Hiring a public accounting firm to provide both internal and external audits, a practice that was banned by the Sarbanes-Oxley Act, actually reduced companies’ accounting risk, researchers claim.
The knowledge of a company that an external auditor gained from internal auditing lowered the chances of publishing misleading or fraudulent financial results, according to preliminary findings by professors at Brigham Young and Texas A&M universities.
“This evidence supports the prediction associated with the knowledge spillover hypothesis — the idea that external auditors are more effective when performing both internal and external audit services,” concluded a paper written by Douglas Prawitt, accounting professor at Brigham Young University, Nathan Sharp, assistant accounting professor at Texas A&M University, and David Wood, a visiting instructor at Brigham Young.
The researchers referenced 166 publicly traded companies’ financial data between 2000 and 2002, when Sarbox was signed into law. They devised formulas based on several data points, including the Institute of Internal Auditors’ database of internal-audit surveys and metrics calculated by risk-analytics firm Audit Integrity for measuring the likelihood of poor financial reporting, such as the risk of class-action lawsuits and restatements.
Nearly seven years ago, Sarbox ended what was once a cozy relationship between companies and their audit firms. Bristled by Arthur Andersen’s collapse and strict prohibitions in the law, auditors quickly stepped back from their clients, withholding accounting advice and isolating their consulting services.
Among Sarbox’s many auditor-independence restrictions: audit firms could no longer provide internal-audit work to the clients they audit. For some observers of the industry, there was no question that keeping the two audit functions separate was preferable, to avoid any appearance of conflict of interest and, effectively, boost investor confidence that had been violently shaken by Enron and the other corporate debacles earlier this decade. “These were obvious areas to separate,” says Ed Nusbaum, CEO of accounting firm Grant Thornton.
Until now, there’s been lots of talk about how much Sarbox — in particular, its internal-control provision — has cost companies, but little analysis of what benefits the law truly achieved, says Prawitt.
“Of all the services external auditors provided before the SOX prohibition, we believe internal audit outsourcing represents the greatest possibility for creating knowledge spillover effects,” the academics said in their paper.
Their conclusion doesn’t sit well with IIA president Richard Chambers, who cautions that the researchers’ scope was very narrow and doesn’t delve into the many responsibilities of internal auditors. “They’re also looking at operational risks, compliance risks, business and strategic risks,” Chambers says.
While external auditors are independent of a company and primarily focused on reviewing financial statements and attesting to internal controls, internal auditors are — in the views of the IIA — ideally working in-house, as part of the business, and their work in helping management test and document internal controls is just one of their many tasks. Internal auditors have the best understanding of any function in a company to know where a company’s risks lie, Chambers contends.
Chambers doubts any of the large accounting firms would want to revisit this aspect of auditor independence rules, and the researchers themselves aren’t advocating that lawmakers reconsider this part of Sarbanes-Oxley. What they do hope is that their research — which is still subject to a peer review process that could take months or longer — will begin a debate about the thought process behind the law, which by all accounts was rushed through Congress. “There was a tsunami that came from the scandals and it didn’t matter what the evidence showed,” says Prawitt. “We had to shore up public perception and investor confidence in the markets.”
Grant Thornton’s Nusbaum says he hopes future research will consider the more “absurd” independence restrictions Sarbox has put on firms when it comes to related entities that really have no interaction with each other except that they’re owned by the same company.
Another outcome the researchers are hoping for is that communication between internal and external auditors will improve, which in turn, as their paper implies, could lead to better financial reporting by knowledge sharing. Chambers says the two groups’ anxiety over being open with each other in the beginning of Sarbox has waned. “It’s important for both parties to be open and receptive to each other,” he says. External auditors can gain from internal auditors’ knowledge by talking more regularly and informally than some do now, he adds.