Proceeding of the 10th International Conference on Multinational Enterprise
How do Auditors Assess Risks? An Exploration of the Risk
Determinants
Hsueh Ju Chen
Assistant Professor, Chung Hsing University, ROC
Kuang-Hsun Shih
Assistant Professor, Chinese Culture University, ROC
Shaio Yan Huang
Associate Professor, Feng Chia University, ROC
Abstract
The primary objective of this study is to identify what factors affect the assessments
of the auditor’s risk including audit risk, business risk, and personal risk in
under-researched area of Taiwan. Factor analysis and logistic regression were selected as
being analysis methods. The result shows that three factors including the effectiveness of
control activities, reporting bias of management and reliability of management are
strongly associated with identified risks’ assessment, which indicates that the client’s
control environment dominates auditor’s risk assessment.
Keywords: Auditing, Audit Risk, Business Risk, Personal Risk, Control Environment
1. Introduction
In today’s expanding global economy, accounting firms serve not only local but also
international companies. The increasingly complex audit procedures and the largely
complicated sets of investors’ portfolios have led to a question about the credibility of the
auditing profession, when faced with such large risks. The challenge facing the auditor
has been argued by Vinten (1991), “Auditors need to achieve a via media (middle way)
between abrogating risk-taking entirely and permitting totally uncontrolled and huge risk
exposures” (p. 3)
Following his perspective, how much risk can an auditor bear and in how can an
auditor assess it? This is a difficult question to answer, and undoubtedly the answer is
1
Proceeding of the 10th International Conference on Multinational Enterprise
influenced
by
several
factors,
including
the
resources
available
and
the
risk-taking/avoiding propensity of the auditors. In addition, a phenomenon noted by Stice
(1991), lawsuits against auditors are a continuing source of concern for members of the
public accounting profession. A great effort, therefore, to investigate what gets public
accountants into “trouble” with their clients and with third parties was made (Pierre and
Anderson, 1984). The responses of the accounting profession to a reduction in the
likelihood of litigation allegation via more audit effort input and fee billed has been
analyzed. However, these issues are prevailingly taking into consideration within a
Western world context. Whether the auditors from the non-Western world face the same
litigation environment and whether the auditors replicate similar strategies to responding
to such a threat still remain to be answered. For clarifying those questions, therefore, this
study aims to the identification of those factors that are associated with Taiwanese
auditor’s potential risks. Three potential risks identified in this study are audit risk,
business risk and personal risk.
2. Prior research
Under the study of audit risk model, the focus can be traced back to the question of
the adequacy of the audit risk concept. Kinney (1989) conducted an analysis by
examining the properties of a portfolio of one thousand audit clients simultaneously to
consider the risk of incorrect acceptance (IA) and the risk of incorrect rejection (IR) in
determining a complete audit outcome space. He argued that achieved audit risk
indicated by the AICPA (American Institute of Certified Public Accountants)audit risk
model is likely to be understated at the individual audit level and at the portfolio level
(i.e., audit-firm or economy-wide) under audit practice environment. Sennetti (1990)
developed a model in which each of the components (inherent and control risk) affect the
outcome space. He argued that a correct conceptual modeling should follow the general
understanding that “…the concept of the auditor’s risk includes his reliance risk on his
assessment of control risk, not the control risk itself (p.111).
In compensating the deficiency of existing risk models, Simunic and Stein (1990)
provided a much broader view of audit risk by arguing that audit risk is fundamentally
portfolio specific. They defined audit risk as “the change in the standard deviation of
2
Proceeding of the 10th International Conference on Multinational Enterprise
return of a particular portfolio caused by adding a particular audit to an existing set of
investments” (p. 330). Audit risk is therefore measured within a portfolio rather than for
an isolated single audit. Huss and Jacobs (1991) emphasized the need for audit risk
models to re-examine important decision points. They argued that the traditional view of
risk assessment which generally begins with the preliminary planning stage, i.e. after
acceptance of the engagement, does not reflect some firms’ practices of risk assessment
in the client acceptance process. They also recognized the multiple and interrelated risks
faced by the auditors, which were the client’s business risk, audit risk, and the auditor’s
business risk. Huss et al. (2000), following Huss and Jacobs’s (1991) research, proposed
a complex “audit practice risk” model to overcome the limitations involved in the
existing audit risk model. Their model encompassed the elements related to the
non-compensatory nature of the client acceptance/continuation decision and the audit
process which are omitted in the professional standards concerning audit risk.
