INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
Transcript of INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
1/32
INTERNAL AUDIT OUTSOURCING:
AN ANALYSIS OF SELF-
REGULATION BY THE
ACCOUNTING PROFESSION
Dennis Caplan, Diane Janvrin and James Kurtenbach
ABSTRACT
This paper examines the accounting professions self-regulation of inter-
nal audit outsourcing services. The question of whether public accountantscompromise their independence when they provide internal audit services
to their attest clients was debated within the accounting and regulatory
communities throughout the 1990s, and resulted in a confrontation
between the accounting profession and the Securities and Exchange
Commission in 2000. Internal audit outsourcing was a factor in the public
perception of Arthur Andersens role in the collapse of Enron, and in
lawmakers reaction to that event. It is specifically identified in the
Sarbanes-Oxley Act of 2002 as a prohibited service that public accountants
generally cannot provide to their public company external audit clients.Our purpose is to contribute an historical perspective to ongoing dis-
cussions about the efficacy of self-regulation by the public accounting
profession. Self-regulation of internal audit outsourcing remains impor-
tant because the Sarbanes-Oxley prohibition does not apply to auditors
private company clients, and because the rules that the SEC issued to
implement Sarbanes-Oxley seem to allow accounting firms to provide
Research in Accounting Regulation, Volume 19, 334
Copyrightr 2007 by Elsevier Ltd.All rights of reproduction in any form reserved
ISSN: 1052-0457/doi:10.1016/S1052-0457(06)19001-3
3
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
2/32
internal audit services to public company attest clients under a variety ofcircumstances that were not anticipated in the original legislation. Al-
though accounting firms have not yet shown strong interest in testing the
limits of the new rules, the firms may do so in the future.
History is full of examples of how improper or ineffective self-regulation leads to gov-
ernment regulation. (Leonard Spacek, managing partner of Arthur Andersen, 1969)
Self-regulation by the accounting profession is a bad joke. (Arthur Levitt, former chair-
man of the SEC, 2003, p. 135)
1. INTRODUCTION
The Sarbanes-Oxley Act of 2002 significantly altered the regulatory land-
scape of the public accounting profession. It increased third-party oversight
of a profession that had previously been largely self-regulated. This paper
examines the efficacy of self-regulation by the accounting profession in the
years leading up to the Act in the context of a single issue: the question ofwhether public accountants maintain independence when they provide in-
ternal audit services to their attest clients. The rapid growth of internal audit
outsourcing during the 1990s prompted every important professional and
regulatory body with responsibility for auditor independence to address this
issue. It was debated within the accounting profession and the regulatory
community, culminating in a confrontation in 2000 between the AICPA and
three of the Big 5 firms on the one hand, and the Securities and Exchange
Commission on the other. Internal audit outsourcing was a factor in the
negative publicity incurred by Arthur Andersen following the collapse ofEnron, and in lawmakers reaction to that event, because internal auditing
was a consulting service that Andersen provided Enron. Hence, internal
audit outsourcing was an important phenomenon in the events that led to
Sarbanes-Oxley.
The Sarbanes-Oxley Act prohibits accounting firms from providing in-
ternal audit services to their public company attest clients. Nevertheless,
self-regulation of internal audit outsourcing remains important for two
reasons. First, the Sarbanes-Oxley ban does not apply to private company
audit clients. Second, the SEC issued rules in 2003 to implement Sarbanes-Oxley that still allow accounting firms to provide internal audit services to
public company attest clients, if those services are unrelated to internal
accounting controls, financial systems, and financial statements, or if the
DENNIS CAPLAN ET AL.4
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
3/32
auditors will not be reviewing their own work during the audit, or if theservices are nonrecurring evaluations of discrete items. Although accounting
firms have not yet shown an interest in exploring the limits of these new
rules, they may do so in the future.
In Section 2 of the paper, we identify and describe significant events,
pronouncements, and statements of position on internal audit outsourcing,
as well as important antecedent events. In Section 3, we assess the extent of
consensus within the accounting profession and regulatory communities, we
summarize the role played by the AICPA, and we provide concluding re-
marks.
2. A CHRONOLOGY OF INTERNAL AUDIT
OUTSOURCING
Internal audit outsourcing evolved as the result of two broad trends. The
first trend was the increasing importance of consulting services as a revenue
source for accounting firms. Throughout the 1980s and 1990s, competitive
forces in the public accounting profession led many practitioners to char-acterize attest services as a low-margin commodity product. In this envi-
ronment, accounting firms increasingly turned to consulting services to
increase revenues and profits. The second trend was the increasing visibility
and importance of internal controls. Because the routine review of internal
controls is an important internal audit activity in companies large enough to
support an internal audit department, the increased focus by regulators,
accountants, and managers on internal controls led to increased visibility
for the internal audit function. An early milestone in this regard was the
Foreign Corrupt Practices Act of 1977, which required large companies tomaintain adequate systems of internal control. The Treadway Commission
Report1 of 1987 recommended that all public companies maintain an effec-
tive and objective internal audit function, and also recommended that
management report annually on its assessment of the effectiveness of the
companys internal controls.2 Another milestone occurred when the
Committee of Sponsoring Organizations of the Treadway Commission
(COSO) issued its report Internal Control Integrated Framework (1992).
The report became widely accepted as an industry standard for its definition
of internal controls and the criteria for evaluating controls.Hence, at a time when public accounting firms were looking for new
consulting opportunities, the demand for internal control reviews was
on the rise. There was a natural fit between the training, education, and
Internal Audit Outsourcing 5
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
4/32
professional competency of public accountants and the work involved inreviewing internal controls. Also in the 1980s, companies experimented with
outsourcing many activities that historically had been performed internally.
Even before 1990, some companies had outsourced internal audit activities
to their public accountants for reasons that seemed compelling. For exam-
ple, because accounting firms often had a physical presence in foreign lo-
cations, such as an affiliated local firm, the firms could often provide
internal audit services in these locations more efficiently than the companys
own internal auditors.
During the 1990s, internal audit outsourcing grew rapidly. By the mid-1990s, about 1012 percent of companies were outsourcing some or all of
the internal audit function (Kralovetz, 1996; Renner & Tebbe, 1998). Often,
the outsource provider was a public accounting firm, although internal audit
outsourcing is not an attest service, and other consulting and service firms
began offering these services. Two surveys provide evidence of the preva-
lence of internal audit outsourcing just prior to the passage of Sarbanes-
Oxley. Serafini, Sumners, Apostolou, and Lafleur (2003) finds that by about
2001, among companies that had an internal audit function, 11 percent
outsourced the entire function and another 54 percent outsourced someportion of it. Forty-three percent reported that they intended to outsource
more internal auditing in the future. Carcello, Hermanson, and
Raghunandan (2005) surveyed the internal audit budgets of 217 mid-sized
U.S. public companies, and finds that for 2002, 15 percent of all internal
audit work was performed by outsource providers.
The Regulatory/Self-Regulatory Environment: During this period of rapid
growth of internal audit outsourcing, the principal regulatory bodies
with oversight responsibility for auditor independence were the SEC, theFederal Deposit Insurance Corporation (FDIC), the General Accounting
Office (GAO), and the state boards of accountancy. The various state
boards did not pursue this issue to any significant extent, so the important
regulatory activities occurred at the federal level. Although the GAO and
the FDIC were actively involved in the internal audit outsourcing inde-
pendence question, the jurisdiction of the GAO is limited to government
agencies, government contractors, and their auditors, and the jurisdiction
of the FDIC is limited to financial service firms and their auditors. Since
the jurisdiction of the SEC includes all U.S. public companies and theirauditors, the SEC was the preeminent regulatory body concerned with the
question of whether internal audit outsourcing compromises an auditors
independence. The SECs approach to this issue, consistent with its
DENNIS CAPLAN ET AL.6
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
5/32
longstanding approach toward the public accounting profession generally,was to allow the profession to self-regulate whenever possible, to use
formal and informal communications to encourage the profession to act
on issues of concern to the Commission, and to enact and enforce reg-
ulations objectionable to the profession only as a last resort.
