INTERNAL AUDITORS' RESPONSES TO EXTERNAL AUDITORS' CRITICISMS
OF THE SYSTEM OF INTERNAL CONTROLS







BY

ALAN B. FRIEDBERG


A DISSERTATION PRESENTED TO THE GRADUATE COUNCIL OF THE
UNIVERSITY OF FLORIDA IN PARTIAL FULFILLMENT OF THE
REQUIREMENTS FOR THE DEGREE OF DOCTOR OF PHILOSOPHY





UNIVERSITY OF FLORIDA


1983















































Copyright 1983

by
Alan H. Friedberg















ACKNOWLEDGEMENTS

I wish to acknowledge the contributions made to this

study by my dissertation committee: Rashad Abdel-khalik,

Bipin Ajinkya, Douglas Snowball, John Brooks, and Roger

Elliot.

I wish to express appreciation to the subjects who

participated in the experiment and to the NAA, IIA, and EDPA

chapters which helped arrange for subjects. I would also

like to thank the undergraduate and graduate accounting

students and faculty at the University of Florida who

helped by taking the pilot tests.

I am indebted to Hadley Schafer for helping me contact

potential subjects.

I must thank my wife, Barbara, for endless hours of

editing and my entire family and parents for their

continued encouragement and support.
















TABLE OF CONTENTS


PAGE

ACKNOWLEDGEMENTS ............................... iii

LIST OF TABLES ................................. vii

LIST OF FIGURES ................................ x

ABSTRACT ....................................... xii

CHAPTER

I INTRODUCTION ......................... 1

The Research Issue ................... 2

Motivation for the Study ............. 3

The Selection of Internal Auditors
as Subjects .......................... 7

The External Auditor's Recommendation 8

Description of the Study ............. 10

Organization of Remaining Chapters ... 13

II BACKGROUND AND LITERATURE REVIEW...... 14

Audit Committees and the Review of
Internal Control Criticisms .......... 15

Cost-Benefit Analysis ................ 17

External Auditors' Reliance on Internal
Auditors' Work ....................... 27

Auditors' Ability to make Internal
Control Judgments .................... 29










The Differential Impact of Source
Characteristics on the Internal
Auditor's Decision ................... 32

III RESEARCH METHODS .................... 40

Model of Corporate Behavior .......... 40

Experimental Design .................. 42

The Role of the Independent and
Dependent Variables in the Overall
Decision Model ....................... 57

Subjects ............................. 61

Chapter Summary ...................... 65

IV CAUSAL MODELS AND PATH ANALYSIS ...... 67

V ANALYSIS AND RESULTS ................. 81

Disposition of Missclassified
Responses ............................ 84

Intended vs Perceived Classification 87

Subject Reliability .................. 93

Hypothesis One ....................... 97

Hypothesis Two ...................... 101

Tone ................................. 106

Hypothesis Three ..................... 108

Path Analysis ........................ 111

Chapter Summary ...................... 121

VI SUMMARY AND CONCLUSIONS .............. 123

Summary ............................. 123

Conclusions and Implications ......... 128

Limitations of This Study ............ 131

Suggestions for Future Research ...... 133

v












APPENDICES

A INSTRUCTIONS FOR SUBJECTS ............ 135

B SCENARIOS ........................... 140

C ADDITIONAL QUESTIONS ................. 178

D EXPLANATION OF ADDITIONAL QUESTIONS .. 181

E PRE-TESTING .......................***. 183

F FORMULAS FOR PARTIAL CORRELATION
COEFFICIENTS ........................ 186

BIBLIOGRAPHY ........................................ 188

BIOGRAPHICAL SKETCH .............................. 196















LIST OF TABLES


Table Page
3-1 Expected Effects of Change Types on
Internal Control Reliability ............. 46

3-2 Packages of Scenarios .................... 51

3-3 Relationship Between Expected Subject
Perception and Corresponding Manipulation
of Internal Control Change ................ 54

3-4 Possible Subject Perceptions and the
Corresponding Values of Difference ........ 55

3-5 Subject Pool and Response Rate ............ 64

4-1 Abbreviated Form of Variable Names ........ 68

4-2 Formulas Used to Generate Path Coefficients
Used in the Model ......................... 75

4-3 Correlation Pairs and Connecting Paths for
the Four-Variable Model ................... 77

4-4 Formulas Used to Generate Path Coefficients
in the Five-Variable Model ................ 79

4-5 Correlation Pairs and Connecting Paths for
the Five-Variable Model ................... 80

5-1 Abbreviations for Variables ............... 83

5-2 Table of Missclassified Responses as a
Percentage of All Responses ............... 84

5-3 Distribution of Subjects' Classification of
Type-P2 Scenarios ......................... 85

5-4 Distribution of Subjects' Classification of
Type-P3 Scenarios ......................... 86

5-5 Comparison of the Intended and Perceived
Results ................................... 92

vii









5-6 Scores Resulting From Comparisons Between
Dependent Variables Classified by Type of
Change (Intended and Perceived) and Sets of
Missclassified Data ....................... 94

5-7 Distribution of Returned Scenarios by
Independent Variable ...................... 97

5-8 Evaluation of Changes in Costs and Benefits
for Types of Changes ..................... 98

5-9 Mean Points Allocated to Source and Tone,
Classified by Perceived Type of Change .... 99

5-10 Mean Points Allocated to Cost-Benefit,
Classified by Perceived Type of Change .... 188

5-11 F-Values and Probabilities of Independent
Variable "Source", from ANOVAs of
Independent Variables on Selected
Dependent Variables ....................... 102

5-12 The Expected Effects of Source on Average
Recommendation When Classified by Type of
Change ................................... 104

5-13 Means of Average of Variable "Decision"
Classified by Perceived Type of Change and
Source of Recommended Change .............. 106

5-14 Test of Difference in Mean Points Allocated
to Tone When Responses are Classified by
Intended Manipulation of Tone ............. 108

5-15 Expected Values of the Variable "Difference"
for All Perceived Types of Changes ....... 189

5-16 Tests of the Variable "Difference"
Classified by Type of Change ............. 110

5-17 Correlation Coefficients For Variables in
the Path Analysis Model ................. 112

5-18 Variables Used in Path Analysis .......... 113

5-19 Decomposition of Path Coefficients From
Unclassified All-Data Model .............. 116

5-20 Path Coefficients for Classified and
Unclassified Models ...................... 118

viii









5-21 Path Coefficients in Order of Magnitude by
Perceived Type of Change ................. 119















LIST OF FIGURES

Figure Page
2-1 General Model of Factors Influencing
Auditors' Responses to External
Criticism of the System of Internal
Controls ................................. 39

3-1 Possible Combinations of Adding and
Deleting a Substitute or Complement
Control .................................. 45

3-2 Four Combinations of Source and Tone ..... 49

3-3 Decision Model of Factors Influencing
Internal Auditor's Response to External
Criticism of the System of Internal
Control .................................. 58

3-4 Decision Model of Perceived Factors
Influencing Internal Auditors' Responses
to External Criticism of the System of
Internal Controls ....................... 61

4-1 Four-Variable Causal Model .............. 69

4-2 Model of the Relationship Between Change,
Importance, and Decision ................ 69

4-3 Blalock's Model Al ...................... 71

4-4 Five-Variable Model ..................... 78

5-1 Plots of the Average of the Variable
"Difference" as a Function of Intended
and Perceived Changes ................... 89

5-2 Plots of the Average of the Variable
"Decision" as a Function of Intended and
Perceived Changes ...................... 90

5-3 "Source" Influence of the Average of the
Subjects' Decisions as a Function of
Perceived Change ...................... 105









5-4 Unclassified Path Analysis Model Using
All Data ............................... 115















Abstract of Dissertation Presented to the Graduate Council
of the University of Florida in Partial Fulfillment of the
Requirements for the Degree of Doctor of Philosophy


INTERNAL AUDITORS' RESPONSES TO EXTERNAL AUDITORS' CRITICISMS
OF THE SYSTEM OF INTERNAL CONTROLS




By

Alan H. Friedberg

December, 1983

Chairman: Rashad Abdel-khalik
Cochairman: Bipin B. Ajinkya
Major Department: Accounting

Internal auditors must evaluate external auditors'

recommendations for changes in the internal auditors'

systems of internal controls. This study examines some of

the factors that influence internal auditors in their

evaluation. An experiment was performed using 125 internal

auditors as subjects. Each subject was presented with four

scenarios which emphasized each of four factors that were

thought to influence the internal auditors' decision

processes: (1) costs and benefits of the change, (2) source

of the recommendation, (3) tone of the recommendation, and


xii










(4) importance of the internal control procedure being

changed.

Results indicated that the first factor was

consistently the most important influence on the decision

makers. Factors two, three, and four varied in relative

importance depending on circumstances specified in the

scenarios.


xiii
















CHAPTER I
INTRODUCTION

Corporate managers are responsible for safeguarding the

assets and assuring the reliability of the corporation's

financial statements. In all but the smallest firms,

management must fulfill these responsibilities by installing

and maintaining a system of internal controls.

The establishment and maintenance of a system
of internal control is an important
responsibility of management. The system of
internal control should be under continuing
supervision by management to determine that
it is functioning as prescribed and is
modified as appropriate for changes in
conditions. [AICPA, 1982, section AU320.31]

Internal auditors play a major role in managers'

efforts to maintain an effective and efficient system of

internal control. In particular, internal auditors are

involved in the process by which managers modify the system

in response to changed conditions. This study focuses upon

internal auditors' responses to recommended changes in

internal control systems. Through experimentation, this

study seeks to provide empirical evidence that will

facilitate understanding of the process by which internal

control systems are modified.

The primary purposes of this first chapter are to

identify and describe the research issue and to justify its











importance as a topic for research. The first two sections,

therefore, consist of a brief presentation of the research

issue and of the motivations that led to the choice of the

research topic. In the next section, the specific role of

the internal auditor in the process of modifying internal

control systems is examined. The remaining sections

provide a summary of the empirical study that was designed

to address the research issue. The empirical study, which

used practicing internal auditors as subjects, is reported

in depth throughout the remaining chapters.


The Research Issue

The internal audit staff is responsible for reviewing

the system of internal control and evaluating internal and

external criticisms of the system. One common source of

external criticism is the external auditor's "management

letter." Therefore, the focus of this study is the response

of internal auditors to the types of criticisms that are

often found in letters to management.

It is important to know why internal auditors respond

to criticisms of their internal control systems for several

reasons. These reasons can be categorized by the viewpoints

of several interested parties.

Internal auditor's point of view. The internal auditor

should be aware of the relative importance of various

factors on his decision process. This awareness will help











him reconcile his method of approaching his job with

management's expectations of him. In this sense, the

factors that influence his opinion are, to some degree, a

measure of his professionalism and independence.

External auditor's point of view. The external auditor

is frequently the source of the criticism. It would be in

his interest to have a better understanding of the impact of

his communication in order to make it more effective.

Audit committee's point of view. The audit committee

must motivate the internal auditors and engage the external

auditor in a way designed to make the interests of the

internal auditors, external auditors, audit committee, and

shareholders coincide as much as possible. For this reason,

the audit committee must be informed about the factors

influencing the internal auditors' decisions.

Unfortunately, not much is known about how internal

auditors respond to criticisms of their system of internal

controls. Therefore, this study is an empirical attempt to

describe the relative importance of some of the factors that

influence the internal auditor's decision process.



