Internal Audit Outsourcing and The Risk Of...

Internal Audit Outsourcing and the Risk of Misleading or
Fraudulent Financial Reporting: Did Sarbanes-Oxley Get It

Wrong?*
DOUGLAS F. PRAWITT, Brigham Young University
NATHAN Y. SHARP, Texas A&M University
DAVID A. WOOD, Brigham Young University
1. Introduction
The Sarbanes-Oxley Act of 2002 (SOX) represents a far-reaching legislative attempt to
improve the quality of financial reporting in the United States in response to the major
accounting frauds of the late 1990s and early 2000s (Klein 2003). A significant change
imposed by SOX was to prohibit the outsourcing of internal audit services to firms’ exter-
nal auditors.1 Competing academic arguments suggest that this ban will either improve or
worsen financial reporting quality. The knowledge spillover argument suggests that by
both performing the external audit and providing nonaudit services, auditors improve
overall audit quality through a deeper understanding of the client (e.g., Simunic 1984;
Plitch 2002). The economic bonding argument suggests that overall audit quality is com-
promised when the external auditor provides nonaudit services, essentially because the
external auditor is unwilling to stand up to aggressive or abusive accounting practices for
fear of losing a lucrative client engagement (e.g., Simunic 1984; Moore 2002; Lindberg and
Beck 2004). Given the competing predictions for how outsourcing may affect audit qual-
ity, and thus financial reporting quality, we examine whether outsourcing internal audit
services to the external auditor pre-SOX is associated with higher or lower accounting risk,
where accounting risk is defined as the risk that clients’ financial statements contain mis-
leading or fraudulently reported numbers.
This study is important for several reasons. Prior research examining the relation
between auditor-provided nonaudit services and financial reporting quality generally does
not discriminate among the types of nonaudit services provided and produces mixed
results (e.g., see Beattie and Fearnley 2002; Kinney, Palmrose, and Scholz 2004; DeFond
and Francis 2005; Francis 2006; and Schneider, Church, and Ely 2006 for reviews of this
* Accepted by Jeffrey Pittman. This paper is the recipient of the University of Oklahoma Price College of
Business 2010 Glen McLaughlin Award for the best unpublished research paper on accounting ethics. The
paper has benefitted from the helpful comments and suggestions of the editor, Jeffrey Pittman, two
anonymous reviewers, Urton Anderson, Margaret Christ, Steve Glover, Audrey Gramling, Bill Kinney, Bill
Mayew, Tom Omer, Kenny Reynolds, Jaron Wilde, and workshop participants at the University of Okla-
homa, the Brigham Young University Accounting Research Symposium, the 2009 International Symposium
on Audit Research, and the 2009 AAA Annual Meeting. We express our thanks to Audit Integrity for
granting access to its Accounting Risk data. We also express our thanks to the Institute of Internal Auditors
Research Foundation (IIARF) for financial support and access to company data on conditions of anonym-
ity and confidentiality. Although financially supported by the IIARF, the views expressed in this paper are
those of the authors and do not necessarily represent positions or opinions of the IIARF or The Institute of
Internal Auditors (IIA).
1. For purposes of this paper, we use ‘‘outsourcing’’ to mean contracting any portion of the work of the
internal audit function (IAF) to a third party. Arrangements involving the outsourcing of less than 100
percent of the work of the IAF to a third party are sometimes referred to as ‘‘co-sourcing’’.
Contemporary Accounting Research Vol. 29 No. 4 (Winter 2012) pp. 1109–1136 CAAA
doi:10.1111/j.1911-3846.2012.01141.x
1110 Contemporary Accounting Research
literature). Assessing the impact of a specific type of nonaudit service on audit quality is
important if different nonaudit services have different effects. Our study also provides
insights on the impact of the SOX prohibition on external auditors’ provision of internal
audit services to their clients, and provides evidence concerning whether private companies
may benefit from a similar practice.2 Finally, this study provides insight on how increased
interaction among different parties involved in corporate governance might affect financial
reporting quality.
We use proprietary sources of data relating to internal auditing and accounting risk to
examine whether economic bonding or knowledge spillover best explains the impact of
outsourcing internal audit services to the external auditor. The proprietary internal audit-
ing data set contains descriptive information on the IAFs of publicly traded companies
from fiscal years 2000 through 2002. This archive, called the GAIN database, was col-
lected for benchmarking purposes by the IIA. The IIA database provides a rich set of data
relating to a relatively large sample of IAFs of U.S. firms. The proxy we use for account-
ing risk (AR) is commercially produced by Audit Integrity, LLP, a financial analytics orga-
nization. Audit Integrity uses publicly available accounting information as inputs to a
proprietary model that measures the ‘‘overall risk of potentially fraudulent or misleading’’
financial reporting (Audit Integrity, LLP 2005). Academic research demonstrates that
Audit Integrity’s risk measures are as good as or superior to other academic and commer-
cial measures for predicting accounting restatements, Securities and Exchange Commission
(SEC) enforcement actions, and shareholder lawsuits (Correia 2009; Daines, Gow, and
Larcker 2010; Price, Sharp, and Wood 2011).
Consistent with the knowledge spillover argument, our results indicate that companies
that outsourced at least some portion of their IAF to their Big N external auditor (pre-
SOX) had lower accounting risk than companies that (1) outsourced to other Big N service
providers, (2) outsourced to other non–Big N, third-party service providers, and (3) kept
their IAF entirely in-house. Holding other factors in our model constant, outsourcing to
the external auditor reduces accounting risk by 23 percent relative to firms that kept the
IAF in-house. Further, we find that accounting risk decreases as the percentage of work
outsourced to the external auditor increases. Finally, confirming the results of prior
research (Prawitt, Smith, and Wood 2009) using a different dependent measure, our results
provide evidence that higher quality in-house IAFs are positively associated with account-
ing quality.
Because the hypothesized causal variable in our study (i.e., outsourcing to the external
auditor) is an endogenous choice, we employ a propensity score matching research design
to create a sample of firms that are similar along a comprehensive set of characteristics
that affect the outsourcing decision but differ by whether the firms outsource internal audit
services to their external auditor. In addition, we discuss the results of a sensitivity analysis
that is designed to test whether the inferences from our matched analysis are robust to the
presence of unobserved, confounding variables (Rosenbaum 2002; Rosenbaum 2005;
Armstrong, Jagolinzer, and Larcker 2010).3 In sum, our evidence is consistent with the
knowledge spillover argument, which suggests that knowledge gains achieved when exter-
nal auditors provide internal audit work result in improved overall audit quality.
2. Although Sarbanes-Oxley did not prohibit private companies from outsourcing internal audit work to
their external auditor, some practitioners have advocated against any companies outsourcing internal audit
to their external auditor (see, e.g., http: ⁄ ⁄ www.theiia.org ⁄ recent-iia-news ⁄ ?i=10587).
3. Ultimately, although propensity score matching mitigates the misspecification that occurs when the
research design assumes an incorrect functional form for the relation between the variable of interest and
the outcome variable, we cannot entirely eliminate selection bias due to unobservable factors (see discus-
sion in Armstrong et al. 2010). Therefore, as with other observational studies, the inability to completely
rule out the effects of endogeneity remains a limitation.
CAR Vol. 29 No. 4 (Winter 2012)

Internal Audit Outsourcing: Did Sarbanes-Oxley Get It Wrong? 1111
The remainder of this paper proceeds as follows. In the next section, we discuss the
relevant literature and develop our expectations. In section 3 we discuss methodology, fol-
lowed by a discussion of results in section 4. We conclude in section 5 by discussing impli-
cations of our findings, limitations of our study, and areas for future research.
2. Background and expectations

The next two subsections discuss the relation between (1) nonaudit services and accounting
risk, with a particular emphasis on internal auditing and (2) IAF sourcing characteristics
and accounting risk.
Nonaudit services and accounting risk

Academic researchers have invested significant effort examining the degree to which finan-
cial reporting quality is affected by external auditors’ provision of nonaudit services. Two
competing academic arguments suggest that this prohibition will either compromise or
improve overall audit quality. The economic bonding argument suggests that external
auditors that provide lucrative nonaudit services will be less likely to stand up to a client’s
inappropriate accounting treatments for fear of losing fee revenue associated with nonau-
dit services (e.g., Joe and Vandervelde 2007; Simunic 1984). This argument implies that
companies that use the external auditor to provide other services will have a higher level
of accounting risk than companies that do not engage in this practice. In contrast, the
knowledge spillover argument suggests that external auditor provision of nonaudit ser-
vices, such as internal auditing, results in better overall audit coverage because the external
auditor is able to see more of and learn more about the organization (Simunic 1984). This
argument leads to the inference that companies that hire the external auditor to perform
nonaudit services will have a lower level of accounting risk than companies that do not
engage the external auditor to perform such services.4
Researchers have attempted to distinguish between these competing arguments using
a variety of different dependent variables including discretionary accruals, restatements,
SEC enforcement actions, auditor going-concern opinions, accounting conservatism mea-
sures, and capital markets–related responses (e.g., abnormal returns, bond ratings, cost
of capital, analyst forecast accuracy ⁄ bias, bond yields, etc.). Literature reviews by Beattie
and Fearnley 2002, DeFond and Francis 2005, Francis 2006, and Schneider et al. 2006
and a meta-analysis by Habib 2009 provide detailed discussions of these different stud-
ies. The general conclusion of this research is that ‘‘there is no ‘smoking gun’ evidence
linking the provision of nonaudit services with audit failures’’ (Francis 2006: 747). Or,
in other words, ‘‘there is some scattered evidence of a modest positive association
between some NAS [nonaudit service] fee measures and surrogates for reduced financial
reporting quality. However, existence of the positive association that regulators and leg-
islators presume remains largely undocumented for the post-1999 period’’ (Kinney et al.
2004: 568).
Given the extensive literature on the relation between nonaudit services and financial
reporting quality, a discussion of how this study adds new and additional insights to this
area is appropriate. Consistent with the suggestion of Schneider et al. 2006, we test the
4. Although these are the two dominant arguments, there are two additional arguments that suggest an
increase in nonaudit service fees will be associated with lower accounting risk (see discussion in Kinney et
al. 2004). First, nonaudit services provided by the audit firm may increase the audit firm’s reputation capi-
tal, thereby increasing incentives for the audit firm to conduct thorough and independent audits. Second,
high-quality registrants may seek greater expertise in nonaudit services and may choose their audit firm as
the preferred supplier of nonaudit services because of quality or cost. We discuss these alternatives later in
the paper and attempt to control for these possibilities by including external audit quality variables in our
models.

relation between nonaudit services and financial reporting quality using a specific nonaudit
service: internal audit outsourcing.5 We view internal audit outsourcing as the nonaudit ser-
vice that is most likely to provide knowledge spillover gains, as the work of internal audit-
ing most directly affects financial reporting quality through its effects on risk assessment
(Asare, Davidson, and Gramling 2008; Sarens and De Beelde 2006), safeguarding of assets
(Coram, Ferguson, and Moroney 2008; Beasley, Carcello, Hermanson, and Lapides 2000),
evaluation of reported financial numbers (Prawitt et al. 2009; Gramling, Nuhoglu, and
Wood 2011), strength of internal controls (Lin, Pizzini, and Vargus 2011), improvements in
audit efficiency (Pizzini, Lin, Vargus, and Ziegenfuss 2010), and overall monitoring of the
organization (Committee of Sponsoring Organizations of the Treadway Commission
[COSO] 2004). In addition, external auditors routinely use the work of internal auditors in
performing the external audit, increasing the likelihood of knowledge transfer between
internal and external auditors (SAS No. 65; AS No. 5; Felix, Gramling, and Maletta 2001;
Gramling, Maletta, Schneider, and Church 2004; Prawitt, Sharp, and Wood 2011).
Given the variety of ways in which internal auditing can influence the financial report-
ing process, internal audit outsourcing provides a compelling setting for investigating
knowledge spillover gains. Thus, examining how outsourcing the IAF to the external audi-
tor affects financial reporting quality contributes to the nonaudit service literature by test-
ing a specific service that has significant potential for observing knowledge spillover
effects.
IAF sourcing and accounting risk

