Auditors’ Evaluation of Management’s Competence After Failure in Internal Control

Abstract

Audit guidance requires auditors to assess management’s competence with respect to internal controls over financial reporting (ICFR) based on the recommendations of COSO’s integrated framework. The omission bias theory suggests that after internal control failures, auditors may assess managers’ competence in a manner that is inconsistent with the requirements of the audit guidance. Results from four experiments using 313 experienced audit and accounting professionals support this concern and show how to mitigate it. I find that auditors are vulnerable to the omission bias, viewing the manager to be least responsible for the control failure and, therefore, most competent when prior to the failure the manager did nothing to prevent it. I also find that auditors can reduce their vulnerability to this bias by forewarning their clients about the increased importance of a key control in an area of potential future concern—a non-required practice encouraged by the audit guidance. Consistent with omission bias literature, I find that forewarning makes omission of action unexpected and thereby mitigates the omission bias. My results also confirm that auditors incorporate competence judgments into their evaluations of the ICFR, as required by the audit guidance.

Keywords: management's competence, omission bias, auditor's communication, COSO, integrated framework, internal control