Motivation for the Study

Three forces in the current business environment

heighten the importance of research in this area. These

are (1) the increasing importance of corporate audit










committees, (2) the Foreign Corrupt Practices Act (FCPA),

and (3) the impact of EDP-related fraud.

Corporate audit committees. It is becoming common for

the directors of large corporations to establish audit

committees. The audit committee is the body ultimately

responsible for the maintenance and organization of internal

control. This responsibility is based in the Foreign

Corrupt Practices Act (FCPA), Securities and Exchange

Commission (SEC) release no. 34-15772, New York Stock

Exchange (NYSE) rules, and The Statement of Auditing

Standards (SAS) section 320.28 [Baruch, 1980 p. 174-5].

Among other things, the audit committee must decide

issues involving changes in the system of internal controls.

Furthermore, it must document those decisions. Therefore,

the more important audit committees become, the more

important it is to understand the method by which audit

committees obtain their information and document it.

The reason an audit committee must carefully document

its work is illustrated by the fact that the FCPA does not

provide "definitive criteria for management to use in

evaluating the adequacy of its system of internal accounting

control" [Neumann, 1981, p. 79]. Yet, the audit committee

is responsible for the quality of the internal control

system. Therefore, the committee should document the extent

of its efforts to achieve an acceptable system.










Even though the NYSE requires domestic companies traded

on the exchange to have corporate audit committees, the

duties of the committees have not been specified by any of

the authoritative organizations involved [Baruch, 1980, p.

174]. However, there is an increased popularity, or demand,

for the audit committee. Reasons given for this increased

popularity of the corporate audit committee range from

"heightened public awareness of corporate responsibility" to

"management's desire for self-regulation" [Neumann, 1981, p.

78]. One reason for the increasing importance of corporate

audit committees is suggested by Neumann: a lack of audit

committee participation might be viewed by the SEC as a

weakness in internal control under the FCPA.

Impact of the Foreign Corrupt Practices Act. The

second force in the current business environment that

increases the importance of research in this area is the

impact of the FCPA. The FCPA has focused attention on

internal control as a social issue. It has also redefined

the responsibilities of corporate boards of directors. Even

though the Act was initiated as a measure to inhibit the

bribery of foreign officials, it has had a significant

impact in directing accountants' attention to the importance

of internal controls beyond those necessary to insure the

fairness of financial statements. Thus, it provides a

motivation for examining the mechanisms through which

changes in internal controls occur.









EDP-related frauds. The third force in the current

business environment is the increasing frequency and rising

dollar amount of EDP-related fraud. This is, of course, a

result of increasing reliance placed on computers by modern

business. The result is due to a perverse relationship

between fraud and business use of computers. Business is

able to increase productivity and efficiency by using

computers. At the same time, computers provide an

environment in which frauds can take place faster and with

larger dollar consequences than ever before.

Increased fraudulent activity [Allen, 1977, p. 52] also

has an impact on the cost-benefit structure of internal

control decisions because of the impact on the probability

of errors. One way of measuring the dollar value of a

control is to compute the conditional probability that a

fraud will be prevented by a control, given the probability

that the attempt at fraud will occur. Therefore, if the

probability of an EDP-related fraud increases, then the

benefit of a control designed to detect or prevent such a

fraud also increases.

Because the increase in EDP-related fraud has a direct

impact on the costs and benefits of internal control

procedures used to protect the firm in an EDP-environment,

the increased number and value of EDP-related frauds

provides a strong motivation to study internal auditors'










responses to suggested changes in EDP-related internal

controls.



The Selection of Internal Auditors as Subiects

As it becomes more common for the directors of large

corporations to establish audit committees, the link between

corporate responsibility for internal controls and the

importance of the internal audit group becomes clearer.

The audit committee is the body ultimately responsible for

the maintenance and organization of internal control.

Hence, the audit committee's responsibility is higher

than management's responsibility because it must include

control of management itself. Corporate organizations are

often arranged such that professional management is directly

responsible to the corporate audit committee. One of the

management groups that reports directly to the audit

committee is the internal audit group. The audit group

advises the audit committee on matters concerning the

establishment and maintenance of a system of internal

control. Therefore, in the event of an external auditor's

criticism, the audit committee will rely heavily on the

internal audit group's recommendation [Mautz and Neumann,

1977, p. 62]. These considerations underlie this study's

focus on the internal audit group's reaction to externally

generated suggestions for changes in the system of internal

controls.









The External Auditor's Recommendation

Organizations which depend on the protection afforded

by a system of internal controls should have that system

periodically reviewed. The review of a system of internal

controls often leads to criticisms and related suggestions

for "improvement." Those criticisms and suggestions that

come from parties external to the corporate entity are the

focus of the present study.

The response of a firm to external evaluation of

internal control may be a function of to whom the criticism

is directed, the source of the criticism, and whether or not

the firm solicited the criticism. This study is concerned

with solicited evaluations, coming from responsible sources

and directed to the board of directors. The most important

sources of such evaluations are external auditors.

The process that gives rise to an external auditor

recommending an "improvement in the client's system of

internal controls" is closely related to the type of

engagement in which the external auditor is involved. The

most common involvement between an external auditor and his

client, resulting in recommended changes in internal

control, is the typical audit of the client's financial

statements (hereafter referred to as a standard audit).

While other types of auditing engagements are possible

(audit of internal control, report to regulatory agencies,

audit of a special problem area), the standard audit will










serve to illustrate the relationship between the external

auditor and his client's system of internal controls.

In an audit of financial statements, the external

auditor predicates the amount of substantive testing on his

evaluation of the client's system of internal controls and

his cost-benefit analysis of various auditing techniques.

The process by which the external auditor's evaluation

affects the extent of substantive testing is sequential in

nature. Intuitively, it would appear that the more positive

the auditor's evaluation of his client's internal control,

the more confidence the auditor would have in his opinion as

to the soundness of the client's financial statements. This

proposition is supported by Brown [1977] in presenting her

financial-analyst's view of the impact of stronger internal

controls on the auditor's report and the analyst's

evaluation of the client. On the other hand, the

authoritative pronouncements [AICPA, 1982, Section AU642.10]

indicate that the external auditor's evaluation of his

client's internal control system should not (theoretically)

influence his level of confidence in his audit opinion, even

if the auditor relied on that system in forming his opinion.

This is because other audit procedures (analytical review

and substantive testing) can compensate for the degree of

reliance on internal controls.

It is common for external auditors to find weaknesses

in the client's system of internal controls during the










course of a standard audit. In such an event, the external

auditor must report such weaknesses to management or to the

audit committee [AICPA, 1982, section AU323.01 amended by

section AD642.62]. It also should be noted that

suggestions or other comments concerning
accounting control and various other matters
are often submitted to management by auditors
as a result of observations made during their
examinations of financial statements. These
comments are often submitted by letters,
memoranda, and other less formal means. This
practice is encouraged. . [AICPA, 1982,
section AU642.53]

As a result, most audits, even though they may be

audits of the financial statements and not internal control

audits per se, result in an "internal control letter" to

management. These management letters, identifying

weaknesses in the client's internal control system, are

frequently accompanied by recommended changes to the system.

While the study is concerned primarily with independent

external auditors' recommendations, solicited

recommendations from external systems analysts have been

included for comparison. Both of these sources are

considered highly responsible; the major difference is that

external auditors' recommendations are usually packaged with

other auditing services, while a systems analyst's services

are solicited for a particular purpose.

Description of the Study

The study analyzed the responses of 125 subjects

(internal auditors and controllers), to external











recommendations for changes in the system of EDP-related

internal controls. Subjects were asked to assume that they

were internal auditors who had to make a recommendation to

the audit committee as to whether the proposed change should

be implemented. Forty-eight different scenarios were used.

However, each subject was required to participate in only

four scenarios.

The scenarios varied across four dimensions. Each of

the dimensions is listed below with a brief description. A

more detailed description is found in Chapter III. The

dimensions (independent variables) are (1) the strength

with which the external recommendation was made, (2) the

source of the external recommendation, (3) the type of EDP

controls in question, and (4) the type of change being

recommended. The strength dimension refers to the tone of

the communication. Two levels of strength were used: strong

and weak. The source dimension refers to the two sources of

evaluation: external auditor or systems analyst. The third

dimension deals with the type of EDP controls which were the

subject of the evaluation. These were three types: (1)

transaction origination, (2) transaction entry, and (3)

processing. The fourth dimension deals with the nature or

quality of the changes recommended. The four types of

criticisms are described briefly below and are detailed in

Chapter III.










Controls were classified as either "complements" or

"substitutes." Complement (important, necessary, needed)

controls were defined as controls whose addition or deletion

had a significant impact on the overall effectiveness of the

internal control procedure described in the scenario.

Substitute (unimportant, unnecessary, not needed) controls

were defined as controls whose addition or deletion did not,

in the author's opinion, change the overall effectiveness of

the internal control procedure being evaluated in the

scenario. The terms "complement" and "substitute" have been

used previously by Fisher in 1978:

When two or more controls both contribute to
reduce a cause of exposure, one needs to
determine whether they are complementary, or
actually increase assurance when used
together, or are substitutable. [1978, p.
355]

The types of changes recommended were the addition of a

control, the deletion of a control, or the replacement of

one control with another. Some of the possible combinations

were not used (see Chapter III). The four types of

changes that were used included the following: (1) add a

complement, (2) delete a complement, (3) delete a

substitute, and (4) replace a substitute with a complement.

Subjects were asked to respond to seven questions about

each scenario and ten questions about themselves. The seven

questions about each scenario addressed the following areas:

(1) evaluation of the unchanged internal control procedure,

(2) importance of the internal control procedure to the











overall system of internal controls, (3) evaluation of the

changed internal control procedure, (4) classification of

the type of change being suggested, (5) relative importance

of four factors on the subject's judgment (source of the

criticism, tone of the criticism, subject's evaluation of

the cost-benefits associated with making the recommended

change, and other factors), (6) evaluation of the impact of

the adoption of the recommendation on the quality of the

overall internal control system, and (7) subject's

recommendation to a hypothetical audit committee.

Organization of the Remaining Chapters

Chapter II is devoted to background information and a

brief review of the literature. Chapter III describes the

research methods used in this study. It includes

descriptions of a general model of the problem, the

experimental design, the independent and dependent

variables, instrumental variables, the task and the

instrument, subjects used in both pilot and field testing,

the experiment, expected responses, and effects of the pilot

tests. Chapter IV is a brief description of path analysis.

Included are techniques for path estimation, differences in

path analysis and regression analysis, and models considered

in this study. Chapter V contains the experimental results

and the analysis of those results. Chapter VI contains

conclusions and suggestions for further research.
















CHAPTER II
BACKGROUND AND LITERATURE REVIEW


The previous chapter included a brief review of the

interrelationship between audit committees, external

auditors' recommendations relating to internal control

systems, and the internal audit staff of corporations. The

first section of this chapter provides background

information which shows that (1) external auditors use the

management letter to communicate their critical evaluations

of the clients' systems of internal control; (2) audit

committees consider it part of their responsibility to

review these criticisms; and (3) it is a function of the

internal audit group to review the changes recommended by

the external auditor and advise the audit committee of their

own reaction to these recommendations.

It is assumed that internal auditors evaluate internal

controls primarily on a cost-benefit basis. Techniques that

have been suggested for making cost-benefit analysis of

internal control systems are reviewed below. An area

closely related to the cost-benefit evaluation of internal

controls is the substitution of internal auditing for

external auditing to achieve more cost-effective external











auditing. Whether or not to include such a trade-off in a

cost-benefit analysis is also addressed.