The use of external providers as internal auditors has a contentious history within the
internal auditing profession, with proponents of both outsourcing and of keeping the IAF
in-house vehemently arguing the superiority of their respective positions.6 On one hand,
proponents of keeping the IAF in-house contend that outsourced internal auditors do not
understand the business as well as in-house internal auditors, lack commitment to the
company they are auditing, and may not adapt the auditing approach to the client’s situa-
tion — all of which may reduce their ability to detect or deter inappropriate accounting
(Grant Thornton 2007). On the other hand, research has shown that outsourced internal
auditors are perceived to be more objective by external auditors (Glover, Prawitt, and
Wood 2008) and more competent by finance directors (Carey, Subramaniam, and Ching
2006). In addition, outsourced internal auditors believe that they face greater legal liability
than do in-house internal auditors, which may affect their incentives regarding audit issues
that influence the quality of external financial reporting (Ahlawat and Lowe 2004).
A central consideration in the outsourcing decision is the choice of the outsourced ser-
vice provider. Before SOX, public and private companies were permitted to outsource all
or part of the IAF to their external auditor or to another third-party service provider. As
discussed previously, SOX, as a response to the accounting frauds of the late 1990s and
5. Schneider et al. (2006) note that many of the previous studies examining the relation between nonaudit
services and financial reporting quality use broad measures of nonaudit fees to test these relations. These
measures are problematic because they are ‘‘based on the mandated broad and changing services [fee] cate-
gories’’ (Schneider et al. 2006: 199). Schneider et al. argue that measures based on specific nonaudit services
are likely to provide a clearer picture of how individual services are related to financial reporting quality.
6. See Rittenberg and Covaleski 2001 for a discussion of the history of outsourcing in internal audit. The
large accounting firms, the American Institute of Certified Public Accountants (AICPA), the SEC, and the
IIA have all weighed in on the internal audit outsourcing debate; however, little empirical evidence has
been available for policy and decision makers. It should be noted that this study examines only one effect
of outsourcing; other important issues to consider include but are not limited to the cost of the outsourc-
ing arrangement (Anderson, Christ, Johnstone, and Rittenberg 2009) and effects of sourcing on external
auditing fees (Glover, Prawitt, and Wood 2008; Prawitt et al. 2011), organizational performance, recruit-
ment, employee satisfaction, and so on.

early 2000s, prohibited external auditors from providing internal audit services to their
public clients.7
In related research, Kinney et al. (2004) investigate whether nonaudit services, includ-
ing auditor-provided internal audit services, are associated with lower financial reporting
quality pre-SOX.8 Kinney et al. do not find a significant relation between outsourcing the
work of the IAF to the external auditor and restatements; however, the authors note that
the lack of significant results may be due to their small sample size (a total of 42 useable
observations with data about internal auditing). Further, their data did not enable them to
make comparisons between sourcing providers. Similar to Kinney et al. 2004, a strength of
our study is that we are able to use data that is not publicly available to examine the
research question in a ‘‘last chance’’ period before nonaudit services were prohibited. We
extend Kinney et al. 2004 by examining a larger internal audit sample and by incorporat-
ing data concerning IAF sourcing arrangements, allowing us to make comparisons
between outsourcing providers.
As previously discussed, we believe internal audit outsourcing yields high potential for
creating knowledge spillover effects relative to other nonaudit services available to external
auditors pre-SOX. However, because of the possibility that this arrangement creates an
economic bond, which would result in higher accounting risk, we do not take an a priori
position about how outsourcing to the external auditor will be related to accounting risk.
Rather, we investigate empirically whether outsourcing to a third party is associated with
the risk of misleading or fraudulent external financial reporting, controlling for IAF and
overall corporate governance quality.
3. Data and the model specification

Sample and data
To test the relation between internal audit outsourcing and accounting risk, we use a mea-
sure of accounting risk (AR) developed by Audit Integrity, LLP, and a proprietary data
set relating to the IAFs of U.S. companies developed and maintained by the IIA. We
combine data from these two sources with data from the COMPUSTAT, Center for
Research in Security Prices (CRSP), and RiskMetrics databases to test our model. Appli-
cation of our data requirements results in 334 firm-year observations from 159 companies
in 37 different two-digit SIC code industries for the years 2000 through 2002 (see Table 1
for a description of how we arrived at our final sample).9
Audit Integrity, LLP, uses publicly available financial data to estimate the likelihood
that reported financial information includes elements that are misleading or fraudulent.
Audit Integrity’s Web site (accessed December 2009) describes the AR score as ‘‘a forensic
assessment of the risk that financial results are misrepresented in public disclosures’’. It rep-
resents an independent, comprehensive measure of the ‘‘overall risk of potentially fraudu-
lent or misleading’’ financial reporting at public companies. Audit Integrity’s objective is to
‘‘use publicly posted financial data to discriminate between fraudulent and nonfraudulent
7. The external auditor can still provide outsourced internal audit services to private company clients and to
nonaudit clients (see Messier, Glover, and Prawitt 2012).
8. Previous research has examined whether the presence or absence of an internal audit function is associated
with lower incidence of financial statement fraud (Beasley et al. 2000; Coram et al. 2008) or weaknesses in
internal controls (Krishnan 2005). These studies find that companies with an IAF are less likely to experi-
ence — but more likely to detect — fraud. Prior research also suggests that IAF quality is associated with
a mitigation of earnings management (Prawitt et al. 2009). We build on these studies by examining
whether IAF sourcing, while controlling for IAF quality characteristics and overall corporate governance
quality, affects accounting risk.
9 As discussed subsequently, our propensity score matching technique reduces the sample to 327 firm-year
observations.

TABLE 1
Derivation of sample, 2000 to 2002
Description Sample size
Firm-year observations in internal auditing database 3,015

Less observations with no reported data in COMPUSTAT and CRSP (2,368)
Less observations with no AR values (69)
Less observations with missing data items for model estimation (200)
Less observations where IAF reported values are nonsensical (38)
Less observations with a non-Big N external auditor (6)
Firm-years available for final sample 334
Notes:
The final sample of 334 firm-years are from 159 different companies from 37 different two-digit SIC
code industries. Note that the internal auditing database covers a wide range of institutions,
including publicly-traded companies, private companies, educational institutions, divisions
within companies, and educational and governmental institutions.
Nonsensical IAF values include reported average internal audit experience amounts greater than 30
years, percentage of certified internal auditors greater than 100 percent, time spent performing
financial audits greater than 100 percent, and training hours greater than 160 hours.
We removed six firm-year observations relating to firms that were not audited by a Big N auditor.
We did this because the sample contains no firms with non–Big N external auditors, so we
have no basis for comparing firms with non–Big N auditors who do and do not outsource.
Our results are qualitatively similar if we retain the six observations.
companies’’ (Audit Integrity 2005). AR is the output of a proprietary model that evaluates
public companies’ financial reports and independently assesses the risk of misreporting by
identifying suspicious patterns in accounting. Thus, AR is an ex ante estimate of the risk
that companies might be engaging in the types of inappropriate or aggressive financial
reporting SOX was intended to deter.10
Price et al. (2011) provide evidence of the validity of the Audit Integrity measures.
They find that Audit Integrity’s risk measures are as good as or superior to a variety of
academic risk measures for predicting SEC enforcement actions, accounting irregularities
(Hennes, Leone, and Miller 2008), and lawsuits related to accounting malfeasance. In
addition to evidence from Price et al. 2011, Audit Integrity has performed extensive testing
to validate its risk measures.11
The IIA GAIN database is a compilation of survey responses from Chief Audit Exec-
utives (CAEs) associated with IIA member organizations and thus includes a wide range
of institutions (e.g., publicly traded companies, private companies, educational institutions,
subsidiaries and divisions within companies, and governmental institutions). The purpose
10. Market pricing data and data relating to companies’ IAFs are not used in the calculation of Audit Integ-
rity’s risk measure. Audit Integrity also produces an ‘‘Accounting and Governance Risk’’ (AGR) measure,
which incorporates both accounting risk as described in this paper and ‘‘governance risk’’. We do not use
the AGR measure because the IAF is a component of corporate governance (IIA 2005).
11. Test results indicate that Audit Integrity’s risk measure accurately separates low and high-risk firms for
every range of risk with reasonable Type I and Type II error rates. Additionally, out-of-sample testing
indicates that Audit Integrity’s model is not over-fitted and performs well on hold-out samples. Examples
of other academic studies that use Audit Integrity’s risk measures include: Bartov and Hayn 2007; Charles,
Glover, and Sharp 2010; Dyreng, Mayew, and Williams 2010; Xie 2011; and McGuire, Omer, and Sharp
2012.

of the survey is to provide benchmarking data for participating firms. The survey is
approximately 30 pages long and covers various aspects of internal audit practice. The sur-
vey has changed slightly from year to year; however, all of the questions included in this
study were unchanged from 2000 to 2002.
The IIA does not reveal company identity. Thus, we perform a match of several self-
reported fields in the survey with data items in COMPUSTAT in order to include appro-
priate control variables in our study. We matched on self-reported total assets, total reve-
nues, and operating industry to identify firms. We include all firms for which we are able
to match identically in a particular year and then use the unique identifier in the IIA data
to identify subsequent or previous firm-year responses.12
Accounting risk model specification

As mentioned previously, we employ propensity score matching to test our research ques-
tion. Propensity score matching is a method of matching treatment firms with other firms
along multiple characteristics to control for observable confounding variables in cases
where the hypothesized causal variable is an endogenous choice. Advantages of propensity
score matching include that it does not assume a linear or other specific functional form in
estimating the treatment effects and it induces maximum variation in the causal variable
of interest while minimizing variation in the control variables (Armstrong et al. 2010). We
estimate the following logistic regression model to obtain the propensity scores:
OutsrcEA ¼ b0 þ b1 IndOutsrcEA þ b2 IAQuality þ b3 AuditSpecialist þ b4 IASize

þ b5 AuditFees þ b6 Assets þ b7 Leverage þ b8 Complexity þ b9 AuditTenure
þ b10 NAFees þ b11 TimeEA þ b12 Gindex þ b13 ACExpert þ b14 AC%Ind
þ b15 ACSize þ b1620 IndustryDummies þ b2122 YearDummies þ e ð1Þ:
(See the Appendix for variable descriptions.)