The two most important self-regulatory bodies with responsibility for
auditor independence during this period were the Executive Committee of
the Professional Ethics Division of the AICPA, and the Public Oversight
Board (POB). The Executive Committee of the Professional Ethics
Division promulgates ethics standards for members of the AICPA. ThePOB was established by the AICPA in 1977 as an independent, self-
regulatory body to oversee the quality of public company audits. An
important milestone in the self-regulation of consulting services occurred
in 1979, when the POB issued its report Scope of Services by CPA Firms.
One of the key conclusions in this report is that there is virtually no
evidence that consulting services impair auditor independence. However,
the report acknowledges that specific evidence of such impairment would
probably not be available, even if it occurred.
The remainder of this section describes important regulatory and self-regulatory events and pronouncements related to internal audit outs-
ourcing, organized by year. Exhibit 1 provides a time line of key events. 1984: The SEC responds to an inquiry by a small public accounting firm
regarding whether the firm can provide internal audit services to a small
bank that is also an attest client. The SEC states that the auditors per-
formance of internal audit type duties would impair independence in ap-
pearance. The SEC reply also states that the nature of the internal auditor
relationship appears to be close to that of an employee, and that the
internal audit function generally would be part of the system of internalcontrols administered by employees of the client. However, the SEC letter
also confirms that auditors can assist clients in the establishment of systems
of internal control that would then be administered by client personnel.3
1991: Congress passes the Federal Deposit Insurance Corporation
Improvement Act (FDICIA). The Act requires large insured depository
institutions to report annually on internal controls over financial report-
ing, and for the auditors to attest to this report. FDICIA appears to be an
important impetus for internal audit outsourcing in the financial services
industry. A worldwide survey of large financial institutions, conducted byDeloitte Touche Tohmatsu International (DTTI), found that about 25
percent of survey respondents were outsourcing some internal audit work
by 1995 (DTTI, 1995).
Internal Audit Outsourcing 7
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
6/32
Exhibit 1.Time Line of Key Events Related to Internal Audit
Outsourcing.
Year Event Description
1979 The Public Oversight Board (POB) issues its
report Scope of Services by CPA Firms
The POB notes the lack of evidence that
consulting services compromises auditor
independence, but also observes that such
evidence would probably not be available,
even if independence were compromised.
1984 The SEC responds to an inquiry by an
accounting firm
The SEC staff states that internal audit
outsourcing would probably compromise
auditor independence.
1993 The AICPA Professional Ethics Division
issues ruling No. 97 under Rule of
Conduct 101
The ruling applies existing standards to
internal audit outsourcing, allowing firms
to provide these services provided they do
not perform management functions.
1994 The Auditing Standards Division of the
AICPA issues an Audit Risk Alert that
includes the topic of internal audit
outsourcing
The Audit Risk Alert references a speech by
the SEC chief accountant, and urges
practitioners to carefully consider the
implications of internal audit outsourcing
on independence.
1996 The AICPA Professional Ethics Division
issues rulings 103, 104, 105, andinterpretation 101-13, all under Rule of
Conduct 101
The rules generally allow auditors to provide
internal audit services to their externalaudit clients, as long as the auditor does
not act or appear to act in the capacity of
management or as an employee.
2000 The SEC issues new rules on auditor
independence
The new rules prohibit large companies from
sourcing more than 40% of their internal
audit function from their external
auditors.
2000 The Panel on Audit Effectiveness issues its
report
The Panel reports disagreement among its
members on the question of a general ban
on nonaudit services. It is the only
question on which the Panel does not
achieve a consensus.
2001 Enron declares bankruptcy Arthur Andersen incurs significant negative
publicity, in part because the firm
provided Enron extensive consulting
services including internal auditing
services.
2002 Congress passes the SarbanesOxley Act The Act specifically prohibits accounting
firms from providing internal audit
services to their public company attest
clients.
2003 The SEC adopts rules to implement Title II
of SarbanesOxley
With respect to internal audit outsourcing,
the SEC rules appear more permissivethan the SarbanesOxley ban would seem
to permit.
DENNIS CAPLAN ET AL.8
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
7/32
1993: In November, the Executive Committee of the Professional EthicsDivision of the AICPA issues Ruling No. 97 under Rule of Conduct 101,
responding to an inquiry by the auditor of a financial services firm.
The inquiry concerned the auditors ability to assist with the clients in-
ternal audit activities, or extend the accounting firms audit services when
the client did not maintain an internal audit function. The accounting
firm asked about three types of services: (1) testing the system of internal
controls, confirming accounts receivable, and analyzing fluctuations of
income and expense accounts; (2) reviewing loan originations or similar
activities as part of the clients approval process; and (3) reviewing theclients loan origination or other business processes for their function-
ing, efficiency or effectiveness, and providing recommendations to man-
agement.
Ruling No. 97 states that the activities described in (1) would not impair
independence, noting that these activities are similar to extensions of audit
procedures performed in connection with the annual audit; the activities
described in (2) would impair independence because the auditor would be
performing a management function; and the activities described in (3)
would not impair independence as long as the auditor did not performmanagement functions or make management decisions, even though these
activities are not normally necessary for conducting the annual audit. The
response to this last item applies existing standards for consulting services
generally to internal audit outsourcing in particular. Ruling No. 97 re-
mains in effect until 1996. 1994: In September, the Institute of Internal Auditors (IIA) publishes
Professional Issues Pamphlet 94-1: The IIAs Perspective on Outsourcing
Internal Auditing: A Professional Briefing for Chief Audit Executives.
The pamphlet notes that outsource providers are aggressively marketinginternal audit services to companies around the world. The pamphlet
summarizes the IIAs position:
The IIAs perspective is that internal auditing is best performed by an independent
entity that is an integral part of the management structure of an organization. The IIA
states unequivocally that a competent internal auditing department that is properly
organized with trained staff can perform the internal auditing function more effi-
ciently and effectively than a contracted audit service. (IIA, 1994, p. 2, emphasis in the
original)
The pamphlet characterizes the rapid growth of outsourcing as beingdriven, in part, by outsource providers promises of lower cost and higher
quality services, reduced fixed staff salaries, and improved access to spe-
cialization.
Internal Audit Outsourcing 9
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
8/32
Also in September, the POB releases the report of the Advisory Panelon Auditor Independence, Strengthening the Professionalism of the
Independent Auditor. The POB commissioned the report in response to
a speech by SEC Chief Accountant Walter Schuetze criticizing the ac-
counting profession for not standing up to clients on financial reporting
issues. According to the report:
The Panel finds worrisome the trend of accounting firms, in wanting to grow, to add
or expand nonaudit services and thereby reduce their reliance on and the relative
importance of auditing.y Growing reliance on nonaudit services has the potential to
compromise the objectivity or independence of the auditor by diverting firm lead-
ership away from the public responsibility associated with the independent audit
functiony. (Advisory Panel on Auditor Independence, 1994, p. 9)
The report goes on to recommend that independent auditing firms need
to focus on how the audit function can be enhanced and not submerged in
large multi-line public accounting/management consulting firms (p. 9).
In a speech to an AICPA banking conference in November, SEC Chief
Accountant Schuetze expresses concern about the practice of total outs-
ourcing of the internal audit function to the companys public accounting
firm. Schuetze notes that AICPA Ethics Ruling No. 97 is very restric-tive, and that because external auditors must be independent both in fact
and in appearance, auditors attempting to fulfill the responsibilities of the
external auditor and the responsibilities traditionally performed by inter-
nal auditors must exercise great care. Schuetze also observes that to the
extent banking laws require internal auditors to be under the control of
management, outsourcing the internal audit function to the banks exter-
nal auditors is fundamentally inconsistent with the auditors independ-
ence (Schuetze, 1994).