It is suggested that auditors have the ability to make

expert internal control judgments. The body of literature

that has grown around auditors' expert judgment ability is

reviewed in the fourth section of this chapter.

Finally, the study is related to a brief review of the

source credibility literature. The source credibility

literature is used to justify the expectation that there

will be no difference between the experimental group (source

is external auditors) and the control group (source is

systems analysts).


Audit Committees and the Review of Internal Control
Criticisms

The question of who reviews criticisms found in a

management letter is addressed from both descriptive and

normative points of view: Schiff [1977] describes what is

being done, while Pomeranz [1977] specifies what should be

done.

At the 1977 Ross Round-Table Discussions, Schiff,

Sorter, and Wiesen examined "The Evolving Role of Corporate

Audit Committees" [1977]. Participants in the round table

included "audit committee members, lawyers, chief financial

officers, practicing certified public accountants, a

representative from the SEC, and accounting professors"









[Schiff, 1977, p. 20]. One of the things to come out of the

meeting was the relationship between the internal audit

group and the audit committee. Basically, it was seen that

internal auditors review the external auditors' criticisms

with the intention of reporting their findings to the audit

committee.

The June meeting is devoted to a review of
internal controls and to gain assurances that
shortcomings raised relative to procedures
and controls in the outside auditor's
management letter have been addressed
correctly. [Schiff, 1977, p. 21]

The audit committee directly discusses any problems

with the chief internal auditor as is evidenced by his

position in the company's organizational structure: "the

Chief Auditor's position has been elevated to vice-president

reporting directly to the audit committee" [Schiff, 1977, p.

21]. Therefore, internal auditors, acting for audit

committees, are responsible for the review of the criticism

in management letters.

Pomeranz pointed out that the audit committee should

be concerned with "review of management letters,

specifically findings not acted upon" [1977, p. 46]. He

emphasized that unadopted changes should be reviewed.

Furthermore, he said that the committee should review

"internal audit reports in summary form" and consider

"corrective actions not taken" [1977, p. 46]. Thus, in many

cases, what is done coincides with what should be done.









Cost-Benefit Analysis

There are at least four reasons why an external

organization reviewing a system of internal controls might

suggest a change: (1) the change is deemed to be essential;

(2) the change is deemed to be a binding constraint to

achieving some other goal; (3) the change is deemed to have

overriding qualitative considerations; or (4) the change is

deemed to be cost-beneficial. The four reasons listed are

certainly not mutually exclusive, nor is the extent of the

overlap known. However, each of the reasons is discussed

independently.

Essential controls are those either required by law or

deemed almost necessary from a practical business management

standpoint. An example of a legally essential control is

the requirement of the SEC Release No. 34-15722 that certain

companies maintain an audit committee [Baruch, 1980 pp. 174-

175]. Control over access to sensitive computer hardware

and software is an example of a practical-management

essential control.

Controls may become binding constraints in achieving

other goals. These controls become important when the

primary goal with which they are associated is considered.

For example, a firm which is building a submarine has as its

primary goal providing services to the government on a cost-

plus basis. The government insists on a certain internal

control that would be of minor importance in the normal










course of business: security over the blueprints. However,

because of government security concerns, the entire

opportunity to participate in the project may be contingent

upon the firm's ability to show that adequate arrangements

have been made for the physical security of the blueprints.

Thus, physical control of the blueprints, not the ability to

reproduce them, is a binding constraint to getting the

contract.

Changes in controls suggested because of qualitative

considerations are normative in nature. Qualitative

controls are included in a system because of the belief that

certain things should be protected even if they are not

material. Common business practices are often qualitative

controls. For example, restricting access to accounting

records such as payroll ledgers is both a common business

practice and a qualitative control. Controls necessitated

by qualitative considerations may also be essential,

constraining, or cost beneficial. DeMiotto points out that

while it is obvious that management would not want
to spend more for a control procedure than the
benefit to be derived from achieving a particular
control objective, it is important to remember
that cost considerations do not only encompass
direct monetary effects. They include qualitative
effects as well. [1980, p.18]

This study is not designed to examine qualitative,

essential, or constraining controls; however, the controls

that are studied may also be so classified. The main thrust

of this study is to examine internal auditors' reactions to










external auditors' recommendations for control changes from

a cost-benefit standpoint only.

Cost-beneficial controls are controls for which the

benefits can be shown to outweigh the costs for a specific

entity. Both costs and benefits can be classified as

tangible or intangible, current or future, and probabilistic

or deterministic. Furthermore, a firm is a coalition of

interests to which the interests of the external authority

are added in this study. This adds to the complication by

making it necessary to interpret costs and benefits in

relation to whom they affect in order to understand a

particular decision.

Tangible costs are easily identified and enumerated.

An example of a clearly identified tangible cost is the cost

of providing computer equipment. Typically, intangible

costs and benefits are difficult to identify or evaluate.

For example, the added strain on employees when a procedure

is changed is an intangible cost.

Current costs are costs to be incurred in the immediate

future. For example, the payroll cost of an internal audit

staff is a current cost. Future costs will be incurred far

enough in the future for the time value of money to become

important. An example of future costs is the payments on a

lease.

Probabilistic costs are costs which are uncertain

either because the amount is uncertain or because the










timing of the expenditure is uncertain. For example, the

cost of business missed due to down-time on a computer is a

probabilistic cost. Deterministic costs are certain in

either amount or timing.

Most costs and benefits are a mixture of future or

current, tangible or intangible, and deterministic or

probabilistic. It is relatively easy to assess costs that

are current or future, tangible, and deterministic. Where

the time value of money is known fairly accurately and

inflation is under control, a comparison between cost and

benefits can easily be made using present value techniques.

However, when future costs become probabilistic it becomes

difficult to even estimate the expected present value of

future costs and benefits. When costs and benefits are also

intangible as well as future and probabilistic, a comparison

becomes more of an art form than a science.

Auditors' Cost-Benefit Technicues

Fisher [1978] recognized the ambiguity involved in

trying to detail the cost of implementing an internal

control:

The cost of a control can be calculated in
various ways: absolute total cost to
implement a control; marginal or incremental
cost; or the percentage of total or marginal
cost allocated to each cause of an exposure
reduced by a specific control. When two or
more controls both contribute to reduce a
cause of exposure, one needs to determine
whether they are complementary, or actually
increase assurance when used together, or are
substitutable. [Fisher, 1978, p. 355]










She argued that the benefit of a control can be

calculated as the product of the exposure, a percentage of

the particular cause that the control is designed to

prevent, and the effectiveness of the control measured as a

percentage [1978, p. 355].

Rittenberg and Miner [1979] have built a cost-benefit

model of internal controls using the following parameters:

control objectives, number of transactions processed during

a period of time, loss associated with an error per

transaction, probability of an error in an uncontrolled

environment, reliability of controls in reducing either the

probability of a loss or the probability of an error, cost

of controls, and nature of controls. The last element in

the list, the nature of controls, refers to whether the

controls are sequential (roughly, the only control for an

exposure) or parallel (roughly, a redundant or compensating

control). There are strong similarities between the

complement/substitute and sequential/parallel concepts.

The authors measure exposure in two ways: (1) as the

product of the loss, the number of transactions, and the

probability of an error; and (2) as the product of the loss,

number of transactions, probability of an error, and one

minus the reliability of the control. They also illustrate

how parallel controls can be combined to reduce exposure.

The authors' measure of the benefit of a control is the

difference in the two measures of exposure. They compare










this measure of benefit with the cost to get the net benefit

of the controlss.

Cushing [1974] applied modeling concepts taken from the

field of reliability engineering to the cost-benefit

analysis of internal control procedures and systems. He

developed a series of models of increasing complexity.

Cushing's basic model revolved around a concept of

reliability for internal control. Reliability was used as a

measure of the probability that some accounting process,

which was being controlled, would be completed without

error. That was not to say that an error would not occur;

rather, once completed, the process would be error-free.

Process reliability is not the same as sampling reliability

in auditing. Cushing computed reliability as the sum of the

following probabilities:

(1) the probability that the process is
executed correctly and the control step does
not signal an error; (2) the probability that
the process is executed correctly, the
control step signals an error, and the
failure of the control is detected and no
correction is made; and (3) the probability
that an error in the process is made, but
that the control step signals an error and
the proper correction is made. [1974, p. 26]

Cushing also illustrated a procedure to compute the

probability of a failure to complete the process correctly.

Based on these formulations, Cushing showed that the benefit

of a control is the increase in the probability that the

process will be correctly completed caused by the presence

of the control procedure.











Cushing used the following costs in computing the total

cost of an independent control associated with a single

potential error:

(1) The cost of performing the control
procedure each time the process is performed.
(2) The average cost of searching for an
error and detecting whether one exists once
the control procedure has signalled that one
exists, and then making whatever corrections
are necessary.
(3) The average cost of an uncorrected
error. [1974, p. 27]

The total cost, assuming the control step is performed,

was computed as the sum of the expected costs of "(I)

performance of the control step, (2) uncorrected errors, and

(3) search, detection, and correction" [1974, p. 27]. The

cost of nor performing a control step was defined as the

probability of an error times the average cost of an error.

Cushing argued that a cost-benefit analysis was performed

when the total cost was compared to the cost of not

performing the control step.

The work reviewed above illustrates how cost-benefit

analysis can be operationalized. But, it also illustrates

how cost-benefit analysis becomes increasingly complex as

concepts are further refined. All of the authors described

rules for cost-benefit analysis. They specified ways of

measuring the conditions under which the benefits of a

control outweighed their costs. Fisher [1978] and

Rittenberg and Miner [1979] also stipulated that being cost-

beneficial was not enough to insure a controls acceptance.










The company as a whole must be considered, which means

allocating resources through overall capital budgeting.

Fisher [1978, p. 352] has delineated some criteria for

strategies to be adopted in response to the FCPA. She

stated that corporate strategy "should be systematic,

defensible, and well-documented." The strategy advocated is

an appeal to consider overall corporate objectives and the

interaction of controls, control objectives, and control

causes. The strategy also called for ranking of controls,

in a cost-benefit sense, along with other corporate

projects. In other words, if all corporate projects whose

benefits exceed their costs cannot be accepted, then

internal controls should not be an exception.


Costs and Benefits Accruing to Individuals and Groups

Each measure of cost-benefit is contingent on a

particular point of view. There are numerous points of view

in the modern firm: they include management, owners,

creditors, labor, governmental organizations, and external

authorities.

Management's point of view. Management has a complex

problem in analyzing the cost and benefits of a decision.

The complexity arises because management benefits from

corporate success both directly in terms of measures of job

performance, and indirectly in terms of profit-sharing

and future mobility. Management's decision process is











further complicated by differences in long-term and short-

run notions of optimal policies.

Owner's point of view. The owner's point of view is to

maximize the present value of dividends and/or stock prices

in the long run (and an indirect interest in minimizing

payments to all other parties), constrained by the owner's

need to maintain appropriate coalitions in the long run.

Creditors' point of view. Rather than maximizing

return on investment, creditors' interests lie in meeting a

certain level of achievement while minimizing risk.

Labor's point of view. The classical approach is to

view labor and owners in a zero sum game with the profits of

the firm as the objective. However, labor takes a short-run

approach to the definition of the firm's profits (as is to

be expected from individuals whose investment is a day's

labor and who may work elsewhere if the firm cannot pay

labor's wage). This short-run approach does not include

growth or escalating replacement cost of plant and

equipment.