In estimating the propensity score matching model, it is standard practice to employ
all the covariates that determine the outcome model (Brookhart et al. 2006). Thus, we
model the choice to outsource to the external auditor as a function of five primary factors:
the use of this arrangement by industry peers, the quality of the internal auditors and the
external audit outsourcing partner, the costs associated with the outsourcing decision, rela-
tionships that have developed between the company and the external auditor, and whether
the significant corporate governance players in the organization will allow the opportunity
for this arrangement.13
In relation to the use of outsourcing arrangements by industry peers, we include the
measure IndOutsrcEA.14 Internal auditors often benchmark their performance based on
industry peers; thus, if industry peers are outsourcing to the external auditor, we posit that
a company will be more likely to outsource to its external auditor as well. We expect to
observe a positive coefficient on IndOutsrcEA.
In relation to the quality of internal and external auditors, we include two variables:
IAQuality and AuditSpecialist.15 IAQuality is a composite measure of internal audit quality
12. The IIA granted permission to use the matching procedure explained in the paper to enable us to include
appropriate control variables. As reported in Prawitt et al. 2009, this matching procedure is highly effec-
tive in correctly identifying firms in the database.
13. We note that if we include all other variables from (2) (discussed subsequently) in this model, our infer-
ences do not change.
14. We lose seven observations from this data requirement because these seven observations have three or
fewer firms in their respective industries.
15. IAQuality is a measure of the quality of in-house internal auditors as opposed to outsourced internal
auditors.

introduced to the literature by Prawitt et al. 2009. To form the measure, we dichotomize
several measures of quality that are prescribed by external auditing standards (SAS No.
65, AS No. 5; Public Company Accounting Oversight Board 2007) by assigning a value of
one to the variable if it is above the median of our sample for that variable and zero if it
is below the sample median.16 We then sum these measures to create IAQuality, a compos-
ite measure of internal audit quality with a potential range of zero to six. A larger IAQual-
ity score indicates a higher quality IAF. If an IAF is low quality or lacks specific skills,
they may seek to obtain those skills from a third-party provider, which suggests a negative
coefficient on IAQuality. However, it may be that companies with strong IAFs are more
apt to realize when they need additional skills and will thus be more likely to seek an out-
sourcing arrangement, which would suggest a positive coefficient on IAQuality. Therefore,
we do not make a directional prediction for the IAQuality measure. AuditorSpecialist is a
dichotomous variable that indicates whether or not the external auditor is an industry spe-
cialist auditor. We define industry specialist auditor in a similar fashion to Mayhew and
Wilkins 2003 and Knechel, Naiker, and Pacheco 2007: an external audit firm is considered
the industry specialist (AuditorSpecialist = 1) if the firm provides 30 percent or more of
the within-industry market share. If the external auditor is a specialist in the industry in
which the company operates, the IAF may be more likely to use the external auditor as its
outsourcing partner. Therefore, we expect to observe a positive coefficient on AuditSpecial-
ist.
In relation to costs, one commonly stated reason for outsourcing is to achieve cost
savings (Rittenberg and Covaleski 1997). We include five variables to model outsourcing
to the external auditor as a cost savings: IASize, AuditFees, Assets, Leverage, and Com-
plexity. The larger the IAF, the greater the chance for realizing cost savings by outsourc-
ing; thus, we expect to observe a positive coefficient on IASize. External auditors may
lower their external audit fee in order to attract clients for more lucrative consulting and
nonaudit activities. Thus, we include AuditFees and expect to observe a negative coefficient
on this variable. Large companies should have large IAFs that could benefit to a greater
extent from outsourcing, which would result in a positive coefficient on Assets. Companies
that could violate debt covenants can experience significant pressure to find cost savings
and therefore may be more likely to outsource; we thus expect to observe a positive coeffi-
cient on Leverage. Finally, the more complex a company, the more cost savings that might
be achieved by outsourcing to a third party provider. We therefore include Complexity
and expect to observe a positive coefficient on this variable.
With respect to relationships, a company may be more likely to outsource to its external
auditor if it has developed a strong relationship with the external auditor in the past. This
may occur if the external auditor has had significant tenure with the client; we thus include
AuditTenure and expect to observe a positive coefficient on this variable. If the external
auditor provides significant nonaudit services other than internal auditing, the company
and external auditor may develop a stronger relationship and therefore the company may
be more likely to select the external auditor to provide internal audit services. We therefore
include NAFees and expect to observe a positive coefficient on this variable. Finally, if inter-
nal and external auditors coordinate their audit plans, we would expect a closer working
relationship and thus the external auditors would more likely be selected to provide internal
auditing services. Thus, we expect to observe a positive coefficient on TimeEA.
16. Similar to Prawitt et al. 2009, we exclude 38 observations with internal auditing data points that we
deemed as nonsensical. Nonsensical IAF values include reported average internal audit experience
amounts greater than 30 years or equal to 0 years, percentage of certified internal auditors greater than
100 percent, time spent performing financial audits greater than 100 percent, and training hours greater
than 160 hours.

In relation to opportunity, some important corporate governance players outside of

internal auditing may have preferences regarding outsourcing to the external auditor. We
therefore include four variables that proxy for management power and audit committee
quality. To proxy for management’s role in corporate governance, we include Gompers,
Ishii, and Metrick’s 2003 corporate governance measure Gindex. Gindex is formed by
giving an organization a point for each takeover defense or lack of shareholder rights for
24 different provisions. Higher Gindex scores suggest that management has greater relative
power, which suggests lower corporate governance quality. Following Krishnan 2005, we
measure audit committee quality using size (ACSize), independence (AC%Ind), and exper-
tise (ACExpert). We do not make directional predictions for these variables, as it is
unclear, ex ante, how indicators of stronger corporate governance will be related to the
choice to outsource to the external auditor.
From the logistic regression presented in (1), we obtain a propensity score for each
firm-year that represents the likelihood that companies outsource the work of the IAF to
the external auditor. We then match (without replacement) each observation that outsour-
ced the work of the IAF to the external auditor to the firm with the closest propensity
score that did not outsource to the external auditor. To ensure we obtain close matches,
we require the propensity scores of the treatment and match firms to be within 0.05 of
each other.17 After matching, we perform a univariate comparison of the firms in our
OutsrcEA = 1 and OutsrcEA = 0 samples to demonstrate that we achieve covariate bal-
ance. Covariate balance is achieved if both the treatment and control groups are similar
along the observable dimensions in (1). If propensity score matching effectively matches
firms based on all the characteristics included in the model, we should not need to control
for covariates to test our research question. However, in order to provide a comparison of
the effect size of OutsrcEA with the effect sizes of other variables that affect accounting
risk, we report the results of both univariate and multivariate tests using our matched
sample. The multivariate regression model is presented below:
AR ¼ b0 þ b1 IAQuality þ b2 OutsrcEA þ b3 OutsrcBigN þ b4 OutsrcOther þ b5 ACExpert

þ b6 AC%Ind þ b7 ACSize þ b8 AuditSpecialist þ b9 NAFees þ b10 Gindex þ b11 Assets
þ b12 Leverage þ b13 Complexity þ b14 Loss þ b15 Return þ b16 CFO þ b17 SalesGrowth
þ b18 MB þ b19 Age þ b20 FinRaised þ b21 FinNeed þ b22 NYSE
þ b2328 IndustryDummies þ b2930 YearDummies þ e ð2Þ:
(See the Appendix for variable descriptions.)
Independent variables
In (2), we obtain separate coefficient estimates for each type of outsourced internal audit
service provider, using the indicator variables OutsrcEA (Big N audit firm that is the cli-
ent’s external auditor), OutsrcBigN (Big N audit firm that is not the client’s external audi-
tor), and OutsrcOther (service provider that is neither a Big N firm nor the client’s external
auditor).18 As depicted in Figure 1, panel A, we analyze the service providers separately to
17. Our inferences remain the same if we allow the propensity scores to differ by 0.10 or 0.15.
18. The variables OutsrcEA, OutsrcBigN, OutsrcOther, correspond to 49, 66, and 62 unique firms, respectively. A
company may choose to outsource internal audit work to both the external auditor and another third
party. In this case, OutsrcEA will equal one and either OutsrcBigN or OutsrcOther will equal one. If we
exclude the firm-years where a company outsourced to more than one provider, or if we combine the
OutsrcBigN and OutsrcOther categories, our results are qualitatively similar to those reported in all
instances.

Figure 1 Depiction of predictions for differences in accounting risk (AR) for different outsourcing
arrangements
Panel A: Predictions for differences in accounting risk (AR) for different outsourcing arrangements
OutsrcEA OutsrcBigN OutsrcOther
Knowledge Spillover if
OutsrcBigN OutsrcBigN > OutsrcEA
(No Potential Quality Contamination)
Knowledge Spillover if AR Comparison:
OutsrcOther OutsrcOther > OutsrcEA OutsrcOther vs.
(Potential Quality contamination) OutsrcBigN
Knowledge Spillover if
AR Comparison: In- AR Comparison: In-
In-house In-house > OutsrcEA
house vs. OutsrcBigN house vs. OutsrcOther
(Potential Quality contamination)
Notes:
The OutsrcBigN x OutsrcEA cell offers the cleanest test of whether external auditors that provide internal audit
services to clients benefit from knowledge spillover effects versus whether negative effects from economic
bonding are manifest, because quality of service provider is held constant (i.e., all are Big N providers).
The OutsrcEA vs. OutsrcOther and OutsrcEA vs. In-house comparisons are also relevant but may suffer from
quality contamination effects relating to possible differences in quality of service providers.
The OutsrcOther x OutsrcBigN, In-house vs. OutsrcBigN, and In-house vs. OutsrcOther cells offer an overall test
of differences in accounting risk between internal auditing service providers. To the extent these pairs
are not significantly different, this suggests similar levels of performance between these different
sourcing arrangements.
Panel B: Results for differences in accounting risk (AR) for different outsourcing arrangements
OutsrcEA OutsrcBigN OutsrcOther
OutsrcBigN OutsrcBigN > OutsrcEA
OutsrcOther OutsrcOther > OutsrcEA NS
In-house In-house > OutsrcEA In-house < OutsrcBigN In-house < OutsrcOther
Notes:
If equation is written out in a cell, this indicates that there is a significant difference (p-value < 0.05) between
variables in a multivariate test (see Table 3). If “NS” is listed, this indicates there is not a significant
difference between variables.
better control for quality differences among them and to examine whether the results are
more consistent with knowledge spillover or economic bonding. Although prior research
has not distinguished among different internal audit service providers, this distinction is
important if quality differences are present.
To test for differences in knowledge spillover versus economic bonding, we examine
how accounting risk at firms outsourcing to the external auditor (OutsrcEA) compares with
accounting risk at firms with other sourcing arrangements. The cleanest possible test of
whether outsourcing to a third party creates knowledge spillover versus economic bonding
effects is to determine whether accounting risk is different for companies that outsource to

a Big N external auditor (OutsrcEA) as compared to companies that outsource to another

Big N service provider that is not the external auditor (OutsrcBigN). Note that this compar-
ison is made within only Big N outsourced providers. This makes the comparison particu-
larly powerful because it holds constant both provider quality and the decision to
outsource internal audit work to a Big N service provider. Thus, any differences between
the groups should be attributable to differences in whether the service provider is also the
company’s external auditor rather than outsource provider quality or the company’s deci-
sion to outsource (i.e., endogeneity that relates to simultaneity). Comparing within compa-
nies that choose to outsource to a Big N service provider holds the quality of the service
provider constant so that the only difference between these two groups is whether they
outsourced to their external auditor.
Comparing accounting risk between outsourcing to a Big N external auditor
(OutsrcEA) and outsourcing to a third party other than a Big N provider (OutsrcOther) or
between OutsrcEA and keeping the IAF in-house (In-house) may not provide as clean a test
of knowledge spillover versus bonding effects because there may be differences in the qual-
ity of internal auditing among these three types of providers. However, if there are no
overall differences in accounting risk among these three types of providers (OutsrcBigN,
OutsrcOther, and In-house), then comparisons between OutsrcEA and each of these other
three types of service providers provides additional evidence concerning the knowledge
spillover hypothesis.
Additional variables
To facilitate comparing the effect size of OutsrcEA with other variables that determine
accounting risk, we include the covariates from (1) as well as additional variables likely
to influence accounting risk in (2). In the event that some of the covariates affect
accounting risk directly (i.e., other than through their effects on the outsourcing deci-
sion), we may observe significant coefficient estimates on these variables. We also
include Loss and Return in our model because we expect that if a company is perform-
ing poorly, management will have greater pressure to misreport or record accounting
transactions aggressively. Loss is a dichotomous variable representing whether the
company reported a net loss in the previous fiscal year. Return is the annualized buy-
and-hold stock return of the firm’s stock over the previous year. We expect a positive
coefficient on Loss and a negative coefficient on Return. Following Dechow, Sloan, and
Sweeney 1996 we include CFO (cash flows from operations); following Menon and
Williams 2004 we include SalesGrowth; and following Matsumoto 2002 we include MB
(market-to-book ratio) to control for growth. Consistent with these prior papers, we
expect to observe negative coefficients on CFO and MB and a positive coefficient on
SalesGrowth. Beneish (1997) also showed that younger firms are more likely to have
accounting problems; thus, we include Age and expect to observe a negative coefficient
on this variable.
Following Richardson, Tuna, and Wu 2003 and Romanus, Maher, and Fleming 2008,
the variables FinRaised and FinNeed measure the amount of capital a company raised dur-
ing the previous year and the expected need they will have to raise financing in the future,
respectively. Richardson et al. (2003) argue that companies have greater incentive to
engage in earnings management or manipulation if they have sought or are seeking financ-
ing from the capital markets; thus, we expect to observe a positive coefficient on each vari-
able. We include an indicator variable for NYSE because the NYSE enacted rules
requiring firms to have an IAF shortly after our sample period. Although this regulation
was not in effect during our sample period, it was proposed during our sample period,
which may have led to systematic differences in the IAFs of firms listed on the NYSE in
our sample. We make no directional predictions related to NYSE.