3. Risk identification
For the purpose of assessing the relevant risks that an auditor faces when conducting
an audit engagement, the risks in this study can be thought of as having three
components:
First, the auditor’s audit risk (Audit risk)- the risk that the auditor may unknowingly
fail to appropriately modify his or her opinion on financial statements that are materially
misstated. Second, the audit firm’s business risk (Business risk)– the risk to the audit firm
from association with the client, consisting of the risk of potential litigation costs and the
related effect on the audit firm’s reputation and the risk of other costs (not related to
litigation) such as problems with fee realization (bad debts). Finally, the auditor’s own
personal risk (Personal risk)– the risk of damage to the individual auditor’s own personal
reputation from being associated with the client as distinct from the risk to the audit firm
overall.
4. Major hypothesis
4.1. Control environment
3
Proceeding of the 10th International Conference on Multinational Enterprise
SAS No. 82 “Consideration of Fraud in Financial Statement Audit” acknowledges
that audit risk includes the risk related to misstatement due to fraud, and hence that
auditors have a significant responsibility to discover management and employee fraud.
Fraudulent acts may be committed by a single individual, or may involve collusion
among employees or perhaps, in conjunction with external parties. Whether such acts are
detected will depend on the auditor’s understanding of the entity’s internal control system.
The control environment provides the atmosphere in which people conduct their
activities and carry out their responsibilities. Thus, a good understanding of the control
environment will often affect the auditor’s consideration of the possibility of fraud and
hence influence the auditor’s evaluation of audit risk.
Empirical evidence suggests that correctly assessing the control environment is
beneficial to assessing the identified risks. Sullivan (1988) emphasized that fraudulent
financial reporting is often found at the very top of the organisation – what the Treadway
report (1992) called “the tone at the top” and what auditors call the control environment.
A similar result was also found by Loebbeoke et al. (1989), the control environment was
found to be one of the significant factors associated with management fraud. Where
controls are weak, an important condition exists that can allow either management fraud,
a defalcation, or an error to occur. The control environment also serves to enhance or
mitigate the assessment of inherent risk and control risk (Haskins & Dirsmith, 1995;
Marden et al., 1997). Accordingly, an incorrect evaluation of the control environment
will lead to an incorrect assessment of inherent risk, control risk and fraud risk, and
possibly result in audit errors, such as failing to detect material errors and misstatements
in the financial statements and then forming an improper opinion. An increasing
likelihood of lawsuit and litigation cost can then be expected. As a result, we argue that
the condition of a client’s control environment is related to the risks perceived by
auditors in conducting an audit engagement.
4.2. Client’s characteristics
4.3. Auditor’s characteristics
The name of the audit firm, especially the grouping called the “Big Five”, is argued
4
Proceeding of the 10th International Conference on Multinational Enterprise
by many to be influential in contributing to the assessment of client risks for the
following reasons. Firstly, as a result of their “deep pockets” (Lennox, 1999) the Big Five
firms will be more able to pay a higher level of damages, which motivates litigation
against auditors. Secondly, economic losses resulting from the damage to firm is
reputation leads to the Big Five firms being more aware of the risks that they confront.
For example, Wilson and Grimlund (1990) suggested that a question mark about the
auditors’ credibility has created by those of the Big Six firms’ clients listed by the
Securities and Exchange Commission (SEC) as a result of enforcement actions. Rollins
and Bremser (1997) further argued that the loss of market share was connected with the
brand name of the Big Six firms in the national or international audit market. David and
Simon (1992) found that a reduction of audit fee results from the impairment of auditors’
reputation by a SEC disciplinary action. As to the local firms, their practice is generally
performed on a personal level and regional areas so that their reputation may not suffer to
the same extent from the effects of negative publicity. In a sense the Big Five firms have
more to lose than local firms when an audit failure is alleged.
Tirole (1996) argued that a group’s reputation is only as good as that of its members,
and vice verse. If, in fact, a group reputation is an aggregate of its individual’s reputation,
and then the degree to which an individual suffers is related to the increasing probability
of reputation impairment of the group. On the one hand, we could argue that large
accounting firms would have given more attention to maintain and/or improve the quality
of their personnel when considering the “deep-pocket” and/or “reputation” effects.
Promotion policies seem to be directly associated with those maintenance and/or
improvement. Certain factors such as education level, professional certification, the year
of experience and gender have been found to have a significant influence on the
promotion probability of managerial accountants (Wier and Hunton, 1995), and it is
reasonable to expect that similar factors will affect the promotion probability of members
in large accounting firms. On the other hand, a member who has a position of high status
in an audit firm would have a strong incentive to maintain or enhance his/her individual
reputation, and by extension his/her firm’s reputation.
Based on the above reasoning, the following hypothesis is explored.
