Reporting Control Deficiencies in Repeat Internal Audit Engagements*

Abstract

This study examines the reporting of control deficiencies in repeat internal audit engagements. Experienced internal auditors were presented with a hypothetical case in which they were asked about the likelihood of reporting an internal control deficiency discovered last year but which was, “through an oversight,” not reported to company management. The study varies whether the deficiency is an operational control or an internal control over financial reporting and who identified but failed to report the deficiency last year (either the participant, the participant's colleague whom they like and admire, or a colleague whom they neither like nor dislike). The results show that internal auditors are less likely to report an operational deficiency (versus a financial reporting deficiency) in the current year that was not reported last year. Further, internal auditors are less likely to report a control deficiency in the current year when they themselves or a colleague they like and admire (versus a colleague they feel neutral about) failed to report it last year.