Does the Adoption of a Business Risk Audit Approach Change Internal Control Documentation and Testing Practices?

The purpose of this study is to investigate the impact of the adoption of a business risk audit approach on internal control documentation and testing. Data were collected from senior auditors before and after a change to a new business risk approach to determine if auditors’ preferred internal control documentation format, as well as the number of formats commonly used, had changed. In addition, corroborating data were collected from 23 experienced managers and partners regarding preferred documentation format and extent of control testing and reasons for changes in control evaluation and testing approaches. The results suggest that auditors use narratives significantly more often and rely on other formats significantly less than previously. In addition, results indicate that the primary reason auditors choose to rely on narratives is to enhance audit efficiency, and second, because the flexibility of this format works well with the new audit approach adopted. These findings have implications for audit effectiveness, since recent research suggests that significant internal control deficiencies may be overlooked if auditors rely on a single format. Finally, auditors indicated that the frequency of testing of controls has significantly increased as a result of the enhanced audit focus on business processes.