Do External Financial Statement Auditors Sufficiently Adjust Their Audit Plans for Automated-Control Deficiencies?

ABSTRACT Shelton (1999) found that experience, based on rank, mitigates the influence of less-than-diagnostic evidence in going concern assessments. But, numerous studies (e.g., Abdolmohammadi and Wright 1987) question the external validity of studies that use rank to determine experience. I suspect that specialized domain experience is a better measure because all auditor ranks do not have procedural knowledge in going concern decisions but many auditors may have procedural knowledge in audit planning (AICPA 2008) and automated controls (Hunton et al. 2004). I investigate whether external financial statement auditors (henceforth auditors) sufficiently adjust their audit plans for material-automated-control-weaknesses. I determine the sufficiency of auditors' audit plan adjustments by comparing their adjustments for material-automated-control-weaknesses to professionals with specialized domain experience in automated-controls, IT audit specialists. Auditors' audit plan adjustments are significantly lower than IT audit specialist when less-than-diagnostic evidence is present. Thus, specialized domain experience mitigates the influence of less-than-diagnostic evidence. Meanwhile, experience based on rank, does not mitigate the influence of less-than-diagnostic evidence. The implication of my study is that consulting with IT audit specialists while revising plans for material-automated-control-weaknesses may improve the likelihood that adequate resources will be allocated to address automated-control weaknesses and reduce the likelihood of audit failure. KEYWORDS: Specialized domain experience, diagnostic evidence, audit planning, IT audit specialists, internal controls, automated controls, IT controls INTRODUCTION Automated-control-deficiencies in computerized hardware or applications have a reasonable possibility of producing material misstatements in the financial statements (AICPA 2008). One example of an automated-control-deficiency is when financial data is transferred between computer applications without automated verification that all data that was intended to be sent is received. When auditors become aware of an automated-control-deficiency they are encouraged to adjust their audit plans so that they can better assess the effectiveness of the internal controls and better assess the effects of the weakness on the financial statements (AICPA 2008; PCAOB 2010; IAASB 2010a; IAASB 2010b; ITGI 2007). In this paper, I investigate whether external financial statement auditors (henceforth, auditors) sufficiently adjust their audit plans for automated-control-deficiencies. I also investigate whether auditors' audit plan adjustments are influenced by less-than-diagnostic evidence.1 Auditors are allowed to adjust their audit plans for material-automated-control-weaknesses without the assistance of IT (information technology) audit specialists (AICPA 2008; PCAOB 2010; IAASB 2010a; IAASB 2010b). However, auditors perform fewer audit procedures for automated-controls than manual-processes (Brazel and Agolia 2007). Thus, auditors do not possess as much specialized domain experience2 in automated-controls as IT audit specialists (Weber 1980) and may (1) discount the relevance of automated-controls in audits (Messier et al. 2004), (2) be overconfident about their ability to examine automated-controls (Hunton et al. 2004), (3) provide significance of deficiency ratings for IT control deficiencies that are influenced by management persuasion techniques, (4) not fully utilize their accounting information system expertise for the extent of audit planning (Brazel and Agolia 2007), and (5) find it more difficult to identify the effects of automated-control weaknesses on the financial statements (Vendryzk and Bagranoff 2003). Thus, auditors' lower specialized domain experience in automated-controls may influence them to provide insufficient audit plan adjustments for automated-control-deficiencies. Moreover, auditors' audit plan adjustments for automated-controls may be insufficient in audit settings where less-than-diagnostic evidence is present. …