內(nèi)部控制的爆炸

1、The Internal Control ExplosionSteven MaijoorMaastricht Accounting and Auditing Research and Education Center(MARC), Universiteit Maastricht, The NetherlandsAbstractThe central theme in Powers 1997 book on the audit society is the proliferation of audit activity within the United Kingdom (UK) and Nor

2、th America. The most important joint development with the audit explosion is the rise of internal control systems. Auditing has shifted from auditing outcomes to auditing systems, and internal controls have become the subject of public policy debates on the regulation of corporate governance and the

3、 regulation of auditing. Power states that there is much confusion in practice about what (effective) internal controls actually are. This paper makes a similar argument with respect to internal control research. Internal controls are studied in various areas of accounting research, covering very di

4、fferent concepts, and studying controls at different organizational levels. As a result, the cross-fertilization between the various types of internal control research is limited. Also, most internal control research in accounting is not conducted within the context of wider corporate governance iss

5、ues. Hence, many claims about the value of internal control systems for corporate governance still need to be studied.Key words: agency theory; corporate governance; external auditing; internal audit; internal control systems; management control.SUMMARYThe central theme in Powers 1997 book on the au

6、dit society is the proliferation of audit activity within the United Kingdom (UK) and North America. The most important joint development with the audit explosion is the rise of internal control systems. As a result of the explosion of internal control systems, auditing has shifted from auditing out

7、comes to auditing systems, and internal controls have become the subject of public policy debates on the regulation of corporate governance and the regulation of auditing. For example, in the recent debates on the formation of an internal market for external auditing services within the European Uni

8、on, regulatory recommendations were made regarding internal control systems and internal auditing. While the expectations regarding the value of internal controls are high, Power states that there is much confusion in practice about what (effective) internal controls actually are. This paper makes a

9、 similar argument with respect to internal control research. Internal controls are studied in various areas of accounting research, covering very different concepts, and studying controls at different organizational levels. As a result, the cross-fertilization between the various types of internal c

10、ontrol research is limited. Also, most internal control research in accounting is not conducted within the context of wider corporate governance issues. Hence, many claims about the value of internal control systems for corporate governance still need to be studied.THE INTERNAL CONTROL EXPLOSIONThe

11、concept of internal control receives increasing ttention in public policy debates on uditing and corporate governance. The increasing ublic attention for internal control is onvincingly illustrated for the UK and North merica in Powers 1997 book on the auditsociety. The main theme of the book is the

12、 proliferation f auditing activities in Anglo-Saxon conomies: the audit explosion. According to ower, a joint development with the audit xplosion is the rise of internal control systems. he increased (regulatory) demands for ccountability has made organizations internal ontrol systems part of public

13、 policy debates on uditing, and corporate governance. However, ower observes that despite this increased ublic attention for internal control, the concept s still very vague. He states that there are fundamental roblems with what internal controls eally are and what it means when they are considered

14、 o be effective.It should be noted that Powers (1997 and 1998) work on the audit explosion is written in the context of the UK and North America. Hence, the developments described by Powermight not be generic, but concern specific developmentsof current Anglo-Saxon financialauditing markets. Whether

15、 there is an audit explosion or implosion probably depends on the specific characteristics of the national audit market at hand. The Anglo-Saxon audit markets have a long history going back to the 19th century, are well-developed and seem indeed saturated. By contrast, most continental European fina

16、ncial auditing markets are much younger in age and can be expected to still be growth markets for at least two reasons: (1) the implementation in the European Union Member States of Directives requiring company audits; and (2) the internationalization of capital markets requiring continental Europea

17、n companies to adjust their financial accounting and auditing to international practices (which are dominated by Anglo-Saxon practices). This internationalization requires companies to change their reporting system and to buy specialized auditor expertise.Especially the European Union Directives can

18、 be expected to have had a substantial effect on continental European financial auditing markets. Some continental European Union Member States had very thin audit markets before the implementation of European Directives requiring company audits. While the first development of course also affected t

19、he United Kingdom audit market, because it had a long history and was more developed, the effects can be expected to be far less substantial. Buijink et al. (1996, p. 26) list six European Union Directives resulting in the implementation of audit requirements in the Member States of the European Uni

20、on.1 Especially the Fourth Directive, which was implemented in most European Union Member States in the Eighties, can be expected to have increased the size of the audit markets in Member States. For example, Maijoor (1994) and Maijoor and Van Witteloostuijn (1996) provide empirical evidence that th