H1: The assessed levels of audit risk, business risk, and personal risk are subject to the
5
Proceeding of the 10th International Conference on Multinational Enterprise
evaluation of client’s control environment, client’s characteristics, and auditor’s
characteristics.
5. Research methodology
5.1. Variable
Three individual dependent variables (AR, BR and PR) and three groups of
independent variables (control environment, client’s and auditor’s characteristics) were
measured in the study. The variables on the control environment were chosen from those
of Haskins (1987) to take account of the differences between Taiwan and US. For
example, in Taiwan, family firms are the dominant organizational forms throughout the
economy. Those are of small to medium size with no more than 300 employees or total
assets of less than US.$20 million. Therefore, audit clients are too small to be equivalent
to Haskins’ “referent client” (1987, p. 544). As a result, some control factors used by
Haskins were either irrelevant or inappropriate for Taiwanese enterprises. Moreover,
measures were elicited using a seven-point, Likert-type scale ranging from “strongly
disagree” to “strongly agree”. To reduce ambiguity among a wide variety of clients, a
“not applicable” response was supplied in case the statement of control factor was
considered not to be suitable for the example audit client. As the questions were adopted
from Haskins (1987) and the Cronbach’s Alpha is 0.864, therefore the validity and
reliability were regarded as considerably acceptable. A brief description of independent
variables and their abbreviations are presented in Table 1.
5.2. Sample and procedure
5.3. Research methods
5.3.1. Factor analysis of independent variables
Preliminary data analysis related to computing correlations among the dependent
variables (DVs) and independent variables (IVs) was undertaken to examine for potential
problems relating to multicollinearity. Table 2 presents the highest correlation coefficient
was .790, showing that multicollinearity should not be a significant problem
6
Proceeding of the 10th International Conference on Multinational Enterprise
(multicollinearity becomes a serious problem when the coefficient is higher than 0.90,
Tabachnick and Fidell, 2001, p.82).
5.3.2. Logistic regression model
6. Results
6.1. Results for audit risk
Table 5 shows that there were three significant (p < 0.5) factors: the effectiveness of
control activities, the reporting bias of management, and the reliability of management.
Not surprisingly, the effectiveness of control plays a key role as they help prevent
mistakes from occurring in the financial statements. Hence, it would be expected that the
more effective the control activities are, then the lower level of audit risk that will be set.
In addition, the assessed level of audit risk was also found to be influenced by the degree
of the reporting bias of management. The greater the desires and opportunities for
management to bias the annual accounts, the higher the likelihood that material mistakes
will remain undiscovered in the financial statements, and hence, the higher the level of
audit risk that will be assessed. This result is consistent with the requirement in SAS No.
5 of Taiwan: ‘Investigation and Appraisal of Internal Accounting Control’ which states
that the auditor has to consider management integrity and honesty when evaluating the
existence of those internal accounting control defaults, that could cause material errors or
irregularities. Furthermore, the reliability of management is also one of the key factors in
explaining the changes of audit risk. The negative sign indicates that the higher reliability
of the management, the fewer will be the expected number of material mistakes. Audit
evidence is more reliable when the management of the client can be trusted. If the
reliability of management is suspect, then the information contained in the financial
statements will become questionable.
6.2. Results for business risk
6.3. Results for personal risk
7
Proceeding of the 10th International Conference on Multinational Enterprise
7. Conclusion and discussion
In conclusion, it would appear from the evidence of the postal questionnaire that
client’s control environment are significant explanatory variables when assessing audit,
business and personal risk. In particular, the factors relating to the effectiveness of
control activities, management reporting bias and management reliability dominate these
three risks’ assessments. Not surprisingly, the assessments of identified risks are
influenced by the same factors as a result of the inter-relationship among audit, business
and personal risk. In practice, audit risk is adjusted to reflect the level of business risk.
The auditor may reduce audit risk to a low level to respond to a high level of business
risk, and vice verse. Further, following the perspective of Tirole (1996), a group
reputation is an aggregate of its individual’s reputation, and their interdependence
stimulates the group and its individual members to sustain a good reputation for each
other. For that reason, auditors might consider the same risk factors influentially on the
assessments of audit, business and personal risk. However, the failure to discover the
relationship between risk assessment and auditor characteristics might have less
explanatory power over the assessment of engagement risk found in the Western
countries. Future research could shed light on the investigation of this inconsistent result.
Moreover, it would extend analysis to consider “other attributes” of control environment
excluding from this study or “other factors” such as the individual “personality’ variables,
which might be influential in auditor’s risk assessment, but have not been properly
identified.
Two limitations of the current study have to be drawn The first limitation is referring
to the questions asked relating to the description of the client’s control environment.