Others' point of view. Government and others have many

diverse interests in the firm. Most, like labor's, are

short-run. For example, governments are frequently accused

of taking the expedient route of correcting social ills in

the short run at the long-run expense of business.

Auditors' point of view. External auditors have an

interest that partially coincides with the mutual interests










of owners, creditors, and managers, yet partially conflicts

with that joint interest. The mutuality of interest comes

in reducing the cost of the audit by having the client's

internal audit staff do as much of the audit as possible

(internal audit procedures and staff are assumed to cost the

client less than external audit procedures and staff), and

by having the client's system of internal controls be as

effective as possible. The diversity in interest arises

when (1) the cost of the marginally effective control is

considered too great by the client but not so by the

external auditor, or (2) the cost savings from the internal

auditors' work is expected to be shared by the external

audit firm and the client.

Additional non-monetary interests are also of

considerable importance. An example is management's

expectation that the external auditor will find weaknesses

when he reviews the internal control system and will report

these in the management letter. The auditor, on the other

hand, feels the need to meet management's expectations and

attempts to enumerate weaknesses even if they are not

significant.

Study's point of view. Clearly, the issue of to whom

the cost and benefits of a change in the system attach must

be resolved before any predictions can be made concerning

the directions that the internal audit group will take in

response to criticism. For purposes of this study, the










mutuality of interests among the management, owners, and

creditors will be considered the firm's interest. In

effect, the study adopts the owner's point of view, adapted

so as to minimize conflicting interest with other interested

parties. This is achieved by selecting and wording

scenarios which are as unambiguous as possible.

External Auditors' Reliance on Internal Auditors' Work

The Round-Table reported that, based on the audit

committee's final evaluation of internal control, internal

audit group, and external auditors, the audit committees

were seen as shifting auditing tasks between internal and

external auditors.

Internal controls determine the trade-offs
between risks and costs, judgments that must
be made by the audit committee, independent
of the outside auditor. The review of
internal controls could lead to changes in
the scope and focus of audits. Then the
determination must be made whether these
modifications are to be assigned to inside or
outside auditors. [Schiff, 1977, p. 26]


Ward and Robertson [1980] surveyed internal and

external auditors. The results indicated that all

independent auditors relied on internal auditors to some

extent, but only half of the respondents claimed that they

relied on internal auditors as much as possible. This was

despite the fact that it was suggested that the audit costs

could be decreased or the rate of increase in audit costs

could be slowed through cooperative audit performance










between the internal and external auditors. Both

independent and internal auditors agreed that the extent of

the external auditors' reliance on the internal auditors'

work should be increased.

The independent auditors' reliance took the form of two

major areas: the internal auditors' contribution to

internal control and the internal auditors' "performance of

substantive audit procedures under the supervision of and

review by independent auditors" [Ward and Robertson, 1980,

p. 64]. The extent of the efficiency of the cost-savings

depends on (1) "Capabilities of the internal auditors", and

(2) the reliance placed on their work by the independent

auditors" [Ward and Robertson, 1980, p. 71]. Consistent

with this evaluation of cost-savings, "two international

accounting firms are actively promoting professional

training programs for internal auditors" [Ward and

Robertson, 1980, p. 71]. Therefore, it is clear that some

professionals consider a shift from external to internal

auditing as cost-beneficial from both the CPAs' and the

clients' points-of-view.

Clay and Haskin [1981] provide a familiar economic

argument in favor of greater reliance by external auditors

on the work of internal auditors:

If procedures performed by an internal audit
staff are duplicated during the year or at
the year-end by the external auditors, the
company incurs multiple costs for
essentially the same information. [Clay and
Haskin, 1981, p. 63]










Clay and Haskin also surveyed 100 internal auditors

(60% response rate) to gather information about the

competence, objectivity, value, extent of external auditor

reliance, and cost effectiveness of internal auditors. Clay

and Haskin found no evidence to support the idea that

internal auditors were cost-effective in reducing external

auditing costs. This is contradictory to what Schiff [1977]

reported. Therefore, it is uncertain whether or not

benefits from reduced external auditing costs should be

considered in evaluating a change in internal control.


Auditors' Abilities to Make Internal Control Judgments

Ashton [1974a] measured judgment stability (within

subject consistency) and judgment consensus (between subject

consistency) for 63 subjects in an experimental setting.

The experiment consisted of asking the subjects to evaluate

an internal control setting by rating the control on a six-

point scale. Intra-subject consistency over time was found

to be quite high. Subject consensus was measured by the

correlation among subject responses for the same

experimental internal control variable settings. Consensus

was also found to be quite high. These results were

confirmed by Ashton [1974b], Ashton and Brown [1980], and

Ashton and Kramer [1980].









Joyce [1976] was not directly concerned with auditors

making internal control judgments, but was concerned with

auditors' abilities to make judgments. Furthermore, Joyce's

study was a response to Ashton's study which used auditors'

abilities to evaluate internal controls as a vehicle to

study judgment abilities. The criterion used to measure

judgment ability was consensus (agreement among judges) [p.

30]. The reasons given for the selection of consensus as a

measure of judgment ability were (1) if experts are

measuring the same thing, no matter what method is used,

their results should approach each other; (2) if

professional expertise exists among auditors, it should be

exhibited by consensus [pp. 30-31]. These arguments can be

considered from another point of view. Only if a right

answer exists, can we expect expert judgments to converge on

that answer. On the other hand, if a right answer exists

only through convention or definition, then consensus only

measures the similarity of training among experts. Joyce

pointed out that the accounting establishment goes to pains

to reduce differences among auditors [p. 31]. He reviewed a

series of articles that indicated a low measure of consensus

among auditors. The only exception appeared to be Ashton's

1974 study [pp. 31-4]. Joyce hypothesized that the

"differences in the experimental tasks required of the

subjects could account for the apparent discrepancy between

Ashton's findings and those of the others" [p. 33].









Basically, this difference could be attributable to the fact

that Ashton asked subjects to make narrower, more technical,

judgments about the quality of internal control, while the

others asked for judgments on broader areas (such as the

amount of audit work that would be done under given

conditions) [p. 33].

Like Ashton's subjects, Joyce's subjects had to

evaluate internal controls. However, they had to make a

more complex judgment. For this reason, Joyce expected less

consensus among his subjects than was the case for Ashton's

subjects. His results were as expected. In other words,

the consensus among Joyce's subjects was consistent with the

lower levels observed by researchers before Ashton.

Lewis [1980, p. 594] worked from the presumption that

consensus is a measure of the validity of professional

judgment. Based on that presumption and utility theory, he

concluded that "auditors would have to possess homogeneous

utilities for the outcomes or consequences of their

decisions" [1980, p. 594]. Like Joyce, Lewis pointed out

some of the mechanisms that tend to create homogeneity among

members of a profession, and more so among members of the

same firm. He performed an experiment which was designed

around the provisions of FASB Statement EN. 5, Accounting

for Contingencies, to test whether judgments across firms

would vary more than judgments within firms. Lewis reported

evidence that provided mild support for the contention that










there was less difference between firms than within firms

[1980, pp. 598-9]. He also varied the materiality of the

data the subjects were given. This allowed him to test

whether consensus varied with materiality. He found that as

materiality increased so did consensus [1980, p. 600].

It is the relationship between materiality and consensus

that makes the Lewis article interesting. The direct

relationship between consensus and materiality indicates that

consensus is contingent on at least one event. Ashton

found more consensus in simpler decision settings, while

Joyce found less in a more complex setting. A major

distinction between the judgment settings may be thought of

as the additional contingencies encountered in the more

complex setting.

This section shows that the literature offers

conflicting evidence on the degree of consensus that can be

expected in an experimental setting similar to this study.


The Differential Impact of Source Characteristics on the
Internal Auditor's Decision

The concept of source as a variable affecting the

(auditor's) confidence in a received message is well

established, even codified. Auditors classify evidence by

source. They consider externally generated, third-party

evidence the most reliable. At the same time, auditors are

taught, from their first auditing class, that internally

generated documents or communications should be confirmed.










In other words, auditors are attuned to considering the

source of a message separately from its content.

In this particular experimental setting, the judges are

performing auditing or auditing-like functions. Therefore,

the subjects should be conscious of the source-content

distinction. On the other hand, the subjects' awareness of

the source-content distinction does not insure that a change

in source will have an impact on their decisions. This is

especially true since each judge was exposed to only one

source. Hence, no intra-subject comparisons were possible.

The purpose of this section is to determine if a

systematic difference in response for the two sources,

external auditors and systems analysts, should be expected

in the current experiment. This is not to say that, if no

difference in source is expected, that source itself will

not be an important factor. Rather, source may still be

important, but the source systems analysts had the same

impact as did the source external auditors. There are two

reasons to expect no difference in the responses. The first

is the possibility that source could have an insignificant

weight attached to it. The second is that other variables

have the effect of negating the impact of source. The most

important of these compensating variables is the relative

confidence of the judge in his opinion compared with that

of the source.










Experimental psychologists classify those attributes of

a communicator which influence the receiver's attitude about

a message's content as source characteristics. There is (as

yet) no generally accepted measurement scale for source

characteristics, theoretical constructs adopted by

researchers. Therefore, each researcher has selected his

own system of measurement. So, while generalizations may be

made within groups studied using a set of source

characteristics, no comparisons can be made between studies

using different source characteristics. In particular,

difficulties arise when overlapping source characteristics

are used in research. For example, the characteristic of

source credibility has been decomposed into expertise and

bias by some researchers [Birnbaum and Stegner, 1979], while

others have decomposed source credibility into expertise and

trustworthiness [Haas, 1981]. The concepts of bias and

trustworthiness overlap but are not the same. Other

problems arise because of research methodology. Jaccard

says that

persuasive messages in the experimental
literature are composed of a set of belief
statements (i.e. information) and hence are
designed to change beliefs. When an
investigator uses affect, behavioral
intention, or behavior as the dependent
measure, he or she is implicitly assuming
that changes in these target beliefs will
lead to changes in the dependent measure (an
assumption that may be incorrect). [1981, p. 261]

Haas [1981] provides a useful framework for examining

source characteristics. Some of the details of his











framework are useful to this discussion. For example, he

describes two mechanisms by which a message could produce an

attitude change. The first is called internalization.

"Internalization occurs when an attitude is learned and

adopted as the receiver's own by being integrated into that

individual's belief and value system" [1981, p. 142]. Haas

uses credibility as an example of a source characteristic

that is thought to work through internalization. The second

mechanism is called identification. Identification is a

"desire to establish a gratifying role relationship with the

source" [1981, p. 144]. Haas's example of a source

characteristic that works through identification is

attractiveness. In general Haas's framework has three major

source characteristics: credibility, attractiveness, and

power.

Source credibility is "the extent to which the source

is perceived to know the 'correct' position on the issue and

the extent to which he or she is motivated to communicate

that position" [1981, p. 142]. Source attractiveness

depends on the source being someone liked or admired. It is

thought that association or emulation of someone liked or

admired will improve the self-image or self-esteem of a

communication-receiver. Therefore, a receiver might adopt

the same attitude as a source he admires; or he might hold

an attitude that supplements the attitude of the source,

when the source and receiver have complementary roles










(teacher-student) [1981, p. 144]. Source attractiveness may

be more influential than source credibility because source

credibility could depend on the soundness of the

communication, while attractiveness is independent of the

logical content of the message [1981, p. 144-45].

Source credibility and attractiveness may seem

independent at first, but closer examination reveals an

overlap. A source may be attractive because he is

credible. When an authority speaks of a subject on which

he is not an authority, the tendency is to treat him as

attractive because of his credibility on other subjects.