21、e implementation of the Fourth Directive substantially increased the demand for audit services in the Netherlands. This increase was mainly the result of new market demand for audits by non-listed companies.A distinctive characteristic of the European Union audit markets, compared to North-American

22、audit markets, is the wide scope of the audit requirement for non-listed companies. While the North-American audit requirement is mainly restricted to listed companies, for nearly a decade large groups of non-listed companies are subject to an audit requirement in European Union countries. This dema

23、nd by non-listed companies might have compensated an implosion of the demand by large and listed companies. Smaller non-listed companies can be serviced both by large and small audit firms. Hence, measuring the size of European financial auditing markets by only looking at the audit fee-incomes of t

24、he large international audit firm networks will result in the underestimation of the sizes of the traditional financial auditing markets.Buijink et al. (1998) and Meuwissen (1999) provide evidence on the number of audit firms and the complete sizes of the audit markets in Belgium, Germany and the Ne

25、therlands. Their data concern the period 1970 - 1994. In the period 1984 - 1994, which includes the implementation effects of the Fourth Directive, there has been an impressive growth in all three markets, both in terms of the sizes of the markets and the number of active audit firms. In the period

26、1984 - 1994, the average total growth of the sizes of the three markets is 99% (compared to 61% in the longer period 1970 - 1984). The average growth of the number of audit firms active in the three markets in the period 1984 - 1994 is 85% (compared to 31% in the longer period 1970 - 1984). The stro

27、ng growth of the number of audit firms seems inconsistent with the mergers of the large international audit firms networks. However, apparently the effects of increasing demand by smaller companies of the services of smaller audit firms are substantial. The strong growth figures presented above are

28、confirmed by other studies on continental European audit markets (see e.g., Weets and Jegers 1997). In sum, the data available, although clearly limited in scope and time period, provide no signs of an audit implosion for continental European markets.The rise of internal controlIrrespective of wheth

29、er there is an audit explosion or implosion, both in Power (1997) and (1998) internal control systems are considered to increase in importance in auditing. According to Power (1997, p. 83), the audit explosion has been possible because of the assumption that internal control systems are auditable. M

30、ore specifically for financial audits,the concept of auditing internal control systems is at the heart of the financial audit explosion. As a result of the rise of internal control systems, external audits are less focussed on auditing outcomes, and more focussed on auditing systems. In addition, in

31、ternal control systems are now also becoming part of the regulatory systems. Many national corporate governance reports and reforms include recommendations for internal controls, and reporting on internal controls. A joint development with the rise of internal control is the increased public signifi

32、cance of internal auditors.The rise of internal control is possible because internal control systems became auditable.According to Power, whether or not a system is auditable is not determined by technical auditing aspects but by the acceptance of auditability by the profession. Power (1997, pp. 54

33、- 57) illustrates his argument regarding the rise of internal control with the case of the Cadbury Code (1992), which includes recommendations for the responsibilities of directors and auditors regarding internal control systems. Powers point regarding the rise of internal control, can also be illus

34、trated with developments at a European Union level.The concept of internal control is important in the discussion on the establishment of the internal market for financial statement auditing within the European Union. Currently, there are hardly any common European Union regulations regarding auditi

35、ng, and in fact there is no internal market for financial statement auditing. Only two aspects of auditing are harmonized: which organizations need an audit (as a result of the earlier mentioned Directives), and the qualification of auditors (as a result of the Eighth Directive). Hence, internal con

36、trol systems, and reporting on those systems, are currently not included in any European Directive on accounting or auditing.In 1996, the European Commission published a research report (Buijink et al. 1996) and a Green Paper, both titled The Role, the Position, and the Liability of the Statutory Au

37、ditor within the European Union. These publications were the first major steps in the internal market for auditing services project of the European Commission and included a number of recommendations on internal control and auditing.In Section 3.31 of the Green Paper it is argued that auditors shoul

38、d attest whether welldesigned internal control systems exist. The recommendation is made that the result of this attestation should be included in the audit report. In Section 4.24 of the Green Paper, the point is made that there should be a strong internal audit function within companies. This is r

39、equired for the proper functioning of the audit committee. Reliance on only the external auditor is not sufficient: the external audit is considered to be a snapshot of the company while internal audit activities can be undertaken at a continuous basis. The recommendation mentions a requirement for

40、significant enterprises and sectors to establish a professional internal audit function. In Section 4.27 internal control systems are identified as an area of priority for action. The main motivation given for this priority are the recent debates on corporate governance and the need to define the ro

41、le of all parties involved in the financial reporting process.Finally, the rise of internal control in the debate on the European internal market for financial statement auditing is also clear from the European Commissions (1998) communication on the future of the statutory audit. Again, internal co

42、ntrol, internal audit and risk management are explicitly mentioned as areas for proposed action by the European Commission.What are internal controls?The previous sections show that in public policy debates there is an increasing interest in internal controls, also from a European Union perspective.

