Accounting Horizons American Accounting Association

Vol. 24, No. 1 DOI: 10.2308/acch.2010.24.1.1

2010
pp. 1–24

Serving Two Masters: The Association

between Audit Committee Internal Audit
Oversight and Internal Audit Activities
Lawrence J. Abbott, Susan Parker, and Gary F. Peters

SYNOPSIS: In this paper, we investigate the association between the audit commit-
tee’s oversight of the internal audit function 共IAF兲 and the nature of IAF activities. The
importance of internal controls and of the roles of both the audit committee and the
internal audit function in monitoring control activities have grown in recent years. De-
spite the importance of these topics, relatively little regulatory or best practices guid-
ance addresses the distribution of IAF activities and amount of audit committee involve-
ment with the IAF. We hypothesize that when the balance of oversight over the IAF lies
with the audit committee 共vis-à-vis management兲, the committee will steer the IAF to-
ward a more internal-controls-oriented focus. Our hypothesis is based on the existing
practice guidance in this area and the relative incentives of management and the audit
committee.
To test our hypothesis, we survey 134 chief internal auditors from Fortune 1000
firms regarding the amount of internal audit resources allocated across internal audit
activities in fiscal year 2005. We then construct a composite measure of audit commit-
tee oversight contingent on the relative control that the audit committee has over IAF
vis-à-vis management. Our composite measure is derived from three key facets of the
audit committee/internal audit relationship: reporting duties, termination rights, and bud-
getary control. Consistent with our hypothesis, we document a strong, positive asso-
ciation between our audit committee oversight variable and the amount of IAF budget
allocated to internal-controls-based activities.

INTRODUCTION

T
his study examines the association between the activities performed by the internal audit
function 共hereafter, IAF兲 and the extent of audit committee oversight of the IAF. Two
primary concerns motivate our study. First, relatively little regulatory or best practices
guidance relates to the distribution of IAF activities, and virtually no current research has been
done about these activities. We believe this topic to be important because current New York Stock
Exchange listing rules require registrants to maintain an IAF, increasing the pervasiveness of

Lawrence J. Abbott is an Associate Professor at the University of Wisconsin–Milwaukee, Susan Parker is an

Associate Professor at Santa Clara University, and Gary F. Peters is an Associate Professor at the University
of Arkansas.

Submitted: December 2007

Accepted: September 2009
Published Online: March 2010
Corresponding author: Lawrence J. Abbott
Email: abbottl@uwm.edu
1
2 Abbott, Parker, and Peters

internal audit. The second motivation concerns the relatively incomplete set of audit-committee-
related regulations. In particular, the Sarbanes-Oxley Act of 2002 共SOX兲 共U.S. House of Repre-
sentatives, Committee on Financial Services 2002兲 requires audit committee oversight of internal
controls over financial reporting and also mandates reporting on a registrant’s internal controls.
However, SOX is silent on internal audit, a key participant in both the financial reporting process
and the internal control structure. Moreover, SOX does not address internal audit’s reporting
relationship with the audit committee or the audit committee’s duties concerning internal audit
resources.
In response to SOX and the associated increase in audit committee responsibilities, the Insti-
tute of Internal Auditors 共IIA 2003a兲 issued a commentary on standards relating to public company
audit committees. In it, the IIA states the audit committee should expect the IAF to examine and
evaluate the adequacy and effectiveness of the organization’s systems of internal control. To
ensure that internal auditors carry out these internal control responsibilities, the audit committee
should review and approve the IAF’s staffing schedules and financial budgets. By doing so, the
audit committee can determine whether budget limitations impede the ability of the IAF to execute
its audit plans. These sentiments are echoed by the Public Company Accounting Oversight Board
共PCAOB 2004兲 and other audit stakeholders 共KPMG 2008; Ernst & Young 2006; Jefferson Wells
2004兲. In particular, the PCAOB’s Auditing Standard No. 2 共effective during our sample period兲
highlights the importance of the adequacy of internal audit activity and whether the IAF reports
directly to the audit committee in assessing control risk for the entity 共PCAOB 2004兲.
The use of the IAF in meeting heightened audit committee oversight expectations may con-
flict with management’s IAF objectives 共Gray 2004; Hermanson 2002兲. More specifically, man-
agement may view the IAF as a means of achieving operational goals and generating cost savings
共Anderson 2003; Hermanson and Rittenberg 2003兲. In contrast, an audit committee’s litigational
and reputational concerns can engender a demand for the IAF to focus its efforts on evaluating
financial-statement-related internal controls 共Krishnan 2005; Braiotta 2000; Reinstein et al. 1984兲.
While the CEO and CFO bear the ultimate responsibility for internal controls, these individuals
have distinct financial reporting and compensation-related incentives that are not necessarily
present for audit committee members 共Ernst & Young 2006兲. Thus, instances may occur in which
the two primary consumers of IAF resources may disagree with respect to the allocation of those
resources 共Anderson 2003; Hermanson and Rittenberg 2003; Raghunandan et al. 1998兲. Conse-
quently, we posit that the extent to which the audit committee can direct IAF resources toward
activities that reduce their reputational and litigational exposures depends on its oversight of the
IAF.
In this paper, we examine the association between audit committee oversight and the amount
of IAF resources allocated to internal-controls-based activities. To address our research question,
we obtained 134 useable survey responses from Fortune 1000 chief internal auditors 共hereafter,
CIAs兲 regarding their interactions with audit committees and their budget allocations for fiscal
year 2005. We construct our audit committee oversight variable based on the relative amount of
IAF control that the audit committee possesses vis-à-vis management. This continuous variable is
based on three critical facets of the IAF/audit committee relationship: reporting lines, termination
rights, and budgetary control. Note that each facet can range from being the sole domain of upper
management to the sole domain of the audit committee—thus the need to measure the relative
degree of control between these two potentially conflicting IAF supervisors. Consistent with our
prediction, we find that the percentage of the IAF budget devoted to internal-controls-based
activities is positively related to our measure of the audit committee’s oversight.
The evidence provided herein indicates a positive association between the audit committee’s
oversight and a more controls-based IAF focus. In doing so, our study contributes to the literature
in four distinct ways. First, we extend Carcello et al. 共2005兲, which explored the determinants of

Accounting Horizons March 2010

American Accounting Association
Serving Two Masters 3

the IAF budget, including company risk, ability to pay, and audit characteristics. Carcello et al.
共2005兲 found a positive association between the size of the IAF budget and a dichotomous variable
representing whether the audit committee reviewed the budget. We examine 共in addition to budget
size兲 the allocation of the IAF budget, and utilize a finer measure of the degree of audit committee
involvement with the budget process. Second, we provide initial post-SOX data regarding the
breakdown of internal audit activities, an area with sparse prior evidence. We find that a substan-
tial percentage 共in excess of 40 percent兲 of in-house IAF budgets is allocated to areas unrelated to
internal control, such as special consulting projects and assisting the external auditor in the finan-
cial statement audit. Moreover, we provide evidence on the allocation of outside service provider
共hereafter, OSP兲 hours, on which prior evidence is also limited.
Third, we provide initial empirical evidence on the degree of audit committee oversight, in
addition to its impact on the allocation of IAF resources. Such post-SOX evidence is important to
policymakers, as SOX has increased the expectations, legal exposure, and responsibilities of the
audit committee, while remaining silent as to the audit committee’s relationship with the IAF
共Gramling and Hermanson 2006兲. We find that the mean overall measure of our audit committee
oversight variable is approximately 48 percent, suggesting that the audit committee is a near-equal
partner with management. Finally, we create a new, relatively straightforward measure of audit
committee oversight, which extends Carcello et al.’s 共2005兲 dichotomous treatment. For example,
although more than 97 percent of our respondents agreed that the audit committee reviews the
IAF’s budget 共compared with 50 percent in Carcello et al. 2005兲, 40 percent disagreed or strongly
disagreed with the statement “the audit committee determines Internal Audit’s budget,” suggesting
that a more detailed measure may better capture the extent of audit committee oversight of the
IAF.
Our study is subject to a number of caveats. First, it is important to note that the companies
in our survey were actively engaged in initial compliance with the internal controls requirements
of SOX during our sample period 共2005兲. Thus, both the audit committee and management were
likely to be especially sensitive to controls and liability issues. As a result, our results may not
apply to firms not subject to SOX internal control requirements or to later periods in which SOX
compliance has matured. Second, our results are not meant to imply that controls-based activities
represent the optimal use of the IAF, nor does our evidence suggest that management is interested
in using the IAF as a means of achieving financial and operational goals exclusively. We note that
prior research is scant on the nature of internal audit activities and what constitutes an appropriate
mix. To whit, several professional and regulatory groups recognize the significant differences
between IA departments in terms of size, nature, and focus 共Ernst & Young 2006; Jefferson Wells
2004; IIA 2002a兲. Third, as noted by many practitioner publications, opinion diverges consider-
ably about how “good” governance uses the IAF, and this divergence likely varies from firm to
firm 共KPMG 2008; Deloitte 2006兲.1 Thus, higher levels of our audit committee IAF oversight
variable should not necessarily be interpreted as indicative of better governance. To sum up, our
purpose is to provide evidence on IAF activities and the IAF-audit committee relationship to better
understand the IAF’s role in a post-SOX environment.
The remainder of this paper is organized as follows. The next section reviews prior literature
and develops our hypothesis. Succeeding sections discuss sample selection, followed by research
design and results. Our final section concludes.

