Internal Controls and the Detection of Management Fraud

TLDR

Auditors must assess fraud risk on every audit, yet GAAS audits often cannot distinguish errors from fraud, and managers can override internal controls, making internal controls increasingly important in fraud risk assessments. The study examines how auditors decide to investigate fraud when managers choose internal control quality and can also influence audit error rates. The model lets managers choose both fraud and an error‑rate‑affecting control quality, extending strategic auditing theory. In 1997, the Auditing Standards Board issued SAS No.

Abstract

The purpose of this paper is to examine an auditor's decision to investigate for fraud, when a manager with exogenous incentives to misreport chooses the quality of internal controls. I extend the strategic auditing literature by allowing the manager both a choice with respect to fraud and a second choice that affects the error rate in the audit population. Consistent with the practitioner literature, I assume managers can commit fraud by overriding internal controls, and that audits conducted in accordance with Generally Accepted Auditing Standards (GAAS) do not always distinguish between errors and fraud. The study is motivated by the increasing importance of internal controls in auditors' fraud risk assessments. In 1997, the Auditing Standards Board issued Statement on Auditing Standards (SAS) No. 82: Consideration of Fraud in a Financial Statement Audit. This standard requires auditors to assess the risk of fraud on every audit and encourages auditors to consider both the internal control system and management's attitude toward controls, when making this assessment.1