43、 However, as observed by Power (1997), there is much confusion in these public policy discussions about what internal controls actually are and what it means when they are effective. The state of current research on internal control, which will be discussed below, reinforces Powers (1997) point. The

44、 discussion of current internal control research will be preceded by the issue of what internal controls are.To answer the question what internal controls are, Power (1997, p. 83) refers as a start to concepts in the professional accountancy literature.Traditionally, in the professional accountancy

45、literature, internal controls refer to accounting controls, and concern measures in organizations like segregation of duties, author ization policies, organization structure,measures to protect assets and information, and credibility tests. These accounting controls can either be general and relevan

46、t to the organization as a whole, or designed for particular cycles. The recent professional accountancy literature has expanded the internal control concept and now uses much wider definitions. The new definitions cover many other controls in addition to accounting controls. Especially the publishe

47、d public policy documents on auditing and corporate governance use wide definitions of internal control. A report like COSO (1992) defines internal control as:A process, effected by an entitys board of directors, management, and other personnel, designed to provide reasonable assurance regarding the

48、 achievement of objectives in the following categories:- Effectiveness and efficiency of operations- Reliability of financial reporting- Compliance with applicable laws and regulationsObviously, the organizational measures that can contribute to this process are numerous. As a consequence of this wi

49、de definition, a report like COSO considers many organizational measures to be part of internal control systems, including human resource policies and practices, procedures for communication within organizations, and the management style of the board of directors. A problem with these wider definiti

50、ons is that it is not clear what the boundaries are of internal control systems. For example, it could be argued that all organizational measures contribute to internal control as defined by COSO.The unclear boundaries of the concept of internal control are also witnessed to some extent in the acade

51、mic accounting literature. Within this literature, three areas of (internal) control research can be distinguished: (1) internal control from an external auditing perspective, (2) internal control from an organization theory perspective; and (3) internal control from an economics perspective. Each o

52、f the three areas will be discussed below.There is a vast academic literature on internal control from an external auditing perspective. Internal controls are the main subject area in auditing research, and pioneering studies are,for example, Ashton (1974) and Mock and Turner (1981). Internal contro

53、l research from an auditing perspective mainly focuses on traditional accounting controls. These are studied in the context of decision making by auditors. As a result, the focus is on how accounting controls affect the reliability of financial reporting. Further, most of the internal control resear

54、ch in auditing focuses on problems related to lower level controls, i.e. accounting controls for specific cycles and transactions. Broad control concepts are hardly considered in this literature. Even the concept of control environment, which is currently a standard item in audit manuals of the inte

55、rnational audit firm networks, receives limited attention in this area of research.Control research from an organization theory perspective, or management control perspective, uses a much broader concept of control than in auditing research. The control problems studied in this area of research are

56、mainly at the level of departments and divisions. Further, controls are studied mainly in the context of the organizational effectiveness of departments and divisions. The typical organizational measures distinguished in this area of research are action controls, results controls, and personnel and

57、cultural controls (Merchant, 1998). These organizational measures include traditional internal accounting controls: the action controls listed by Merchant (1998, pp. 27 - 30), are the accounting controls that are typically the subject of study in the external auditing literature. Results controls co

58、ncern management systems based on rewarding individuals, or groups of individuals, for generating good results. Personnel and cultural controls are based on systems where employees control their own behaviors, or are based on employees controlling each others behaviors. It should be noted that COSO

59、(1992) more or less combines, both in terms of perspectives and in terms of the controls studied, the two literatures identified above.The control research in the accounting literature from an economic perspective is dominated by agency theory. The control measures studied are broad: monitoring mechanisms, bonding mechanisms and reward systems or bonus plans. Most of the agency theory research focuses on the control problems between outside capital suppliers, and (inside and outs