1
The diversity of what constitutes best practices with respect to IAF use and corporate governance will likely also vary
between countries because of different regulatory and litigation environments. We thank an anonymous reviewer for this
insight.

Accounting Horizons March 2010

American Accounting Association
4 Abbott, Parker, and Peters

PRIOR RESEARCH AND HYPOTHESIS DEVELOPMENT

Audit Committees and Internal Audit
To effectively execute their corporate governance duties, audit committees rely in part on the
IAF 共Gramling and Hermanson 2006; IIA 2003b, 2002a, 2002b; McHugh and Raghunandan
1994兲. Many corporate governance observers point to a symbiotic relationship between the IAF
and the audit committee, with effective audit committees heightening the status of internal audit
and the IAF aiding audit committees in avoiding financial misstatement 共e.g., McHugh and Ra-
ghunandan 1994兲. However, research has yet to explore how an IAF can accomplish this, though
some recent studies suggest that improving the quality of internal controls is likely to reduce the
incidence of financial misstatement 共Ge and McVay 2005; Krishnan 2005; Verschoor 2002; POB
2000兲. Consequently, it appears reasonable that an audit committee may view the IAF as well
equipped to provide internal control assurance and, in turn, wish to have internal audit allocate
relatively more of its resources toward internal control evaluation.
However, the ability of an IAF to satisfy the audit committee’s concerns may be constrained
by budgetary limitations and competition with management for the direction of scarce resources
共Jefferson Wells 2004; Anderson 2003; Hermanson and Rittenberg 2003; Quarles 1994; Pei and
Davis 1989兲. Most directly, budgetary restrictions can result in reduced testing of controls, as well
as reduced geographic audit coverage 共POB 2000兲. Indirectly, an IAF that spends relatively less
time on internal controls may not see the return on investment in related specialized training
programs, including those for electronic data processing 共hereafter, EDP兲 auditing. Thus the audit
committee has an incentive to support the allocation of resources to internal control activities.
Carcello et al.’s 共2005兲 study most closely addresses the above issues. These authors docu-
ment a positive association between audit committees that reviewed internal audit’s budget and the
size of that budget. Carcello et al. 共2005兲 find that only 59 percent of the chief internal auditors
surveyed stated that audit committees reviewed internal audit’s annual budget. This may indicate
the audit committee’s reluctance to challenge management on the resources allocated to internal
audit. In particular, management may endeavor to have internal audit direct more attention to
operational audits and other consulting-related “value-added” services 共Gray 2004; Anderson
2003; Hermanson and Rittenberg 2003兲. Moreover, management may be reluctant to grant addi-
tional resources to internal control activities that will not necessarily generate immediate cost
savings 共Gray 2004; Anderson 2003; Hermanson and Rittenberg 2003兲. This suggests that man-
agement and the audit committee may have conflicts concerning not only the IAF’s budget, but
also the focus of the IAF’s activities. The current study extends the prior literature by investigating
the associations between audit committee oversight 共vis-à-vis management oversight兲 and re-
sources devoted to specific IAF activities.

Hypothesis Development
Abbott and Parker 共2000兲 posit that audit committees wish to avoid financial misstatement for
two reasons. First are reputational capital enhancement/preservation concerns. More specifically,
audit committee directors may view the directorate as a means of enhancing their reputations as
experts in decision control, which is likely a function of good internal controls 共Srinivasan 2005;
Beasley 1996兲. Although audit committee service increases the reputational capital of these direc-
tors, it may also exacerbate the reputational damage should a financial misstatement occur 共Srini-
vasan 2005兲. The second reason concerns director liability, which is also a function of the likeli-
hood of financial misstatement. As a consequence, audit committees take steps to heighten overall
audit quality 共including both internal and external audit efforts兲 to reduce the risk of material
financial misstatement 共Abbott and Parker 2000; Carcello and Neal 2000兲.

Accounting Horizons March 2010

American Accounting Association
Serving Two Masters 5

In addition, Coffee 共2005兲 suggests that the litigation vulnerability of the audit committee is
materially altered by the additional internal control information that audit committees receive
post-SOX. This issue is particularly important if the firm receives an adverse internal controls
report, because any subsequent decline in stock price or financial reporting issue will bring the
audit committee’s actions related to the adverse report under intense scrutiny. Thus we expect
heightened emphasis by the audit committee on either preventing material control weaknesses or
reacting proactively to increase internal controls subsequent to an adverse report.
One means of reducing both the likelihood of misstatements and of an adverse internal control
opinion is increasing the quality of a firm’s internal control structure 共Ge and McVay 2005;
Krishnan 2005; Verschoor 2002; Eilifsen and Messier 2000兲. We posit that the use of internal audit
can increase the quality of the internal control structure in two ways. First, the IAF can devote
significant resources to internal control evaluation and, in cases of weaknesses, improvement
thereof 共IIA 2002a兲. Second, the pervasiveness of enterprise resource planning 共hereafter, ERP兲
systems in generating financial statements creates a demand for increased reliance on and testing
of EDP-related application controls by internal audit 共Chan 2004; Lightle and Vallario 2003兲. This,
in turn, increases the demand for internal control and EDP audit specialists. Both internal control
evaluation and EDP auditing would fall under the classification of controls-based activities.
On the other hand, management may not see the value-added aspect of controls-related ac-
tivities and divert IAF focus away from such activities and more toward IAF activities that
produce immediate, contemporaneous cost savings 共Gray 2004; Anderson 2003兲. This is because
management 共usually in the form of the CEO/CFO兲 has financial reporting and compensation-
related incentives that are not present 共or not present in the same degree兲 for audit committee
members. For example, in terms of financial reporting incentives, Graham et al. 共2005兲 find that
the majority of managers would avoid initiating a positive NPV project if it meant falling short of
the current quarter’s consensus earnings.2
In sum, we argue that the evaluation of an audit committee’s effectiveness is heavily weighted
toward the strength of the company’s internal control structures and financial reporting environ-
ment, and no mention is made of responsibilities for the firm’s economic performance. As such,
audit committee members do not have the same degree of economic incentives as management
with respect to earnings per share or the pursuit of risk-taking activities that promote growth.
However, the audit committee member does receive personal benefit from the minimization of
downside risk with respect to internal controls.
Thus we hypothesize that an audit committee with relatively more IAF oversight will be able
to demand relatively greater IAF focus on internal control. This leads to our hypothesis 共stated in
alternative form兲:
Ha: Higher levels of audit committee oversight of the IAF 共compared with management’s
level of IAF oversight兲 will be associated with a higher percentage of IAF resources
devoted to internal-controls-based activities.
Although the above hypothesis reflects the incentives facing the audit committee and man-
agement, the trade-offs do not necessarily imply optimal uses of the IAF. Rather, the current
hypothesis is tested to determine whether certain governance structures may result in differential
IAF emphasis. Although professional and regulatory organizations 共such as the IIA, PCAOB, and
others兲 emphasize the benefits of audit committee oversight of the IAF, we are not aware of any
discussion about anticipated outcomes related to such oversight.

2
These views are consistent with survey results of Ernst & Young 共2006兲. In a survey of 148 international corporate board
members, they find evidence that audit committee members emphasize and respond to distinctly different 共compared
with management兲 considerations of company risk.