Therefore, credibility and attractiveness may interact or

overlap.

The third characteristic in the framework is power of

the source. If the source has the ability to exercise power

over the receiver, the recipient may comply with the source's

communication [Haas, 1981, pp. 149-51].

In the current study, the source is either an external

auditor or a systems analyst. Both have sufficient

expertise to be considered credible sources, if they are

perceived to have the proper motivation (trustworthy or

unbiased).

Nothing definitive can be said about the attractiveness

of external auditors (or systems analysts) to internal

auditors. An equal number of arguments can be put forth

considering whether internal auditors would find external











auditors attractive. The best of these arguments,

identification through similarity, can be argued in either

direction.

There is a clear distinction between the power

relationship for internal-external auditors and internal

auditors and systems analysts. The external auditor has a

professional obligation to exercise a certain amount of

power over the internal auditor. That power is derived from

the terms of engagement combined with the fact that the

auditor will issue an opinion. The systems analyst offers a

report, but it is for internal use only. Even after the

systems analyst is engaged, his power is strictly limited to

internal use. Thus, it would appear that the two sources,

systems analyst and external auditor, should be different on

the power dimension. However, because it was felt that such

use of power would obscure the other factors being examined,

the external auditors' recommendations were carefully

designed to avoid the naked use of power. Therefore, it is

unclear if any distinction can be made between the power of

the analyst and the external auditor along the power

dimension.

Even if one of the source characteristics were capable

of being well-measured in the experiment, another problem

would make testing difficult. Jaccard found that "whenever

people are more confident in themselves than the source,

relatively little belief change results" [1981, p. 266].











This has significant implications for relations among

"experts." By definition, an expert should be confident in

his own conclusions. Therefore, it is reasonable to assume

that there should be no difference between sources when the

recipient is an expert, as is the case in the current

experiment. Professional judgment is assumed to be strongly

dependent on the circumstances of the decision. The model

will represent professional judgment as various types of

changes being recommended. Figure 2-1 illustrates the

decision process. However, the experimenter and the subject

may not agree on the classification of the type of change

being recommended. Therefore, provisions have been made in

the design of the experiment to measure not only the effects

of the intended manipulations of the independent variables,

but also the effects of manipulations with respect to the

subjects' perceptions.










Source


Tone


of of
Criticism Criticit




Decisic


Type
of
sm Criticism



J


Figure 2-1. General Model of Factors Influencing Internal
Auditors' Responses to External Criticism of the System of
Internal Controls
This section suggests that the impact of the two
sources, systems analysts and external auditors, will not be
different. However, this is not to be construed to mean
that source will not be a meaningful factor influencing
decision.















CHAPTER III
RESEARCH METHODS

The purpose of this chapter is to describe the general

model of corporate behavior used as a basis for this

experiment, the experimental design and task, the subjects,

the hypotheses, the pilot testing procedures, and the final

design.

Model of Corporate Behavior

It was indicated in the literature review that the

current trend in the organization of the corporate internal

control hierarchy is directed toward the use of largely

independent audit committees. It was also suggested that

internal control departments must frequently review

suggestions for changes in the system of internal controls.


In this study, the internal auditor is used as a

surrogate for the corporate audit committee. As a result,

the corporate model of behavior becomes a model of the

internal auditor's behavior. Because this study focuses on

the response to externally generated suggestions for changes

in the system of internal control, the proposed model of the

internal auditor's behavior consists of the expected modes

of response to that particular stimulus.









The influence of an external authority is assumed to

affect the internal auditor's opinions as well as his own

evaluation of the merits of the suggested change. Since no

direct measures of the degree of an external authority's

influence are available, the source and tone of the external

authority's criticism have been adopted as surrogates. The

source and tone of a message may only serve to direct

attention to a problem, which will then be considered on its

own merits. On the other hand, internal auditors may be

more influenced by the prestige and power of external

authorities. Internal auditors may respond to the influence

exerted on them by external authorities in many different

ways. Furthermore, the nature of their responses should be

heavily influenced by their own professional judgment. In

the model proposed, professional judgment is assumed to be a

function of the complexity of the choice before the internal

auditor. The more complex the choices available to the

internal auditor, the more he will rely on his professional

judgment. However, the more ambiguous the decision, the

more he will rely on other factors such as the source and

tone of the criticism, to make his decision. This argument

is formalized in the first hypothesis, which is presented

below. All hypotheses are restated in the chapter summary.

HI: The more ambiguous the decision, the greater the subject's
reliance on the source and tone of the message.










Experimental Design

The experimental design is described in terms of

scenarios, independent variables, dependent variables, other

responses, and assignment of variable combinations to

subjects. There were forty-eight scenarios, four

independent variables, eight dependent variables and ten

other responses.

Scenarios

The experimental instrument consisted of a package

containing (1) two pages of instructions (see Appendix A),

(2) eight to ten pages containing four scenarios (see

Appendix B), and (3) two pages of additional questions (see

Appendix C). The instructions contained a brief description

of (1) the assumptions the subject was to make, (2) the

subject's task, (3) the confidential nature of his response,

(4) the absence of any time limit imposed on the task, and

(5) a corporate structure. Each subject was to respond to

four scenarios, each of which was based on the same

corporate structure; the corporate structure was described

as being common to four companies: Alpha, Beta, Gamma, and

Delta. The four companies represented the four scenarios

included in that subject's package.










There was a brief description of the corporate

structure of the company for which the subject was assumed

to work and for which the external source (external auditor

or systems analyst) had suggested a change in internal

controls in the scenario.

Each scenario described a different internal control

procedure which was associated with a particular type of

control (see the independent variable "type of control").

After the initial description subjects were asked to rate

the strength of the internal control procedure and to rate

the overall importance of an internal control procedure of

the type described (see the descriptions of the dependent

variables). The scenario then described the recommendation

that was being made (see the independent variable "type of

change") and the tone of the recommendation (see the

independent variable "tone"). Next, the task required

five more responses, numbers 3 through 7: (3) assuming the

change is implemented, rate the strength of the internal

control procedure; (4) classify the type of change; (5)

allocate 100 points to the reasons for the subject's

decision concerning the internal control change; (6) rate

the impact of the change on the overall system of internal

control; and (7) recommend a course of action to the audit

committee. For a more complete discussion of each of the

responses, see the section describing dependent variables.









The detailed scenarios are included in Appendix B. The

forty-eight (3 x 4 x 2 x 2) scenarios consisted of the

combinations of the various levels of the following

independent variables: type of control (3 levels), type of

recommended change (4 levels), source (2 levels), and tone

(2 levels).

Independent Variables

There are four independent variables: (1) type

of control, (2) type of change, (3) source of criticism,

and (4) tone of criticism.

Tyve of controls. Three types of internal control

areas were selected from a comprehensive survey of EDP-

related internal controls performed by the Stanford Research

Institute. Of the six control areas discussed, three were

selected: transaction origination, (T); data processing

transaction entry, (E); and computer processing, (P)

[Russell, Eason, and Fitzgerald, 1977]. However, due to the

nature of the scenarios, which had to be written around a

particular control, the three types of controls were not

varied systematically with respect to the other independent

variables. In other words, while it was possible to combine

an E-type of control with each of the other independent

variables, it was not possible to combine the same E-type of

control with each of the other independent variables. As a

result the type of control variable was confounded with the

scenario in which it was described. While this prevents the









study from determining anything about the three types of

controls individually, it does provide a convenient way to

characterize the combination of control type and scenario.

Tyve of change. Four types of changes were varied

systematically across the other independent variables.

Controls were classified by the researcher as complements or

substitutes. Complement controls were designed into an

internal control setting such that, if they were added or

deleted, they would have a significant impact on the

reliability of the system. Substitute controls were

designed such that their presence or absence would not have

a significant impact on the reliability of the system. The

definition of substitute and complement led to the

organization of the controls in a two-by-two table, shown in

Figure 3-1.

Control Control
Added Deleted


Complement cell a cell b
II I
Substitute cell c cell d


Figure 3-1. Possible Combinations of Adding and Deleting a
Substitute or Complement Control

Cell c (addition of a substitute) was eliminated from

consideration because, by definition, it would have the same

impact as cell d (deletion of a substitute). By contrast,

cell a (addition of a complement) would enhance the










reliability of the system, while cell b (deletion of a

complement) would have a worsening effect. The latter three

types of changes were arbitrarily labeled: type-1 (cell a,
add a complement), type-2 (cell b, delete a complement), and

type-3 (cell d, delete a substitute). A fourth type of

change, type-4, was included as a measure of consistency

within subjects. Type-4, the replacement of a substitute

with a complement, should have the same impact as adding a

complement (type-1) because the deletion of a substitute

should have only a small effect on internal control

reliability while adding a complement is an enhancement. A

review of the types of changes and their expected impact on

the reliability of internal control is presented in Table 3-

1.

Table 3-1. Expected Effects of Change Types on Internal
Control Reliability

Expected Impact on
Change Internal Control
ZTye Description Reliability
Type-1 add a complement increase

Type-2 delete a complement decrease

Type-3 delete a substitute none

Type-4 replace a substitute with increase
a complement


The researcher's classification of controls as

substitutes or complements was subjected to testing in pilot

test situations. Substantial revisions of the scenarios










were made as a result of these pilot tests. The details are

reported in Appendix E: Pre-testing.

Each subject was asked to respond four times, once for

each type of change. Subjects were randomly assigned to

various combinations of types of controls and types of

change as well as to combinations of the other independent

variables. The details of this assignment will be presented

following the description of the independent variables.

Source. The main concern of the experiment was to

measure the internal auditors' responses to criticism from

external auditors. However, in order to provide a

standard against which to compare responses, half of the

subjects were presented with recommendations from systems

analysts instead of external auditors. The distinction

between the sources of the recommendations was made in the

instructions attached to the experimental instrument (see

Appendix A: Instructions For Subjects). The subjects

received one of two sets of instructions, which included a

request that the subjects make some assumptions. The

external auditor type of instruction read

3. The company's external auditors have recently
submitted a management letter at the
completion of their audit.

4. The management letter includes a recommended
change in the internal control system, which
has been included under the heading of
"EXTERNAL AUDITOR'S RECOMMENDATION."









The systems analyst type of instruction read

3. The organizational design requires that you
report directly to the board of directors'
audit committee.

4. Each year the controller, who reports to the
company president, employs an outside systems
analyst to review the system of internal
controls. The most recent analyst's report
includes a recommended change in the internal
control system, which has been included under
the heading of "SYSTEMS ANALYST'S
RECOMMENDATION."

The only other differences between the two versions of

the experimental instruments were the differences in the

headings. The two versions are included in Appendix B:

Scenarios. A review of the literature in Chapter II

indicated that no difference should be expected between the

amount of reliance the subjects place on the source of the

criticism for either external auditors or systems analysts.

This expectation is the basis for hypothesis two, which

would be desirable to support.

H2: There is no difference between the amount of reliance
subjects place on the source (either external auditors or
systems analysts) of the criticism.


Tone. The experiment was also concerned with the

effect of the tone of the external authority's

recommendation on the internal auditor's response.

Therefore, two levels of tone, or strength of

recommendation, were used. The measure of tone used was

made relative to prior years' recommendations. For each

type of change, subjects were told:









Note: The external auditor views this change as
relatively less critical than changes recommended
in prior years.

In total there were four levels of source and tone

combinations as illustrated in Figure 3-2.