We control for industry by including six industry dummy variables (controlling for
industry at the one-digit SIC code level).19 We make no explicit ex ante prediction about
whether the risk of fraudulent or inappropriate accounting transactions differs by industry
and thus for parsimony we do not tabulate results for these variables. Finally, because we
are using a relatively short time window, we use year fixed effects in our model and report
results clustered by firm but not by time.20
4. Test results
Descriptive results
Table 2 presents descriptive statistics of the variables used to compute IAQuality (panel A)
and the variables included in our other models (panel B). These descriptive statistics sug-
gest our sample contains significant variation in terms of IAF quality and outsourcing
arrangements. The descriptive statistics also suggest that nearly our entire sample comes
from NYSE-listed firms; thus, the generalizability of our results may be limited to firms
listed on this exchange. We discuss this issue in greater detail later in the paper. We note
that panel B reveals there are significant differences across the OutsrcEA = 1 and OutsrcEA
= 0 samples for the following variables from (1): IAQuality, AuditSpecialist, NAFees, and
Leverage. This provides evidence supporting the use of propensity score matching to
remove variation across the samples caused by differences in these variables.
Panel C presents Spearman and Pearson correlations for the variables included in the
model. Of the simple correlations, AR is negatively related to OutsrcEA (p-value < 0.10)
and is not related to OutsrcBigN or OutsrcOther (p-values > 0.10). Given that OutsrcEA and
OutsrcBigN are both performed by Big N auditors, this preliminary evidence is more consis-
tent with knowledge spillover than with economic bonding. It is also noteworthy that AR
is negatively related to IAQuality (p-value < 0.10).
Modeling the choice to outsource to the external auditor

Table 3, panel A, presents the results of (1), which models a firm’s choice to outsource the
work of the IAF to the external auditor. In this model, IndOutsrcEA, AuditSpecialist,
IASize, Leverage, Complexity, AuditTenure, and NAFees are all statistically significant
(p-values < 0.10). With the exception of Complexity, each variable is significant in the
direction we predicted. Complexity is significantly negative, suggesting that companies that
have more operating units are less likely to outsource to their external auditor. The results
of this model suggest that without matching firms along these characteristics, our infer-
ences regarding the effects of OutsrcEA could be confounded by the covariates that explain
OutsrcEA.
Using the predicted probabilities from (1), a nearest neighbor propensity matching
procedure identifies 72 firm year observations in the OutsrcEA = 1 sample that have
matching firms in the control sample with a difference in propensity scores no larger than
5 percent. To provide evidence on covariate balance, panel B of Table 3 provides univari-
ate evidence comparing the matched firms that either outsource the IAF to the external
auditor or do not outsource the IAF to the external auditor. The results suggest our
matching procedure was effective at producing covariate balance. Specifically, we find no
significant differences in the means or medians of any of the covariates after performing
the propensity score matching.
19. We use one-digit SIC in view of the relatively limited amount of data available for use in our tests. How-
ever, if we include dichotomous variables for each two-digit SIC included in the sample, the results are
qualitatively similar to those reported for all analyses.
20. We note that if we cluster standard errors by both firm and year (CL-2) (see Peterson 2009 and Gow,
Ormazabal, and Taylor 2010), our results are qualitatively similar to those reported.

TABLE 2
Descriptive statistics and correlations between variables
Panel A: Descriptive statistics of internal audit characteristics
Variable Mean Std. Dev Min P25 Median P75 Max
IAQuality 2.54 1.15 0 2 3 3 5

Experience 6.40 4.33 1 3 5 8 28
Certification 0.59 0.32 0 0.40 0.55 0.73 2
Training 59.5 26.9 0 40 60 80 160
CAEAC 0.60 0.49 0 0 1 1 1
TimeFin 33.57 21.78 0 15 39 50 80
IASize 0.65 1.44 )0.79 )0.19 0.27 0.96 9.71
Panel B: Descriptive statistics of variables included in our sample
OutsrcEA = 1 (n = 82) OutsrcEA = 0 (n = 252)
Variable Mean Median Mean Median t-stat z-stat
AR 44.38 42.25 49.53 48.00 1.97** 1.79*

IAQuality 2.82 3.00 2.45 2.00 )2.52** )2.27**
OutsrcBigN 0.44 0.00 0.29 0.00 )2.52** )2.50**
OutsrcOther 0.37 0.00 0.31 0.00 )1.01 )1.01
ACExpert 0.91 1.00 0.91 1.00 )0.05 )0.05
AC%Ind 0.90 1.00 0.91 1.00 0.58 0.85
ACSize 4.49 4.00 4.30 4.00 )1.12 )1.38
AuditSpecialist 0.59 1.00 0.43 0.00 )2.42** )2.40**
NAFees (log) 14.96 15.06 14.42 14.68 )2.01** )2.47**
Gindex 9.82 10.00 9.98 10.00 0.53 0.81
Assets (log) 9.10 9.19 9.03 9.14 )0.48 )0.01
Internal Audit Outsourcing: Did Sarbanes-Oxley Get It Wrong?
Leverage 0.53 0.53 0.49 0.49 )2.82*** )2.56**

Complexity 3.30 3.00 3.77 4.00 1.69* 1.43

1121
(The table is continued on the next page.)

TABLE 2 (Continued)
1122
Loss 0.17 0.00 0.19 0.00 0.40 0.40

Return 0.06 )0.02 0.01 )0.04 )0.86 )1.16
CFO 1,483 810 1,859 761 1.14 )0.87
SalesGrowth 0.13 0.03 0.07 0.02 )0.89 )0.27
MB 2.51 2.06 2.83 1.91 0.61 )0.61
Age 43.45 51.50 43.62 51.00 0.10 )0.89

FinRaised 0.33 0.33 0.40 0.33 1.49 0.17
FinNeed 0.01 0.00 0.01 0.00 )0.02 )0.02
NYSE 0.95 1.00 0.92 1.00 )1.04 )0.93
Panel C: Spearman and Pearson correlations (below ⁄ above the diagonal, respectively)
Contemporary Accounting Research
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
1-AR )0.10 )0.11 0.10 0.03 0.00 )0.03 )0.09 )0.03 0.09 )0.05 0.19 0.12 0.06 0.16 )0.18 0.15 0.01 )0.03 )0.12 )0.08 0.13 )0.16
2-IAQuality )0.10 0.14 0.01 0.16 )0.05 0.09 0.08 0.03 0.00 )0.02 )0.14 0.07 0.10 0.00 0.06 )0.14 0.15 )0.01 0.14 0.03 )0.15 0.12
3- OutsrcEA )0.10 0.12 0.14 0.06 0.00 )0.03 0.06 0.13 0.10 )0.03 0.02 0.14 )0.09 )0.02 0.05 )0.05 0.06 )0.04 )0.01 )0.05 0.00 0.05
4-OutsrcBigN 0.09 0.00 0.14 0.17 0.06 0.15 0.01 0.00 0.03 0.17 0.05 0.02 )0.09 )0.02 )0.05 0.02 0.01 )0.04 )0.08 )0.07 0.04 )0.05
5-OutsrcOther 0.03 0.17 0.06 0.17 0.12 0.08 )0.07 )0.02 )0.09 0.00 )0.02 )0.02 )0.04 )0.08 0.10 )0.05 0.12 )0.08 0.11 0.05 )0.08 )0.01
6-ACExpert )0.02 )0.04 0.00 0.06 0.12 0.07 )0.02 0.06 )0.05 )0.03 0.02 )0.06 )0.02 0.07 0.00 0.02 )0.04 )0.06 0.05 0.03 0.03 0.00
7-AC%Ind )0.02 0.08 )0.05 0.15 0.06 0.05 )0.01 0.03 )0.05 0.05 )0.03 0.05 0.20 )0.02 )0.07 )0.10 )0.04 )0.10 0.16 0.08 )0.11 0.23
8-ACSize )0.10 0.10 0.08 0.01 )0.05 )0.03 0.00 0.13 0.04 0.22 0.21 0.04 )0.05 )0.09 )0.03 0.20 )0.01 )0.02 0.19 )0.04 )0.05 0.23
9-AuditSpecialist )0.02 0.04 0.13 0.00 )0.02 0.06 0.04 0.17 0.08 )0.09 0.09 0.08 0.08 )0.03 )0.03 )0.11 )0.06 0.00 0.05 )0.07 0.01 0.17
10-NAFees 0.13 )0.08 0.14 0.02 )0.16 )0.02 )0.02 0.05 0.09 )0.14 0.47 )0.01 0.01 )0.06 )0.06 0.26 0.03 0.17 0.02 )0.08 )0.07 )0.02
11-Gindex )0.06 0.00 )0.04 0.16 0.02 )0.03 0.07 0.16 )0.08 )0.12 )0.07 0.00 0.07 )0.09 )0.03 )0.05 )0.03 )0.01 0.15 0.06 )0.06 0.13
12-Assets 0.17 )0.14 0.00 0.05 )0.03 0.03 )0.04 0.18 0.09 0.60 )0.12 0.03 0.05 0.04 )0.15 0.61 0.03 0.11 0.14 )0.13 0.08 0.06
13-Leverage 0.11 0.09 0.14 0.00 0.01 )0.03 0.06 0.02 0.08 0.08 )0.01 0.04 )0.06 0.02 )0.02 )0.19 0.05 )0.13 0.02 0.14 0.20 0.22
(The table is continued on the next page.)