Accounting Horizons March 2010

American Accounting Association
6 Abbott, Parker, and Peters

SAMPLE SELECTION
Our survey questionnaire 共see excerpts provided in the Exhibits兲 was mailed to Fortune 1000
共in terms of total sales兲 companies, after excluding banks.3 Consistent with much prior internal
audit research 共Carcello et al. 2005; Raghunandan et al. 1998; Scarbrough et al. 1998兲, our survey
was directed to CIAs. In survey questions #1–#3 共Exhibit 1兲, CIAs were requested to provide
details concerning the hours expended by outside service providers 共hereafter, OSPs兲 and the
in-house internal audit department, as well as the distribution of those hours across 10 typical IA
activities for fiscal year 2005. Survey questions #6a–6i 共Exhibit 2兲 asked respondents to provide a
Likert-scale level of agreement with statements concerning internal audit reporting responsibility,
termination rights, and budgetary oversight. Note that survey questions #6a–6i in the exhibit are
differentiated by source of oversight: CFO, CEO, and audit committee. In this manner, respon-

EXHIBIT 1
Survey Questions Related to IAF Activities

1. During fiscal 2005, approximately how many hours were devoted to internal audit services by:
OUTSIDE SERVICE PROVIDERS 共OSPs兲 _______ hours
INTERNAL PROVIDERS ________ hours
2. Of the total internal audit hours provided by the outside service provider共s兲 as indicated in question 1,
please give the approximate percentage distribution of activities 共please note that the percentages should
add to 100%兲:
% of % of
Activity Description Hours Activity Description Hours
Financial statement audits of EDP auditing
subsidiaries
Special consulting projects Internal control evaluation
Compliance auditing Section 404-related work
Risk management activities Fraud audits
Assisting external auditor in Operational audits/Other
financial statement audit 共explain兲
3. Of the total internal audit hours provided by the in-house internal audit department during 2005 per
question 1, please give the approximate percentage distribution of activities 共please note the percentages
should add to 100%兲:
% of % of
Activity Description Hours Activity Description Hours
Financial statement audits of EDP Auditing
subsidiaries
Special consulting projects Internal control evaluation
Compliance auditing Section 404-related work
Risk management activities Fraud audits
Assisting external auditor in Operational audits/Other
financial statement audit 共explain兲

3
Consistent with Carcello et al. 共2005兲, banks are excluded because they do not possess inventory and have unique
regulatory environments.

Accounting Horizons March 2010

American Accounting Association
Serving Two Masters 7

EXHIBIT 2
Survey Questions Related to Audit Committee Oversight

6. Please indicate your level of agreement with the following statements: 共1 ⫽ strongly disagree; 2 ⫽
disagree; 3 ⫽ neutral; 4 ⫽ agree; 5 ⫽ strongly agree兲.
Level of
Agreement
(circle one
Statement number)
a. Internal audit reports to the Audit Committee 1 2 3 4 5
b. Internal audit reports to the Chief Financial Officer 共CFO兲 1 2 3 4 5
c. Internal audit reports to the Chief Executive Officer 共CEO兲 1 2 3 4 5
d. The Audit Committee has authorization to terminate the Chief Internal Auditor 1 2 3 4 5
e. The CFO has authorization to terminate the Chief Internal Auditor 1 2 3 4 5
f. The CEO has authorization to terminate the Chief Internal Auditor 1 2 3 4 5
g. The Audit Committee determines Internal Audit’s annual budget 1 2 3 4 5
h. The CFO determines Internal Audit’s annual budget 1 2 3 4 5
i. The CEO determines Internal Audit’s annual budget 1 2 3 4 5

dents are afforded the flexibility to delineate their perception of oversight among the three poten-
tial overseers.
The first survey was sent in July 2006 and resulted in a total of 72 usable responses. A
follow-up mailing was conducted in September 2006 and produced an additional 62 usable re-
sponses. This leads to our final sample size of 134 observations. Table 1 provides details of the
industry membership of the 134 respondents, compared with the industry profile of the original
nonbank population of Fortune 1000 companies. Per Table 1, our sample appears to be represen-
tative of the Fortune 1000 population of firms, except for a slight underrepresentation of the
energy and manufacturing sectors and an overrepresentation of professional, commercial services,
and education firms.

RESEARCH DESIGN
We employ a multivariate regression approach similar to that of Carcello et al. 共2005兲, who
use an agency-based framework to describe the demand for internal audit services. We augment
their regression model with our test variable, as well as additional control variables. Our regres-
sion framework is summarized as follows:
IACONTROL% = b0 + b1AC_OVRSGHT + b2SIZE + b3LEVERAGE + b4INVRATIO
+ b5FORSALE + b6GROWTH + b7OPCASH + b8RDINTENSE + b9MW
+ b10MANAGE + ␧, 共1兲
where:
IACONTROL% ⫽ percentage of total IA budget devoted to internal controls-related activities;
AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management
共CEO and CFO兲;
SIZE ⫽ natural log of total assets 共in millions兲;
LEVERAGE ⫽ ratio of total long-term debt to total assets;
INVRATIO ⫽ ratio of inventory to total assets;

Accounting Horizons March 2010

American Accounting Association
8 Abbott, Parker, and Peters

TABLE 1
Sample Selection Results
# of % of
Fortune Fortune
Related Two- # of Sample % of 1000 1000
Focus Industry Digit SIC Codes Firms Sample Firmsa Firmsa
Construction 15–17 4 3.0 23 2.9
Consumer Product and Food 20–33 28 20.9 174 21.6
Energy 10–14, 46, 49 14 10.4 122 15.2
Financial Services 60–64, 67 12 9.0 62 7.7
Information and 48, 73, 78, 79, 84 14 10.4 84 10.5
Communication
Manufacturing 34–39 18 13.4 135 16.8
Personal Services and 72, 80, 83 4 3.0 15 1.8
Healthcare
Professional, Commercial 75, 76, 82, 87, 89 8 6.0 12 1.5
Services, Education
Real Estate 65, 70 0 0.0 4 0.5
Retail and Wholesale 50–59 28 20.9 142 17.7
Transportation 40–42, 44, 45, 47 4 3.0 30 3.8
All Other 1, 2, 7, 8, 99 0 0.0 0 0.0
Totals 134 100.0 803 100.0

a Fortune 1000 firms that are banks are excluded from both the population and the sample as these firms face additional
regulation unique to their industry and do not have significant inventory accounts 共making the model unfit for regression
purposes兲. The remaining 803 nonbank Fortune 1000 firms act as our sampling population.

FORSALE ⫽ foreign sales as a percentage of total sales;

GROWTH ⫽ three-year rate of sales growth;
OPCASH ⫽ operating cash flow scaled by total assets;
RDINTENSE ⫽ R&D expenditures as a percentage of total sales;
MW ⫽ 1 if company reported a material internal control weakness during the prior
two years, 0 otherwise; and
MANAGE ⫽ 1 if internal audit is used as a training ground for future management
positions, 0 otherwise.

Our hypothesis addresses the association between audit committee oversight and the nature of
IAF activities. Our dependent variable, IACONTROL%, measures the percentage of total internal
audit budget 共both outsourced and in-house兲 devoted to controls-based activities. We classify the
following as controls-based: EDP auditing, internal control evaluation, Section 404 testing, fraud
auditing, risk management activities, and compliance auditing.4 We exclude special consulting
projects, financial statement audits of subsidiaries, operational audits, and incidences in which the
external auditor is assisted in the financial statement audit. These activities do not directly address

4
We include fraud auditing as a controls-related activity because at least a portion of a fraud audit would be devoted to
investigating and correcting a control lapse. Risk management activities are included within controls-related activities
because the COSO framework includes risk management as a key component of internal control. Compliance auditing
is included as it typically entails testing adherence to firm-level internal control policies and procedures. Additional
sensitivity testing of the underlying activities is discussed in the results section.

Accounting Horizons March 2010

American Accounting Association
Serving Two Masters 9

internal controls and may be seen as a means of generating immediate cost savings, especially in
terms of assisting the financial statement auditor 共Felix et al. 2001兲.5
IACONTROL% captures the percentage of total internal audit budgets devoted to controls-
related activities. The numerator of IACONTROL% is the sum of two products: The sum of
controls-related activity percentages for the OSP multiplied by the total number of OSP hours, and
the sum of controls-based percentages for the in-house internal audit department multiplied by the
total number of in-house internal audit hours. The denominator of IACONTROL% is the sum of
the OSP hours and in-house internal audit hours. Consequently, IACONTROL% is bounded by 1
and 0. A mathematical representation of IACONTROL% is:

兵关共⌺Internal control %s for OSP兲 ⴱ 共OSP hours兲兴 + 关共⌺Internal control %s for in-house IAF兲 ⴱ 共IAF hours兲兴其
.
兵OSP hours + in-house IAF hours其