The Auditing Standards Division of the AICPA issues Audit Risk Alert 1994 (Auditing Standards Board, 1994). The Risk Alert states that
companies are outsourcing internal audit activities to their public ac-
countants with increasing frequency, and then notes the concerns that
Schuetze expressed in his November speech. The Risk Alert advises au-
ditors to carefully consider the implications of internal audit outs-
ourcing arrangements on independence. 1995: In January, SEC Professional Accounting Fellow Tracey Barber
gives a speech at an AICPA conference on SEC developments. Barber
summarizes current regulatory and self-regulatory guidance on internalaudit outsourcing (including AICPA Ethics Ruling No. 97) as providing
very strict limitations (Barber, 1995, p. 3). The position of the SEC, as
described by Barber, seems to be that any arrangement for outsourcing
DENNIS CAPLAN ET AL.10
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
9/32
would either place the auditor under day-to-day control of management,or require the auditor to exercise management functions, neither of which
is consistent with auditor independence. Barber conveys the staffs view
that it is very difficult to devise internal audit outsourcing arrangements
that both would overcome the prohibitions set forth by all of the guidance
currently available, and simultaneously satisfy all of the needs of a client
(pp. 34). Barber also indicates that the SEC staffs interpretation of the
COSO internal control framework is that some internal audit activities
constitute part of the internal control system. As such, the auditor who
undertakes these activities would compromise independence.In February, the Wall Street Journal runs an article on Morrison
Knudsen. The company reported a loss of $141 million for the fourth-
quarter of 1994, its worst quarterly loss in its 83-year history, and more
than twice analysts expectations. Morrison Knudsen also announced that
it was firing Deloitte & Touche as the companys internal auditor and
hiring Arthur Andersen for these services. The Wall Street Journal staff
reporter concludes that since last November, Deloitte & Touche has
performed both Morrisons external and internal audits, effectively re-
moving a layer of review that most companies consider crucial (Rigdon,1995).
1996: In February, the Professional Ethics Division of the AICPA issues
exposure drafts of new ethics rulings that would explicitly permit auditors
to provide internal audit services to their attest clients as long as the
auditor does not act or appear to act in a capacity equivalent to a member
of client management or as an employee. Comment letters from practi-
tioners align almost uniformly with their apparent economic interests:
practicing CPAs support the proposed rules; internal auditors, including
internal audit executives from Merrill Lynch and Texas Instruments, op-pose the proposed rules. Most of the comment letters in opposition to the
exposure draft question whether it is practically feasible for auditors to
provide internal audit services without crossing the line that separates
consultants from employees, or without engaging in activities that look
like management functions. The Institute of Management Accountants
(IMA) opposes the proposed rules, primarily due to concerns about in-
dependence in appearance when the same auditor provides both internal
audit and attest services to the same client (IMA, 1996).
Comment letters from the Board of Governors of the Federal ReserveSystem and the Director of the FDIC generally support the proposal, but
object that the terms management and employee are used in a vague
manner, and also object to the proposed interpretation that allows the
Internal Audit Outsourcing 11
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
10/32
auditor to attest to managements report on internal controls when thatsame auditor provides internal audit services that serve as a basis for
managements report (Board of Governors of the Federal Reserve System,
1996; FDIC, 1996). Because FDICIA requires large financial institutions
to provide a management report on internal controls and for their au-
ditors to attest to this report, these regulators focus on this issue is not
surprising. The Professional Ethics Division appears to have responded to
this concern, because the final ruling states that management cannot rely
on the auditors work as the primary basis for its assertion in its internal
controls reportJ The Institute of Internal Auditors. The lead story in the March/April
issue of IIA Today announces a significant shift from the IIAs 1994
position on internal audit outsourcing.4 The article notes that the major
accounting firms are pursuing internal audit outsourcing services and
predicts that outsourcing is likely to grow. The article acknowledges
that, as a matter of practice, internal auditing practitioners have long
used third-party providers to satisfy the need for special knowledge or
to compensate for language or distance difficulties (IIA, 1996, p. 1).
The IIA also acknowledges that outsource providers might providecost/effective internal audit services for companies too small to main-
tain their own internal audit staff, and that outsource providers might
constitute an improvement over internal audit departments that are less
than world class.
The article goes on to reference the Standards for the Professional
Practice of Internal Auditing promulgated by the Institute, and to urge
all providers of internal auditing to conform to those standards. Hence,
the Institutes new position is to try to bring outsource providers under
the umbrella of the IIA, to expand its membership to include outsourceproviders, and to urge outsource providers to support and participate in
the activities of the Institute. The IIA continues to express concern
about public accountants providing internal audit services to their attest
clients:
The IIA has also gone on record with the SECs Chief Accountant by expressing
the view that total outsourcing of internal auditing to the organizations external
auditor would impair the independence of the external auditor. The IIA most
recently affirmed that view in a letter to the AICPA Professional Ethics Executive
Committee. (IIA, 1996, p. 1)
J New Ethics Rulings. In August, the Executive Committee of the
Professional Ethics Division of the AICPA adopts new ethics
pronouncements for internal audit outsourcing, superseding ruling
DENNIS CAPLAN ET AL.12
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
11/32
No. 97, which had been in effect since 1993. The new pronouncementsconsist of ruling Nos. 103, 104 and 105, and Interpretation No. 101-13,
all under Rule of Conduct 101 (American Institute of Certified Public
Accountants, Professional Ethics Executive Committee, 1996a, b, c, d).
The pronouncements distinguish between activities that constitute on-
going monitoring of the internal control system, and separate reviews of
the control system. Under the new rules, auditors are allowed to pro-
vide attest clients internal audit services as long as those services con-
stitute separate reviews of the control system, and as long as the auditor
does not act, or appear to act, in the capacity of an employee or man-agement of the client.
The new pronouncements list examples of activities that would com-
promise the auditors independence. The client must designate one or
more individuals, preferably from senior management, responsible for
the internal audit function. The client must determine the scope, risk,
and frequency of internal audit activities, and evaluate the findings and
results arising from those activities. The accounting firm cannot deter-
mine which control recommendations should be implemented, report to
the board of directors or audit committee on behalf of management, orbe responsible for the overall internal audit work plan.
The new pronouncements address the question of whether the au-
ditor can render an opinion on managements report of the effectiveness
of internal controls over financial reporting, if the auditor also provides
internal audit services. The auditor is independent with respect to this
attest service as long as management retains responsibility for estab-
lishing and maintaining internal controls, management does not rely on
the auditors work as the primary basis for its assertion in its internal
controls report, and the auditor does not act or appear to act in acapacity equivalent to that of client management or as an employee.
The new pronouncements allow auditors to conduct operational au-
dits, such as reviewing the effectiveness or efficiency of business proc-
esses. Independence is not impaired provided that the auditor does not
act or appear to act in a capacity equivalent to that of client manage-
ment or as an employee. Also, the auditors independence does not
depend on the frequency of internal audit services provided to the cli-
ent, provided that the auditors activities constitute separate evaluations
of the effectiveness of the ongoing control and monitoring activities andprocedures built into the clients normal recurring activities.J Other Developments in 1996. In August, SEC Chief Accountant Michael
Sutton discusses internal audit outsourcing in a speech to the American
Internal Audit Outsourcing 13
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
12/32
Accounting Association (Sutton, 1996). Sutton notes that internal au-diting traditionally has been a management responsibility that, in critical
ways, has been integral to the system of internal control, and then
questions whether independent auditors can perform the internal audit
function and also provide an independent look at the system of internal
control. The skillful balance sought by the drafters of the [AICPA
ethics rulings] may, in the final analysis, run up against the wall of
perception and credibility. Sutton states that both the investing public
and the accounting profession would be better served if accounting firms
only provided internal audit services to nonaudit clients, noting thatsuch an arrangement would not affect the total market for these services.
In September, the General Accounting Office issues its report The
Accounting Profession Major Issues: Progress and Concerns. This re-
port reviews developments and trends related to auditor independence,
audit quality, auditors responsibilities for detecting fraud and reviewing
internal controls, and financial reporting and auditing standard setting.
The report states that concern over auditor independence is a long-
standing and continuing problem for the accounting profession (U.S.