TABLE 2 (Continued)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
14-Complexity 0.07 0.13 )0.08 )0.05 )0.03 )0.02 0.22 )0.01 0.06 0.08 0.11 0.02 )0.02 0.12 )0.08 )0.07 )0.02 0.04 0.22 0.02 )0.07 0.13
15-Loss 0.15 0.00 )0.02 )0.02 )0.08 0.07 0.00 )0.09 )0.03 0.04 )0.10 0.05 0.01 0.12 )0.17 )0.14 )0.16 )0.07 )0.18 )0.06 0.16 )0.17
16-Return )0.19 0.13 0.06 )0.05 0.10 )0.03 )0.08 0.05 0.02 )0.12 0.00 )0.10 0.01 )0.02 )0.19 )0.08 0.08 0.08 )0.04 0.04 )0.13 0.00
17-CFO 0.07 )0.18 0.05 0.05 )0.02 0.02 )0.07 0.21 0.05 0.53 )0.06 0.81 )0.03 )0.03 )0.11 0.00 0.03 0.22 )0.02 )0.10 )0.02 )0.10
18-SalesGrowth )0.07 0.05 0.01 )0.08 0.07 )0.10 )0.11 )0.05 )0.21 )0.02 )0.06 )0.02 0.01 )0.08 )0.22 0.19 )0.01 0.01 0.02 0.01 0.03 )0.02
19-MB )0.02 )0.16 0.03 0.02 )0.19 )0.07 )0.08 0.02 )0.08 0.32 0.04 0.13 )0.01 )0.06 )0.16 0.20 0.32 0.14 0.00 )0.10 )0.01 )0.11
20-Age )0.10 0.03 )0.05 )0.01 0.11 0.16 0.15 0.22 0.16 )0.08 0.16 0.09 0.09 0.19 )0.11 )0.06 0.06 )0.24 )0.13 0.07 )0.20 0.36
21-FinRaised 0.00 0.06 )0.01 )0.03 0.07 0.00 0.06 0.03 0.06 )0.20 0.08 )0.02 0.41 )0.02 )0.04 0.00 )0.06 0.11 )0.24 0.09 )0.05 0.10
22-FinNeed 0.11 )0.14 0.00 0.04 )0.08 0.03 )0.08 )0.05 0.01 0.09 )0.07 0.10 0.12 )0.07 0.16 )0.16 0.02 0.03 0.01 )0.16 )0.10 )0.29
23-NYSE )0.16 0.13 0.05 )0.05 )0.01 0.00 0.19 0.26 0.17 0.01 0.13 0.03 0.18 0.13 )0.17 0.08 0.03 )0.08 )0.14 0.33 0.22 )0.29
Notes:
Italics – p-value £ 0.10; Bold – p-value £ 0.05 (all p-values in this table are two-tailed)
See the Appendix for variable descriptions. In panel B, OutsrcEA (OutsrcBigN) [OutsrcOther] corresponds to 49 (66) [62] unique firms.
Internal Audit Outsourcing: Did Sarbanes-Oxley Get It Wrong?

1123
TABLE 3
Predicting choice to outsource internal audit services to the external auditor
Panel A: Logistic regression model to obtain propensity scores
Variable Hypothesized sign b v2
Intercept )⁄+ )7.166 7.53***

IndOutsrcEA + 9.863 7.74***
IAQuality )⁄+ 0.158 1.40
AuditSpecialist + 0.468 2.33*
IASize + 0.264 4.22**
AuditFees ) )0.252 1.10
Assets + 0.163 0.55
Leverage + 2.189 4.12**
Complexity + )0.181 5.97**
AuditTenure + 0.084 2.40*
NAFees + 0.214 1.86*
TimeEA + )0.023 0.67
Gindex )⁄+ 0.019 0.09
ACExpert )⁄+ 0.424 0.58
AC%Ind )⁄+ )0.84 0.80
ACSize )⁄+ 0.089 0.57
Industry fixed effects Included
Year fixed effects Included
N 327
Pseudo R2 0.236
Panel B: Covariate balance between the matched pairs
IndOutsrcEA 0.27 0.29 0.26 0.29 )1.39 )1.39

IAQuality 2.88 3.00 2.69 3.00 )0.90 )0.78
AuditSpecialist 0.56 1.00 0.54 1.00 )0.17 )0.16
IASize 0.84 0.59 0.64 0.28 )0.78 )1.35
AuditFees (log) 14.32 14.32 14.32 14.6 )0.00 )0.43
Assets 9.12 9.22 9.24 9.49 0.56 0.99
Leverage 0.52 0.53 0.51 0.53 )0.47 )0.06
Complexity 3.5 3.00 3.10 3.00 )1.28 )1.20
AuditTenure 8.33 10.00 8.29 10.00 )0.10 )0.35
NAFees (log) 14.96 15.08 14.74 14.99 )0.60 )0.84
TimeEA 4.63 2.00 3.96 2.00 )0.75 )0.57
Gindex 9.78 10.00 10.06 10.00 0.68 0.73
ACExpert 0.92 1.00 0.94 1.00 0.65 0.65
AC%Ind 0.91 1.00 0.91 1.00 )0.23 )0.23
ACSize 4.56 4.00 4.60 4.00 0.18 )0.06
Notes:
***, **, * indicate statistical significance at the p-value £ 0.01, 0.05, and 0.10 levels respectively. p-values
represent one-tailed tests when a specific direction is predicted and the sign of the coefficient is consistent
with that prediction. 327 firm-year observations are used in this analysis (see Table 1 for more informa-
tion). Seven observations from Table 1 are not included because of the inability to estimate IndOutsrcEA.
See the Appendix for variable descriptions.

Internal audit sourcing and accounting risk

Table 4 presents the results of testing the association between AR and outsourcing internal
audit services to the external auditor. In panel A, we present mean and median tests for
AR for the 144 firm-year observations in our propensity-score matched sample. We find
both the mean and median values of AR are lower in the OutsrcEA = 1 condition (p-value
< 0.05 and p-value < 0.10, respectively). Consistent with the knowledge spillover argu-
ment, this univariate evidence suggests companies that outsource to the external auditor
have significantly lower accounting risk.
In Table 4, panel B, we regress AR on indicator variables that represent the specific
IAF sourcing arrangement and other variables discussed previously. A multivariate analy-
sis allows us to compare the effects of outsourcing to different providers and to compare
the size of the effect of outsourcing internal audit services to different providers on
accounting risk, relative to other covariates. First, with respect to testing whether our
results are more consistent with knowledge spillover or economic bonding, the coefficient
estimate for OutsrcEA is significantly lower than for OutsrcBigN, indicating accounting risk
is significantly lower when internal audit work is outsourced to the external audit provider
(p-value < 0.01). This result is consistent with the knowledge spillover argument. Also
consistent with knowledge spillover, we find that accounting risk is significantly lower for
OutsrcEA than for OutsrcOther (p-value < 0.01). Finally, the coefficient estimate on Outs-
rcEA provides evidence of lower accounting risk when internal audit work is outsourced to
the external auditor versus keeping the IAF entirely in house (p-value < 0.01). This result
provides further evidence consistent with knowledge spillover.
With respect to tests for differences in accounting risk across providers that are not
the external auditor, we find that OutsrcBigN is positively related to AR (p-value < 0.10),
but the coefficients on OutsrcBigN and OutsrcOther are not significantly different from each
other (p-value > 0.10). These results suggest that in terms of accounting risk, outsourcing
internal audit work to a Big N accounting firm that is not the external auditor results in
more accounting risk than keeping the IAF entirely in-house; however, accounting risk
does not differ among firms that outsource internal audit work to a Big N or non–Big N
accounting firm that is not the external auditor.
In terms of practical significance, relative to keeping the IAF entirely in-house, out-
sourcing to the external auditor reduces accounting risk by 23.0 percent. For comparison,
the results of our regression suggest that having an audit committee comprised entirely of
members who have financial expertise (ACExpert) lowers accounting risk by 33.4 percent
and reporting a loss in the previous fiscal period increases accounting risk by 22.6 percent.
Overall, these results provide evidence consistent with the idea that knowledge spillover
gains are achieved when the external auditor also performs internal auditing services.
In addition to the results we report for OutsrcEA above, ACExpert, Loss, ACSize,
Leverage, Complexity, and CFO are all significant in the directions predicted (all p-values
< 0.10). The coefficient on IAQuality is negative and moderately significant (p-value <
0.10). Prawitt et al. (2009) find that internal audit quality is negatively associated with
earnings management, measured using abnormal accruals. Our finding confirms and
extends that of Prawitt et al. 2009 by showing that high quality IAFs also reduce account-
ing manipulation as measured by AR.
Additional analyses
As discussed previously, we conduct a sensitivity analysis based on Rosenbaum 2002 and
Rosenbaum 2005 to assess whether the inferences from our matching analysis are robust
to the possible presence of unobserved, confounding variables (see also Armstrong et al.
2010 for an example of this technique in an accounting setting). Although interpreting

TABLE 4
The association between outsourcing internal audit services and accounting risk
Panel A: Univariate tests using propensity-matched samples
AR 38.09 42.10 46.53 49.40 2.10** 1.77*
Panel B: Multivariate tests of relation between outsourcing measures and accounting risk
Variable Hypothesized sign b t-value
Intercept )⁄+ 4.008 6.03***

IAQuality ) )0.070 )1.75*
OutsrcEA )⁄+ )0.262 )2.93***
OutsrcBigN )⁄+ 0.174 1.68*
OutsrcOther )⁄+ 0.125 1.14
ACExpert ) )0.406 )2.12**
AC%Ind ) )0.056 )0.17
ACSize ) )0.057 )1.47*
AuditSpecialist ) )0.085 )0.84
NAFees )⁄+ 0.040 1.53
Gindex + )0.006 )0.29
Assets + )0.034 )0.56
Leverage + 1.369 2.97***
Complexity + 0.057 2.22**
Loss + 0.204 1.38*
Return ) )0.119 )1.18
CFO ) 0.000 1.94*
SalesGrowth + 0.032 0.37
MB ) )0.002 )0.52
Age ) )0.005 )1.30
FinRaised + )0.417 )1.63
FinNeed + )0.572 )1.18
NYSE )⁄+ )0.195 )0.77
Industry fixed effects Included
Year fixed effects Included
N 144
Adjusted R2 0.247
Test of OutsrcBigN = OutsrcEA F = 9.16***
Test of OutsrcOther = OutsrcEA F = 6.97***
Test of OutsrcOther = OutsrcBigN F = 0.08
Notes:
Firms with OutsrcEA are matched to firms that did not outsource to their external auditor using the model
presented in Table 3, panel A. Standard errors are clustered by firm. Industry and year fixed effects are
repressed for presentational ease.
***, **, * indicate statistical significance at the p-value £ 0.01, 0.05, and 0.10 levels respectively. p-values rep-
resent one-tailed tests when a specific direction is predicted and the sign of the coefficient is consistent
with that prediction. 144 firm-year observations are used in this analysis.