Our audit committee oversight 共AC_OVRSGHT兲 variable is designed to capture the degree of IAF
oversight the audit committee has relative to upper management 共CEO and CFO兲. Thus, it can
range from 0 共i.e., no oversight over the IAF兲 to 1 共i.e., total oversight over the IAF兲.6 From the
answers to survey question 6, we construct the ratio of the total agreement points for the audit
committee, divided by the total agreement points for the audit committee, CFO, and CEO. To
illustrate, if the CIA answers “5” 共i.e., strongly agree兲 to all questions 6a–6i, then the audit
committee is seen as an equal tri-partner with the CEO and CFO. Our AC_OVRSGHT variable
would receive a value of 0.33, denoting 33 percent relative oversight of the internal audit function,
vis-à-vis management. If, however, the CIA strongly disagrees with any relationship with the
CEO/CFO 共i.e., responding with a “1” to questions 6b, 6c, 6e, 6f, 6h, 6i兲, while strongly agreeing
with all audit committee relationships 共i.e., responding with a “5” to questions 6a, 6d, 6g兲, our
AC_OVRSGHT variable equals 1, denoting full internal audit oversight by the audit committee.7
Consistent with Carcello et al. 共2005兲, our control variables are generally agency-based, as an
increase in agency costs necessitates greater monitoring. We posit that an IAF focus on controls is
consistent with its role in ensuring the efficacy of the management control systems 共Carcello et al.
2005; Ramamoorti 2003兲. Consequently, we predict a positive association between our agency
cost proxies, SIZE 共natural log of total assets in billions兲 and LEVERAGE 共ratio of total long-term
debt to total assets兲, and our dependent variable. The need for better monitoring increases with
firm complexity 共Carcello et al. 2005; Ramamoorti 2003兲, and we expect a positive association
between our proxy for firm complexity, INVRATIO 共ratio of total inventory to total assets兲, and our
dependent variable. In a related note, as a firm becomes more decentralized, there is a concomitant

5
The audit committee’s desire for reliable financial reporting may be served by increased IAF assistance with the
financial statement audit. However, the results of Felix et al. 共2001兲 suggest that direct assistance rendered by the
internal auditors has the effect of decreasing the external audit fees because of a reduction in audit effort. Thus direct
assistance by the IAF does not result in an overall increase in audit scope. Although resources devoted to assisting the
external auditors can result in cost savings, we hypothesize the audit committee will have a stronger preference
共compared with management兲 for less assistance with the financial statement audit 共when traded-off against internal
control works兲, resulting in an overall larger audit scope.
6
Recognizing the level of control over the internal audit department as a three-pronged function of reporting, termination,
and budget rights is also consistent with the PricewaterhouseCoopers 共PwC兲 survey of audit committee chairpersons.
For example, PwC observed that “even with direct reporting to the Audit Committee Chairman, there was recognition
that 共internal audit兲 independence is threatened if 共the audit committee兲 does not have an active involvement in the
career path and reward of the Head of Internal Audit, as well as in the funding of the function” 共PwC 2006兲.
7
Survey responses to questions 6a–6i can range from 1–5, but are recalibrated to a scale of 0–4 By doing so, our
AC_OVRSGHT variable captures the intuition behind the relative oversight over the internal audit function. For ex-
ample, if the CIA strongly disagrees 共agrees兲 with a statement concerning the audit committee’s 共CFO/CEO兲 reporting,
hiring, and budgetary roles 共i.e., responds with a “1” to questions 6a, 6d, and 6g兲, the resulting AC_OVRSGHT score will
be 0. Without such recalibration, the AC_OVRSGHT value would be 关共1 ⫹ 1 ⫹ 1兲/共1 ⫹ 5 ⫹ 5 ⫹ 1 ⫹ 5 ⫹ 5 ⫹ 1 ⫹ 5
⫹ 5兲兴 or 0.099.

Accounting Horizons March 2010

American Accounting Association
10 Abbott, Parker, and Peters

demand for management control systems that utilize accounting-based information 共Ditello 2004;
Ramamoorti 2003兲. Our proxy for decentralization is FORSALE, which is defined as the foreign
sales as a percentage of total sales. We expect a positive coefficient estimate for our FORSALE
variable. Beasley 共1996兲 posits that firms experiencing rapid growth rates may experience dete-
rioration in controls, spurring the audit committee to press for more controls-oriented work. This
would suggest a positive association between our growth proxy, GROWTH 共three-year growth rate
in sales兲, and our dependent variable. The desire for cost savings 共and focus away from internal
control on the part of IA兲 is proxied with OPCASH, or cash flow from operations scaled by total
assets. Consistent with Carcello et al. 共2005兲, we expect a positive coefficient estimate for this
variable.
In terms of our additional test variables, Ditello 共2004兲 notes that excessive emphasis on
management control systems may have a deleterious effect on innovation. Consequently, for
knowledge-intense firms, we may observe a de-emphasis on internal controls. We proxy for
knowledge-intensity with RDINTENSE, defined as the ratio of R&D expenditures to total sales.
We expect a negative coefficient estimate for this variable. We add a dichotomous variable, MW,
contingent on the presence of a reportable material internal control weakness.8 In particular, firms
reporting an internal control weakness may direct resources toward the remediation of those
weaknesses. We expect a positive association between our MW variable and the percentage of
controls-based activity because the IAF may be used to improve and eliminate such weaknesses.
Finally, we add a dichotomous variable, MANAGE, depending on whether internal audit is a
training ground for future management positions.9 We include this variable as such career arrange-
ments may induce the IAF to promote well-rounded entry into the management sphere by focusing
on the operational aspects of the business 共Quarles 1994兲. As such, we expect a negative coeffi-
cient estimate on our MANAGE variable.

RESULTS
Table 2 presents descriptive statistics for our 134 firms. Panel A of Table 2 provides a
breakdown of the size of budgets and hours allocated to in-house internal audit functions and OSP
internal audit services 共approximately 75 percent of sample firms use an OSP兲. In-house IAF
budgets are large, with a mean 共median兲 of 34,873 共20,000兲 hours. In contrast, OSP hours are
much smaller, with a mean 共median兲 budget of 4,123 共2,000兲.
Panels B and C of Table 2 present the allocation of OSP and in-house internal audit hours
devoted to specific activities. We find substantial differences in the allocation amounts between
OSPs and in-house internal audit departments. OSP budgets are dominated by Section 404-related
activities 共with a mean 关median兴 of 51.25 percent 关60 percent兴 of budgeted OSP hours兲 and
assisting the external auditor with the financial statement audit 共with a mean 关median兴 of 15.20
percent 关15 percent兴 of budgeted OSP hours兲. This may speak to the specialization on the part of
OSPs in response to the Sarbanes-Oxley Act. In comparison, there is much greater variety of
in-house internal audit activities, with the most dominant activity also being Section 404-related
work, albeit at a much lower concentration 共a mean 关median兴 of 20.50 percent 关20 percent兴 of
budgeted in-house IA hours兲. Also a considerable proportion of IAF hours 共approximately 40
percent兲 are devoted to noncontrols-based activities. This suggests that even in the post-SOX
environment, noninternal-control activities remain important. Panel D shows the breakdown of the

8
MW is coded “1” if one or more internal control weaknesses were reported by management under SOX Section 302 or
by the auditor under SOX Section 404 in either 2004 or 2005.
9
Information on this variable was obtained via our survey. The survey question was phrased as follows: “Is internal audit
used as a training ground for future management positions?”

Accounting Horizons March 2010

American Accounting Association
 Accounting Horizons

Serving Two Masters

TABLE 2
Descriptive Data—Internal Audit Function (IAF) Activities per Survey Responses
Panel A: Size of Internal Audit Budgets Including Outside Service Provider (OSP) Hours (n ⴝ 134)
Variable Name Mean Median 25th % 75th %
Total OSP-Provided Hours 4,123 2,000 0 5,000
Total In-House IAF Hours 34,873 20,000 8,000 37,750
Total Combined IAF Hours 38,995 22,000 12,000 43,000

Panel B: Breakdown of Outside Service Provider (OSP) Internal Audit Activities (n ⴝ 98)
% of OSP Hours Devoted to: Mean Median 25th % 75th %
Financial Statement Audits of Subsidiaries 1.00 0.00 0.00 0.00
Special Consulting Projects 3.00 0.00 0.00 0.00
Compliance Auditing 1.25 0.00 0.00 0.00
Risk Management Activities 1.25 0.00 0.00 0.00
Assisting External Auditor in Financial Statement Audit 15.20 15.00 5.00 25.00
EDP Auditing 11.35 10.00 5.00 15.00
Internal Control Evaluation 12.75 15.00 5.00 15.00
Section 404-Related Work 51.25 60.00 15.00 90.00
Fraud Audits 0.50 0.00 0.00 0.00
Operational Audits 0.22 0.00 0.00 0.00
Internal Control Activitiesa 78.35 80.00 57.50 95.00

Panel C: Breakdown of In-House Internal Audit Activities (n ⴝ 134)

American Accounting Association

% of In-House Internal Audit

Hours Devoted to: Mean Median 25th % 75th %
Financial Statement Audits of Subsidiaries 10.15 10.00 0.00 15.00
Special Consulting Projects 9.00 10.00 5.00 15.00
Compliance Auditing 1.00 0.00 0.00 0.00
Risk Management Activities 1.00 0.00 0.00 0.00
Assisting External Auditor in Financial Statement Audit 15.75 15.00 5.00 25.00
March 2010

EDP Auditing 18.50 15.00 10.00 25.00

(continued on next page)

