اثرات رابطه گزارش دهی و نوع نقص بازرسی داخلی در ارزیابی کنترل های داخلی حسابرسان داخلی Effects of reporting relationship and type of internal control deficiency on internal auditors’ internal control evaluations

Introduction Management has responsibility for designing, implementing and maintaining effective internal controls, while the audit committee has oversight responsibility for internal controls (COSO, 2013). Internal auditors have a responsibility to provide independent assurance about effectiveness of internal controls to the board and top management (COSO, 2015, 2013) and can also provide advice on internal controls to the board and top management. Internal auditors do not design or implement controls as part of their normal responsibilities and are not responsible for the organization’s operations, including its internal controls (COSO, 2015). Public company top management (i.e. CFO, CEO) also has a responsibility to publicly report on the effectiveness of internal control over financial reporting (ICFR)[1]. If the company has a material weakness in ICFR, management must conclude that ICFR is not effective[2]. Internal auditors often assist top management by evaluating their organization’s ICFR for the purpose of providing management reports in compliance with the requirements of Section 404(a) of SOX (Protiviti, 2012; Schneider, 2009; SEC, 2007). In this role, internal auditors must provide objective evaluations. As mandated by the Institute of Internal Auditors (IIA) (2012), “internal auditors must have an impartial, unbiased attitude and avoid any conflict of interest” (IIA, 2012, sec. 1120). Lack of objectivity in evaluating internal controls can cause management to provide inappropriate SOX reports. We recognize that there are unique factors in an internal audit setting that call into question whether internal auditors can be objective when evaluating internal control deficiencies. First, two parties that are elements of a company’s internal control system (i.e. audit committee and management) are the two parties that typically have influence and oversight responsibility for the internal audit function (IAF), although the relative influence of these two parties varies across organizations (Abbott et al., 2010). Thus, ineffective ICFR may reflect poorly on these two parties. Given that internal auditors neither design nor implement controls as part of their normal responsibilities and are not responsible for the organization’s operations, including its internal controls, the quality of ICFR may not reflect as directly on the IAF (COSO, 2015). Second, some internal control deficiencies are pervasive across the organization. Pervasive deficiencies can give impressions that top management does not consider internal controls very important and that the audit committee does not have proper oversight of internal controls. In contrast, other deficiencies relate only to one specific process. Processspecific control deficiencies, as compared with pervasive control deficiencies, are likely not as reflective of management’s internal control responsibilities and the audit committee oversight of internal controls.