General Accounting Office, 1996, p. 37). With respect to nonaudit serv-ices, the report references an earlier report, Failed Banks: Accounting
and Auditing Reforms Urgently Needed (1991), in which the GAO con-
sidered but rejected a recommendation to limit the scope of nonaudit
services that accounting firms can provide their clients. The current
GAO report reiterates that position: GAO believes measures that
would limit auditor servicesy are outweighed by the value ofy tradi-
tional consulting services (p. 8). The report notes that the GAO favors
addressing concerns about independence through improved corporate
governance, but cautions the accounting profession that these concernsmight increase as accounting firms become more heavily involved in
nonaudit services. 1997: In June, the SEC, AICPA, and large public accounting firms agree
to the formation of a new private regulatory body: the Independence
Standards Board (ISB). The mission of the ISB is to establish independ-
ence standards for public company audits. The organizational structure of
the ISB is similar to the POB. The eight-member ISB includes four mem-
bers from outside the public accounting profession. The Board retains an
executive director and a small staff, and is funded by contributions fromthe accounting profession. The ISB begins operations in October. 1999: In November, Earnscliffe Research and Communications issues the
results of a study commissioned by the ISB. The report, Research into
DENNIS CAPLAN ET AL.14
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
13/32
Perceptions of Auditor Independence and Objectivity, is based on 131 in-terviews of CEOs, CFOs, audit committee chairs, investment analysts,
audit partners, and regulators. The study asked interviewees about inter-
nal audit outsourcing as well as other types of nonaudit services. The
report concludes that internal audit outsourcing is one of the three areas
where people felt pulled both ways, and considered the matters to be
important (Earnscliffe Research and Communications, 1999, p. 24, em-
phasis in the original). The report summarizes that while most people felt
internal audit outsourcing was in no way problematic, a notable minor-
ity took the position that this might lead to a lower standard of protectionfor the investor (p. 25).
The study notes that as a group auditors were more homogeneous than
any other except perhaps regulators (p. 39). Auditors were also insistent
that there were no greater issues of independence today than there
had been in the past (p. 39), and they bridled at the notion that they
might have to consider altering their business model, simply to avoid a
perception problem, when the reality was that there was no impairment
(pp. 3940). By contrast, regulators (most or all from the SEC) worried
that the [accounting] profession had been moving too slowly to deal withthe issues around nonaudit assignments (p. 43). Summarizing the views of
each group, regulators exhibited moderate concern about whether in-
dependence in both fact and appearance is a real problem today, and
serious concern about whether independence in both fact and appear-
ance will be a real problem tomorrow. By contrast, the consensus response
of auditors was none to the concern about independence in fact both
today and tomorrow, and slight to the concern about independence in
appearance both today and tomorrow. In summary, the Earnscliffe study
documents a gulf between regulators and the public accounting profession. 2000: In June, the SEC proposes new auditor independence rules that
include a provision prohibiting auditors from providing internal audit
services to their attest clients (SEC, 2000a). The large accounting firms
launch a no-holds-barred public relations and lobbying campaign
against the proposal (Levitt, 2003, p. 137). The AICPA argues that the
SEC had not proven a single instance in which an auditor had compro-
mised independence in order to obtain or retain a consulting contract, or
in which a lack of auditor independence had led to an audit failure. Ac-
cording to Levitt, the no-smoking-gun argument was very effective withCongress. Some commentators and regulators believe this argument is
exaggerated and that a few instances have been identified (over many
years) in which nonaudit services may have contributed to audit failures.5
Internal Audit Outsourcing 15
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
14/32
Within a month of issuing the proposed rules, Levitt receives negativeletters from 46 members of Congress, including two-thirds of the SECs
oversight committee. Levitt believes that the public accounting profes-
sions success in lobbying Congress was related to the professions po-
litical campaign contributions. Levitt notes that the Big 5, their partners,
and the AICPA contributed $14.5 million to the 2000 elections, and that
each of the Big 5 was one of President Bushs top 20 contributors.
The AICPA Board of Directors concludes that the proposed restric-
tions on nonaudit services were not in the public interest, as they would
strip the profession of skills needed to meet its auditing responsibilities inthe New Economy (AICPA, 2000). The AICPA reports:
Putting the very future of the CPA profession on the line, the SEC in late June [2000]
proposed sweeping rules that, if enacted in their current form, would force a restruc-
turing of the accounting profession. The most threatening rule would prohibit ac-
counting firms performing audits for SEC registrants from providing most non-audit
services for those clientsyThe SECs new proposals are draconian and unwar-
rantedy. (AICPA, 2000)
The characterization of a ban on nonaudit services as draconian may
have been taken from the POBs 1979 Scope of Services report, which usedthe same term in almost the same contextJ Testimony Provided to the SEC. The SEC holds hearings on the pro-
posed rules in July and September. Thornton (2003) finds that among
39 representatives of the accounting profession, 27 oppose the proposed
rules, 9 are in favor, and 3 are neutral; among 19 financial statement
users, 18 favor the SEC proposal; and among 21 regulators, 11 favor
the proposal, 3 are opposed, and 7 are neutral.
The AICPA and leaders of three Big 5 firms oppose the proposed
rules. Leaders from two Big 5 firms support the proposed rules con-tingent on modifications that include allowing limited internal audit
outsourcing. The division among the Big 5 firms corresponds to whether
the firm has sold or is in the process of selling its consulting practice.
KPMG, Arthur Andersen and Deloitte & Touche oppose the proposal,
while PricewaterhouseCoopers and Ernst & Young support the pro-
posal. Four members of the Independence Standards Board testify:
three support the proposed rules, one is neutral. The Institute of Internal
Auditors opposes a blanket ban on outsourcing, but opposes permitting
total outsourcing due to concerns about independence arising from au-ditors reviewing their own work and assuming managerial responsibil-
ities. Former Senator Howard Metzenbaum and former Federal Reserve
Board Chairman Paul Volcker support the proposed rules.
DENNIS CAPLAN ET AL.16
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
15/32
KPMG partner Robert Elliott, then serving as chairman of theAICPA, testifies:
We in the AICPA are disappointed in the rush to judgment manifest in the SECs
premature issuance of a hastily and poorly drafted rule proposal followed by an inad-
equate comment period.yThere is no evidence that lack of auditor independence is
even an infrequent problem, let alone a current crisis. (Elliott, September 13, 2000) 6
Elliott says this is not about how much accountants are paid. This is
about our ability to provide they same level of high-quality information
for investors that has enabled the American economy to zoom ahead of
the rest of the world (Elliott, September 13, 2000). Elliotts statementcontrasts with the candor exhibited 20 years earlier by the POB:
The Board has also considered and rejected the more extreme view, expressed in
the [Metcalf Report], that auditors be prohibited from furnishing to audit clients
any nonaudit servicesySuch a draconian measure would not only deprive audit
clients of services that they obviously deem valuable but also would cause a sub-
stantial reduction in revenues for many CPA firms. (POB, 1979, p. 2)
In reply to an SEC Commissioner who asked whether there is dissent in
the AICPA about the proposal, AICPA president and CEO Barry
Melancon states that clearly, the overwhelming response of our pro-fession is of grave concern for the proposed rule (September 13, 2000).
In contrast to the remarks by Elliott and Melancon, Jim Schiro, CEO of
PricewaterhouseCoopers, testifies:
We would support restrictions of the types of consulting services accounting firms
provide, including internal audit outsourcing, because we believe that changing
market forces are making it increasingly difficult for firms to provide these services
alongside their assurance practices. (Schiro, September 20, 2000)
Shiro explains that historically, consulting services had not presented an
independence problem, but given the way consulting services were evolv-
ing, consulting and audit services cannot exist under one roof in the
future. Phil Laskawy, chairman and CEO of Ernst & Young, testifies:
Ive grown increasingly concerned during the past several years that the heightened
scrutiny of auditor independence has had a negative impact in the marketplace.
y I have, in other words, been concerned that the appearance that auditors
lack independence could undermine our relationship with the investing public.
(Laskawy, September 20, 2000)
With regard to the AICPA position, Laskawy and Schiro testify:I do not agree with the approach taken by others in the profession, including the
AICPA, in making harsh attacks against the Commission [the SEC] and in trying
to stonewall the Commissions efforts. In fact, I am quite troubled that the AICPA,
Internal Audit Outsourcing 17
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
16/32
which has an obligation to represent all of its members, would take sides in a
fashion that can only weaken public confidence in the accounting profession.