The design of the control environment is primarily accounted on the client’s size. The
larger the client size, the more effective the control environment. However, the samples
are reduced from 141 to 111 because the internal audit function is not operated in small
or medium companies. The size effect may violate the present results in explanation. The
second limitation lies on the weaknesses of using questions in a questionnaire survey
(Lee-Wong, 2000). As a questionnaire survey is entirely relied on the respondent’s self
report, it is possible that the information given by the respondent is untrue.
8
Proceeding of the 10th International Conference on Multinational Enterprise
Reference
Anderson, J. C., Johnson, E. N. and Reckers, P. M. (1994). Perceived Effects of Gender,
Family Structure, and Physical Appearance on Career Progression in Public
Accounting: A Research Note. Accounting, Organizations and Society, 19(6),
483-491.
Carcello, J. V. and Palmrose, Z. (1994). Auditor Litigation and Modified Reporting on
Bankrupt Clients. Journal of Accounting Research, 32(l), 1-30.
Daniel, S. J. (1988). Some Empirical Evidence about the Assessment of Audit Risk in
Practice. Auditing: A Journal of Practice & Theory, 7 (2), 174-181.
Davis, L. R. and Simon, D. T. (1992). The Impact of SEC Disciplinary Actions on Audit
Fees. Auditing: A Journal of Practice & Theory, 11(1), 58-68.
Haskins, M. E. (1987). Client Control Environments: An Examination of Auditors’
Perception. The Accounting Review, 62(3), 542-563.
Haskins, M. E. and Dirsmith, M. W. (1995). Control and Inherent Risk Assessments in
Client Engagements: An Examination of Their Interdependencies. Journal of
Accounting and Public Policy, 14, 63-83.
Huss, H. F. and Jacobs, F. A. (1991). Risk Containment: Exploring Auditor Decision in
the Engagement Process. Auditing: A Journal of Practice & Theory, 10(2), 51-60.
Kreutzfeldt, R. W. and Wallace, W. A. (1994). The Relation of Inherent and Control
Risks to Audit Adjustments. Journal of Accounting, Auditing & Finance,
459-481.
Loebbecke, J. K., Eining, M. M., and Willingham, J. J. (1989). Auditors’ Experience with
Material Irregularities: Frequency, Nature, and Detestability. Auditing: A Journal
of Practice & Theory, 9 (1), 1-28.
Lennox, C. S. (1999). Audit Quality and Auditor Size: An Evaluation of Reputation and
Deep Pockets Hypotheses. Journal of Business Finance & Accounting, 26(7&8),
779-805.
Marden, R. E., Holstrum, G. L. and Schneider, S. L. (1997). Control Environment
Condition and the Interaction between Control Risk, Account Type and
Management’s Assertions. Auditing: A Journal of Practice & Theory, 16(1),
51-68.
9
Proceeding of the 10th International Conference on Multinational Enterprise
Palmrose, Z. V. (1987). Litigation and Independent Auditors: The Role of Business
Failures and Management Fraud. Auditing: A Journal of Practice & Theory, 6(2),
91-103.
Pratt, J. and Stice, J. D. (1994). The Effects of Client Characteristics on Auditor
Litigation Risk Judgments, Required Audit Evidence, and Recommended Audit
Fees. The Accounting Review, 69(4), 639-656.
Rollins, T. P. and Bremser, W. G. (1997). The SEC’s Enforcement Actions against
Auditors: An Auditor reputation and Institutional Theory Perspective. Critical
Perspectives on Accounting, 8, 191-206.
Sennetti, J. T. (1990). Toward a More Consistent Model for Audit Risk. Auditing: A
Journal of Practice & Theory, 9 (2), 103-111.
Simunic, D. A. and Stein, M. T. (1990). Audit Risk in a Client Portfolio Context.
Contemporary Accounting Research, 6 (2), 329-343.
Stice, J. D. (1991). Using Financial and Market Information to Identify Pre-Engagement
Factors Associated with Lawsuits Against Auditors. The Accounting Review,
66(3), 516-533.
Sullivan, D. J. (1988). Why the Auditing Standards on Evaluating Internal Control
Needed to be Replace. Auditing Symposium, 40, 47-54.
Wilson, T. E., Jr. and Grimlund, R. A. (1990). An Examination of the Importance of an
Auditor’s Reputation. Auditing: A Journal of Practice & Theory, 9(2), 43-59.
Wier, B. and Hunton, J. E. (1995). Promoting Management Accountants. Management
Accounting, 76(11), 47-51.