Tone Levels

Less More
Critical Critical


External
Auditor
source I I I
Levels
Systems
Analyst



Figure 3-2. Four Combinations of Source and Tone.



Each subject was assigned four scenarios, all of which

were either systems analyst scenarios or external auditor

scenarios. In either case, a subject was assigned two

"less" critical and two "more" critical scenarios. The four

scenarios assigned to a subject were each a different type

of change, and all three different types of controls were

represented in each subject's package of four scenarios.

Assignment of subjects to treatments. In order to

assign a reasonably small number of treatments to each

subject and still be reasonably certain that the response

rate would be fairly even among all cells, particular

combinations of independent variables were devised. All










together there were 48 combinations of the four independent

variables: type of control x type of change x source x tone

= 3 x 4 x 2 x 2 = 48. It was decided that each subject

could respond to four scenarios within a reasonable time (as

was shown in the pilot tests).

The following additional constraints were also placed

on the assignment of scenarios into four scenario packages:

(1) each package must contain one each of the four types of

changes; (2) each package must contain each of the three

types of controls; (3) each package must contain both levels

of tone; and (4) the order of the scenarios in each package

must not be the same as to type of change, type of control,

or tone. As a result, scenarios were combined in the six

packages described in Table 3-2. There were twelve

different packages in all, six for external auditors and six

for systems analysts.











Table 3-2. Packages of Scenarios.


Package Type of Type of
Number Control Change
1 T 1


Tone
s
w
w


S
w
s
w

w
w
s
s

s
w
s
w

w
w
s
s

w

S
w


Key to symbols used in table:
Type of Control
T Transaction Origination
E Transaction Entry
P EDP Processing
Type of Change
1 Add a Complemenet
2 Delete a Complement
3 Delete a Substitute
4 Replace a Substitute with a
Complement
Tone
s More Critical Than Last Year
(Strong)
w Less Critical Than Last Year (Weak)










Dependent Variables

Each subject was asked to make seven responses for each

of the four scenarios under his consideration. Those

responses are seven of the eight dependent variables: (1)

internal control strength-before, (2) procedure importance,

(3) internal control strength-after, (4) classification of

change, (5) allocation of points, (6) impact of change, and

(7) recommendation. The eighth dependent variable,

difference, is the signed change in the after minus before

ratings of internal control strength [(3) (1)].

Internal control strength-before. Subjects were asked

to rate the strength of the internal control procedure

described in the scenario immediately after the procedure was

described and before the external authority's change was

presented. Their responses were recorded on a nine-point

scale which ranged from very weak (-4) through adequate (0)

to very strong (+4).

Procedure importance. The second question asked the

subject to rate the importance of having an adequate

internal control procedure designed to protect the area

under consideration. The subject was to respond without

reference to the particular internal control procedure

mentioned in the scenario. Therefore, this question was

designed to measure the importance of the weakness

indicated, not the importance of a particular solution. In

this way, it was possible to have a response in which a










subject stated that a control increased the strength of the

particular internal control procedure, combined with a

response that the overall internal control did not improve

very much. The subjects responded on a five-point scale

which ranged from not very important (0) to very important

(+4).

Internal control strength-after. Subjects were asked

to rate the strength of the internal control procedure

described in the scenario immediately after the external

authority's change and tone were presented. Their responses

were recorded on a nine-point scale which was identical to the

scale used in the internal control rating before the change.

Difference. To measure the impact of the changes

presented, the difference in the before and after internal

control ratings (after before) were computed. Also, the

difference was used to reclassify the responses in

accordance with subjects' perceptions (rather than the

author's) into three categories: (1) increased internal

control, (2) decreased internal control, and (3) unchanged

internal control. Table 3-3 indicates the relationship

among the subjects' perceived changes and the intended

(author's) manipulations of type of change.










Table 3-3. Relationship Between Expected Subject Perception
and Corresponding Manipulation of Internal Control Change


Difference Corresponding Type of
in Internal Type of Internal Change
Control Ratins Control Change Number

increase add a complement, or 1 or 4
replace a substitute
with a complement

decrease delete a complement 2

none delete a substitute 3



Classification of Change. Subjects were asked to

classify the changes recommended to them by an external

source. Rather than explain the concepts of substitute

and complement in the directions, subjects were asked to

classify changes as desirable or undesirable. The cover

sheet instructions included the following note:

Each change involves one or two controls.
Controls can be loosely classified into two
groups:
(a) desirable controls- those controls that
correct a weakness in the internal control
procedure, and
(b) undesirable controls- those controls that
fail to correct a weakness in the internal control
procedure, including redundant controls.

You will be asked to classify each change as one
of the following:
a. addition of a desirable control
b. addition of an undesirable control
c. deletion of a desirable control
d. deletion of an undesirable control
e. a simultaneous deletion of an undesirable
control and the addition of an undesirable
control
f. a simultaneous deletion of an undesirable
control and the addition of a desirable
control











This subject response provided an opportunity to verify

the subject's internal control rating with his perception of

the type of change recommended. Even if the subject

classified the change incorrectly, there are a set of

expectations for the dependent variable "difference." These

expectations are detailed in Table 3-4. This concept

suggests the third hypothesis: the change in the internal

control ratings will be a function of the subject's

classification of the type of change, as is specified in

Table 3-4.



Table 3-4. Possible Subject Perceptions and the
Corresponding Values of Difference

Subject Corresponding Corresponding Rating
Response Type At Change Difference

a 1 increase

b none none

c 2 decrease

d 3 none

e none none

f 4 increase


Allocation of points. Each subject was asked to

allocate one hundred points to the factors which would

influence his recommendation-to-the-audit-committee

decision. The subjects were given four categories for

allocating their points. Three of the categories were pre-











specified: (1) source of the recommendation, (2) tone of the

recommendation, and (3) the subject's assessment of the

economic cost-benefit impact of the change on the company.

The fourth option was to assign points to "other" factors.

Subjects were reminded that the points allocated must sum to

100.

Impact of change. Subjects were asked to rate the

effect that the proposed change would have on the quality of

the overall system of internal controls. They were given a

nine-point scale ranging from greatly reduce internal

control (-4), through internal control unaffected (0), to

greatly improve internal control (+4). It was thought that

this response would capture the combination of the

importance of the change to the particular internal control

procedure and the importance of the internal control

procedure itself.

Recommendation. Subjects were asked to rate the

strength of their suggestions to the audit committee about

the proposed change on a nine-point scale ranging from

strongly recommend rejection (-4) to strongly recommend

acceptance (+4).

Other Responses

Each subject was asked to provide additional data about

himself after the task (completing responses to four

scenarios). In all, there were ten "other" questions. The

first three were intended to measure the subject's











involvement in his task. The next six "other" questions asked

for demographic data about the subject. The last question

related to the experimental task. The ten questions are

described in Appendix D.


The Role of the Independent and Dependent Variables in the
Overall Decision Model

The general decision model presented earlier as Figure

2-1 was implemented in the experimental design as a function

of independent and dependent variables. The outside

authority's influence on the decision process, which was

implemented as the source and the tone of outside criticism,

is represented by using the independent variable to obtain

the independent variables source and tone. The type of

criticism is represented as the independent variable type of

change. The decision process is represented by two

dependent variables, the importance of the internal control

procedure and the internal auditor's recommendation to the

audit committee. The model assumes that the internal

auditor's decision is a function of the importance of the

internal control procedure. The assumed decision process is

illustrated in Figure 3-3.











Intermediate
Theoretical Independent Dependent Dependent
Variable Variable Variable Variable

Source
of Source
Criticism


Tone Importance of
of Tone Internal Decision
Criticism Control
Procedure

Type Type
of of I
Criticism Change


Figure 3-3. Decision Model of Factors Influencing Internal
Auditor's Response to External Criticism of the System of
Internal Control

The effectiveness of the decision model presented in

Figure 3-3 depends on the concurrence of the experimental

design and the subjects' perceptions of the design. In

other words, the investigator may have intended a scenario

to signal that the addition of a complement is strongly

suggested by an external auditor. However, the subject may

have perceived a signal that was the addition of a

substitute, weakly suggested by an external auditor. This

problem may be addressed in two ways. First, it could be

assumed that there were no systematic differences between

intended manipulations and perceived manipulations so that

any errors would be averaged out by randomness. Second, the

model could be redefined, based on the subjects' revealed

perceptions. The second approach was adopted so that the











two alternate models (intended manipulation versus perceived

manipulation) could be compared. The comparison of the

models would indicate the existence of a systematic bias.

Furthermore, because interest is focused on the internal

auditors' reactions, rather than the ability to manipulate

independent variables, the internal auditors' perceptions of

the independent variable manipulations should be a preferred

measure. Also, using both models simultaneously provides a

measure of achieved success in the intended manipulations of

the variables.

The revised decision model, which depends on the

subjects' perceptions, requires the substitution of

intermediate dependent variables for independent variables.

The independent variables to be replaced are source, tone,

and type of change. The subjects' perceptions of source and

tone were taken from the dependent variable which asked the

subjects to assign 100 points to the factors that influenced

their decisions. The subjects' responses for strength of

source were substituted for the independent variable source.

However, because the source response and the tone response

were not independent, the measure of tone could not be used

without removing the systematic effect of source. This

problem was overcome by regressing tone on source and using

the residuals as a measure of tone. The model used was

Tone = a + b x Source + e. The residual term, , was used

as a measure of tone.










The last independent variable to be replaced by the

subjects' perceptions was type of change. The subjects'

perceptions were measured by directly asking them to

classify each of the scenarios they worked. These

responses were used in the perception model in place of the

type of change. This procedure provides a built-in measure

of the subjects' involvement in and understanding of their

tasks by comparing subjects' classifications of each

scenario with the dependent variable "difference." A

positive value for "difference" is expected to result from

types of change one and four. On the other hand, a type-2

(type-3) change should result in a zero (negative) value for

"difference." This was used as one test of the third

hypothesis. The substitution of subjects' perceptions for

intended manipulations results in a revised model, which is

illustrated in Figure 3-4.











Theoretical
Variable

Source


Perceived
Variable

Measured


Intermediate
Dependent
Variable


Dependent
Variable


or ----4 Importance
Criticism of Source -
Decision

Tone Measured Importance of
of __ Importance Internal
Criticism of Tone Control
Residuals Procedure

Type Classification
of --- of Type of I
Criticism Change


Figure 3-4. Decision Model of Perceived Factors Influencing
Internal Auditors' Responses to External Criticism of the
System of Internal Controls

Subjects

The final field experiment work was completed using

internal auditors1 and controllers from a variety of sources

in two types of settings. In the first setting the

experiment was administered at a monthly meeting of the

Orlando, Florida, NAA chapter. Chapter officers asked

members to participate in the experiment. However, the

conditions under which the experiment was administered were


1A variety of subjects was used in both the pilot and
field testing phases of the experiment. Subjects used in
early pilot tests were University of Florida undergraduate
auditing and accounting Ph.D. students. The pilot was
extended to the field by using a small sample of internal
auditors who worked for an independent software production
firm and a controller. The results led to several revisions
of the experimental instrument.










not conducive to promoting subjects' concentration.

Fourteen responses were completed at the meeting and another

five were returned by mail. The experimenter felt that this

approach to gathering data was unsuitable. Therefore, the

rest of the data was gathered using a different approach.

Having obtained no statistically significant difference in

responses for this first group of subjects and other

subjects, all were treated as a single group (Statistical

tests are presented in Chapter V).

