reports findings
Electronic copy available at: https://ssrn.com/abstract=1476431

Objectivity
nizational policies affecting investigatory scope. 2. Breadth and scope:
the independence of the 3. Evidence of recommendation • Ability to investigate any area
internal auditor. implementation. • Freedom from conflicting duties
3. Recommendation implementation:
• Disposition of recommendations
• IAs access to audit committee
4. Quality of corporate governance:
• Minutes of audit committee meetings
• Documentation of communication between IAF
and audit committee
• Verification of directors’ independence
• Education and experience of audit committee
members
*See Footnote 1 for details. Also see (AICPA, 1991).

57
 Table 2
Symbols and descriptions

Symbol Description
S {SS, SW} S represents the strength of IA function. It has two values: SS represents that the strength
of IA functions is strong, and SW represents that the strength of IA function is weak.
C {CY, CN} C represents Competence of the internal auditor. It has two values: CY represents that the
internal auditor is competent, and CN represents that the internal auditor is not competent.
W {WS, WU} W represents Work Performance of the internal auditor. It has two values: WS represents
that the Work Performance is satisfactory, and WU represents that the Work Performance
is unsatisfactory.
O {OY, ON} O represents the Objectivity of the internal auditor. It has two values: OY represents that
the internal auditor is objective, and ON represents that the internal auditor is not objec-
tive.
R1, r1 R1 denotes the relational node between C and W and r1 represents its strength
R2, r2 R2 denotes the relational node between W and O and r2 represents its strength
The basic belief mass (m-value) for the value of the variable in the parenthesis from the
m.. (..)
evidence represented by the subscript.
This symbol represents the frame of a variable denoted by the subscript. For example, the
Θ .. frame of variable ‘C’ is represented as ΘC = {CY, CN}.
The belief mass that the internal auditor is competent.
m C+
m C− The belief mass that the internal auditor is not competent.

m ΘC The belief mass that the internal auditor may or may not be competent.

m +W The belief mass that the Work Performance of the internal auditor is satisfactory.

m −W The belief mass that the Work Performance of the internal auditor is unsatisfactory
The belief mass that the Work Performance of the internal auditor may or may not be
m ΘW satisfactory.
m O+ The belief mass that the internal auditor is objective

m O− The belief mass that the internal auditor is not objective.

m ΘO The belief mass that the internal auditor may or may not be objective.
Bel..(SS) The belief that the strength of the IA function is strong.
Bel..(SW) The belief that the strength of the IA function is weak.
K A normalization constant

58

Electronic copy available at: https://ssrn.com/abstract=1476431