10
Proceeding of the 10th International Conference on Multinational Enterprise
Table1 Summary of Independent Variables for Input into the Audit, Business and Personal Risk
Regression
Control Variables
AR
BR
PR
Abbreviation Definition
Predicted Sign
CA1
There is an appropriate policy for the authorisation of transactions
There is appropriate segregation of duties for client employees
CA2
whose work is related to financial matters
There are effective general Computer Information Systems (CIS)
CA3
controls
CA4
There are effective physical safeguards over assets
There is effective co-ordination between different financial
CA5
functions (e.g. sales, purchases, cash, etc.)
There are appropriate procedures for the review of variances from
CA6
budgeted performance
There are appropriate practices in place to cover the holidays of
CA7
employees whose work is related to financial matters
There are appropriate duties and responsibilities assigned to the
CA8
internal auditors
The internal auditors are effective at remedying weaknesses in
CA9
internal control
There are strong factors that might motivate senior management to
CA10
override existing controls (e.g. tight credit, low working capital,
+
+
+
bonus plans, need to meet forecasts, declining industry, etc.)
The rate of turnover of senior management has been low in the
CA11
last three years
CA12
The client's senior management has a good business reputation
The client's senior management usually tends to report the most
CA13
+
+
+
favourable financial picture
The client's major operating decisions are usually made by just
CA14
+
+
+
one or two individuals
The client usually investigates the background of new employees
CA15
whose work is related to financial matters
There are appropriate training programmes for employees whose
CA16
work is related to financial matters
CA17
The client is effective at monitoring competitors' activities
The client is effective at monitoring changes in customer
CA18
requirements
The audit process usually produces changes in the client's draft
CA19
financial statements
TAST
Client size
+
+
+
TSALES
Client size
+
+
+
LISTD
Whether client lists on the Stock Exchange
+
+
+
CYINV
Tenure of auditor/client relationship
?
Age
How old the auditor is
?
+
+
Sex
Which gender the auditor is
?
+
+
WKY
How many years of auditing experience the auditor has
?
+
+
PART
The auditor’s position
?
+
+
CPAY
The length of being a CPA
?
+
+
The approximate percentage of the auditor’s time spent on
ATMP
?
auditing
Big 5
Whether the respondent works for a Big Five auditor firm
?
+
+
11
Proceeding of the 10th International Conference on Multinational Enterprise
Table2 Correlation Matrix of Audit Risk, Business Risk, Personal Risk, Client and Auditor
Characteristics by Taiwan
BR
AR
BR
PR
LISTD
TAST
TASLES
AGE
SEX
WKY
PART
CPAY
ATMP
.762
PR PR
.598
LISTD
-.141
TAST TASLES CYINV
-.130
-.138
-.098
.033
.032
.070
.035
-.084
.050
BIG 5
-.052
(.000)
(.000)
(.097)
(.125)
(.102)
(.246)
(.696)
(.707)
(.411)
(.683)
(.320)
(.561)
(.539)
.720
-.094
-.028
-.072
-.167
.024
.101
.003
.099
-.028
-.070
.066
(.000)
(.270)
(.740)
(.394)
(.048)
(.782)
(.233)
(.974)
(.243)
(.744)
(.413)
(.436)
-.175
-.137
-.110
-.028
-.113
.074
.073
.116
-.019
-.025
.072
(.039)
(.106)
(.194)
(.740)
(.184)
(.387)
(.389)
(.172)
(.824)
(.767)
(.397)
.516
.453
-.090
-.026
.091
-.008
-.049
.082
-.082
.093
(.000)
(.000)
(.292)
(.759)
(.289)
(.923)
(.564)
(.333)
(.336)
(.273)
.779
.032
.000
.187
.046
.018
.1880
.112
.137
(.000)
(.708)
(.999)
(.027)
(.590)
(.832)
(.025)
(.186)
(.106)
.057
.031
.193
.044
.042
.277
.105
.222
(.503)
(.717)
(.023)
(.606)
(.620)
(.001)
(.216)
(.008)
.525
.200
.658
.332
.211
-.220
-.192
(.000)
(.018)
(.000)
(.000)
(.012)
(.009)
(.022)
CYINV
AGE
.412
.790
.458
.317
-.330
-.238
(.000)
(.000)
(.000)
(.000)
(.000)
(.004)
.261
.271
.205
-.267
.034
(.002)
(.001)
(.015)
(.002)
(.690)
.485
.333
-.283
-.208
(.000)
(.000)
(.001)
(.013)
SEX
WKY
PART
CPAY
ATMP
.579
-.180
-.125
(.000)
(.034)
(.140)
-.151
.100
(.076)
(.236)
.245
(.004)
* The first number listed is the correlation; the number in parentheses is the significance level
12