(Laskawy, September 20, 2000)
y I am extremely disappointed that a group that is to represent the members
does not solicit the views of all the members before promulgating a position.y I
find that some of the actions of the leadership of that organization have not been
representativeyof our two firms and did not engage us as they were adopting this
position. (Schiro, September 20, 2000)
The former chairman of Deloitte & Touche, J. Michael Cook, supports
the proposed rules, whereas the current chairman, James Copeland, Jr.,
opposes the proposed rules. Cook testifies:y this issue of independence and non-audit services has been highly visible, a matter
of some concern to the profession, to the Commission and to many others for many
years.yThe profession has, I think, diligently and appropriately sought to address
these concerns over these years. Unfortunately, the profession has not been able to
resolve them, and today the profession is, apparently, quite deeply divided over this
issue.yRegrettably, I conclude thaty some action on the part of the Commission
is probably the only practical and feasible way to deal with the issue.y
Some believe and continue to suggest that SEC action is not warranted absent
proof that independence, in fact, has been impaired by non-audit services. Toaccept this position, one, in my judgment, would have to ignore the importance of
the appearance of independence, which has been a fundamental precept of our
independence standards, our professional standards, for almost 70 years. (Cook,
July 26, 2000)
In contrast, Copeland testifies I firmly believe that the unintended
consequences of this bright line limitation on services will be significant
and far reaching, resulting in a lessening of audit quality and perhaps,
ironically, independence (Copeland, September 20, 2000). On the ques-
tion of independence, Copeland statesWhile there is no empirical evidence to support the assertion that an auditors
independence is impaired when it provides non-audit services to its audit clients,
clearly some do perceive this as an issue and I believe the position that the perception
issue exists. yThe appropriate response to the perception issue is to determine
whether the perception represents reality. I thought the panel on audit effectiveness
did a credible job looking into this issue. (Copeland, September 20, 2000)
The testimonies of these two men indicate a significant difference of
opinion, despite their similar backgrounds with the same firm. In 2005,
Copeland characterized the Sarbanes-Oxley ban on nonaudit services ashasty and ultimately counterproductive (Copeland, 2005, p. 39).
From the academic community, 10 professors testify before the SEC,
offering diverse opinions. Yale professor Rick Antle addresses the
DENNIS CAPLAN ET AL.18
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
17/32
potential synergy that occurs when the external auditors provide con-sulting services:
The real question is not how much value can you add by consulting, but how much
of that value is driven by a tie with auditing.yWhat are these economies of scope
Im talking about? Well, theyre the values of the synergies that are generated by
bundling services. Ill tell you now that as far as I know theres no systematic
evidence as to the magnitude of these economies, just none that I know of. (Antle,
July 26, 2000)
Antle goes on to say that his intuition is that these economies of scope
are substantial, as evidenced by Arthur Andersens ability to rebuild itsconsulting practice in just a few years, after Andersen Consulting had
spun off, from almost nothing (excluding tax services) to revenues ap-
proximately equal to its audit practice.
In October, the Financial Accounting Standards Committee of the
American Accounting Association submits a comment letter to the SEC
regarding the proposed rules (AAA, 2001). The committee summarizes
approximately 30 empirical studies, about 20 of which examine nonaudit
services and/or auditor independence. The Committees summary in-
cludes the following: (1) auditors judgments can be influenced by in-centives to retain audit clients, but the extent to which nonaudit services
influence auditors beyond the desire to retain the audit itself is not clear;
(2) auditors do not appear to use audits as a loss leader to obtain con-
sulting services; (3) studies of users perceptions of whether consulting
services impair auditor independence provide mixed results; and (4) the
only study cited by the Committee that specifically focused on internal
audit outsourcing (Lowe, Geiger, & Pany, 1999) found that loan officers
perceive internal audit outsourcing to compromise auditor independence
only when the same personnel are used for both internal audit and attestservices. Although not cited by the Committee, Swanger and Chewning
(2001) surveyed financial analysts and found results similar to Lowe et al.
The Committee presents its views to the SEC as follows: (1) client-
retention incentives that could impair independence exist in the absence
of nonaudit services, so the incremental benefit of the proposed rules
might be minimal; (2) the proposed rules do not give sufficient weight to
institutional features that provide auditors incentives to maintain in-
dependence, including the risks of litigation and loss of reputation, self-
regulatory features such as the POB and peer review, and oversight byclient audit committees; (3) the proposed rules are likely to negatively
affect auditor competency and audit quality due to the loss of expertise
gained from consulting services and due to the inability to recruit
Internal Audit Outsourcing 19
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
18/32
talented employees; (4) financial statement users are not generally con-cerned about the effect of nonaudit services on auditor independence
when the accounting firm does not use the same professional staff for
nonaudit services as for the attest engagement; and (5) the client audit
committee, not financial statement users, might be the appropriate
benchmark for assessing independence in appearance.J The SECs New Independence Rules. The SEC negotiates a compromise
with the leadership of the AICPA and the Big 5 firms. In November, the
SEC adopts new independence rules that reflect this compromise. The
rules allow auditors to provide up to 40 percent of an external auditclients internal audit function, and completely exempt audit clients that
have less than $200 million in assets. These restrictions apply only to
internal audit services that have potential financial reporting implica-
tions, which probably include most reviews of internal controls. Op-
erational audits, for example, are not subject to these restrictions if the
audits are unrelated to internal accounting controls, financial systems,
or financial statements. Levitt (2003) asserts that internal audit outs-
ourcing was one of the two biggest issues that the SEC attempted to
address with the independence rules of 2000 (p. 146). The AICPAleadership reports to its members on the compromise: Our key issues
included avoiding a blanket ban ony internal audit outsourcing serv-
ices. yConsiderable progress was made. y Shielding smaller firms
from the potential crippling effect of the new rule was and is a high
priority (Miller, 2000).
The new rules also include disclosure requirements for companies to
report the amount of nonaudit services purchased from their external
auditors. These new disclosures facilitated empirical research on non-
audit services that had not been possible using publicly available datafor U.S. companies. The results of this research are mixed. Frankel,
Johnson, and Nelson (2002) find that nonaudit fees are positively as-
sociated with a proxy of earnings management. Kinney, Palmrose, and
Scholz (2004) find that certain unspecified NAS (a subset of nonaudit
services that excludes internal audit outsourcing and some other
major categories of nonaudit services) are positively correlated with
financial statement restatements. Three other papers (Ruddock, Taylor,
& Taylor, 2006; Ashbaugh, LaFond, & Mayhew, 2003; Chung &
Kallapur, 2003) do not find a significant correlation between nonauditservices and audit quality.J The Panel on Audit Effectiveness. The Panel on Audit Effectiveness
issues its Report and Recommendations in August. The Panel had been
DENNIS CAPLAN ET AL.20
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
19/32
appointed by the POB at the request of SEC Chairman Arthur Levitt,to examine the current audit model. The eight-member Panel was
chaired by Shaun OMalley, former Price Waterhouse chairman. The
Panel held public hearings and received input from regulators, industry,
the legal profession, accounting faculty, and accounting firms. The
Panels report covers many issues including auditor independence. A
ban on nonaudit services is the only question on which the Panel re-
ports disagreement among Panel members. The report makes no rec-
ommendation regarding a ban, but includes separate statements by
Panel proponents and opponents of a ban.The Panel members supporting a ban state that nonaudit services
have the potential to compromise the auditors independence in fact as
well as in appearance. When auditors provide nonaudit services, they
are serving two different sets of clients: management and shareholders.
Neither the auditor, the audit firm, client management, nor the audit
committee are likely to be able to adequately assess and address inde-
pendence issues as they arise.
The Panel members opposing a ban are persuaded by the lack of any
specific link between audit failures and the rendering of nonaudit serv-ices (POB, 2000, p. 127). Although the growth of consulting services
has highlighted the appearance problem (p. 127), the Panel identified
no new issues related to consulting services (p. 127) since the POBs
1979 Scope of Services by CPA Firms report. The Panel members op-
posing a ban also reference the Panels review of 37 audit engagements
for clients that also purchased nonaudit services, and 67 peer reviews
conducted in 1999, none of which reported that independence, objec-
tivity, or audit effectiveness appears to have been impaired.