11
 Panel C: Breakdown of In-House Internal Audit Activities (n ⴝ 134)
American Accounting Association
Accounting Horizons

12
% of In-House Internal Audit
Hours Devoted to: Mean Median 25th % 75th %
Internal Control Evaluation 15.90 15.00 10.00 25.00
Section 404-Related Work 20.50 20.00 15.00 35.00
Fraud Audits 3.20 0.00 0.00 5.00
Operational Audits 5.63 5.00 0.00 10.00
Internal Control Activitiesa 59.90 60.00 0.33 80.00

Panel D: Breakdown of Combined [Outside Service Provider (OSP) and In-House IAF] Internal Audit Activities (n ⴝ 134)
% of Combined Internal
Audit Hours Devoted to: Mean Median 25th % 75th %
Financial Statement Audits of Subsidiaries 9.25 9.00 0.00 15.00
Special Consulting Projects 8.75 10.00 5.00 15.00
Compliance Auditing 1.05 0.00 0.00 0.00
Risk Management Activities 1.05 0.00 0.00 0.00
Assisting External Auditor in Financial Statement Audit 15.15 15.00 5.00 25.00
EDP Auditing 17.75 14.25 9.75 22.50
Internal Control Evaluation 15.00 15.00 10.00 25.00
Section 404-Related Work 24.25 25.00 15.00 40.00
Fraud Audits 2.75 0.00 0.00 5.00
Operational Audits 5.00 5.00 0.00 10.00
Internal Control Activitiesa 61.85 65.00 37.50 82.50

a Internal control activities include compliance auditing, risk management activities, EDP auditing, internal control evaluation, Section 404-related work, and fraud audits. Excluded
are financial statement audits of subsidiaries, special consulting projects, assisting the external auditor in financial statement audit, and operational audits.

Abbott, Parker, and Peters

March 2010
Serving Two Masters 13

combined in-house and OSP internal audit activities. In general, the allocations mirror that of
Panel C because the amounts of OSP hours are small relatively to those provided by the in-house
IAF.10
Table 3 presents our descriptive statistics for our test and control variables. Panel A of Table
3 provides detailed information concerning our test variable, AC_OVRSGHT. AC_OVRSGHT
exhibits considerable variation, with a mean 共median兲 value of 0.48 共0.44兲. This suggests that the
audit committee is generally seen as a nearly equal partner. We find that for the lower 25 percent
of our firms, the audit committee has relatively little oversight over the IAF with a value of 0.28.
On the other hand, the 75th percentile value of AC_OVRSGHT is 0.65. In terms of the breakdown
of IAF-audit committee relations, audit committees appear to have a much greater degree of
reporting oversight 共with a mean 关median兴 agreement of 4.65 关5兴 with the statement that IA reports
to the audit committee兲 than budgetary control 共with a mean 关median兴 agreement of 3.11 关3兴 with
the statement that the audit committee determines the IAF’s budget兲. In terms of reporting rela-
tionships, internal audit appears to be reporting to both the audit committee and the CFO or CEO.
This could indicate a “solid line” or functional relationship with the audit committee and a “dotted
line” or administrative relationship with the CFO or CEO.
In terms of our control variables, we note that our firms, by design, are very large, profitable,
and growing. In particular, the mean 共median兲 of total assets is $12.86 billion 共$5.49 billion兲,
whereas operating cash flows, on average, represent 10.34 percent of total assets. The mean
共median兲 sales growth rate is 30.60 percent 共34.95 percent兲. Given their Fortune 1000 status, we
also observe a meaningful degree of globalization among our sample firms, with a mean 共median兲
FORSALE value of 14.4 percent 共15.75 percent兲. Sixteen percent of our sample firms had material
internal control weaknesses, which is consistent with prior research in this area 共Ge and McVay
2005兲. Finally, slightly less than two-thirds of our sample respondents use IA as a training ground
for future management positions. Although significant variation generally appears in our indepen-
dent variables, Pearson pairwise correlations between independent variables appear to be quite
low, as reported in Table 4.
Table 5 presents our univariate tests, comparing the 67 sample firms with an IACONTROL%
greater or equal to the median of 65 percent to the 67 sample firms with an INCONTROL% lower
than the median IACONTROL% value of 65 percent. We document a statistically significant
difference in our subsample means for AC_OVRSGHT. For those IAFs spending relatively more
time on internal control activity, the AC_OVRSGHT value is 0.597 共suggesting the audit commit-
tee has more oversight of the IAF than upper management兲. This compares with an AC_OVRS-
GHT value of 0.358 共suggesting a more limited audit committee oversight role of the IAF兲 for
IAFs spending less than the median time on control activities. This result provides univariate
support for our hypothesis. We also document statistically significant univariate differences for our
SIZE, LEVERAGE, INVRATIO, RDINTENSE, GROWTH, MW, and MANAGE variables between
the two subsamples. We fail to document statistically significant differences in our OPCASH and
FORSALE variables, however.
Table 6 presents our multivariate regression results. Our coefficient estimate on our test
variable, AC_OVRSGHT, is positive and highly significant, which is consistent with our hypoth-
esis. This confirms our hypothesized relation between audit committee oversight and IAF activi-
ties. We believe that audit committee oversight can affect the focus on internal audit activities
through several mechanisms. First, during the review of the IAF’s initial program and budget, the

10
Respondents made very little use of the “other” category. Less than 3 percent of respondents used this category and for
very small allocation percentages. Answers were generally in the form of “administration” or “annual employee evalu-
ations.” Consequently, our survey design appears to capture much of the array of different IAF activities.

Accounting Horizons March 2010

American Accounting Association
American Accounting Association
Accounting Horizons

14
TABLE 3
Descriptive Data—Explanatory Variables
Panel A: Likert-Scale Internal Audit Oversight Response Data
Degree of Agreement with
Following Survey Statements Mean Median 25th % 75th %
IA reports to the Audit Committee 4.65 5.00 4.00 5.00
IA reports to the CFO 3.19 4.00 1.00 5.00
IA reports to the CEO 2.46 2.00 1.00 4.00
Audit Committee has authorization to terminate 4.51 5.00 4.00 5.00
the Chief Internal Auditor
The CFO has authorization to terminate the 2.72 4.00 1.00 3.00
Chief Internal Auditor
The CEO has authorization to terminate the 2.78 4.00 1.00 3.00
Chief Internal Auditor
The Audit Committee determines Internal 3.11 3.00 2.00 4.00
Audit’s annual budget
The CFO determines Internal Audit’s annual 3.38 4.00 2.00 4.00
budget
The CEO determines Internal Audit’s annual 2.55 3.00 1.00 4.00
budget
AC_OVRSGHTa 0.48 0.44 0.28 0.65

Panel B: Remaining Control Variable Descriptive Data

Variable Mean Median 25th % 75th %
ASSETS 12.86 5.49 2.63 14.98
LEVERAGE 0.25 0.25 0.12 0.35
INVRATIO 0.14 0.15 0.05 0.22

Abbott, Parker, and Peters

FORSALE 14.40 15.75 5.24 25.58
GROWTH 30.60 34.95 13.15 73.59
OPCASH 0.10 0.09 0.05 0.14
RDINTENSE 0.01 0.00 0.00 0.00
MW 0.16 0.00 0.00 0.00
March 2010

MANAGE 0.65 1.00 0.00 1.00

(continued on next page)

 Accounting Horizons

Serving Two Masters

a AC_OVRSGHT is defined as the sum of the three Likert-scale responses to the three audit committee-IA statements divided by the sum of all nine Likert-scale responses
concerning IA/CEO/CFO/Audit Committee relationships per survey questions 6a–6i.
Variable Definitions:
ASSETS ⫽ total assets 共in billions兲;
LEVERAGE ⫽ ratio of total long-term debt to total assets;
INVRATIO ⫽ ratio of inventory to total assets;
FORSALE ⫽ foreign sales as a percentage of total sales;
GROWTH ⫽ three-year rate of sales growth;
OPCASH ⫽ operating cash flow scaled by total assets;
RDINTENSE ⫽ R&D expenditures as a percentage of total sales;
MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise; and
MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.
American Accounting Association
March 2010

15
American Accounting Association
Accounting Horizons

16
TABLE 4
Pearson Pairwise Correlations
AC RD
OVRSGHT ASSETS LEVERAGE INVRATIO FORSALE GROWTH OPCASH INTENSE MW MANAGE
AC_OVRSGHT 1.00
ASSETS ⫺0.07 1.00
LEVERAGE ⫺0.02 ⫺0.09 1.00
INVRATIO 0.05 ⫺0.01 0.17* 1.00
FORSALE 0.03 0.11 ⫺0.06 0.09 1.00
GROWTH 0.10 0.06 0.05 0.07 0.12* 1.00
OPCASH ⫺0.06 0.11 0.13* 0.06* 0.08* ⫺0.14 1.00
RDINTENSE ⫺0.03 0.01 ⫺0.08* ⫺0.04 0.13 0.16* 0.05 1.00
MW 0.09** ⫺0.05 ⫺0.03 ⫺0.05 ⫺0.08 0.08 ⫺0.04 0.03 1.00
MANAGE 0.03 0.01 0.04 0.01 0.07 0.05 0.10 0.05 ⫺0.07 1.00

*, ** p-value ⬍ 0.10, 0.05, respectively.