Rosenbaum bounding tests in observational studies like ours is not always intuitive, this
technique can provide insight into the impact of omitted-variable and endogeneity con-
cerns. The Hodges-Lehman point estimate indicates that the odds of our OutsrcEA group
outsourcing to the external auditor relative to matched firms would have to be 1.8 times
higher due to different values on an unobserved covariate in order for our inferences to
change.21 Because there is no perfect econometric solution to endogeneity in our setting,
we cannot rule out the influence of correlated omitted variables. However, the results of
our Rosenbaum bounds tests provide some evidence that our inferences are reasonably
robust to the effects of endogeneity.
Next, we perform several additional tests of the robustness of our results. First, we
repeat our regression analysis in (2) without employing propensity score matching. We find
that if we use all firm-year observations in our full sample, our results are qualitatively
similar to those reported using propensity score matching. We also rerun our model using
firm-level fixed effects to control for unobserved heterogeneity. Although our statistical
power appears to be substantially reduced, we find that the coefficient on OutsrcEA
remains negative and statistically different from In-house (p-value < 0.10). Comparisons
of OutsrcEA with the other outsourcing arrangements are all in the same direction as in
Table 3, but they are not significantly different at traditional levels (p-values > 0.10).
Next, we examine whether our inferences change when we use an alternative measure of
accounting quality from the academic accounting literature as our dependent variable:
performance-matched discretionary accruals (Kothari, Leone, and Wasley 2005). Price et al.
(2011) note that the correlations between academic risk measures themselves and between
AR and various academic measures are relatively modest and suggest that this result indi-
cates that the different measures capture different aspects of earnings management ⁄ quality.
We separately test the effect of outsourcing to the external auditor on income-increasing
and income-decreasing accruals (see Hribar and Nichols 2007 for an in-depth discussion of
using signed versus unsigned accruals). For income-decreasing accruals, we use the same
model as presented in (1) except we substitute the accruals-based measure for the account-
ing risk measure. In this sample (sample size = 208 observations), we observe no statisti-
cally significant differences among any coefficient estimates for the outsourcing variables
(p-values > 0.10). However, for income-increasing accruals (sample size = 114), we observe
that OutsrcEA is significantly negative (p-value < 0.01), suggesting that outsourcing to the
external auditor reduces performance-matched, income-increasing discretionary accruals.22
We next examine whether the relation between IAF sourcing and accounting risk
depends on the proportion of the IAF that is outsourced to a third party. Our primary
results, reported above, support the argument that external auditors benefit from knowl-
edge spillover gains when performing internal audit work in addition to the external audit
and that these knowledge spillover gains lead to lower accounting risk. Testing whether
accounting risk is related to the proportion of the IAF that is outsourced to the external
auditor will provide evidence concerning whether improvements in overall audit quality
depend on the external auditor performing more of the IAF work or whether any link (i.e.,
regardless of the amount of work outsourced) between the external auditor and the IAF
serves to improve audit quality. If the proportion of the internal audit work outsourced to
the external auditor is not associated with accounting risk, this would suggest that what is
21. Keele (2010) suggests that a range of between 1 and 1.5 represents reasonable values for the results of this
sensitivity test with observational studies in the social sciences. Although a higher score would provide
greater comfort that our inferences are robust to the influence of unobserved covariates, our score of 1.8
suggests our inferences are reasonably robust when compared with typical observational studies.
22. Using income-increasing performance-matched discretionary accruals, we obtain a negative coefficient esti-
mate for OutsrcEA (p-value < 0.01) in both a pooled sample and a propensity-score matched sample.

most important is that the external auditor has a direct link to the work of the IAF,
regardless of the amount of internal audit work performed by the external auditor.
We code three variables, Outsrc%EA, Outsrc%BigN, and Outsrc%Other, that reflect the
percentage of the IAF’s work that is outsourced to the external auditor, to a Big N firm
that is not the external auditor, or to another non–Big N third-party firm, respectively.
We then substitute these variables for their dichotomous variable counterparts in (2). The
mean for these variables are 3.09, 3.61, and 5.01, respectively; the medians are zero for all
three variables, and the 99th percentiles are 75, 75, and 100, respectively. We trim the top
1 percent of the sample to reduce the influence of outliers.23
The results of this analysis, presented in Table 5, suggest that, consistent with knowl-
edge spillover, the more work a company outsources to the external auditor, the more
accounting risk decreases (p-value < 0.05). Furthermore, outsourcing more work to the
external auditor reduces accounting risk significantly more than outsourcing additional
work to another Big N provider or outsourcing to a third-party provider (p-values <
0.01). The results also show that Outsrc%BigN and Outsrc%Other are both positively related
to accounting risk (p-value < 0.05 and p-value < 0.01, respectively). This provides addi-
tional support for the knowledge spillover theory by demonstrating that outsourcing
greater amounts of internal audit work, either to a Big N or other service provider,
increases accounting risk. It appears that outsourcing to the external auditor is the only
arrangement examined in this study that reduces accounting risk and that the more work
that is outsourced, the greater the reduction in accounting risk.
We conduct an additional sensitivity analysis to determine if the type of internal audit
work performed by the outsourced provider affects accounting risk. Abbott, Parker,
Peters, and Rama (2007) argue that outsourcing routine internal audit work is likely to
impair audit quality by reducing auditor independence, while outsourcing nonroutine
internal audit work is likely to improve audit quality by providing the auditor with firm-
specific knowledge that results in more competent auditing. In untabulated results, how-
ever, we do not find evidence that our results are driven by a specific type of work per-
formed by the external auditor.24
Finally, we note that we are unable to conduct tests of whether outsourcing internal
audit work to the external auditor is associated with actual restatements.25 Of the 334 firm-
year observations in our sample, 13 of those firm-years are restated at some point during
2002–2008 in the Audit Analytics database, and one company restated two years. By its nat-
ure, our study must center on those firms for which we have detailed internal auditing data;
therefore, unlike other studies in the literature, we are unable to start with a sample of
restatement firms and then match those firms with non-restatement firms to form our sample.
Given the very small number of restating firms in our sample of firms with available internal
audit data, it is not possible to run meaningful statistical tests using actual restatements.
23. If we trim at the 5 or 10 percent level, the results are qualitatively similar to those reported. If we do not
trim the outsourcing variables, the results are not statistically significant.
24. The GAIN database contains 11 categories of work performed by third parties. We first test whether any
of these outsourced services, regardless of the service provider, is associated with lower accounting risk.
When we include all these indicator variables in the analysis, the only one that loads significantly in the
regression is one that represents outsourcing internal audit work from ‘‘all’’ activities — meaning that out-
sourced service providers perform a wide variety of internal auditing tasks. We then interact all the indica-
tor variables with OutsrcEA. None of the interaction effects is significant at traditional levels. Thus it
appears that our results related to OutsrcEA are not driven by any particular type of internal audit service
provided by the external auditor.
25. We note that resource constraints prevent auditors and the SEC from detecting all outside-GAAP (gener-
ally accepted accounting principles) manipulations of financial statements. Therefore, actual restatements
very likely are a subsample of the firms that committed outside-GAAP manipulations during our sample
period.

TABLE 5
Multivariate tests of relation between the amount of outsourcing and AR scores
Variable Hypothesized sign b z-value
Intercept )⁄+ 3.529 8.79***

IAQuality ) )0.052 )1.75**
Outsrc%EA )⁄+ )0.013 )2.58**
Outsrc%BigN )⁄+ 0.012 2.22**
Outsrc%Other )⁄+ 0.014 2.62**
ACExpert ) )0.035 )0.29
AC%Ind ) )0.07 )0.34
ACSize ) )0.045 )1.75**
AuditSpecialist ) )0.062 )0.90
NAFees )⁄+ 0.023 1.44**
Gindex + )0.002 )0.11
Assets + 0.01 0.24
Leverage + 0.814 3.05***
Complexity + 0.035 2.27**
Loss + 0.143 1.63*
Return ) )0.203 )2.68***
CFO ) 0.000 1.61
SalesGrowth + 0.052 0.66
MB ) )0.002 )0.78
Age ) )0.004 )1.42
FinRaised + )0.057 )0.99
FinNeed + )0.163 )0.52
NYSE )⁄+ )0.253 )1.80*
Test of OutsrcBigN = OutsrcEA F = 9.30***
Test of OutsrcOther = OutsrcEA F = 12.41***
Test of OutsrcOther = OutsrcBigN F = 0.06
Adjusted R2 0.150
Notes:
Standard errors are clustered by firm. Industry and year effects are repressed for presentational ease.
***, **, * indicate statistical significance at the p-value £ 0.01, 0.05, and 0.10 levels respectively. p-
values represent one-tailed tests when a specific direction is predicted and the sign of the coef-
ficient is consistent with that prediction. 334 firm-year observations are used in this analysis
(see Table 1 for more information).
5. Summary
The primary purpose of this paper is to examine whether internal audit sourcing is related
to accounting risk, which we define as the risk of intentionally misleading or fraudulent
financial reporting activities. In relation to this question, we are interested in understand-
ing whether the provider of outsourced services — the external auditing firm or another
third party — influences accounting risk. Our results are consistent with the idea that com-
panies that outsource internal audit work to the external auditor (pre-SOX) have lower
accounting risk as compared to any other outsourcing arrangement (i.e., a Big N provider
that is not the client’s external auditor or another non–Big N, non-external auditor pro-
vider) or as compared to keeping the IAF entirely in-house. These results are robust to

various alternative model specifications. Overall, the evidence supports the knowledge
spillover argument — that financial reporting quality improves when the external auditor
performs at least some internal audit work. In addition, we find evidence that higher qual-
ity IAFs, regardless of outsourcing arrangement, are associated with lower accounting
risk.
This study has several limitations. First, while previous research provides evidence
that Audit Integrity’s AR scores effectively capture accounting risk (e.g., Correia 2009;
Daines et al. 2010; Price et al. 2011), the validity of our results depends on the construct
validity of the AR measure. However, though the very small number of restatements
among our sample firms precludes us from using restatements as an alternative measure
of financial reporting quality, we obtain similar results using income-increasing discretion-
ary accruals.
Second, although our results are consistent with knowledge spillover, we are unable
to rule out the possibility that they are driven by an alternative mechanism described in
Kinney et al. 2004. Specifically, it is possible that when an external auditor takes on
internal audit work from its clients, this added responsibility increases the audit firm’s
reputation capital, thereby increasing incentives for the audit firm to conduct thorough
and independent audits. We note that although our models control for industry special-
ization and for fees for nonaudit services, we cannot entirely rule out this alternative
explanation.
Third, the IAF data is collected into an archive from surveys completed by chief audit
executives. This introduces two potential problems that might limit the generalizability of
our findings: (1) the data may not be representative of most IAFs in practice due to the
choice to self-select into the survey and (2) the data may not be reliable. While the first
concern remains as a limitation to the generalizability of our results, it is worth noting
that the IIA’s data set is the only data set available to investigate the research questions
posed in this paper. To address the second concern, we have taken steps to verify the data
to the extent possible, including using stringent data-matching inclusion criteria.26
Finally, as discussed previously, the validity of inferences in observational studies is
always threatened by the possibility that unobserved covariates influence the endogenous
choice variable. While there are various econometric techniques that attempt to reduce
these threats, in reality there is no econometric ‘‘fix’’ (see helpful discussions in Armstrong
et al. 2010; Francis, Lennox, and Wang 2012; and Larcker and Rusticus 2010). Although
we have taken care to address the problem of endogeneity, we cannot rule out the possibil-
ity that our results are influenced by unobserved factors.
We suggest one important avenue for future research. This study provides the first evi-
dence of which we are aware suggesting that outsourcing the work of the IAF to the exter-
nal auditor is associated with a lower risk of misleading or fraudulent financial reporting.
Felix, Gramling, and Maletta (1998) note that few companies currently achieve a high
level of coordination between internal and external auditors. Thus, an interesting avenue
for future research is to examine whether companies can realize similar reductions in
accounting risk by increasing coordination and knowledge sharing between the IAF and
external auditors in the absence of outsourcing to the external auditor. Improved coordi-
nation and knowledge-sharing may facilitate enhanced financial reporting quality within
the limitations of the current regulatory environment. We encourage future researchers to
examine this issue.
26. The data were submitted to the IIA for benchmarking purposes with the understanding that companies
would not be publicly identified in conjunction with their responses. There is no apparent reason why
companies would bias their reports or why, if there were any such self-reporting bias, it would be different
across sourcing conditions.