Despite these opposing views, the Panel agreed on the followingstatement:
The Panel is not aware of any instances of non-audit services having caused or
contributed to an audit failure or the actual loss of auditor independence. How-
ever, as the POB noted in its study on scope of services, Specific evidence of loss of
independence through [management advisory services], a so-called smoking gun, is
not likely to be available even if there is such a loss. (POB, 2000, p. 110, emphasis
added)
2001: In January, Richard Miller, AICPA General Counsel and Secretary,
reports to the AICPA membership on the negotiated compromise withthe SEC:
The SEC initially proposed to completely prohibit firms from providing information
technology and internal audit outsourcing services. yWhile this approach [the
Internal Audit Outsourcing 21
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
20/32
negotiated compromise] is not what we were seeking, in that it departs from current
AICPA standards, it is a vast improvement over the proposed blanket ban. Obviously,
the SEC recognized, as a result of comment letters and testimony in its public hear-
ings, that internal audit outsourcing is a very important servicey (Miller, 2001,
emphasis added)
J The Independence Standards Board. The ISB had issued a discussion
memorandum for public comment on a conceptual framework for
auditor independence in February 2000, followed by an exposure draft
in November. A final draft is issued in 2001, but soon thereafter, in
July, the ISB votes to dissolve. According to Alan Glazer and Henry
Jaenicke, who were directors of the conceptual framework project, the
ISB lost support from both the SEC and the accounting profession soon
after its formation, in part because the SEC and large accounting firms
held irreconcilable positions on independence in appearance. The ISB
initially sought middle ground, incorporating in the exposure draft the
concept of independence in appearance, but avoiding the term itself.
This compromise satisfied nobody, and the status and potential role
of the ISB were undermined when the SEC issued its independence
rules in 2000, preempting much of the ISBs agenda. Glazer and
Jaenicke claim that a majority of the conceptual framework task force
supported including independence in appearance as a central element
of the framework, and the Board itself concurred. Independence in
appearance probably would have been included in the final statement,
had the ISB survived long enough to issue one (Glazer & Jaenicke,
2002).J Enron. Enron files for bankruptcy on December 2, 2001. In the ensuing
months, Arthur Andersen comes under fire for, among other things, a
potential lack of independence with respect to the audit because Arthur
Andersen provided Enron significant consulting services, including in-
ternal audit services. Fifteen months prior to Enrons bankruptcy, Joe
Berardino, then a managing partner of the firm, testified to the SEC on
internal audit outsourcing:
When this internal auditing is performed by the same firm that is hired to audit the
financial statements, that firm significantly enhances its knowledge. Who benefits
when the audit firm has this enhanced knowledge? I would suggest the investing
public. ySome say that we are auditing our own numbers in doing what I just
described. I disagree. What we feel we are doing is simply auditing more of the
clients business. (Berardino, September 20, 2000)
As reported by the PBS program Frontline, on the same day as
Berardinos testimony, Enron chairman and CEO Kenneth Lay
DENNIS CAPLAN ET AL.22
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
21/32
submitted a letter to the SEC in opposition to the SECs proposedrestrictions on internal audit outsourcing:
The proposed rule would preclude independent financial statement auditors from
performing certain internal audit services. The description of inappropriate ac-
tivitiesy could restrict Enron from engaging its independent financial statement
auditors to report on the companys control processes on a recurring basis as the
company has now arranged. I find this troubling, not only because I believe the
independence and expertise of the independent auditors enhances this process, but
also because Enron has found its integrated audit arrangement to be more
efficient and cost-effective than the more traditional roles of separate internal and
external auditing functions. Frankly, I fail to understand how extending the scope
of what is independently audited can be anything but positive. ( Lay, September 20,
2000)
According to Levitt (2003): yAndersens independence was compro-
mised. Andersen had been acting as Enrons internal auditory. This
meant that Arthur Andersen was, at times, reviewing its own work
rather than acting as an impartial check on the accuracy of the clients
figures (p. 151). 2002: In January, the General Accounting Office issues rules significantly
changing auditor independence requirements for audits that must complywith GAO standards (U.S. GAO, 2002). The GAO identifies two over-
arching principles: (1) Audit organizations should not provide nonaudit
services that involve performing management functions or making man-
agement decisions. (2) Audit organizations should not audit their own
work or provide nonaudit services in situations where the nonaudit serv-
ices are significant or material to the subject matter of the audit. The GAO
prohibits auditors from providing internal audit services to attest clients
that do not have their own internal audit function; that is, total outs-
ourcing is prohibited. As of 2006, the rules promulgated by the AICPAconcur with the first of the GAOs overarching principles, but not with the
second. As regards internal audit outsourcing, the AICPA rules are less
restrictive than the GAO rules, because the AICPA permits total outs-
ourcing if appropriate controls are in place (AICPA, 2005).
Also in January, the POB votes to dissolve. The vote was made re-
luctantly and as a matter of principle, three days after SEC Chairman
Harvey Pitt announced a proposal for a new, private-sector regulatory
structure (POB, 2001, p. 2). The POB had been excluded from discussions
between the SEC and the accounting profession that preceded the pro-posal. In explaining its reasons for the vote, the POB also cites a lack of
cooperation from the AICPA and the Big 5, including a decision by the
AICPA in 2000 to withhold funding for certain oversight activities that
Internal Audit Outsourcing 23
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
22/32
the SEC had urged the POB to undertake, but that the accounting firmsfound objectionable. On May 1, the POB disbands after 25 years as a key
self-regulatory bodyJ Congressional Hearings on Enron. In Congressional testimony in the
months leading up to passage of Sarbanes-Oxley, regulators and other
commentators provide a generally critical look at the public accounting
profession. The current SEC chairman and every living former chair-
man since 1975 testify before the U.S. Senate Committee on Banking,
Housing, and Urban Affairs.
Rod Hills, chairman from 1975 to 1977, opposes a legislative ban onconsulting services, but states: it is increasingly clear that the accounting
profession is not able consistently to resist management pressures to
permit incomplete or misleading financial statements (U.S. Senate,
2002a). Harold M. Williams, chairman from 1977 to 1981, does not favor
legislation, but observes: The case for insisting that an auditor not
provide other services to the client it audits is a strong one (U.S. Senate,
2002a). David Ruder, chairman from 1987 to 1989, urges the Big 5 firms
to refrain from offering management consulting services to audit cli-
ents, and testifies that the independence rule of 2000 seems to recognizethat outsourcing the internal audit functions to the companys external
auditors creates conflicts or appearances of conflicts because the external
auditor eventually will be auditing its own work (U.S. Senate, 2002a).
Ruder urges the SEC to monitor this portion of the rule, and to consider
prohibiting external auditors from engaging in internal auditing, with
exceptions for small businesses. Richard Breeden, an attorney who was
SEC chairman from 1989 to 1993 and a senior partner at Coopers &
Lybrand for three years afterwards, testifies: at a minimum, the auditing
firms should be prohibited from providing financial structuring, invest-ment banking, internal audit, data processing systems, and legal services
for audit clients, and perhaps for any client (U.S. Senate, 2002a). Arthur
Levitt, SEC chairman from 1993 to 2001, states:
Its well past time to recognize that the accounting professions independence has
been compromised. Two years ago, the SEC proposed significant limits on the
types of consulting work an accounting firm could perform for an audit client. An
extraordinary amount of political pressure was brought to bear on the Commis-
sion. We ended up with the best possible solution given the realities of the time. I
would now urge at a minimum that we go back and reconsider some of the
limits originally proposed. (U.S. Senate, 2002a)
Current Chairman Harvey Pitt opposes a blanket ban on nonaudit
services, stating that sufficient time has not passed since the SEC
DENNIS CAPLAN ET AL.24
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
23/32
independence rules of 2000 to determine whether additional restrictionsare needed.
Shaun OMalley, former chairman of Price Waterhouse, and chair of
the Panel on Audit Effectiveness, testifies:
The SECs November 2000 rule prohibits the provision of many nonaudit services
to audit clients. However, two important services were not adequately addressed in
the rule. These services constitute a significant part of the nonaudit services being
performed by audit firms: (1) financial information systems design and implemen-
tation and (2) internal audit outsourcing.yAll five major firms now have agreed
to the proscription of such services to audit clients, and the AICPA also has
supported that position with respect to public companies.y [T]he professions decision to forego financial information systems design and
implementation and internal audit outsourcing services to audit clients is correct.
y [T]he evidence is strong that such services are perceived as a threat to inde-
pendence. Furthermore, both services should typically be performed by the man-
agement of an issuer, not by its auditors. (U.S. Senate, 2002b)
Bevis Longstreth, another member of the Panel on Audit Effectiveness
and a former member of the SEC, testifies:
Despite the SECs adoption of [the independence rules in 2000], the threat to an
auditors independence from performing non-audit services allowed by the Ruleremains palpable.y [A]n effective system of self-regulation does not exist and can
not be achieved without legislative reformy. (U.S. Senate, 2002b)
On the topic of the SECs independence rules of 2000, Longstreth tes-
tifies:
[I]t took both boldness and courage to issue the Proposing Release. Thats because,
by so doing, the SEC knowingly unleashed an unprecedented attack from those it
was seeking to regulateyThe ensuing battle, and it was clearly a battle, pitted a
legally created monopoly, dominated by five global accounting firms, against the
SEC. Three of the five, representing solely their private business interests, rejectedany meaningful restrictions on the free play of those interests.y
In the tumult of the moment, many leaders of the accounting profession and
here I must say I am not including leadership of the POB forgot their professions
origins as one granted exclusive rights, and reciprocal duties, to perform a vital
public service.y [T]hese leaders were demanding freedom from serious oversight
or constraint.