Variable Definitions:
AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management 共CEO and CFO兲. Measured by respondents’ Likert scale answers concerning
Internal Audit reporting relationships, termination rights, and budgetary oversight. See text for calculation;
ASSETS ⫽ total assets 共in billions兲;
LEVERAGE ⫽ ratio of total long-term debt to total assets;
INVRATIO ⫽ ratio of inventory to total assets;
FORSALE ⫽ foreign sales as a percentage of total sales;
GROWTH ⫽ three-year rate of sales growth;
OPCASH ⫽ operating cash flow scaled by total assets;
RDINTENSE ⫽ R&D expenditures as a percentage of total sales;
MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise; and
MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.

Abbott, Parker, and Peters

March 2010
Serving Two Masters 17

TABLE 5
Univariate Comparisons
Mean Value Mean Value
for 67 for 67
Firms above Firms below Mann-
IACONTROL% IACONTROL% Whitney
Variable Name Median Median Difference Statistic
AC_OVRSGHT 0.597 0.358 0.239 10.551***
ASSETS 15.252 10.468 4.784 6.056**
LEVERAGE 0.287 0.213 0.074 5.364**
INVRATIO 0.178 0.102 0.076 7.889**
FORSALE 13.733 15.066 ⫺1.333 0.648
GROWTH 40.254 20.847 19.407 8.994***
OPCASH 0.095 0.107 ⫺0.012 1.076
RDINTENSE 0.007 0.010 ⫺0.003 6.995**
MW 0.194 0.119 0.075 5.499**
MANAGE 0.552 0.746 ⫺0.194 6.846**
Observations 67 67

*, **, *** p-value ⬍ 0.10, 0.05, and 0.01, respectively.

Variable Definitions:
IACONTROL% ⫽ percentage of internal audit hours 共both in-house provided and provided by outside service
providers兲 devoted to internal control activities per survey questions #1–#3. Included in this amount
are hours devoted to compliance auditing, risk management activities, EDP auditing, internal
control evaluation, Section 404-related work, and fraud audits. Excluded are all other activities per
survey questions #2 and #3;
AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management 共CEO and CFO兲.
Measured by respondents’ Likert scale answers concerning Internal Audit reporting relationships,
termination rights, and budgetary oversight. See text for calculation;
ASSETS ⫽ total assets 共in billions兲;
LEVERAGE ⫽ ratio of total long-term debt to total assets;
INVRATIO ⫽ ratio of inventory to total assets;
FORSALE ⫽ foreign sales as a percentage of total sales;
GROWTH ⫽ three-year rate of sales growth;
OPCASH ⫽ operating cash flow scaled by total assets;
RDINTENSE ⫽ R&D expenditures as a percentage of total sales;
MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise;
and
MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.

audit committee can voice its concerns over the amount of hours allocated to internal controls
activities, the nature of its program, and internal audit’s scope and/or geographic coverage 共Ra-
ghunandan et al. 1998兲. Second, during the review of results of internal audit’s activities, the audit
committee can request the IAF to take actions to improve the existing internal control structure or
increase the amount of coverage on higher-risk areas 共Carcello et al. 2005兲. Finally, during nego-
tiations with management over the IAF’s program and budget, the CIA can indirectly utilize the
audit committee as a bargaining tool and communicate the audit committee’s internal control
concerns to the CFO or CEO 共Abbott et al. 2007兲.
Consistent with Carcello et al. 共2005兲, we document positive, statistically significant coeffi-
cient estimates on our SIZE, LEVERAGE, and INVRATIO. In keeping with our univariate results,
we document a statistically significant, negative 共positive兲 coefficient estimate on our RDIN-
TENSE 共GROWTH兲 variable. We also find support for our MW and MANAGE variables, as our

Accounting Horizons March 2010

American Accounting Association
18 Abbott, Parker, and Peters

TABLE 6
OLS Regression Results

IACONTROL% = b0 + b1AC_OVRSGHT + b2SIZE + b3LEVERAGE + b4INVRATIO

+ b5FORSALE + b6GROWTH + b7OPCASH + b8RDINTENSE + b9MW
+ b10MANAGE + ␧

Model 1: Total Internal Audit

Hours (In-house Internal
Audit Function ⴙ Outside Model 2: In-house Internal
Service Provider Hours) Audit Function Hours Only
Independent Expected Coefficient Coefficient
Variable Sign Estimate t-statistic Estimate t-statistic
Intercept ⫺0.965 ⫺1.806 ⫺0.965 ⫺1.806
AC_OVRSGHT ⫹ 3.588 4.339*** 3.988 4.884***
SIZE ⫹ 0.922 2.034** 0.811 1.537**
LEVERAGE ⫹ 0.768 2.005** 0.492 1.998**
INVRATIO ⫹ 1.663 2.777*** 2.114 3.050***
FORSALE ⫹ ⫺0.249 ⫺0.579 ⫺0.822 ⫺0.222
GROWTH ⫹ 0.003 2.105** 0.005 2.333**
OPCASH ⫹ ⫺0.089 ⫺0.775 ⫺0.104 ⫺0.826
RDINTENSE ⫺ ⫺3.655 ⫺2.555*** ⫺4.824 ⫺2.798***
MW ⫹ 0.727 1.912** 1.085 2.554**
MANAGE ⫺ ⫺1.222 ⫺1.774** ⫺1.519 ⫺1.849**
Observations 134 134
R2 0.5002 0.5701

*, **, *** p-value ⬍ 0.10, 0.05, and 0.01, respectively, significance levels 共one-tailed if in predicted direction兲.
Variable Definitions:
IACONTROL% ⫽ percentage of hours devoted to internal controls-related activities per survey questions #2 and #3.
Included in this amount are hours devoted to compliance auditing, risk management activities,
EDP auditing, internal control evaluation, Section 404-related work, and fraud audits. Excluded are
all other activities per survey questions #1–#3;
AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management 共CEO and CFO兲.
Measured by respondents’ Likert scale answers concerning Internal Audit reporting relationships,
termination rights, and budgetary oversight. See text for calculation;
SIZE ⫽ natural log of total assets 共in billions兲;
LEVERAGE ⫽ ratio of total long-term debt to total assets;
INVRATIO ⫽ ratio of inventory to total assets;
FORSALE ⫽ foreign sales as a percentage of total sales;
GROWTH ⫽ three-year rate of sales growth;
OPCASH ⫽ operating cash flow scaled by total assets;
RDINTENSE ⫽ R&D expenditures as a percentage of total sales;
MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise;
and
MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.

coefficient estimates are in the predicted directions and are statistically significant. We fail to find
a statistically significant association for our OPCASH and FORSALE variables. Nonetheless, the
overall R2 of our regression model is 50 percent, suggesting a good model fit.

Accounting Horizons March 2010

American Accounting Association
Serving Two Masters 19

Outsourced internal audit hours represent approximately 32 percent of the total. Furthermore,
those outsourced hours are heavily concentrated in internal control activities. To assess whether
our results were influenced by the heavy concentration of OSP hours on internal control issues, we
reran our regressions using only the in-house IAF data. These results are found in Table 6, model
2, and are qualitatively similar to those using total hours.
Prior research provides little guidance as to the categorization of certain IAF activities as
controls-related, and we acknowledge that our categorization is exploratory in nature. To address
this, we ran regressions on the six most common and pervasive individual in-house IAF activities
reported. Table 7 presents the results of those individual activity regressions. Consistent with our
expectations, we find that the percentage of the in-house IAF budget allocated to assistance with
the external audit of the financial statements and financial statement audits of subsidiaries are
negatively associated with the level of audit committee oversight, as is the percentage devoted to
special consulting projects. Conversely, the percentage of in-house IAF budget allocated to EDP
auditing, internal control evaluation, and Section 404 work are all individually positively and
significantly associated with our test variable. These results are robust to the inclusion of OSP-
provided hours and their respective allocation percentages.
In unreported tests, we also used additional alternative definitions of our IACONTROL%
dependent variable. First, we deleted amounts allocated to Section 404 activities as this may be
more a function of the regulatory environment than of audit committee oversight. In these tests,
our results also remain qualitatively similar. Second, we created another “controls-related” depen-
dent variable that excludes activities that may not fit the classic definition of control-related
activities such as fraud audits, risk management, and compliance audits. Results from these re-
gressions are substantively the same as those reported in Table 6.

