Internal Audit Outsourcing and the Risk of Misleading or Fraudulent Financial Reporting: Did Sarbanes-Oxley Get It Wrong?

Abstract

The Sarbanes-Oxley Act (SOX) prohibits companies from outsourcing internal audit work to their external audit provider. Competing predictions on the effects of this prohibition stem from two academic arguments relating to the provision of nonaudit services by the external auditor: knowledge spillover and economic bonding. Using proprietary data, we investigate whether companies that outsourced internal audit work to their external auditor pre-SOX had a higher risk of misleading or fraudulent external financial reporting (accounting risk). Consistent with the knowledge spillover argument, our results indicate that prior to SOX, outsourcing internal audit work to the external auditor is associated with lower accounting risk as compared to keeping the internal audit function (IAF) entirely in-house or outsourcing the work of the IAF to a third party other than the external auditor. The magnitude of the relation is significant, as outsourcing to the external auditor is associated with a 23 percent reduction in accounting risk relative to firms that kept the IAF in-house.

Keywords: Internal Audit Function, Outsourcing, Sarbanes-Oxley Act, Corporate Governance, Financial Reporting Quality, and Accounting Risk

JEL Classification: M41, M43, M49, M55, G34, G38, K22