When the smoke had cleared,y the profession had won the battle.yThe SEC
adduced strong and abundant evidence in the rule-making processy that provid-
ing to ones audit client non-audit services of any kind or kinds, if large enough in
terms of fees paid, may impair independence. Despite this powerful predicate for
rule-making, the rule adopted fails absolutely to address this concern.y
I suggest
a simple exclusionary rule covering virtually all non-audit services, in place of the
deeply complex, existing rule that I hope, by now, to have convinced you is in-
effective. (U.S. Senate, 2002b)
Internal Audit Outsourcing 25
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
24/32
Charles Bowsher, chairman of the POB at the time that it voted to
terminate its existence earlier in 2002, testifies: The POB proposes that
SEC regulations concerning independence be legislatively codified with
appropriate revisions to update restrictions on scope of services in-
volving information technology and internal audit services(U.S. Sen-
ate, 2002c). John Whitehead, former co-chairman of Goldman Sachs
and former co-chairman of the Blue Ribbon Committee on Improving
the Effectiveness of Corporate Audit Committees, states Having given
the matter a lot of thought in recent years, y I have reached the con-
clusion that the accounting firm that does the audit should not do other
advisory work for the company (U.S. Senate, 2002c).
On March 13, Barry Melancon, president and CEO of the AICPA,
testifies before the Committee on Financial Services of the U.S. House
of Representatives. After noting the lack of evidence that nonaudit
services impairs auditor independence, and listing the benefits to au-
ditors and their clients from the opportunity for auditors to provide
nonaudit services, Melancon repeats a statement that was announced
by the AICPA six weeks earlier:
Nevertheless, the profession recognizes that public concern about two particularservices financial system design and implementation, and internal audit outs-
ourcing has become intense, with a corrosive effect on public confidence. With our
public interest test in mind, the profession has concluded that it will not oppose
prohibitions on auditors of public companies from providing these two services to
audit clients. In the wake of Enron, such prohibitions will help restore public con-
fidence in the profession and the financial reporting system, without posing a sig-
nificant threat of unintended consequences. (U.S. House of Representatives, 2002)
Former SEC Chief Accountant Lynn Turner testifies: after cases such
as Waste Management and Enron, no longer are people asking, where
is the smoking gun (U.S. House of Representatives, 2002).The Sarbanes-Oxley Act. The Sarbanes-Oxley Act is signed into law
on July 30, 2002. Section 201 of the Act lists prohibited services that
are deemed outside the scope of the practice of public accountants. It is
unlawful for an accounting firm to provide these services to an attest
client. The list includes internal audit outsourcing. Sarbanes-Oxley also
establishes the Public Company Accounting Oversight Board as a reg-
ulatory body with oversight responsibility for the public accounting
profession. At the end of the year, three former SEC chief accountants
send a letter to the Board identifying areas in which the PCAOB shouldshow strong leadership. The letter states:
If investors believe that a particular service conflicts with an auditors ability to be
independent, then that service should be prohibited. Accordingly, it is important
DENNIS CAPLAN ET AL.26
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
25/32
that the provisions of the Sarbanes-Oxley legislation dealing with the independence
of auditors be implemented rigorously and not weakened in any way. (Schuetze,
Sutton, & Turner, 2002)
2003: In January, the SEC adopts rules implementing Title II of Sarbanes-
Oxley. The SEC identifies three basic principles related to nonaudit
services: (1) an auditor cannot function in the role of management; (2) an
auditor cannot serve in an advocacy role for his or her client; and (3) an
auditor cannot audit his or her own work. With respect to internal audit
outsourcing:
These rules will prohibit the accountant from providing any internal audit service thathas been outsourced by the audit client that relates to the audit clients internal
accounting controls, financial systems or financial statements unless it is reasonable to
conclude that the results of these services will not be subject to audit procedures during
an audit of the audit clients financial statements. (SEC, 2003a, emphasis added)
Similar to the independence rules that the SEC adopted in 2000, certain
types of internal audit services are generally permitted. Under the 2000
rules, internal audit services were permitted without limitation for the
size of the company or the extent of outsourcing, if those services did
not relate to internal accounting controls or financial reporting systems.
Similarly, the rules that the SEC adopts in 2003 permit auditors to provide
internal audit services to attest clients if those services are unrelated to
the clients internal accounting controls, financial systems, and finan-
cial statements. In addition, the 2003 rules permit auditors to provide
internal audit services related to internal accounting controls, financial
systems, and financial statements, if it is reasonable to conclude that
the auditors will not be reviewing their own work during the attest en-
gagement.
Also, the 2003 rules allow companies to engage the auditor to perform
nonrecurring evaluations of discrete items that are not in substance the
outsourcing of the internal audit function. For example, the company may
engage the accountant to conduct agreed-upon procedures engage-
ments related to internal controls, since management is responsible for the
scope and assertions in those engagements (SEC, 2003b). The requirement
for management to take responsibility for the scope and assertions in
those engagements is similar to the AICPA ethics rulings that were
adopted in 1996. Hence, the SECs rules seem to permit partial outs-
ourcing of the internal audit function to the companys external auditors,
if the engagement is nonrecurring.
The rules that the SEC adopts in 2003 appear consistent with the
position offered by SEC Chairman Harvey Pitt during the Congres-
sional hearings in 2002, but more permissive than the letter of the law in
Internal Audit Outsourcing 27
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
26/32
Sarbanes-Oxley. The Act identifies internal audit outsourcing as a prohib-ited service, and seems only to allow exceptions on a case by case basis.
The SEC, on the other hand, in pursuing its stated objective of clarifying
the scope of the prohibited services, seems to give general permission for
auditors to provide certain types of internal audit services to their attest
clients.
3. SUMMARY AND CONCLUSION
This paper has reviewed the accounting professions self-regulation with
respect to the question of whether auditors compromise their independence
when they provide internal audit services to their attest clients. In this sec-
tion, we assess the extent of consensus within the accounting profession and
within the regulatory community on this issue, we comment on the AICPAs
role, and we provide concluding remarks.
3.1. Consensus within the Accounting Profession and the RegulatoryCommunity
There never was unanimity within the regulatory community or the ac-
counting profession on the issue of internal audit outsourcing. However,
there was a strong consensus of concern among regulators. From 1984 until
2000, the SEC never publicly condoned the provision of internal audit serv-
ices by a companys external auditors. The first official SEC sign-off occurred
in the politically motivated compromise of 2000. The consensus within the
SEC might be due to Arthur Levitts influence during his eight-year tenure aschairman. However, the SEC expressed concerns prior to Levitt, as did sev-
eral former SEC chairmen during the 2002 Senate subcommittee hearings
(although testimony in 2002 may have been influenced by hindsight). The
General Accounting Office examined the issue but did not identify a signifi-
cant threat to independence until after the Enron bankruptcy. Bank regu-
lators expressed concerns related to the internal controls reporting
requirements of FDICIA. To summarize, the regulatory community exhib-
ited a general consensus prior to 2002, with the SEC under Levitt exhibiting
more concern than other regulators, and the regulatory community exhib-iting a strong consensus by 2002 but still not unanimity.
Within the accounting profession, if the profession is defined to include
accountants who are not engaged in public practice, there was always a
DENNIS CAPLAN ET AL.28
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
27/32
difference of opinion. Professional organizations representing managementaccountants and internal auditors questioned the propriety of internal audit
outsourcing, particularly with respect to total outsourcing. If the profession
is defined narrowly to include only accountants providing attest services,
then there appears to have been a strong consensus until the debate over the
proposed SEC independence rules in 2000. At that point, some current and
former leaders of the profession seemed to conclude that a costbenefit
analysis of the independence-in-appearance issue made compromise de-
sirable.