The second approach involved contacting individual

presidents of NAA chapters, asking them to assist in

distributing experimental packages to qualified subjects at

their monthly meetings. The subjects were provided with an

experimental instrument in a self-addressed stamped

envelope. Each envelope had an index card attached to the

outside, reminding readers that respondents should be either

internal auditors or controllers. No provision was made to

detect which responses came from which chapter, so only an

overall response rate can be computed. In addition to NAA

chapters, a few qualified individuals participated along

with an IIA chapter and an EDP Auditors Association chapter.

Table 3-5 provides details of the response rate. Of the

126 responses received before an arbitrary cut-off date, one

was deemed useless due to its incomplete nature. Some of

the other 125 responses were only partially completed. If a

subject failed to complete the "other" questions, his







63

responses were used nevertheless. However, if a subject

failed to complete a dependent-variable answer, that

particular scenario was not used. There were 5 instances of

partial responses to dependent-variable questions.

Therefore, there were 495 completed scenarios (125 subjects

x 4 scenarios per subject = 500, less 5 incomplete

scenarios).















Ornaniza

NAA

Publix

NAA

NAA

NAA

EDP Audi
and
IIA

Fl. Stat
Universi

NAA

Eckerd C

NAA


Table 3-5. Subject Pool and Response Rate

Number of
tion Cif Instruments Accepted

Orlando, Fl. 19 (only non-mail group)

Lakeland, Fl. 6

Houston, Tx. 50

Atlanta, Ga. 50

Wilminuton. De. 100


tors



te
*ty



orp.


Jacksonville, Fl.


Tallahassee, Fl

Miami, Fl.

Clearwater, Fl.

Baton Rouge, La.


80


6

20

8

35


Total instruments distributed 374

less Orlando-NAA 19

Total instruments distributed
by mail 355

Total number of responses 126

less Orlando-NAA 19

Total mail responses 187

Response Rate (107/355) 30%




The method used to select subjects was not random, and

the selection biases are unknown. Selection biases may be










attributable to differences among all internal auditors and

those who are members of the pool of possible subjects that

were selected. There may be differences among organizations

which agreed to participate and organizations which did not

participate. Within a participating group there could be

differences between those who were qualified to participate

and those who chose to participate. Even though a similar

appeal was made to the leadership of each participating

organization, there may have been differences in the

leaderships' approaches to subjects themselves. It is

impossible to test for most of these differences. However,

it is hoped that geographic diversification and the

reasonably large sample size will mitigate any effects of

self-selection biases.



Chapter Summary

A description of the experimental instrument and the

dependent and independent variables was detailed. This

chapter also developed a simple description of corporate

behavior within a very limited scope. The dependent and

independent variables were related to the description, and

the groundwork was laid for a statistical analysis, to be

presented in the next chapter. The research design to be

used in the experiment was presented along with a

description of the subjects and the protesting of the

experimental instrument. Finally, three hypotheses, which







66

are repeated below, were included in the discussion. The

results of the hypotheses are presented in Chapter V.

HI: The more ambiguous the decision, the greater the
subject's reliance on the source and tone of the message.


H2: There is no difference between the amount of reliance
subjects place on the source (either external auditors or
systems analysts) of the criticism.


H3: The change in the internal control ratings will be a
function of the subject's classification of the type of
change, as is specified in Table 3-4.















CHAPTER IV
CAUSAL MODELS AND PATH ANALYSIS



Since several variables are measured in this study and

several relationships are simultaneously hypothesized, it is

necessary to examine the nature of causality in the proposed

model of behavior in order to strengthen the inferences that

may be drawn from the results of the experiment. The

analysis of causality also prompts the appropriate statistical

procedures that are necessary for testing (path analysis,

etc.).

Correlation among variables may be the result of cause

and effect. In general, it is agreed that, in order to

show causal relationship, three conditions must be

satisfied: (1) the variables must be correlated; (2) the

cause must precede the effect in time; and (3) alternative

hypotheses must be eliminated [Abdel-khalik and Ajinkya, 1979,

p. 26 and Asher, 1976, p. 11]. Therefore, to show that the

model proposed in this study is a valid contender against

other models, the sequence in which the variables occur and

alternative hypotheses must be considered.










For discussion purposes, the proposed model (Figure 3-

5) can be reduced to four variables by combining source and

tone (because these two variables are neither considered to

be independent, nor are they measured independently). For

convenience, the four variables are abbreviated as shown in

Table 4-1.


Table 4-1. Abbreviated Form of

Lona Form

Measured Importance of
Source

and

Measured Importance of
Tone (Residuals)

Classification of
Type of Change

Importance of
Internal Control Procedure

Decision


Variable Names

Abbreviated Frm




st




c


i


d


It is convenient to represent causal relationships

using an arrow diagram, as used in Asher [1976, p.13], who

defines three types of variables: exogenous, endogenous, and

residual. In the current model, and st are exogenous

variables (see Figure 4-1). Endogenous variables are

affected by other variables; in the model, i

and d are endogenous variables. Residuals are those

factors, not actually measured, that impinge upon the

endogenous variables.











As a result of combining source and tone into the

single variable st, the model may now be presented as a

four-variable causal model. The abbreviated model is

presented in Figure 4-1 with the four variables arranged in

a causal network.




st c




R, -> d < i <-- R


Structural Equations

i = Picc + piuRu

d = Pd stst + Pdcc + Pdii + Pdvv


Figure 4-1. Four-Variable Causal Model



Spurious effects can be illustrated using three of the

variables in the model adopted in this study: c, i, and d.

In the model c affects d in two ways. There is a direct

effect byc ond and perhaps an intermediate effect through

i. This relationship is modeled in Figure 4-2.




/ic
d <--- i

Figure 4-2. Model of the Relationship Between Change,
Importance, and Decision











The role of the middle variable, 1, in the model can

never be known with certainty as a result of statistical

tests. As Simon pointed out:

We begin with a set of observations of a pair of
variables, x and y. We compute the coefficient of
correlation, rx between the variables, and
whenever this coefficient is significantly
different from zero we wish to know what can be
concluded from the causal relation between the two
variables. If we are suspicious that the observed
correlation may be derived from 'spurious' causes,
we introduce a third variable, z, that, we
conjecture, may account for this observed
correlation. We next compute the partial
correlation, rx between x and y with z 'held
constant,' and compare this with the zero order
correlation, rx If rx is close to zero,
while rM is no we conifude that either: (a) z
is an intervening variable; or (b) the correlation
between x and y results from the joint cause of z
on both those variables, and hence the correlation
is spurious. [1954, p. 468]

In other words, if the variable i is added to a model

to explain the covariation between and d, one cannot use

statistical methods to distinguish between c -> i -> d and

c <- i -> d. However, the knowledge of the sequence of

the events and common logic should indicate that the

perceived importance of an internal control procedure did not

cause an external auditor to propose a particular type of

change (especially deletion of a complement or addition of a

substitute). Therefore, it can be safely concluded that .

affects d indirectly through i, c -> i -> d,

provided that rcd.i = B.









Blalock applied Simon's work to all possible four-

variable models [1962]. For each of the non-trivial four-

variable models, Blalock offered a test of fit. Basically

the test indicates which specific correlations among the

four variables needs to be zero in order not to be able to

reject a particular model as appropriate. He did not

provide a test of which model fit "best." However,

Blalock's procedure, which allows us to reject a model,

provided considerable insight into the modeling process.

Figure 4-1 is similar to Blalock's model Al which is

reproduced below in Figure 4-3.






X4 < X3
Figure 4-3. Blalock's Model Al

It is convenient to show that Blalock's model Al and

the model proposed in this study are analytically identical

so that Blalock's analysis can be adapted to the study's

model. Blalock restricted his models to the simplest case,

recursive models. To be recursive, the first variable in

the chain, X1, depends only on variables outside the model.

Variable X2, the second variable, can depend only on X1.

This causal dependence is written: X1 -> X2. In an

analogous fashion, X3 can depend only on X1 or X2, and X4

depends on some combination of XI, X2, and X3.










Of course, how X1, X2, and X3 relate to X4 is unknown;

but if the variables are modeled in a particular fashion,

that model can be eliminated because each model predicts

certain vanishing correlations. Therefore, Blalock's

technique provided a practical method to support a

hypothesis indirectly by specifying which other hypotheses

could be rejected. The method does not insure the rejection

of all incorrectly specified hypotheses. If the absence of

a link is hypothesized, a false hypothesis can be rejected

based on the presence of a non-vanishing correlation. To

apply Blalock's technique, the model's variables must be
recursive (the model must proceed in time, and it can have

no feedback loops).

To affect causality, the experiment was conducted such

that the subjects were exposed to the independent variables

corresponding to change (c) and source-tone (at) before they

were asked to respond to the questions that were used as the

variables i and d. Also, the i question always preceded the

d question. Therefore, the timing of the variables, with

the exception of the first two, followed the sequence: X1 ,

c, X2 a st, X3 e i, and X4 5 d. It will be shown that the
ambiguity of precedence between c and st is unimportant.

However, cognitive dissonance theory might suggest that

after the decision, earlier perceptions could be altered,

forming a feedback loop. On the other hand, subjects were

asked the questions in a particular order. If feedback










occurred, it would occur in another scenario. Therefore,

the absence of a feedback loop will be assumed. It can

easily be shown in what follows that the time ordering

between and &t is unimportant to the model.

Notice that in Figure 4-3, X1 and X2 have no connecting

arrow. Other than the arrow between X1 and X4, Figure 4-3

is symmetrical. If we reverse the order of c and t so that

at corresponds to X1, then the model would be unchanged as

long as the original X2 was still linked to X4.

Blalock specified that the model can be rejected if r12

\ B (link between X1 and X2) or if r23 \ 0 (link between X2

and X3). These relationships are stated as null hypothesis

4.

84: r12 0 and r23 0.

Path estimates in a recursive model are found using

regression. "To obtain estimates of the main path

coefficients, one simply regresses each endogenous variable

on those variables that directly impinge upon it" [Asher,

1976, p. 29]. Residual paths are also easily found from a

regression. "Since standardized variables have a variance

of one, the general expression 1-R2 is simply the proportion

of unexplained variance. Therefore, the residual path

coefficient is simply the square root of the unexplained

variation in the dependent variable in question' [Asher,

1976, p. 31].










A series of assumptions are necessary in order to

perform path analysis. These are based on the regression

analysis assumptions. The regression assumptions about the

error term are

(1) its mean is zero;
(2) it has a constant variance for different
values of Xi (homoscedasticity);
(3) pairs of error terms are uncorrelatedl
and
(4) the independent variables and error
terms in the same equation are
uncorrelated. [Asher, 1976, p. 25]

For regression, it is also necessary to assume a

normally distributed error term with the models being

linear in the bi 's [Asher, 1976, p. 25].

In addition to the regression assumptions, Blalock's

technique requires that the model be recursive, and the

independent variables are assumed to be measured without

error [Asher, 1976, p. 27]. The last assumption might give

concern if the path analysis were used to examine non-

experimental data. However, in this experiment, the

independent variables were controlled.

In this study, estimation of the following paths is of

interest (refer to Figure 4-1): (1) pd st(2) Pic; (3) Pdcl

(4) Pdi' (5) PiRu1 (6) PdRv' and (7) Pc st. The method of
estimation and regression formulas used to find these pij 's

is given in Table 4-2.