Appendix
Variable descriptions
ACExpert A dichotomous variable taking the value of 1 if internal auditors surveyed in

the GAIN survey responded to the following question in the affirmative: ‘‘All
[audit committee] members possess core skills including finance literacy’’, and
0 otherwise.
ACIndep The percentage of audit committee members that were listed as independent on
the Risk Metrics database.
ACSize The number of audit committee members listed on the Risk Metrics database.
Age The age of the company computed by summing the number of firm-years for
which they have data listed on COMPUSTAT.
Assets Total assets (Data6) of a company (natural log used in testing).
AR Accounting Risk, based on Audit Integrity’s Accounting Risk ranking (with
governance component removed). The ranking ranges between 0 and 100,
with 0 being the most conservative ranking and 100 being the most risky.a
Audit Integrity estimates this measure quarterly. We average the four quarters
for each year to come up with an annual measure (natural log used in model).
AuditFees The amount of audit fees the company paid to their external auditor (natural
log used in testing).
AuditSpecialistb A dichotomous variable that indicates whether the external auditor is an
industry specialist auditor or not. We define industry specialist auditor as a
Big N audit firm that provides within-industry market shares 30 percent
greater than if the audit firms were to split the industry evenly among
themselves.
AuditTenurec The number of years the external auditor has provided external audit services.
The total is capped at 10 years (i.e., all relationships greater than 10 years are
set to the value 10).
CAEAC A dichotomous variable representing whether the CAE reports to the audit
committee (yes, CAEAC = 1; no, CAEAC = 0).
Certification The percent of internal auditors who have the CIA or CPA certification.
(Number of auditors with the CIA or CPA certification ⁄ Total professional
staff in the IAF).
CFO A companies’ cash flows from operations (Data 308).
Complexity The number of operating segments that the company has.
Experience Average number of years of internal audit experience of the internal auditors.
FinRaised The sum of additional cash raised from the issuance of common and preferred
stock (Data108) and the issuance of long-term debt (Data111) divided by
average total assets.
FinNeed A dichotomous variable equal to one if the firm’s free cash flow is less
than )0.1 and 0 otherwise. Free cash flow is calculated as cash flows less the
average capital expenditure (Data128) over the last three years, deflated by
average total assets.
Gindex Corporate governance metric computed by Gompers et al. 2003. For years the
metric was not computed (i.e., 2001, 2003, and 2005); the average of the
metric for the year before and after the missing year was used. A higher value
suggests that management has greater power, which suggests lower corporate
governance quality.
(The appendix is continued on the next page.)

Appendix (Continued)
IAQualityd A single composite score measuring the quality of the IAF. The variable can
range from zero to six with zero representing the lowest quality and six repre
senting the highest quality. The score is formed by assigning a value of one
to scores above the median of the entire sample for Experience, Certification,
CAEAC, TimeFin, Training, and IASize and summing together.
IASize The average dollar amount spent on internal auditing for the industry divided
by the average total assets of the industry subtracted from the dollar amount
spent on internal auditing per company divided by the company’s total assets.
This amount is then divided by the average dollar amount spent on internal
auditing for the industry divided by the average total assets of the industry.
IndOutsrcEA The average of OutsrcEA at the industry level (use self-report industry
categorization).
IndustryDummies Dichotomous variables used to represent different industries at the
one-digit SIC code level.
Leverage The sum of long-term debt (Data9) and current liabilities (Data5) of a
company divided by total assets (Data6).
Loss A dichotomous variable representing whether the company experienced a loss
in the last fiscal year (yes, loss = 1; no, loss = 0).
MB A company’s market-to-book ratio (Data24 * Data25 ⁄ Data216). Because of
several extreme outliers, we winsorize at the top and bottom 2 percent. All
inferences are robust to winsorizing at the top and bottom 1 percent or not
winsorizing.
NAFees The amount of nonaudit service fees a client paid to their external auditor
(natural log used in testing).
NYSE A dichotomous variable indicating whether the company is traded on the
NYSE or not (yes = 1, no = 0).
Outsrc%BigN The percentage of all work the IAF performs outsourced to a Big N service
provider other than the external auditor.
Outsrc%EA The percentage of all work the IAF performs outsourced to the external
auditor.
Outsrc%Other The percentage of all work the IAF performs outsourced to a non–Big N
third-party service provider other than the external auditor.
OutsrcBigN A dichotomous variable indicating whether the company outsources some or
all of its IAF work to a public accounting firm other than the external auditor
or not (yes = 1, no = 0).
OutsrcEA A dichotomous variable indicating whether the company outsources some or
all of its IAF work to the external auditor or not (yes = 1, no = 0).
OutsrcOther A dichotomous variable indicating whether the company outsources some or
all of its IAF work to a third party other than a public accounting firm or
not (yes = 1, no = 0).
Return The annualized buy-and-hold return for the previous year.
SalesGrowth A company’s one-year sales growth (Data12 ) Data12 prior year ⁄ Data12
prior year).
TimeEA The percentage of time the IAF spends assisting the external auditor.
TimeFin The percentage of time the IAF spends performing financial type tasks.
(The appendix is continued on the next page.)

Appendix (Continued)
Training The actual, average amount of training hours internal auditors attend during
the year.
YearDummies Dichotomous variables used to represent different years in the sample.
Notes:
a
In the original Audit Integrity data, the scale is 0 to 100 but the riskiest firms have the lowest AR
scores. We rescale the AR scores by subtracting from 100 so that the interpretation of the
AR scores is more intuitive (i.e., higher scores now indicate more risk).
b
We measure within-industry market share using two-digit SIC code industry listings. We use the
threshold of 30 percent as industry specialists based on prior research (e.g., Mayhew and
Wilkins 2003; Knechel et al. 2007). We note that studies that examined questions during
times that there were Big 8 and Big 6 audit firms in existence used thresholds of 15 percent
(Krishnan 2003) to 20 percent (Dunn and Mayhew 2004). Auditing firms that provide a
substantial portion of the auditing to an industry are likely to develop specialized skills
that enable them to perform more effective audits.
c
We code AuditTenure to have a ceiling of 10 years (i.e., the variable can range from 0 to 10, and
anything over 10 years is coded as 10 years). If we change the cutoff to five years, the
results are qualitatively similar to those reported. We use a cutoff amount because we view
it as unlikely that the internal and external auditor relationship will strengthen to a greater
degree after several years. That is, if internal and external auditors have not developed a
strong working relationship within the first 10 years of working together, it is unlikely that
more time will cause them to do so.
d
As in Prawitt et al. 2009, the quality measures we use when computing IAQuality are based on
SAS No. 65, the standard that guides external auditors’ evaluations of the quality of the
IAF in determining the extent to which the external auditor can rely on its work (AICPA
1990). SAS No. 65 stipulates that external auditors should evaluate the competence and
objectivity of and the work performed by internal auditors. Following the standard, to
proxy for competence we include the variables Experience, Certification, and Training; to
proxy for objectivity we include the variable CAEAC; and to proxy for work performed we
include the variable TimeFin. In addition, we include IASize to control for differing levels
of investment in the IAF.
References
Abbott, L. J., S. Parker, G. F. Peters, and D. V. Rama. 2007. Corporate governance, audit quality,
and the Sarbanes-Oxley Act: Evidence from internal audit outsourcing. The Accounting Review
82 (4): 803–35.
Ahlawat, S. S., and D. J. Lowe. 2004. An examination of internal auditor objectivity: In-house
versus outsourcing. Auditing: A Journal of Practice & Theory 23 (2): 147–58.
American Institute of Certified Public Accountants (AICPA). 1990. Statement on Auditing Standards
No. 65: The auditor’s consideration of the internal audit function in an audit of financial state-
ments. New York: AICPA.
Anderson, U., M. Christ, K. Johnstone, and L. Rittenberg. 2009. Effectively sizing internal audit
activities: A conceptual model beyond benchmarking. Working paper, University of Texas at
Austin, University of Georgia, and University of Wisconsin.

Armstrong, C. S., A. D. Jagolinzer, and D. F. Larcker. 2010. Chief executive officer equity incen-
tives and accounting irregularities. Journal of Accounting Research 48 (2): 225–71.
Asare, S. K., R. A. Davidson, and A. A. Gramling. 2008. Internal auditors’ evaluation of fraud
factors in planning an audit: The importance of audit committee quality and management
incentives. International Journal of Auditing 12 (3): 181–203.
Audit Integrity, LLP. 2005. The Audit Integrity AGR model: Measuring accounting and governance
risk in public corporations. White paper, available at http: ⁄ ⁄ www.auditintegrity.com ⁄ docu-
ments ⁄ Audit_Integrity_AGR_White_Paper.pdf.
Bartov, E., and C. Hayn. 2007. Investors’ valuation of recognition versus disclosure: Accounting for
employee stock options. Working paper, New York University and UCLA.
Beasley, M. S., J. V. Carcello, D. R. Hermanson, and P. D. Lapides. 2000. Fraudulent financial
reporting: Consideration of industry traits and corporate governance mechanisms. Accounting
Horizons 14 (4): 441–54.
Beattie, V. A., and S. Fearnley. 2002. Auditor independence and non-audit services: A literature
review. Working paper, University of Stirling and University of Portsmouth.
Beneish, M. D. 1997. Detecting GAAP violation: Implications for assessing earnings management
among firms with extreme financial performance. Journal of Accounting and Public Policy 16 (3):
271–309.
Brookhart, M., S. Schneeweiss, K. Rothman, R. Glynn, J. Avorn, and T. Sturmer. 2006. Variable
selection for propensity score models. American Journal of Epidemiology 163 (12): 1149–56.
Carey, P., N. Subramaniam, and K. C. W. Ching. 2006. Internal audit outsourcing in Australia.
Accounting and Finance 46 (1): 11–30.
Charles, S. L., S. M. Glover, and N. Y. Sharp. 2010. The association between financial reporting
risk and audit fees before and after the historic events surrounding SOX. Auditing: A Journal of
Practice & Theory 29 (1): 15–39.
Coram, P., C. Ferguson, and R. Moroney. 2008. Internal audit, alternative internal audit structures
and the level of misappropriation of assets fraud. Accounting and Finance 48 (4): 543–59.
Correia, M. M. 2009. Political connections, SEC enforcement, and accounting quality. Working
paper, London Business School.
Committee of Sponsoring Organizations of the Treadway Commission. 2004. Enterprise Risk
Management – Integrated Framework. www.coso.org/documents/COSO_ERM_Executive
Summary.pdf.
Daines, R., I. Gow, and D. Larcker. 2010. Rating the ratings: How good are commercial governance
ratings? Journal of Financial Economics 98 (3): 439–61.
DeChow, P. M., R. Sloan, and A. Sweeney. 1996. Causes and consequences of earnings manipula-
tion: An analysis of firms subject to enforcement actions by the SEC. Contemporary Accounting
Research 13 (1): 1–36.
DeFond, M. L., and J. R. Francis. 2005. Audit research after Sarbanes-Oxley. Auditing: A Journal
of Practice & Theory 24 (Supplement): 5–30.
Dunn, K. A., and B. W. Mayhew. 2004. Audit firm industry specialization and client disclosure
quality. Review of Accounting Studies 9 (1): 35–58.
Dyreng, S. D., W. J. Mayew, and C. D. Williams. 2010. Religious social norms and corporate finan-
cial reporting. Working paper, Duke University and University of Michigan.
Felix, W. L., A. A. Gramling, and M. J. Maletta. 1998. Coordinating total audit coverage: The rela-
tionship between internal and external auditors. Altamonte Springs, FL: The Institute of Internal
Auditors Research Foundation.
Felix, W. L., A. A. Gramling, and M. J. Maletta. 2001. The contribution of internal audit as a
determinant of external audit fees and factors influencing this contribution. Journal of Account-
ing Research 39 (3): 513–34.
Francis, J. R. 2006. Are auditors compromised by nonaudit services? Assessing the evidence.
Contemporary Accounting Research 23 (3): 747–60.

