Evidence on the Audit Risk Model: Do Auditors Increase Audit Fees in the Presence of Intemal Control Deficiencies?*
CHRIS E. HOGAN, Michigan State University MICHAEL S. WILKINS, Texas A&M University 1. Introduction Internal controls over financial reporting (ICOFR) should provide reasonable assurance about the reliability of financial statements by setting in place policies and procedures related to maintaining accounting records, authorizations, and safeguarding of assets.' For such controls to be effective, they should ensure, to the greatest extent possible, that material financial statement misstatements either cannot occur within a given functional area or will be detected and corrected by management before financial reports are issued. If ICOFR cannot provide this assurance, it is widely assumed that financial reporting quality will suffer. This assumption underlies many of the provisions of the Sarbanes-Oxley Act (SOX) of 2002, including the requirement that managers attest to the effectiveness of ICOFR. Although it may seem reasonable to assume that intemal control deficiencies and "bad accounting" go hand in hand, we contend that strong intemal controls are not necessary for reporting to be in compliance with generally accepted accounting principles (GAAP). Stated differently, financial reports are not generated in a vacuum; rather they are a joint product of management and an independent auditor. The audit risk model — which provides a framework for evaluating the relationship between overall audit risk, inherent risk, control risk, and detection risk — proposes that even when intemal control deficiencies (ICD) are identified, auditors can still provide an unqualified opinion by increasing their substantive testing. More formally, when either inherent risk or control risk increases, auditors can. reduce detection risk by increasing substantive testing (in