Additional Sensitivity Analysis

We performed a number of additional sensitivity analyses. First, we added several additional
explanatory variables to our model. These additional variables, primarily extracted from Carcello
et al. 共2005兲, included the issuance of securities, industry classification 共i.e., dichotomous variables
for inclusion in the financial, service, or utility industries兲, number of reportable segments, pres-
ence of a restatement in any of the prior three years, audit fees, and return on assets. These
variables were added to the regressions both singly and together. These additional variables were
statistically insignificant and did not qualitatively alter our results.
Second, to address the possibility that smaller IAFs focus on internal controls as a function of
necessity 共given their relatively smaller budgets兲, we created a variable defined as total IAF budget
共including both in-house and outsourced IAF budgets兲/total sales. This variable was included as
both a main effect 共i.e., as a stand-alone variable兲, as well as an interactive effect with AC_OVRS-
GHT. Neither of the two coefficient estimates was statistically significant and our results remained
qualitatively unchanged. We also defined a variable measured as total in-house IAF budget/total
sales. The variable was included as both a main effect, as well as interactive term with AC_OVRS-
GHT. As with the prior test, neither of the coefficient estimates was statistically significant, and
our results remained qualitatively unchanged.11

11
We also replicated the results of Carcello et al. 共2005兲 with our AC_OVRSGHT variable, rather than the dichotomous
audit committee review of the IA budget variable used by Carcello et al. 共2005兲. We find a significant positive relation
between the size of internal audit budget 共in both dollars and hours兲 and our AC_OVRSGHT variable, which is generally
consistent with Carcello et al. 共2005兲. However, our coefficient estimate in this regression was 0.022, suggesting that
audit committee oversight has a slight impact on the size of the internal audit budget, but that such oversight has a more
significant impact on the focus of the budget.

Accounting Horizons March 2010

American Accounting Association
American Accounting Association
Accounting Horizons

20
TABLE 7
OLS Regression Results of Specific Activities

IA_ACTIVITY% = b0 + b1AC_OVRSGHT + b2SIZE + b3LEVERAGE + b4INVRATIO + b5FORSALE + b6GROWTH + b7OPCASH

+ b8RDINTENSE + b9MW + b10MANAGE + ␧

Financial Statement External Auditor Special Consulting Internal Control Section 404-Related
Audits of Subsidiaries Assistance Projects EDP Auditing Evaluations Work
Independent Coefficient Coefficient Coefficient Coefficient Coefficient Coefficient
Variables Estimate t-statistic Estimate t-statistic Estimate t-statistic Estimate t-statistic Estimate t-statistic Estimate t-statistic

Intercept 0.882 1.00 ⫺1.411 ⫺2.00 ⫺1.443 ⫺0.96 0.656 0.86 ⫺1.225 ⫺1.77 ⫺1.093 ⫺1.559
AC_OVRSGHT ⫺1.002 ⫺3.01*** ⫺0.556 ⫺4.45*** ⫺1.885 ⫺3.76*** 4.055 3.99*** 3.668 4.01*** 2.776 4.103***
SIZE 0.811 1.34 0.705 0.34 1.222 1.98** 1.015 3.02*** 0.939 2.88** 0.062 3.022***
LEVERAGE 0.005 0.03 ⫺0.003 ⫺0.52 ⫺0.007 ⫺0.87 0.702 2.06** 0.313 2.04** ⫺0.078 ⫺0.149
INVRATIO 0.882 1.05 ⫺0.954 ⫺0.78 0.794 1.01 2.055 3.66*** 2.668 3.01*** 1.728 3.009***
FORSALE 1.025 2.44** 3.098 0.33 2.335 0.12 4.878 0.88 0.555 0.40 0.012 0.668
GROWTH 0.005 0.43 0.055 0.10 0.501 0.16 0.008 2.10** 0.003 2.18** 0.008 2.547**
OPCASH 0.104 1.53* 0.492 3.09*** 0.993 1.45* ⫺0.885 ⫺0.40 ⫺0.885 ⫺0.04 ⫺1.476 ⫺0.808
RDINTENSE 0.647 0.99 0.743 0.01 0.013 0.78 1.995 0.01 ⫺4.977 ⫺2.82** ⫺4.886 ⫺3.054***
MW 1.772 1.04 ⫺2.965 ⫺0.01 0.992 1.08 2.702 1.69** 1.002 2.87** 0.998 2.975***
MANAGE ⫺1.884 ⫺1.01 1.776 1.01 2.352 1.54* ⫺1.323 ⫺2.09** ⫺2.111 ⫺1.90** ⫺1.756 ⫺1.652*
Observations 134 134 134 134 134 134
R2 0.2024 0.2303 0.1776 0.5001 0.5992 0.4998

*, **, *** one-tailed p-value ⬍ 0.10, 0.05, and 0.01, respectively.

Variable Definitions:
IA_ACTIVITY% ⫽ percentage of in-house IAF hours devoted to each of the following IAF activities: financial statement audits of subsidiaries, external auditor assistance,

Abbott, Parker, and Peters

special consulting projects, EDP auditing, internal control evaluations, and Section 404-related work. Obtained from survey question #3;
AC_OVRSGHT ⫽ relative oversight of internal audit by the audit committee vis-à-vis management 共CEO and CFO兲. Measured by respondents’ Likert scale answers concerning
internal audit reporting relationships, termination rights, and budgetary oversight. See text for calculation;
SIZE ⫽ natural log of total assets 共in billions兲;
LEVERAGE ⫽ ratio of total long-term debt to total assets;
March 2010

INVRATIO ⫽ ratio of inventory to total assets;

FORSALE ⫽ foreign sales as a percentage of total sales;

(continued on next page)

 Accounting Horizons

Serving Two Masters

TABLE 7 (continued)

GROWTH ⫽ three-year rate of sales growth;

OPCASH ⫽ operating cash flow scaled by total assets;
RDINTENSE ⫽ R&D expenditures as a percentage of total sales;
MW ⫽ 1 if company reported a material internal control weakness during prior two years, 0 otherwise; and
MANAGE ⫽ 1 if internal audit is used as a training ground for future management positions, 0 otherwise.
American Accounting Association
March 2010

21
22 Abbott, Parker, and Peters

Finally, we conducted univariate tests for differences between early and late responders and
found no significant differences between the two subsamples. We tested for significant differences
between respondents and nonrespondents in the Fortune 1000 in terms of our Compustat-related
variables as well as the incidence of material weaknesses under SOX 404, and the incidence of
restatements. The differences were insignificant.

CONCLUSION
This paper examines the association between audit committee oversight of the IAF and the
nature of internal audit activities. Motivation for the study is threefold. First, the regulatory and
best practices guidance typically fails to explicitly delineate audit committee duties regarding the
IAF. Second, little prior research has been done on either the nature of IAF activities or the relative
degree of IAF-audit committee interaction vis-à-vis management. In particular, prior research has
virtually ignored the potentially competing claims on IAF resources between management and the
audit committee. Finally, little evidence exists concerning how audit committee incentives may
have shaped the nature of IAF activities, despite increased calls to strengthen the relationship
between the IAF and the audit committee.
In this study, we hypothesize that the audit committee’s desire to avoid financial misstatement
leads to an increased IAF focus on internal controls. However, the extent to which this is possible
is determined by the audit committee’s oversight of the IAF. Our results from a survey of 134
chief internal auditors are consistent with our hypothesis. In particular, audit committees with
greater IAF oversight are associated with larger percentages of IAF hours being allocated toward
internal controls activities. Moreover, our results suggest that a significant number of Fortune
1000 companies have audit committees that appear to have little oversight of the IAF. This speaks
to the relevance and timeliness of the recommendations of numerous parties concerning audit
committee internal audit termination/hiring rights and budgetary controls.
We also document significant differences in the allocation of IAF budgets across different
activities, an area with very little prior research. We find that the majority of the IAF budget is
devoted to internal controls activities, but the remainder 共allocated to noncontrols activities兲 is
considerable. Our evidence indicates that outsourcing arrangements are quite prevalent, but are
also quite specific. In particular, the majority of outsourcing hours were spent on Section 404-
related activities, with a lesser portion devoted to assisting the external auditor with the financial
statement audit.
Our results suggest that an audit committee’s demand for better internal controls may lead to
greater IAF focus on internal controls. However, our ability to make causal connections is limited
by at least five factors. First, and most importantly, our survey instrument captures the CIAs’
perception of audit committee oversight and may not indicate the complex relationships among the
various IAF stakeholders. Second, our research design does not allow us to make causal infer-
ences, only to document associations. Third, all of our survey respondents were subject to Section
404, and our results may not be generalizable to firms not yet subject to Section 404. Related to
this, our sample period may reflect a not yet fully realized adjustment to Section 404. That is, as
registrants adjusted to new expectations of internal controls reporting, they may have been dis-
proportionately focused on internal controls, unrelated to our test variable. This may not hold true
in future periods when Section 404 implementation is completed. Given that our results remained
robust to the exclusion of Section 404 activities, we believe this concern is partially mitigated. In
addition, although the significant associations might be more pronounced during the time period
examined, we note that the directional associations are consistent with the underlying charges of
the audit committee compared with management, irrespective of the time period examined.
Fourth, response bias may reduce the generalizability of our results. Finally, endogeneity issues