Francis, J. R., C. S. Lennox, and Z. Wang. 2012. Selection models in accounting research. The
Accounting Review. Forthcoming.
Glover, S. M., D. F. Prawitt, and D. A. Wood. 2008. Internal audit sourcing arrangement and the
external auditor’s reliance decision. Contemporary Accounting Research 25 (1): 193–213.
Gompers, P. A., J. L. Ishii, and A. Metrick. 2003. Corporate governance and equity prices.
Quarterly Journal of Economics 118 (1): 107–55.
Gow, I. D., G. Ormazabal, and D. J. Taylor. 2010. Correcting for cross-sectional and time-series
dependence in accounting research. The Accounting Review 85 (2): 483–512.
Gramling, A. A., M. J. Maletta, A. Schneider, and B. K. Church. 2004. The role of the internal
audit function in corporate governance: A synthesis of the extant internal auditing literature
and directions for future research. Journal of Accounting Literature 23: 194–244.
Gramling, A. A., I. Nuhoglu, and D. A. Wood. 2011. Factors associated with the internal audit
function adding value to and having a positive influence on organizations. Working paper,
Kennesaw State University, Bogazici University, and Brigham Young University.
Grant Thornton. 2007. Outsourcing internal audit. Available at http: ⁄ ⁄ www.grantthorn-
ton.ca ⁄ mgt_papers ⁄ MIP_Outsrcng-Intrnl-Audit.pdf.
Habib, A. 2009. Non-audit service fees and financial reporting quality: A meta-analysis. Working
paper, Auckland University of Technology.
Hennes, K., A. Leone, and B. Miller. 2008. The importance of distinguishing errors from irregulari-
ties in restatement research: The case of restatements and CEO ⁄ CFO turnover. The Accounting
Review 83 (6): 1487–519.
Hribar, P., and D. C. Nichols. 2007. The use of unsigned earnings quality measures in tests of earn-
ings management. Journal of Accounting Research 45 (5): 1017–53.
Institute of Internal Auditors (IIA). 2005. Corporate governance. Available at http: ⁄ ⁄ www.the-
iia.org ⁄ ?doc_id=1041.
Joe, J. R., and S. D. Vandervelde. 2007. Do auditor-provided nonaudit services improve audit effec-
tiveness? Contemporary Accounting Research 24 (2): 467–87.
Keele, L. 2010. An overview of Rbounds: An R package for Rosenbaum bounds sensitivity analysis
with matched data. Working paper, The Ohio State University.
Kinney, W. R., Z. V. Palmrose, and S. Scholz. 2004. Auditor independence, non-audit services, and
restatements: Was the U.S. government right? Journal of Accounting Research 42 (3): 561–88.
Klein, A. 2003. Likely effects of stock exchange governance proposals and Sarbanes-Oxley on corpo-
rate boards and financial reporting. Accounting Horizons 17 (4): 343–55.
Knechel, W. R., V. Naiker, and G. Pacheco. 2007. Does auditor industry specialization matter?
Evidence from market reaction to auditor switches. Auditing: A Journal of Practice & Theory
26 (1): 19–45.
Kothari, S. P., A. J. Leone, and C. W. Wasley. 2005. Performance matched discretionary accrual
measures. Journal of Accounting and Economics 39 (1): 163–97.
Krishnan, G. V. 2003. Does Big 6 auditor industry expertise constrain earnings management?
Accounting Horizons (Supplement): 1–16.
Krishnan, J. 2005. Audit committee quality and internal control: An empirical analysis. The
Accounting Review 80 (2): 649–75.
Larcker, D. F., and T. O. Rusticus. 2010. On the use of instrumental variables in accounting
research. Journal of Accounting and Economics 49 (3): 186–205.
Lin, S., M. Pizzini, and M. E. Vargus. 2011. The role of the internal audit function in the disclosure
of material weaknesses. The Accounting Review 86 (1): 287–323.
Lindberg, D. L., and F. D. Beck. 2004. Before and after Enron: CPAs’ views on auditor indepen-
dence. The CPA Journal 74 (11): 36.
Matsumoto, D. 2002. Management’s incentives to avoid negative earnings surprises. The Accounting
Review 77 (3): 483–514.

Mayhew, B. W., and M. Wilkins. 2003. Audit firm industry specialization as a differentiation strat-
egy: Evidence from fees charged to firms going public. Auditing: A Journal of Practice & Theory
22 (2): 33–52.
McGuire, S. T., T. C. Omer, and N. Y. Sharp. 2012. The impact of religion on financial reporting
irregularities. The Accounting Review. Forthcoming.
Menon, K., and D. Williams. 2004. Former audit partners and abnormal accruals. The Accounting
Review 79 (4): 1095–118.
Messier, W. F., S. M. Glover, and D. F. Prawitt. 2012. Auditing and assurance services: A systematic
approach, 8th ed. New York: McGraw-Hill Irwin.
Moore, D. A. 2002. An honest account. Wall Street Journal, November 13: A24.
Peterson, M. A. 2009. Estimating standard errors in finance panel data sets: Comparing approaches.
Review of Financial Studies 22 (1): 435–80.
Pizzini, M., S. Lin, M. E. Vargus, and D. E. Ziegenfuss. 2010. The impact of internal audit function
quality and contribution on audit delays. Working paper, Southern Methodist University, Cali-
fornia State University (Fresno), University of Texas at Dallas, and Old Dominion University.
Plitch, P. 2002. Pricewaterhouse executive speaks out on accounting issues. Dow Jones Business
News, November 21.
Prawitt, D. F., N. Y. Sharp, and D. A. Wood. 2011. Reconciling archival and experimental research:
Does internal auditing contribution affect the external audit fee? Behavioral Research in
Accounting 23 (2): 187–206.
Prawitt, D. F., J. L. Smith, and D. A. Wood. 2009. Internal audit function quality and earnings
management. The Accounting Review 84 (4): 1255–80.
Price, R. A., N. Y. Sharp, and D. A. Wood. 2011. Detecting and predicting accounting irregularities:
A comparison of commercial and academic risk measures. Accounting Horizons 25 (4): 755–80.
Public Company Accounting Oversight Board (PCAOB). 2007. Auditing Standard 5: An audit of
internal control over financial reporting that is integrated with an audit of financial statements.
Washington, DC: PCAOB. Available at http: ⁄ ⁄ www.pcaobus.org ⁄ Standards ⁄ Standards_
and_Related_Rules ⁄ Auditing_Standard_No.5.aspx.
Richardson, S., I. Tuna, and M. Wu. 2003. Predicting earnings management: The case of earnings
restatements. Working paper, University of Pennsylvania and Hong Kong University of Science
and Technology.
Rittenberg, L. E., and M. A. Covaleski. 1997. Internalization versus externalization of the internal
audit function: An examination of professional and organizational imperatives. Accounting,
Organizations and Society 26: 617–41.
Rittenberg, L., and M. A. Covaleski. 2001. Internalization versus externalization of the internal
audit function: An examination of professional and organizational imperatives. Accounting,
Organizations and Society 26 (7–8): 617–41.
Romanus, R. N., J. J. Maher, and D. M. Fleming. 2008. Auditor industry specialization, auditor
changes, and accounting restatements. Accounting Horizons 22 (4): 389–413.
Rosenbaum, P. R. 2002. Observational studies, 2nd ed. New York: Springer.
Rosenbaum, P. R. 2005. Observational study. In Encyclopedia of statistics in behavioral science,
ed. B. S. Everitt and D. C. Howell, vol. 3, 1451–62. New York: Wiley.
Sarens, G., and I. De Beelde. 2006. Internal auditors’ perception about their role in risk manage-
ment. Managerial Auditing Journal 21 (1): 63–80.
Schneider, A., B. K. Church, and K. M. Ely. 2006. Non-audit services and auditor independence:
A review of the literature. Journal of Accounting Literature 25: 169–211.
Simunic, D. A. 1984. Auditing, consulting, and auditor independence. Journal of Accounting
Research 22 (2): 679–702.
Xie, Y. 2011. The market effects of breaking a string of meeting or beating analysts’ expectations:
Downward revision of future cash flows or increase in cost of equity capital? Journal of Business
Finance & Accounting 38 (1–2): 95–118.

Copyright of Contemporary Accounting Research is the property of Canadian Academic Accounting
Association and its content may not be copied or emailed to multiple sites or posted to a listserv without the
copyright holder's express written permission. However, users may print, download, or email articles for
individual use.

Internal Audit Outsourcing and The Risk Of...

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Internal Audit Outsourcing and The Risk Of...

Uploaded by

Copyright:

Available Formats

Internal Audit Outsourcing and the Risk of Misleading or

Fraudulent Financial Reporting: Did Sarbanes-Oxley Get It

DOUGLAS F. PRAWITT, Brigham Young University

NATHAN Y. SHARP, Texas A&M University

DAVID A. WOOD, Brigham Young University

CAR Vol. 29 No. 4 (Winter 2012)

2. Background and expectations

Nonaudit services and accounting risk

CAR Vol. 29 No. 4 (Winter 2012)

IAF sourcing and accounting risk

CAR Vol. 29 No. 4 (Winter 2012)

3. Data and the model speciﬁcation

CAR Vol. 29 No. 4 (Winter 2012)

Description Sample size

Firm-year observations in internal auditing database 3,015

CAR Vol. 29 No. 4 (Winter 2012)

Accounting risk model speciﬁcation

OutsrcEA ¼ b0 þ b1 IndOutsrcEA þ b2 IAQuality þ b3 AuditSpecialist þ b4 IASize

(See the Appendix for variable descriptions.)

CAR Vol. 29 No. 4 (Winter 2012)

CAR Vol. 29 No. 4 (Winter 2012)

In relation to opportunity, some important corporate governance players outside of

AR ¼ b0 þ b1 IAQuality þ b2 OutsrcEA þ b3 OutsrcBigN þ b4 OutsrcOther þ b5 ACExpert

(See the Appendix for variable descriptions.)

CAR Vol. 29 No. 4 (Winter 2012)

OutsrcBigN OutsrcBigN > OutsrcEA

OutsrcOther OutsrcOther > OutsrcEA NS

difference between variables.

CAR Vol. 29 No. 4 (Winter 2012)

a Big N external auditor (OutsrcEA) as compared to companies that outsource to another

CAR Vol. 29 No. 4 (Winter 2012)

Modeling the choice to outsource to the external auditor

CAR Vol. 29 No. 4 (Winter 2012)

Panel A: Descriptive statistics of internal audit characteristics

Variable Mean Std. Dev Min P25 Median P75 Max

IAQuality 2.54 1.15 0 2 3 3 5

Panel B: Descriptive statistics of variables included in our sample

OutsrcEA = 1 (n = 82) OutsrcEA = 0 (n = 252)

Variable Mean Median Mean Median t-stat z-stat

AR 44.38 42.25 49.53 48.00 1.97** 1.79*

Leverage 0.53 0.53 0.49 0.49 )2.82*** )2.56**

CAR Vol. 29 No. 4 (Winter 2012)

(The table is continued on the next page.)

OutsrcEA = 1 (n = 82) OutsrcEA = 0 (n = 252)

Variable Mean Median Mean Median t-stat z-stat

Loss 0.17 0.00 0.19 0.00 0.40 0.40

CAR Vol. 29 No. 4 (Winter 2012)

(The table is continued on the next page.)

CAR Vol. 29 No. 4 (Winter 2012)

Panel A: Logistic regression model to obtain propensity scores

Variable Hypothesized sign b v2

Intercept )⁄+ )7.166 7.53***

Panel B: Covariate balance between the matched pairs

OutsrcEA = 1 (n = 72) OutsrcEA = 0 (n = 72)

Variable Mean Median Mean Median t-stat z-stat

IndOutsrcEA 0.27 0.29 0.26 0.29 )1.39 )1.39

CAR Vol. 29 No. 4 (Winter 2012)

Internal audit sourcing and accounting risk

CAR Vol. 29 No. 4 (Winter 2012)

Panel A: Univariate tests using propensity-matched samples

OutsrcEA = 1 (n = 72) OutsrcEA = 0 (n = 72)

Variable Mean Median Mean Median t-stat z-stat

AR 38.09 42.10 46.53 49.40 2.10** 1.77*

Leverage 0.53 0.53 0.49 0.49 )2.82* )2.56