Table 4-2. Formulas Used to Generate Path Coefficients Used
in the Model


1 j Rearession Model
d st Model 1

i c Model 2

d c Model 1

d i Model 1

i Ru (1-R2)"5 where R2 comes from the regression
using Ru
d RV (I-R2 )5 where R2 comes from the regression
using Rv
c st rc st

Regression Models

Model 1: d = Pd st st + Pdc c + Pdi i + PdRv Rv

Model 2: i = pic c + iRu Ru


The decomposition of correlation between two variables

depends on the technique used to estimate the path

coefficients, pij 's. The pij 's may be estimated by: (1)

solving simultaneous equations (see Simon), (2) multiplying

by structural variables and then solving (see Blalock), or

(3) by using regression coefficients. In any event it is
mathematically convenient to standardize the data before

computing the pij 's. If regression coefficients are used

to estimate the pij 's, the regression coefficients

themselves may be standardized. In this study, standardized

data was used in Ordinary Least Squares Regression to










estimate the pij 's. The correlation coefficients and

partial correlation coefficients used to estimate the pij 's

were not standardized.

"If the model were specified correctly", (see

hypothesis 4) "then (except for measurement and sampling

errors) the empirical correlation between any two variables

should be numerically equal to the sum of the simple and

compound paths linking the two variables" [Asher, 1976, p.

34]. A compound path is equal to the product of the simple

paths comprising it. Therefore, to decompose the

correlations in a model, it is necessary to identify each

path between variables according to the following rules:

(a) no path may pass through the same variable
more than once;
(b) no path may go backward on an arrow after the
path has gone forward on a different arrow;
(c) no path may pass through a double-headed
curved arrow more than once in a single path.
[Asher, 1976, p. 33]

Once the paths have been identified, the correlations

can be decomposed into three categories: (1) direct effects,

(2) indirect effects, (3) and non-causal effects. The

direct effects are the direct paths between the two

variables. The indirect effects are the compound paths

which are followed without going through a double-headed

curved arrow or going backward on an arrow. All paths other

than direct or indirect are non-causal. The correlations

and their connecting paths used in the four-variable model

are given in Table 4-3.













Table 4-3. Correlation Pairs and Connecting Paths for the
Four-Variable Model

Variables Causal Paths
First Second Direct Indirect Non-Causal Pat

c st rc st none none

c i Pci none none

d c Pdc Pic Pdc Pc st Pd st

d st Da none p. PA,


d i Pdi


i st none


none



none


+Pc st Pic Pdi

Pic Pdc

+Pic Pc st Pd st

Pic Pc st


The model proposed in this study is a five-variable

model rather than the simplified four-variable model used to

illustrate causal analysis. Blalock's four-variable model

is an extension of Simon's and others' three-variable

models. The ability to generalize the principles of earlier

work to an n-variable model is specified in Simon [1971, p.

5]. The study's five-variable model is derived by

separating the variables st into two variables, a and 1.

The five-variable model is presented in Figure 4-4.


tU S1


hs













S t k_ c



Rv -> d <-- i <- Ru

Structural Euuations

i = Picc + PiuRu
d pdss + Pdtt + PdcC + Pdii + PdvRv

Figure 4-4. Five-Variable Model

Hypothesis 4 should now be restated to fit the five-

variable model. A five-variable model could have as many as

(5) = 10 links. However, only eight links are included in
the model. The two missing links are (1) pti and (2) psi*

In addition, the double-headed curved arrows indicate that

the three links among the independent variables, Pst, Psc,

and Ptc, are to be considered exogenous to the model.

Therefore, the Blalock technique would indicate two

vanishing correlations associated with paths pti and Psi.

In other words, rsi.tc and rti.sc should be approximately

zero. The two uninvolved independent variables are "held

constant" to prevent a spurious correlation that might occur

if rst, rsc, or rtc \ 8. Therefore, it would not be
desirable to reject hypothesis 4.

H4: rti.sc = B and rsi.tc =











The computation techniques for the paths based on the

five-variable model are presented in Table 4-4. Also, the

decomposition of the (5) 10 correlation combinations is

given in Table 4-5. The techniques described in this

chapter together with the formulas given in Tables 4-4 and

4-5 represent the method used for the analysis of data in

Chapter V.


Table 4-4. Formulas Used to Generate Path Coefficients in
the Five-Variable Model

I Rearession Model
d s Model 1

d t Model 1

d c Model 1

d i Model 1

i c Model 2

s t rst

t c rtc

a c rsc

i Ru (1-R2) 5 where R2 comes from the regression
using Ru

d R, (1-R2) 5 where R2 comes from the regression
using Rv
Regression Models

Model 1: d = pds s + pdt t + pdc c + pdi i+ PdRv R

Model 2: d = pi c + piRu Ru










Table 4-5. Correlation Pairs and
Five-Variable Model

Variable Causal Paths
1 j Direct Indirect

d s Pds none


d t Pdt


Pdc

Pdi



Pic
none

none

none

none

none


none



Pic Pdi
none



none

none

none

none

none

none


Connecting Paths for the



Non-Causal Paths

Pdt Pst + Pdc Pcs

+ Pdi Pic Pcs

Pds Pst + Pdc Pot

+ Pdi Pic Pct

Pdt Pct + Pds Pcs

Pdc Pic + Pdt Pct Pic

+ Pds Pcs Pic
none

Pic Pct

Pic Pcs
rct

rcs

rat
















CHAPTER V
ANALYSIS AND RESULTS




In Chapters III and IV, four hypotheses were developed

and the path analysis model was discussed. In this chapter,

the path analysis is performed and the hypotheses are

tested. Some background tests are done first.

The background work is organized in three sections: (1)

disposition of missclassified responses, (2) intended vs

perceived classification, and (3) subject reliability. The

first section, disposition of misclassified responses, is

devoted to determining whether or not to include in the

analysis data from scenarios that were missclassified by

subjects. In the second section, the effect of classifying

the data as perceived rather than as intended is analyzed.

"Intended" refers to the author's intended manipulation of

the independent variables. "Perceived" refers to the

subjects' perceptions of what the values of the independent

variables were. The third section examines subject

reliability by specifically including in the analysis the

responses of subjects who missclassified most of their

responses.







82

In the remainder of the chapter each of the following

hypotheses is addressed.


Hl: The more ambiguous the decision, the greater the
subject's reliance on the source and tone of the
message.

H2: There will be no difference between the amount of
reliance the subjects place on the source (either
external auditors or systems analysts) of the
criticism.

H3: The change in the internal control ratings will be a
function of the subject's classification of the type of
change, as is specified in Table 3-4.

H4: The path analysis model will fit, i.e.,
rti.sc = B and rsi.tc B.

For convenience the variables may be referred to in an

abbreviated form. The variables and their abbreviations are

given in Table 5-1.







83


Table 5-1. Abbreviations for Variables

Abbreviation Variable

s Source

t Tone

c Type of Change

i Importance of Procedure Being Changed

d Subject's Decision- Recommendation to Audit
Committee

diff. Difference- Subject's Final Evaluation of
Scenario's Internal Control Minus Initial
Evaluation

2pe DIf control
T Transaction Origination
E Transaction Entry
P EDP Processing









Disposition of Missclassified Responses

Whenever a subject answered question four (classify the

type of change being recommended) differently from the

expected response, his response was labeled missclassified.

Table 5-2 provides a breakdown of the percentage of

responses which were missclassified by type of change and

type of EDP-control task. There were four types of changes

(add a complement, delete a complement, delete a substitute,

and replace a substitute with a complement) and three types

of EDP-controls (transaction origination, transaction entry,

and EDP processing).


Table 5-2. Table of Missclassified Responses as a Percentage
of All Responses

Type a. Change

T C 11 12 13 14 ITotal
y o -------------------------+----------------+
p n E I 10% I 26% I 35% I 47% 1 30%
e t --------------------------+---------------+
r P 1 18% I 77% I 79% I 51% I 56%
o o ---------+--------+--------+-----+-------+
f 1 T I 13% I 2B% I 50% I 55% I 35%
---------+--------+---------------+--------+-----
Total 14% 41% 54% 51% I 40%


In Table 5-2, cells P2 and P3 represent the worst

missclassifications by subjects. Therefore, those two cells

are selected for further examination. In cell P2, the

correct answer would have been "C', delete a complement.

(Refer to Table 3-4 for a complete list of expectations by

type of change.) In Table 5-3, the P2 responses are sorted

by answers to question four.










Table 5-3. Distribution of Subjects' Classification of
Type-P2 Scenarios


Perceived yepe If Change

IA IB IC* ID, E, & GI Total
-----------------------------------+--------+--- --+----------
Frequencyl 8 I 18 10 I 7 1 43
Percent I 18.608 41.86 I 23.26 I 16.29 I 188.80
----- -+--------+--------+--------+---- --------
indicates correct response


Most of the incorrect responses were "B" or "A."

A response of "B" indicated that the subject thought the

change was an addition of a substitute, while response "A"

indicated that the subject perceived an addition of a

complement. In other words, 60.46% (18.68% + 41.86%)

of the subjects missclassified this change as an addition

rather than a deletion of a complement. Examination of the

scenario in question (see Appendix B) shows that the

recommended change involves adding to the duties of the tape

librarian. The additional duties are in violation of the

separation of duties concept. Therefore, the correct answer

to question four should be "C", deletion of a complement.

Subjects who analyzed this scenario as an addition of a

control were most likely confused between the classification

of adding duties and adding a control. Perhaps the 42% who

answered "add an undesirable control" thought of the added

duties as "adding a control" but correctly analyzed that

the change would have an ill effect.









In Table 5-4, the P3 responses are sorted by answers to

question four.


Table 5-4. Distribution of Subjects' Classification of
Type-P3 Scenarios


IA, B, & FIC ID* IE I Total
-------------------+---------+------- -+-------+-----
Frequencyl 8 I 17 I 8 I 6 I 39
Percent I 20.51 I 43.59 I 20.51 I 15.38 I 180.08
---------+---------+--------+----------------------
indicates correct response


Examination of scenario P3 (see Appendix B) reveals

that the intended change was from maintaining six months of

backup tapes to maintaining three days of backup tapes for

the master and transaction files. The grandfather, father,

and son (three days of tapes) are considered adequate in the

literature to reconstruct the current balance and the

history of the account, if you assume that the account

contains a history of past transactions. Therefore, the

expected answer was 'D", delete a substitute. The 43.59%

who responded "C", delete a complement, may have considered

the additional backup tapes necessary, especially if they

thought that the master file contained only the current

balance. In that event, the old transaction tapes would be

necessary to reconstruct the account histories.

Unfortunately, the detailed nature of the master file was

not included in this scenario. Furthermore, if the subject

understood the change as recommending the trading-in of the










six-month policy in favor of the three-day policy, he may

have responded to question four with an "E", replace a

substitute with a substitute. 15.38% of the subjects

responded "E."

From the analysis of some of the missclassified

responses, it can be seen, after-the-fact, that subjects

might have had "legitimate" reasons for missclassifying

scenarios. This raises a question of whether the remaining

analysis should be performed on data classified by intended

manipulations or on data classified according to the

subjects' perceptions.


Intended vs Perceived Classification

The results were analyzed to determine if the author's

intended manipulations of the variable, type of change, were

correctly perceived by the subjects. This analysis was

accomplished in two ways.

First, the subjects' classification of the proposed

change (question four), was compared with the intended

manipulation. For example, the expected response to a type-

1 change, add a complement, was "A" (see table 3-4). Table

5-2 shows that 40% of all scenarios were missclassified.

Second, the subjects' responses were compared to

responses that would be expected if they had correctly

perceived the intended manipulation. For example, the

expected value of the variable "difference" for a type-2