Accounting Horizons March 2010

American Accounting Association
Serving Two Masters 23

may be at play. In particular, management that is highly concerned with internal controls may
simultaneously place more oversight over internal audit with the audit committee and direct more
IAF focus toward internal controls.
Despite these concerns, we believe that future researchers can utilize our results to benchmark
both internal audit resource allocations and the degree of audit committee oversight of the IAF. In
doing so, a more complete understanding of causality may be obtained. In addition, we urge future
researchers to more fully explore the IAF-audit committee relationship to understand the determi-
nants of the mix of IAF activities.
Our results also speak to the need for regulators to consider the incentives of the various
stakeholders when determining policy. Should policy makers consider expanding or restricting
specific oversight roles, they should consider the concomitant effects on the internal audit func-
tion, and the differential incentives faced by the audit committee and executive management. In
addition, as audit committees and managers jointly work or oversee the work of internal auditors,
our results suggest that these two oversight participants should consider how their respective
incentives potentially bias the focus of the internal audit department away from a mix of activities
that optimally address the greater business risks of the company. Likewise, as external auditors
assess the organizational status of the internal audit department, they may also wish to consider the
apparent focus of internal audit as a potential indication of oversight control.

REFERENCES
Abbott, L. J., and S. Parker. 2000. Audit committee characteristics and auditor choice. Auditing: A Journal of
Practice & Theory 19 共2兲: 47–66.
——–, G. Peters, and D. Rama. 2007. Corporate governance, audit quality and the Sarbanes-Oxley Act:
Evidence from internal audit outsourcing. The Accounting Review 82 共4兲: 803–835.
Anderson, U. 2003. Assurance and Consulting Services. Research Opportunities in Internal Auditing. Alta-
monte Springs, FL: Institute of Internal Auditors Research Foundation.
Beasley, M. S. 1996. An empirical analysis of the relation between the board of director composition and
financial statement fraud. The Accounting Review 71 共4兲: 443–465.
Braiotta, L. 2000. The Audit Committee Handbook. 2nd edition. New York, NY: John Wiley.
Carcello, J. V., D. Hermanson, and K. Raghunandan. 2005. Factors associated with U.S. public companies’
investment in internal auditing. Accounting Horizons 19 共2兲: 69–84.
——–, and T. L. Neal. 2000. Audit committee characteristics and auditor reporting. The Accounting Review
75 共4兲: 453–467.
Chan, S. 2004. Sarbanes-Oxley: The IT dimension. The Internal Auditor 共February兲: 31–33.
Coffee, J. C., Jr. 2005. The scarlet letter: What happens after an adverse opinion on internal controls? The
Corporate Governance Advisor 13 共1兲: 1–6.
Deloitte. 2006. Optimizing the Role of Internal Audit in the Sarbanes-Oxley Era. 2nd ed. New York, NY:
Deloitte Development LLC.
Ditello, A. 2004. Dealing with uncertainty in knowledge-intensive firms: The role of management control
systems as knowledge integration systems. Accounting, Organizations and Society 29 共December兲:
401–421.
Eilifsen, A., and W. F. Messier. 2000. The incidence and detection of misstatements: A review and integration
of archival research. Journal of Accounting Literature 19: 1–43.
Ernst & Young. 2006. Board Members on Risk–Leveraging Frameworks for the Future. New York, NY: Ernst
& Young LLC.
Felix, W. L., A. A. Gramling, and M. J. Maletta. 2001. The contribution of internal audit as a determinant of
external audit fees and factors influencing this contribution. Journal of Accounting Research 39
共December兲: 513–534.
Ge, W., and S. McVay. 2005. The disclosure of material weaknesses in internal control after the Sarbanes-
Oxley Act. Accounting Horizons 19 共3兲: 137–158.

Accounting Horizons March 2010

American Accounting Association
24 Abbott, Parker, and Peters

Graham, J. R., C. R. Harvey, and S. Rajgopal. 2005. The economic implications of corporate financial
reporting. Journal of Accounting and Economics 40 共1–3兲: 3–73.
Gramling, A., and D. Hermanson. 2006. What role is your internal audit function playing in corporate
governance? Internal Auditing 6: 37–39.
Gray, G. L. 2004. Exploring the effects of the Sarbanes-Oxley Act on internal auditors. Working paper,
California State University.
Hermanson, D. R. 2002. The growing stature of internal auditing. Internal Auditing 17 共6兲: 43–44.
——–, and L. Rittenberg. 2003. Internal Audit and Organizational Governance. Research Opportunities in
Internal Auditing. Altamonte Springs, FL: Institute of Internal Auditors Research Foundation.
Institute of Internal Auditors 共IIA兲. 2002a. The IIA’s Recommendations to the Conference Committee on H.R.
3703. Altamonte Springs, FL: IIA.
——–. 2002b. Recommendations for Improving Corporate Governance. Altamonte Springs, FL: IIA.
——–. 2003a. The IIA’s Position Statement on Audit Committees. Altamonte Spring, FL: IIA.
——–. 2003b. The IIA’s Commentary Regarding PCAOB Rulemaking Docket No. 008. Altamonte Springs,
FL: IIA.
Jefferson Wells. 2004. The Right Stuff: Seven Key principles for Building an Effective Audit Committee. New
York, NY: Jefferson Wells International.
KPMG. 2008. The Audit Committee Journey: Charting Gains, Gaps, and Oversight Priorities: A Global
View. Albany, NY: Audit Committee Institute–KPMG International.
Krishnan, J. 2005. Audit committee quality and internal control: An empirical analysis. The Accounting
Review 80 共2兲: 649–675.
Lightle, S. S., and C. W. Vallario. 2003. Segregation of duties in ERP. Internal Auditor 共October兲: 27–29.
McHugh, J., and K. Raghunandan. 1994. Internal auditors’ independence and interactions with audit com-
mittees: Challenges of form and substance. Advances in Accounting 12: 313–333.
Pei, B. K., and F. G. Davis. 1989. The implications of organizational structure on internal auditor
organizational-professional role stress: An exploration of linkages. Auditing: A Journal of Practice &
Theory 8 共2兲: 101–115.
PricewaterhouseCoopers LLP 共PwC兲. 2006. Views of Audit Committee Chairmen on the Effectiveness of
Internal Audit. New York, NY: PricewaterhouseCoopers LLP.
Public Company Auditing Oversight Board 共PCAOB兲. 2004. An Audit of Internal Control over Financial
Reporting Performed in Conjunction with an Audit of Financial Statements. Auditing Standard No. 2.
Washington, D.C.: PCAOB.
Public Oversight Board 共POB兲. 2000. Panel on Audit Effectiveness: Report and Recommendations. Stamford,
CT: POB.
Quarles, R. 1994. An examination of promotion opportunities and evaluation criteria as mechanisms for
affecting internal auditor commitment, job satisfaction and turnover intentions. Journal of Managerial
Issues VI 共2兲: 176–194.
Raghunandan, K., D. V. Rama, and P. Scarbrough. 1998. Accounting and auditing knowledge level of
Canadian audit committees: Some empirical evidence. Journal of International Accounting, Auditing
& Taxation 7 共2兲: 181–194.
Ramamoorti, S. 2003. Internal Auditing: History, Evolution, and Prospects. Research Opportunities in In-
ternal Auditing. Altamonte Springs, FL: Institute of Internal Auditors Research Foundation.
Reinstein, A., J. Callaghan, and L. Braiotta, Jr. 1984. Corporate audit committees: Reducing directors’ legal
liabilities. Journal of Urban Law 共Winter兲: 375–389.
Scarbrough, D. P., D. V. Rama, and K. R. Raghunandan. 1998. Audit committee composition and interaction
with internal auditing: Canadian evidence. Accounting Horizons 12 共1兲: 51–62.
Srinivasan, S. 2005. Consequences of financial reporting failures for outside directors: Evidence from re-
statements. Journal of Accounting Research 43 共2兲: 291–334.
U.S. House of Representatives, Committee on Financial Services. 2002. Sarbanes-Oxley Act of 2002. Public
Law No. 107–204. Washington, D.C.: Government Printing Office.
Verschoor, C. 2002. Reflections on the audit committee’s role. The Internal Auditor 2: 26–35.

Accounting Horizons March 2010

American Accounting Association