3.2. The Role of the AICPA
With respect to the question of whether auditors compromise their inde-
pendence when they provide internal audit services to their attest clients, the
leadership of the AICPA and the large public accounting firms never iden-
tified an independence-in-fact issue, and for the most part, did not express a
desire to respond to concerns about independence in appearance by cur-
tailing the provision of these services. The independence-in-appearance is-sue, in particular, led to conflicts between the SEC and the profession, and
to criticism of the profession by current and former Congressional leaders.
The AICPA was somewhat confrontational, as illustrated by comparing the
moderate views expressed by the POB in its 1979 Scope of Services report
with statements made by the AICPA leadership, and also by comparing the
mixed views contained in the report by the Panel on Audit Effectiveness
with the strongly worded statements from the AICPA leadership during the
SEC hearings of 2000.
Regarding the efficacy of self-regulation of internal audit outsourcing, thetwo private-regulatory bodies with the most significant ongoing responsi-
bility for auditor independence were the POB and the Professional Ethics
Division of the AICPA. Importantly, neither body was entirely independent
of the AICPA. The Professional Ethics Division is an integral part of the
AICPA. The POB, although organizationally independent of the AICPA,
relied on discretionary funding from the profession. The importance of this
dependence was illustrated during the POBs final years, when the AICPA
withheld funding that the POB needed to fulfill its agreement with the SEC
to review compliance by the Big 5 with the professions stock ownershiprules.
Consequently, any evaluation of self-regulation of auditor independence
requires an evaluation of the AICPAs conduct, and the difficult dual role
Internal Audit Outsourcing 29
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
28/32
the AICPA played: as an organization that oversaw self-regulatory activ-ities; and as a membership organization that represented and advanced the
professional and economic interests of its members. One criterion by which
to judge the AICPA is a standard proposed by Mautz and Sharaf 45 years
ago: Like the individual practitioner, the profession as a whole must avoid
any appearance of lacking independence (Mautz & Sharaf, 1961, p. 209).
With respect to internal audit outsourcing, the leadership of the AICPA
maintained a position consistent with protecting the financial interests of
public accounting firms. During this time, the AICPA seldom acknowl-
edged, let alone represented to regulators and to the public, the diverseviews of its broad-based membership; a membership that includes not
only accountants in public practice, but also CPAs who work in industry,
government and education.
3.3. Conclusion
In 1990, internal audit outsourcing was a consulting service that was un-
familiar even to most accountants. In 2002, Congress identified it by nameas a consulting service that is incompatible with the independence of the
public accountant. This paper has reviewed how, in 12 years, internal audit
outsourcing went from obscurity to become a familiar expression in the halls
of Congress. We believe that the acrimonious and visible confrontation over
internal audit outsourcing that occurred between the SEC and the public
accounting profession in 2000 helped shape the Congressional hearings two
years later that led to Sarbanes-Oxley. Enron has been referred to as a
perfect storm. We subscribe to a modified perfect-storm theory: Enron
and WorldCom led to legislation that would not have occurred except underextraordinary circumstances, but the accounting professions refusal to take
self-regulatory actions that the SEC would have considered meaningful in
2000 was an integral part of that storm.
Despite Sarbanes-Oxley, the regulation and self-regulation of internal
audit outsourcing remains an important topic. The Sarbanes-Oxley prohi-
bition applies only to public companies, so the AICPA and various state
boards of accountancy continue to promulgate independence standards for
audits of private companies. Also, as discussed above, the rules that the SEC
issued in 2003 to implement Sarbanes-Oxley seem to allow accounting firmsto provide certain types of internal audit services to public company attest
clients that would seem inconsistent with a nave reading of the legislation.
The large accounting firms have not yet shown an interest in testing the
DENNIS CAPLAN ET AL.30
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
29/32
limits of these SEC regulations, perhaps because of a sense of conservatismbrought about by the demise of Arthur Andersen, or perhaps because of
increased audit workloads related to Sarbanes-Oxley Section 404 compli-
ance. However, when the accounting firms have the available staff, the reg-
ulation and self-regulation of internal audit outsourcing may again become
an important policy debate.
NOTES
1. Formally, the Report of the National Commission on Fraudulent FinancialReporting (1987).
2. The recommendation for an internal audit function became a requirement forcompanies on the New York Stock Exchange in 2003 (NYSE, 2003). The require-ment is for an internal audit function, not an internal audit department, and anoutsourced internal audit function satisfies the NYSE listing requirement. The rec-ommendation for an annual management report on internal controls became a re-quirement for large financial institutions with the passage of the Federal DepositInsurance Corporation Improvement Act of 1991, and a requirement for all U.S.public companies with the passage of the Sarbanes-Oxley Act in 2002.
3. The accounting firm was Knapp and Company. The letter from the SEC to theaccounting firm is dated August 31, 1984. Information about this correspondence isreported in Barber (1995).
4. The IIAs change in position is analyzed in Rittenberg and Covaleski (2001).5. Two examples of audit failures in which nonaudit services may have played a
role, Colonial Reality and Westec, are referenced in Thornton (2003, p. 51).6. With respect to testimony provided to the SEC in 2000, we provide the name of
the individual and the date of his testimony immediately following the quotation. Inthe References section of the paper, we do not list each individual separately, butprovide the web address for the hearings (SEC, 2000b). With respect to the SEChearings in 2000 and the Congressional hearings in 2002, we correct spelling errors in
the transcript without using sic.
ACKNOWLEDGMENTS
We would like to thank seminar participants at Portland State University
for helpful comments. We would like to acknowledge Professor John
Thornton for sharing his insights with respect to the hearings that the SEC
held in 2000 related to the SECs proposed independence rules. We are
grateful to Joan Sterling, Technical Manager of the Professional EthicsDivision of the AICPA, for providing us comment letters and other relevant
documents related to the ethics rulings and interpretations issued by the
Professional Ethics Executive Committee.
Internal Audit Outsourcing 31
-
7/29/2019 INTERNAL AUDIT OUTSOURCING: AN ANALYSIS OF SELFREGULATION BY THE ACCOUNTING PROFESSION
30/32
REFERENCES
Advisory Panel on Auditor Independence. (1994). Strengthening the professionalism of the in-
dependent auditor. Stamford, CT: Public Oversight Board.
American Accounting Association (AAA). (2001). Financial Accounting Standards Committee.
SEC auditor independence requirements. Accounting Horizons, 15(4), 373386.
American Institute of Certified Public Accountants. (2000). SEC proposes sweeping rules; ripple
effect could impact firms that audit private companies. The CPA Letter, 80(7), 1, 6.
American Institute of Certified Public Accountants. (2005). AICPA GAO independence rules
comparison: Nonaudit services. Available at www.aicpa.org/download/ethics/
2004_02AICPA-GAO_rules_comparison.pdf
American Institute of Certified Public Accountants (AICPA), Professional Ethics Executive
Committee. (1993). Ethics Ruling No. 97 under Rule of Conduct 101. Performance of
certain extended audit services. New York, NY: AICPA.
American Institute of Certified Public Accountants, Professional Ethics Executive Committee.
(1996a). Ethics Ruling No. 103 under Rule of Conduct 101. Member providing attest
report on internal controls. New York, NY: AICPA.
American Institute of Certified Public Accountants, Professional Ethics Executive Committee.
(1996b). Ethics Ruling No. 104 under Rule of Conduct 101. Member providing oper-
ational auditing services. New York, NY: AICPA.
American Institute of Certified Public Accountants, Professional Ethics Executive Committee.
(1996c). Ethics Ruling No. 105 under Rule of Conduct 101. Frequency of performance of
extended audit procedures. New York, NY: AICPA.
American Institute of Certified Public Accountants, Professional Ethics Executive Committee.
(1996d). Interpretation No. 101-13 under Rule of Conduct 101. Extended audit services.
New York, NY: AICPA.
Ashbaugh, H., LaFond, R., & Mayhew, B. W. (2003). Do non-audit services compromise
auditor independence? Further evidence. The Accounting Review, 78(3), 611639.
Auditing Standards Board. (1994). Audit risk alert 1994. New York, NY: