Sourcing of internal auditing: An empirical study

Management Accounting Research 18 (2007) 102–124

Sourcing of internal auditing: An empirical study Roland F. Spekl´e ∗ , Hilco J. van Elten, Anne-Marie Kruis Centre for Accounting, Auditing & Control, Nyenrode Business University, P.O. Box 130, 3620 AC Breukelen, The Netherlands

Abstract This paper studies the factors associated with organizations’ internal audit sourcing decisions, building from a previous study by Widener and Selto (henceforth W&S) [Widener, S.K., Selto, F.H., 1999. Management control systems and boundaries of the firm: why do firms outsource internal audit activities? J. Manage. Account. Res. 11, 45–73]. In their study, W&S used Transaction Cost Economics (TCE) to explain the governance of internal auditing. Our study seeks to replicate their results, using newly collected data from 66 companies headquartered in the Netherlands. Our findings are supportive of W&S. Like W&S, we find asset specificity and frequency (both individually and in interaction) to be significantly associated with sourcing decisions. These findings are robust against different model specifications, and they hold across variously defined samples. We conclude that the W&S results are reproducible in different conditions, enhancing the credibility of the TCE-based explanation of organizations’ internal audit sourcing practices. © 2006 Elsevier Ltd. All rights reserved. Keywords: Internal auditing; Sourcing; Make-or-buy decisions; Transaction cost economics

1. Introduction Traditionally, the internal audit function has been designed to help ensure reliable accounting information and to safeguard company assets. More recently, internal auditing has evolved to encompass operational auditing, risk assessment, IT assurance services, and more. This expanding role has increased the importance of internal auditing as part of the organization’s management control structure (Widener and Selto, 1999) or risk management system (Spira and Page, 2003). But it has also changed the demands ∗

Corresponding author. Tel.: +31 346 291225; fax: +31 346 291250. E-mail addresses: [email protected] (R.F. Spekl´e), [email protected] (H.J. van Elten), [email protected] (A. Kruis). 1044-5005/$ – see front matter © 2006 Elsevier Ltd. All rights reserved. doi:10.1016/j.mar.2006.10.001

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

103

being put on internal auditors. Their new role requires different skills and competencies, and many organizations need to face the choice whether to develop these broader competencies internally or to outsource internal auditing to outside service providers (Ahlawat and Lowe, 2004; Widener and Selto, 1999). Over the last decade, this decision has been hotly debated in the professional literature. The debate over the benefits of organizing the internal audit function in-house versus the alternative of outsourcing this function to third party vendors (usually a public accounting firm) is not without partisan interests. Indeed, the debate can be seen as a jurisdictional dispute between the internal audit and the public accounting professions over the right to control the provision of internal audit services (Covaleski et al., 2003; Rittenberg and Covaleski, 2001). For public accounting firms, the provision of internal audit services is a lucrative market (Petravick, 1997; Rittenberg and Covaleski, 1999). Some estimate that potentially, an accounting firm’s revenues from internal audit services can be up to 10 times that of annual financial statement audits (Aldhizer et al., 2003). These firms justify their presence in the market for internal audit services by stressing their sophisticated expertise, flexibility, and cost-effectiveness (Caplan and Kirschenheiter, 2000). Internal auditors, on the other hand, emphasize the importance of in-depth, organization-specific knowledge, loyalty, and their role in handling crisis situations and fraud prevention (Barr and Chang, 1993; Chadwick, 2000; Martin and Lavine, 2000). This debate has gained additional momentum as in the wake of recent business scandals many organizations are currently reconsidering their internal audit functions –either voluntary or forced by new laws, regulations, and guidelines (the Sarbanes-Oxley Act, SEC-rules and their local counterparts all around the world). Although these new rules appear to favour in-house internal auditing as an integral part of the organization, outsourcing is still allowed provided – broadly speaking – that the organization retains management of the internal audit function and the contractor is not the external auditor. As for the future, most practitioners seem to accept – albeit sometimes grudgingly – that outsourcing is here to stay (Aldhizer et al., 2003; IIA, 1998). In the academic literature, only a few studies address the factors that drive organizations’ decisions to internalize or outsource internal audit activities. In an analytical study, Caplan and Kirschenheiter (2000) demonstrate that the choice between outsourcing and in-house provision of internal audit services may be explained by the higher incentive intensity an outside vendor experiences. As public accounting firms can be sued following an audit failure, their stake in providing high quality services is high, and they may be expected to exert quite intense effort to prevent audit mistakes. Internal auditors who are employees of the organization cannot be exposed to incentives of similar strength. On the other hand, public accountants may have higher reservation wages. On balance, Caplan and Kirschenheiter found that the incentive to outsource increases in various measures of risk, including the risk that a control weakness exists and the size of the loss that can result from an undetected control weakness. The only empirical study we know of that addresses the specific factors associated with organizations’ internal audit sourcing decisions is Widener and Selto (1999). In their study, they used Transaction Cost Economics (TCE; Williamson, 1975, 1985, 1996) to explain the organization of internal auditing. Based on survey data collected from 83 firms based in the USA, they found that asset specificity and frequency – both individually and in interaction – were significantly related to outsourcing. For several other hypotheses, especially regarding the role of uncertainty, they found no support. Their regression model explained 53% (adjusted R2 = 0.46) of the variation in outsourced internal auditing. Given the apparent strength of their results, the Widener and Selto study (henceforth referred to as W&S) is an important contribution to our understanding of internal audit sourcing behaviour. Our study seeks to replicate these results, using newly collected data relating to the year 2003 from 66 companies

104

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

headquartered in the Netherlands. This is a valuable project for several reasons. For one, replication is important in its own right. Although replication does not seem to be part of the academic management accounting tradition, many would agree that replication studies are essential to assess the robustness of the results of earlier work, and to add to a knowledge base that is truly cumulative in nature (Otley and Pollanen, 2000). Lindsay (1995) argues the point most poignantly: “[. . .] successful replication is the bedrock of scientific knowledge. It tells us whether we have a result at all. It also tells us the range of conditions under which the result can be expected to hold [. . .]” (Lindsay, 1995, p. 47). More specific reasons to replicate the W&S study include the following. Because their sample was relatively small, some may doubt the generalizability of the W&S results. But even if one takes a less strict position, generalizability may be an issue. As W&S rely exclusively on US data, it is conceivable that the insights derived from their paper do not generalize to sourcing decisions in other institutional contexts. Although we currently do not have any clear theoretical expectations as to how institutional context (e.g. culture, legal environment, development of the audit profession) influences internal auditing, the idea that context matters is intuitively appealing. Additionally, W&S is based on data from the year 1996. Both the conception of internal auditing and the role of this function in organizations seem to have changed quite considerably over the past few years. Particularly, one would expect that the recent business scandals and the regulatory response to them have had a rather profound impact on the organization of the internal audit function. Because of these changes, it is possible that the relations found by W&S are no longer valid. By trying to replicate W&S’s results in an independent sample, at a different point in time (2003 versus 1996), and in a different institutional setting (the Netherlands versus the USA), our study addresses the concerns as to the generalizability and (continued) validity of the original W&S study. As our study is explicitly designed to build from W&S, our hypotheses are also based on TCE, and are largely similar to those tested by W&S, except for the influence of uncertainty which we predict to be insignificant. Our questionnaire is essentially identical to the W&S survey instrument. Our findings are supportive of W&S and strengthen their substantive conclusions. In variously specified regression models, we consistently find that asset specificity and frequency (individually and in interaction) are significantly associated with internal audit sourcing decisions, reinforcing the importance of these TCE variables in explaining organizations’ internal audit sourcing behaviour. However, we also find evidence to suggest that the W&S study overstates the explanatory power of TCE and that the high R2 reported by W&S is in part the result of measurement problems. The structure of this paper is as follows. The second section uses TCE to identify and hypothesize constructs that may explain internal audit sourcing decisions. The third section describes our research design and operationalizes the constructs. Section 4 presents the quantitative analysis. The final section provides conclusions and discusses this study’s limitations, implications, and suggestions for further research.

2. Hypotheses From a TCE perspective, sourcing of internal auditing is seen as a choice between two alternative modes of governance. These alternative governance structures differ in the control mechanisms they employ to safeguard contract execution. In-house provision of internal audit services subjects these activities to hierarchical control, which is primarily based on managerial authority, internal incentive structures, and monitoring. Outsourcing implies reliance on market discipline. Because of these structural

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

105

differences, each individual mode of governance has a distinctive problem-solving potential. But the alternatives also differ in respect of transaction costs. These include the costs of drafting, negotiating, and safeguarding the transaction, but also the (opportunity) cost of performance losses due to imperfect control. TCE suggests that economic agents seek to adopt governance structures that match their control needs in a cost-effective way. These control needs arise from the characteristics of human behaviour, of which bounded rationality and opportunism are especially consequential. Bounded rationality refers to man’s limited cognitive and computational ability. Opportunism is “self-interest seeking with guile” (Williamson, 1985, p. 47), which may include calculated efforts to mislead and deceive. But the control needs also depend on the attributes of the transaction, i.e. on its score on asset specificity, uncertainty, and frequency. Specific assets are resources that are more valuable in their current use than in alternative uses. Asset specificity denotes the presence of opportunity losses that arise if the investments made to support the transaction are to be put to alternative uses or users. Uncertainty refers to the degree of specifiability of intended performance and predictability of the environment within which the contract is to be executed (environmental uncertainty), and to the problems contracting parties may experience in monitoring performance (behavioural uncertainty). Frequency represents the volume and value of the transactions over time. TCE’s main idea is that “transactions, which differ in their attributes, are aligned with governance structures, which differ in their cost and competence, so as to effect an economizing result” (Williamson, 1999, pp. 1090–1091). 2.1. Asset specificity Specific investments are associated with differentiated products, services, or processes. The willingness to invest in specific assets is related to the value of this differentiation to the firm, net of cost differentials of both a production and transaction cost nature. Specificity, then, is present if there is no equally attractive alternative for a given means to achieve a given purpose (Nooteboom, 1993, p. 443). In some firms, specific investments may be required to perform the internal audit function.1 For instance, it may be necessary to build a firm-specific knowledge base for the internal auditors to function effectively. They may need a rich and detailed understanding of the firm’s operations, strategies, and corporate culture to be able to construct a meaningful audit strategy and to conduct the audit in a competent and informative way. This knowledge, however, is only valuable within the context of the firm to which it relates, and the costs associated with its acquisition can only be recovered in that particular context. The degree of asset specificity of internal auditing depends on the nature of the audits as such. For instance, a routine financial audit to review the reliability of accounting information relies on a generic, fairly standardized technology and its specificity will be relatively low. Operational audits and special projects on the other hand require a more tailored approach, taking into account organization-specific circumstances and considerations, and their specificity rises accordingly. But the degree of asset specificity also depends on the role played by the products of the audit efforts in managing the firm. Some firms seem to approach their internal audit function rather passively, viewing it as just another component of their financial control system with no special status. Others, however, attribute a more vital role to the internal audit function, emphasizing its value-adding contribution to the firm’s operations, risk management, and 1 At least to some extent, all auditing requires specialist knowledge, i.e. some degree of technical competence (Arru˜nada, 2000). This competence, however, is of a functional kind and does not necessarily involve asset specificity at the level of the auditor–auditee dyad because the functional expertise may be applicable (without loss of value) to a broad class of firms.

106

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

control processes. In this latter view, internal auditing is much more integrated in the management of the organization, and it will rely more on strategically relevant information. In fact, it may even produce such information. In this more pronounced role, asset specificity is higher than in the case of internal auditing as a plain guardian of financial data reliability. If internal auditing requires deep knowledge of the business and the company, firms will tend to internalize the internal audit function. Acquisition of such knowledge is best supported through thorough immersion in the organization, especially if the required ‘business sense’ resists codification and can only be gained in a learning-by-doing fashion. Potential external providers can only be persuaded to make the auditee-specific investments if they can secure a long-term contract that allows them to recover their initial investments. Writing such contracts, however, is problematic because that requires firms to specify up front the properties of the audit services they desire over longer periods of time. In addition, firms would need to be able to explicate the necessary investments in firm-specific knowledge in legally enforceable terms, and would need to be able to assess whether their contracting partner actually makes these investments. When these conditions cannot be met, contracts will be incomplete, opening the door to opportunistic behaviour, e.g. shirking on effort and quality, underinvesting in firm-specific knowledge, or commanding increasing premiums for the services. In the presence of substantial asset specificity, the outsourcing firm cannot rely on market discipline to constrain such behaviour, because switching to another external provider (with no company-specific knowledge) would compromise audit quality – at least for the period of time required for the new partner to build up its knowledge base.2 If, however, the internal audit function requires no significant investments in firm-specific assets, market-mediated procurement of internal audit services is likely to be the more efficient alternative. Market exchange provides strong performance incentives, while reputation concerns in the market for audit services serve as a low-cost quality safeguard (Arru˜nada, 2000). To summarize the discussion, our hypothesis is that when asset specificity of the internal audit function rises, firms will be more likely to internalize this function. Conversely, low asset specificity would motivate firms to outsource internal auditing (cf. also Widener and Selto, 1999). The asset specificity of internal auditing becomes manifest through investments in firm-specific expertise and training, the nature of the audit activities, the role of internal auditing, and its integration in the management of the organization. Thus: H1. Asset specificity of the internal audit function is negatively associated with the degree of outsourcing. 2.2. Environmental uncertainty Environmental uncertainty affects the degree of ex ante specifiability of desired performance and the predictability of (the influence of) the environment in which the contract is to be executed. Higher uncertainty inhibits a full ex ante specification of required performance, favouring governance structures that can secure smooth adaptation to unfolding conditions and emerging insights. The alternative modes of governance differ in the way in which they accommodate adaptation. In spot market contracting (i.e. 2 It is interesting to observe that these theoretical arguments – though cast in a different language – are also present in the professional debate. The Institute of Internal Auditors (IIA) for instance argues that the internal auditor’s superior knowledge of the business favours in-house sourcing, and points to the danger of becoming dependent on the outside provider as the external auditor gains more institutional knowledge about the organization (IIA, 1998).

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

107

the purest form of market governance), flexibility is achieved through autonomous unilateral adaptation to changing circumstances. When confronted with altered conditions, each party reconsiders its own position, and the market ensures that a new equilibrium is found in which new contracts fully reflect the novel conditions. Recurrent spot market contracting, however, requires low asset specificity. With higher levels of specificity, the market becomes too thin to induce convergent expectations, and successful adaptation presumes a coordinated rather than a unilateral response from contracting parties. Then, the hierarchy becomes the preferred governance mode. Its reliance on managerial authority provides the mechanisms for sequential adaptation and supports a cooperative response to changing circumstances. Thus, TCE’s standard position is that uncertainty reinforces the effect of asset specificity (cf. Boerner and Macher, 2002; David and Han, 2004): when asset specificity is present to a non-trivial degree, uncertainty tilts the balance in favour of internalization at lower levels of asset specificity than would otherwise be required to result in a preference for in-house sourcing. Conversely, if asset specificity is low, higher uncertainty strengthens the motivation to outsource. We expect, however, that this general argument cannot be sustained in the specific context of our study. One reason for this is that internal audit sourcing is not a discrete choice between the extremes of complete outsourcing on the one hand, and full internal provision of these services on the other. Rather, firms can choose to internalize parts of the internal audit function, and to rely on external providers for other internal audit services. This co-sourcing option provides additional ways to deal with uncertainty; ways that are not captured by the default predictions of TCE. For instance, even if a firm’s total package of internal audit activities is highly specific, the internal audit department may still hire external assistance to cope with peaks in the demand for its services. In that case, outside contractors work together with the internal audit department, presumably handling the relatively unspecific parts of the total package. Similarly, the firm may choose to assign ad hoc projects that would overburden the capacity of the internal department to outside parties (e.g. implementation of “Sarbanes–Oxley”). Another argument that leads us to believe that TCE’s standard position on uncertainty may lack relevance in explaining internal audit sourcing decisions has to do with the basis of the hierarchy’s advantage in handling adaptation when asset specificity is substantial. The asserted superiority of the hierarchy’s ability to manage sequential adaptation to emerging conditions hinges critically on managerial involvement. For reasons that will be discussed more fully in the context of behavioural uncertainty, we argue that in the typical organization this involvement cannot be realized for lack of auditing expertise at senior management levels (see Section 2.3, in which we shall also address the broader theoretical implications of this argument). If this is true, the decision on whether and how to adapt to changing circumstances must essentially be left to the internal auditors themselves. Although senior management probably retains formal ratification rights, its influence will usually not extend beyond a rather passive, relatively uninformed ‘pre-action review’ (Merchant, 1985). This deprives the hierarchy of the benefits that are usually associated with its unique ability to support coordinated adaptation. That is to say, we can think of no compelling reason to assume that the effectiveness of a relatively uninformed pre-action review depends on whether the internal auditors who initiate the adaptation proposal are employees of the firm or outside contractors. These issues probably warrant a detailed examination. However, our empirical study has been designed to capture the general thread of internal audit sourcing and cannot address these finer points. Therefore, we leave the details to future research and stick to a coarser hypothesis: H2. Environmental uncertainty does not affect internal audit sourcing decisions.

108

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

2.3. Behavioural uncertainty, or information impactedness Up to this point, our discussion has focused on uncertainty as it relates to the desired properties of performance and the external circumstances affecting these properties. Uncertainty, however, may also have behavioural origins. Behavioural uncertainty is associated with strategic non-disclosure, manipulation of information, and – more generally – moral hazard and information asymmetry. Williamson uses the notion of information impactedness to refer to behavioural uncertainty. He conceptualizes information impactedness as a derivative condition that arises mainly from uncertainty and opportunism (Williamson, 1975). Parties to an exchange may possess or acquire private information that is relevant to contract execution or to the assessment of performance. Such private information may be exploited at the expense of the other party. If asset specificity is low, competitive pressure effectively curbs opportunistic inclinations, and behavioural uncertainty is not a problem. With higher degrees of asset specificity, however, behavioural uncertainty poses serious contracting hazards. In the case of internal auditing, such hazards are particularly real. At least to some extent, internal auditing is a specialist function, requiring specialized skills and competencies. Therefore, internal auditors tend to have significant autonomy and exert considerable influence on what to audit and how to audit it. Also, the internal auditors’ job involves a great deal of professional judgement, and the evidence from which they work cannot always be explicated fully. For instance, their reports may partly be based on personal observations, interviews, and visual on-site inspections. For these reasons, audit reports document their efforts imperfectly, and the quality and efficiency of their work cannot fully be ascertained from these reports (cf. Arru˜nada, 2000). The fact that auditors often work at remote locations, physically separated from one another exacerbates these problems of observability and verifiability. This puts them in a position to shirk on effort and quality (cf. also Caplan and Kirschenheiter, 2000; Widener and Selto, 1999). In conditions of non-trivial asset specificity, the standard TCE prediction is that higher behavioural uncertainty increases the attractiveness of internalization. The argument is that internal organization brings better monitoring, enhancing observability of effort and performance quality. Also, internal organization weakens incentive intensity, diluting the incentive to perform well, but also alleviating the problem of opportunism (Williamson, 1975). In their study of internal audit sourcing, W&S adopt a similar view. They hypothesize that if firms experience problems in observing the quality of idiosyncratic internal auditing, they are even more likely to internalize the audit function (Widener and Selto, 1999). We take a different position. Our point of view is that the standard TCE approach may well overestimate the relative benefits of internalization in coping with conditions of information impactedness (and environmental uncertainty; see Section 2.2) in contexts in which expert knowledge is important. Examples of such contexts may include legal and tax advice, IT services, and – indeed – internal auditing. Before we argue this point more fully, it is important to stress that our analysis challenges a specific, individual TCE hypothesis, not the theory as such. We believe that the perspective we develop below is in fact consistent with TCE’s explanatory apparatus and general logic. Our reasoning merely reemphasizes the role of knowledge in matters of governance and control – a theme that has always been central to TCE – and explicates its hitherto implicit ramifications in the specific situation of activities that involve expert knowledge. Williamson discusses the superior monitoring properties of internal organization in a rather general, context-free way (cf. Williamson, 1975, pp. 29–30). He argues that an internal monitor (as opposed to an external supervisor) has greater freedom of action, can rely on less formal evidence, and has a wider scope, being less restricted by a predefined mandate. Also, he refers to the language advantage of internal organization. Hierarchies tend to develop their own idiosyncratic jargon, facilitating effective internal

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

109

communication of complex matters and supporting a deeper and subtler mutual understanding of what goes on. External parties do not speak that language, and are more vulnerable to problems of interpretation. Coupled with the inside experience on which the internal monitor can rely, internal monitoring becomes more knowledgeable, perceptive and relevant than external supervision (cf. Williamson, 1975, pp. 35, 36). Hierarchies, however, cannot always capitalize on these comparative advantages in the same way and to the same degree. Monitoring is associated with observing actual effort or performance, and with comparing the observations to some pre-set norms or standards. Thus, monitoring presupposes the ex ante availability of a frame of reference as to the attributes of satisfactory behaviour or outcomes, and the presence of a sufficiently knowledgeable monitor to interpret actual observations against that background. The problem with activities that require expert knowledge is that this condition cannot always be met. When expert knowledge is involved, the frame of reference soon becomes too broad and indiscriminate, and senior management no longer possesses sufficient expertise to be able to assess the quality of performance and to initiate corrective action. Of course, senior management may choose to invest in the necessary expertise in order better to be able to perform its monitoring function, but that is only economically rational if the activity is important enough to warrant the investment. In absence of such expertise, however, the potential monitoring advantage of internalization cannot be realized (cf. Spekl´e, 2001). In the case of internal auditing, it is unlikely that hierarchical monitoring can be very effective. Because of the specialist nature of the internal audit function, an independent assessment of its performance requires a detailed and costly examination of audit operations by a knowledgeable monitor. Given the specialized skills and technologies involved in internal auditing and the strong reliance on professional judgement, the monitor almost needs to be an auditing expert himself or herself. Although internal auditing might be important to the firm, organizational performance will usually be relatively insensitive to internal audit quality differences as long as this quality remains above a minimum threshold level. Therefore, the net benefits of building the required knowledge base at senior management levels are likely to be negative, and senior management must accept that its ability systematically and purposefully to influence the quality of internal audit operations is seriously limited. Furthermore, this limited ability does not depend on whether the firm chooses to internalize or to outsource the internal audit function, at least not critically so. Even if firms outsource their internal audit function, recent regulations and guidelines (in the USA as well as in the Netherlands and in many other countries) require them to retain the top internal audit position inside the firm. For instance, AICPA ethics rulings forbid public accounting firms providing outsourcing services to assume ultimate management responsibility for the internal audit function. Hence, the (limited) ability of senior management to monitor the individual who has overall responsibility for the internal audit function (the chief auditor) appears largely unaffected by the sourcing decision (Caplan and Kirschenheiter, 2000). Therefore, we expect that differential monitoring ability cannot explain internal audit sourcing decisions to any significant extent, simply because the alternatives are practically similar in this respect. To be sure, TCE’s default preference for hierarchical governance in conditions of high asset specificity and uncertainty does not only rest upon the asserted monitoring advantages of internalization, but also on its weaker incentive intensity. Within the organization, individual compensation tends to be less strongly tied to the outcomes of the transaction, decreasing the prospective gains from opportunistic exploitation of information asymmetries. In the case of internal auditing, however, we expect that reputation concerns on the part of outside providers may compensate for this potential advantage. Because the external auditor’s reputation is a valuable asset, it is costly for external service providers to risk their reputation by reneging on promised performance quality (Arru˜nada, 2000; DeAngelo, 1981), even if the chances that shirking

110

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

will go undetected are relatively large. Therefore, monitoring is less important in an outsourcing situation than in the case of internally serviced internal audit needs. In fact, the incentives associated with reputation concerns of an outside service provider – though presumably still pretty weak – may offset any remaining monitoring advantage accruing to hierarchical governance of internal auditing. To summarize our argument: in the case of internal auditing, internalization might be more attractive for its relative monitoring advantages, but these are small. From an incentive point of view, however, outsourcing may be better, but only marginally so. On balance, we expect that both sourcing options are essentially alike qua ability to cope with behavioural uncertainty. Accordingly: H3. Behavioural uncertainty does not affect internal audit sourcing decisions. 2.4. Frequency TCE submits that governance structures are aligned with transactions in a discriminating, transaction cost economizing way. There are, however, set-up costs involved in matching the structure to the transaction. Obviously, these costs must be weighted against the benefits of better governance. Frequency refers to the volume and value of a particular transaction over time,3 and affects the economic rationality of investing in specialized governance. As recurrent and more valuable transactions provide a larger basis against which to charge the extra costs of specialized governance (Williamson, 1985), higher frequency supports the emergence of tailored control. An implication of this argument is that as frequency rises, firms develop a preference for in-house sourcing at lower levels of asset specificity than would otherwise be required to tilt the balance in favour of internalization. Or to approach the issue from the opposite angle: frequency considerations may keep companies from internalizing the internal audit function even if they would prefer to do so because of high asset specificity. In-house provision of internal audit services requires firms to invest in audit expertise and in training and development to keep this expertise up-to-date. As the scope of internal auditing is expanding and internal auditors have to confront increasing demands on their competence and skills, these investments become considerable. By their nature, such investments carry significant economies of scale, and the demand for internal audit services must be sufficiently large to be able to recover the investments. In fact, we expect that only the largest users of internal audit services are able fully to internalize the audit function if they wish to do so. The reason for this is that internal auditing is becoming increasingly more advanced and specialized in terms of technical competence, so that only the larger firms can afford to keep the necessary specialties on staff.4 For example, few firms are able to manage IT-auditing entirely in-house. In line with these arguments, we expect firm size and the intensity of internal audit use to interact with asset specificity, affecting internal audit sourcing decisions. More specifically: 3 The notion of frequency as it is being used in TCE differs from the meaning of this word in common parlance. In the latter use, the term refers to the rate of recurrence of something. In TCE, however, frequency is associated with both incidence and value, representing the ‘value at risk’ related to a group of transactions. 4 The professional literature echoes this argument. Thus, the Institute of Internal Auditors expresses the belief that the internal audit function is best performed by a fully resourced and competent staff that is an integral part of the organization, but recognizes that smaller firms find it difficult to attract and retain competent staff, and that smaller internal audit shops are unable to keep up with increasing demands for specialization (IIA, 1998).

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

111

Fig. 1. Synopsis of expectations.

H4. The effect of asset specificity on the degree of outsourcing is larger when frequency is low than when frequency is high. Although in theoretical TCE per se frequency is presented primarily as a moderator variable, we also hypothesize that firm size and the intensity of internal auditing have a direct effect on the sourcing decision: as the volume of internal auditing increases, differences in production costs between internally sourced audit activities and outsourced auditing diminish, simply because larger internal audit departments are better equipped to capitalize on economies of scale than smaller ones. Therefore: H5. Frequency is negatively associated with the degree of outsourcing. 2.5. Summary of expectations Fig. 1 visualizes the relations in the theoretical model and summarizes our expectations.

3. Research design and measurement 3.1. Research design and sample In absence of publicly available archival data on firms’ internal audit sourcing decisions and most of our independent variables, our study required extensive data collection using survey methods. Since our study seeks to replicate W&S, our initial questionnaire was identical to W&S. We discussed this draft version with knowledgeable employees of a major external provider of internal audit services to check for clarity and relevance. This led to a small number of minor modifications that helps us better to capture local conditions. We also sought to compress the questionnaire, believing that a shorter survey instrument would lead to a better response rate. Thus, we deleted from the original survey the questionnaire items that did not play a role in W&S’s final analysis. Also, we combined a few individual questions from the original instrument. These operations reduced the length of the questionnaire considerably, without affecting our ability to tap the relevant information. The final survey was mailed to the CFO’s of the 450 largest companies (in terms of number of employees) headquartered in the Netherlands. The companies were identified using the REACH database, which

112

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

is also the source of the archival data we rely on in the analysis. The focus on the largest firms is consistent with W&S, who indicate that firms with more than 100 employees are more likely to demand internal audit services than smaller firms. To further increase the probability that sampled firms would use internal auditing, W&S conservatively selected firms with a minimum of 500 employees (cf. Widener and Selto, 1999, p. 51). This threshold, however, is too high in the Dutch context where firm sizes tend to be more modest as compared to the US, and we chose to retain the initial ‘theoretical’ minimum of 100 employees as our selection criterion. The mailing (and subsequent reminders) resulted in 131 responses (29% overall response rate). Of these respondents, 56 reported that they did not use any internal auditing. Of the remaining 75 responses, 66 (15% of the original sample of 450 firms) were useable. Obviously, the (useable) response rate is quite low, despite our efforts to shorten the questionnaire. However, it does not compare unfavourably to similar survey-type studies in the management accounting and control literature. For instance, W&S got a useable response rate of 14%. Also, because 56 respondents (12% of our original sample and 43% of respondents) report not to use internal auditing, our useable response rate as calculated above underestimates the extent to which our final sample covers the population of firms that actually use internal auditing. We compared the scores of responding firms on sales and number of employees (both of which are variables that the study uses as archival proxies for TCE variables) to those of the original sample of the 450 largest firms. Using ANOVA, we find no significant difference in the scores on these variables between respondents and the full sample. Neither are there any significant differences between early and late respondents. Furthermore, the distribution of our respondents over industries is broad, and roughly similar to the distribution in the total sample. Thus, we have no indication of a non-response bias. 3.2. Measurement of variables The dependent variable is the proportion of outsourcing of internal audit activities (PROP OUT). Scores for this variable are calculated by dividing the number of hours of outsourced internal auditing by the total number of hours of internal auditing. The independent variables used in the analyses are asset specificity (AS), frequency (FREQ), environmental uncertainty (EUNC), and behavioural uncertainty (BUNC). The questionnaire contains 12 items that were designed to pick up different aspects of asset specificity. Examples are the amount of operational versus financial audits, the use of proprietary information, and the role of internal auditing in relation to the achievement of strategic goals. Respondents answered these questions for both internalized and outsourced activities. The responses are differenced so that the score reflects the importance of internalized internal auditing in relation to that particular item. Confirmatory factor analysis conveys that nine of these items load on a single factor. Therefore, we combine these items by calculating the mean difference between the scores for internal and outsourced activities to obtain a single score for asset specificity. The correlation of the other three items with the factor was too low and we dropped these items from the analysis. Table 1 provides further details. Frequency is measured by two archival proxies, plus two questionnaire items: sales, number of employees, number of internal audit reports, and number of internal audit engagements (see Table 1 for full details). Because of the vastly different measuring scales of the individual items, we standardized the scores, and our proxy for frequency is measured by computing the mean of the standardized item scores.

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

113

Table 1 Composition and reliability of variables Itemsa

Component loading

Asset specificity • Operational vs. financial audits (Q5–Q6) • Reliance on proprietary information (Q7–Q8) • Contribution to firm credibility by ensuring compliance with policies and procedures (Q9.1) • Provision of feedback and prevention of surprises (Q9.2) • Degree of interaction with management (Q9.3) • Contribution to achievement of strategic plans (Q9.4) • Contribution to identification of process improvement potential (Q9.5) • Contribution to identification of market opportunities (Q9.6) • Contribution to success of certification programmes (Q9.7)

0.854 0.841 0.951 0.967 0.934 0.928 0.969 0.917 0.919

Cronbach’s α: 0.976 Environmental uncertainty • EUNC1 : variation in business activity (Q13) • EUNC2 : predictability of the need for internal auditing (Q14) Behavioural uncertainty • Degree of difficulty of evaluating outsourced vs. insourced internal auditing (Q16) Frequency • Sales (archival data) • Number of employees (archival data) • Number of internal auditing reports (Q18) • Number of internal auditing engagements (Q19)

0.856 0.907 0.860 0.847

Cronbach’s α: 0.891 a

The Q-numbers in brackets refer to the survey questions (see Appendix A).

The survey measures environmental uncertainty by (1) the variation in business activity, and (2) the predictability of the need for internal auditing. These items are uncorrelated and we enter them into the analyses as separate variables (EUNC1 and EUNC2 , respectively). We sought to measure behavioural uncertainty using two items: (1) verifiability of outsourced contract performance, and (2) the degree of difficulty of evaluating the quality of outsourced internal auditing relative to internally sourced auditing. However, due to the large number of missing values on the first of these items, we are only able to use the scores on the second item to proxy for behavioural uncertainty.

4. Results 4.1. Descriptive statistics Table 2, panel A presents summary statistics for each variable. Compared to W&S, we observe a generally larger propensity to outsource. Our sample includes 32 firms that have fully internalized their internal audit function. Four firms completely rely on external supply, while 30 firms outsource part of their internal audit activities. Thus, we find that 52% of our respondents outsource all or part of their

114

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

Table 2 Descriptive statistics and correlations Variable

Mean

S.D.

Minimum

Median

Maximum

Panel A: Descriptive statistics PROP OUT AS EUNC1 EUNC2 BUNC FREQ

0.156 1.718 2.700 2.390 2.700 0.000

0.278 2.100 1.176 0.953 0.710 0.856

0.000 −3.400 1.000 1.000 1.000 −0.380

0.008 2.400 2.000 2.000 3.000 −0.245

1.000 4.300 5.000 5.000 5.000 5.720

Individual items comprising FREQ Sales (×D 1000) 2,834,021 Employees 12,980 Reports 40 Engagements 31 1 Panel B: Correlation matrix 1: PROP OUT 1 2: AS −0.777a 3: EUNC1 0.044 4: EUNC2 0.004 5: BUNCb 0.205 6: FREQ −0.132

6,632,869 39,137 107 98

7424 101 1 1

42,693,000 240,000 750 750

2

3

4

5

6

1 −0.081 −0.050 −0.296a −0.039

1 0.174 0.128 0.162

1 0.036 0.009

1 −0.041

1

a

Correlation is significant at the 0.01 level (two-tailed). BUNC (behavioural uncertainty) is reversed scaled, i.e. higher values of this variable reflect a lower degree of behavioural uncertainty. b

internal auditing (W&S: 29%). We also observe that firms that outsource all or part of their internal auditing do so more intensively: the mean proportion being 0.31 for this group versus 0.10 in the W&S study. Consistent with our theory, one might speculate that this relative preference for outsourcing is at least in part driven by asset specificity and frequency (including firm size). On average, our respondents report lower levels of asset specificity, the mean score being 1.72 as opposed to 2.96 in the sample of W&S. Also, our firms are generally smaller, the mean number of employees equaling nearly 13,000. Firms in the W&S study averaged 21,100 employees.5 Table 2, panel B presents the correlation matrix. Asset specificity is negatively and significantly associated with the degree of outsourcing (r = −0.78, p < 0.01). Asset specificity and behavioural uncertainty are also significantly correlated. The correlations between the exogenous variables are sufficiently low not to prompt any serious multicollinearity concerns.

5

The larger propensity to outsource cannot be explained directly from the difference in sample selection. As discussed in section 3.1, our study includes firms with employee numbers between 100 and 500, whereas W&S only selected firms with a minimum of 500 employees. Our final sample contains 8 firms in the 100–500 interval. Although this group features only 3 full insourcers, the mean outsourcing proportion for the remaining 5 firms is actually lower than the average in the full group of firms that rely partly or fully on external provision of internal audit services.

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

115

4.2. Tests of hypotheses for the full sample As a first step in our analysis, we run a multiple OLS regression with the full set of exogenous variables, including the uncertainty-related ones for which we expect that they do not affect sourcing decisions. The results of this regression are reported in Table 3, panel A. This initial model includes a number of multiplicative terms to capture the interaction of asset specificity and frequency (H4), plus any interactions that might exist between asset specificity and uncertainty. The initial model also tests for the main effects of the uncertainty-related variables EUNC1 , EUNC2 , and BUNC. Although these main effects are not grounded in theoretical TCE (TCE posits that uncertainty is only relevant in conjunction with asset specificity; not in isolation), they must be included in the regression equation to verify that a significant coefficient for an interaction effect is not in fact due to lower order effects (cf. Hartmann and Moers, 1999). Including product terms to capture interactions can introduce multicollinearity. To address this problem, we centred (mean-adjusted) the scores on asset specificity, frequency, and the uncertainty proxies prior to forming the multiplicative terms (cf. Aiken and West, 1991; Jaccard et al., 1990). In addition to centring the variables, we added a constant to the scores for asset specificity to obtain positive values only. This linear transformation has no effect on the estimated coefficients, but facilitates (qualitative) Table 3 Results of multiple regression analysis: initial and base model (all firms)

Panel A: Initial model Intercept AS BUNC EUNC1 EUNC2 FREQ AS × BUNC AS × EUNC1 AS × EUNC2 AS × FREQ R2

Panel B: Base model Intercept AS FREQ AS × FREQ R2 a

Coefficient

S.E.

t-Statistic

Probability (two-tailed)

0.140 −0.094 0.097 −0.071 −0.045 −0.109 0.016 0.006 −0.023 0.017

0.023 0.013 0.131 0.065 0.077 0.045 0.011 0.012 0.019 0.009

6.190 −7.332 0.741 −1.081 −0.583 −2.460 1.504 0.538 −1.209 1.904

0.0000 0.0000 0.4623 0.2848 0.5623 0.0173 0.1387 0.5928 0.2321 0.0625

a

0.639

Adjusted R2

0.576

Coefficient

S.E.

t-Statistic

Probability (one-tailed)

0.159 −0.100 −0.178 0.034

0.021 0.012 0.042 0.008

7.580 −8.080 −4.237 4.064

0.0000 0.0000 0.0001 0.0001

b

0.646

Adjusted R2

0.629

Dependent variable: proportion of outsourcing; method: least squares; sample: 66; included observations: 61; White heteroskedasticity-consistent standard errors and covariance. b Dependent variable: proportion of outsourcing; method: least squares; sample: 66; included observations: 66; White heteroskedasticity-consistent standard errors and covariance.

116

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

interpretation of the interaction effects. We maintain these practices throughout our analyses. Also, we use White heteroskedasticity-consistent standard errors and covariance in all regressions to correct for heteroskedasticity. Consistent with H2 and H3 we find that none of the uncertainty variables has a significant effect on sourcing decisions; neither individually nor in conjunction with asset specificity. We cannot, however, positively exclude the possibility that these interaction effects do in fact exist. The reason for this is that our sample is not nearly large enough to detect interactions with small effect sizes, especially not when individual predictors are prone to measurement error (Cohen et al., 2003). Additional ANOVA-type analysis of the uncertainty-related scores (not fully reported here) reveals some interesting details. In Section 2.3, we argued that firms that outsource internal auditing experience roughly similar monitoring difficulties to those that choose to internalize this function. Our evidence indicates that the average respondent believes that monitoring the performance of the internal audit function is easier if this function is internalized, the difference being small but significant. However, this relative monitoring advantage does not appear to influence the sourcing decision –perhaps because reputation concerns compensate for the monitoring disadvantage associated with outsourcing as suggested in Section 2.3. In Section 2.2, we argued that internal audit sourcing is not a dichotomous choice between the extremes of complete outsourcing on the one hand, and pure internalization on the other, and that co-sourcing may provide additional ways to cope with uncertainty. Comparing the group that fully internalizes internal auditing to the co-sourcers, we find that co-sourcers report higher levels of environmental uncertainty. Although the difference is only significant for EUNC1 , this result is consistent with our claim that firms may seek to cope with uncertainty through partial reliance on outsourcing. The next step in our analysis is to remove the uncertainty-related variables and their interaction with asset specificity to arrive at our base model. The base model includes only the factors that we identified as theoretically relevant in explaining internal audit sourcing decisions, i.e. asset specificity (AS; H1), frequency, (FREQ; H5), and their multiplicative interaction (AS × FREQ; H4). This model is specified as follows: PROP OUT = b0 + b1 × AS + b2 × FREQ + b3 × AS × FREQ + e The base model explains 65% of the variance in outsourced internal auditing (adjusted R2 = 0.63). Detailed results of this regression are reported in Table 3, panel B. The results provide substantial support for hypotheses H1, H4 and H5. Consistent with H1, we find that asset specificity is significantly and negatively associated with the degree of outsourcing (p = 0.0000). We also find that frequency is negatively associated with internal audit outsourcing, as predicted in H5 (p = 0.0001, one-tailed). Finally, we find support for H4, stating that the effect of asset specificity on the degree of outsourcing is larger when frequency is low than when frequency is high (p = 0.0001, one-tailed). Fig. 2 visualizes the interaction effect by plotting the proportion of outsourcing as a function of asset specificity at different levels of frequency. Like most empirical studies in management accounting research (cf. Ittner and Larcker, 2001; Luft and Shields, 2003), our base model suggests that the relations we are trying to capture are linear. The fact, however, is that they are not. As the dependent variable is a proportion, its value is bounded at zero and one. If we plot the proportion of outsourcing against asset specificity, we observe an S-shaped relation, with ‘compressed’ values of the dependent variable at both the high and the low end of the asset specificity measurement range. Particularly, we observe in our data that firms choose fully to internalize internal auditing above some threshold level of asset specificity, which lies well below the maximum level of asset

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

117

Fig. 2. Interaction effect of asset specificity and frequency. Note: the qualifiers ‘high’ and ‘low’ are defined as the mean plus or minus one standard deviation. Table 4 Results of multiple regression analysis: non-linear model (all firms)

Intercept AS FREQ AS × FREQ R2

Coefficient

S.E.

t-Statistic

Probability (one-tailed)

4.426 2.032 4.003 −1.053

1.596 1.015 2.531 0.733

2.773 2.001 1.581 −1.437

0.0037 0.0249 0.0595 0.0779

Adjusted R2

0.809

0.800

Dependent variable: proportion of outsourcing; method: least squares; sample: 66; included observations: 66; White heteroskedasticity-consistent standard errors and covariance.

specificity as we measure it. A common solution to this problem is to perform a logit transformation on the dependent variable, linearizing the relationship. It may, however, be difficult to interpret the results from logit transformed data. An alternative and arguably more direct way to confront the issue is to estimate a non-linear model to test the hypotheses. Although we would not want to argue that non-linear models are particularly easy to interpret, at least they leave the properties of the dependent variable intact. For this reason, we choose to pursue the non-linear approach.6 Based on visual inspection of the scatter plots, we specify the following model: PROP OUT =

1 {1 +

exp(b0 +b1 ×AS+b2 ×FREQ+b3 ×AS×FREQ) }

+e

Table 4 presents the results. As expected, the non-linear specification improves model fit (R2 = 0.81; adjusted R2 = 0.80), and reinforces our earlier conclusions for the hypotheses H1, H4, and H5. The coefficients for asset specificity (p = 0.0249, one-tailed), frequency (p = 0.0595, one-tailed), and their interaction (p = 0.0779, one-tailed) remain significant in the hypothesized direction. Please note that in 6

The logit transformation approach, however, leads to better results in terms of significance and fit (but not to different conclusions).

118

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

Table 5 Results of TOBIT analysis (all firms)

Intercept AS FREQ AS × FREQ McKelvey–Zavoina R2

Coefficient

S.E.

t-Statistic

Probability (one-tailed)

−0.180 −0.276 −0.520 0.141

0.077 0.045 0.151 0.043

−2.324 −6.131 −3.434 3.243

0.0101 0.0000 0.0003 0.0006

0.64

Dependent variable: proportion of outsourcing; method: TOBIT (lower limit = 0, upper limit = 1); sample: 66; included observations: 66.

the non-linear model, the sign of the coefficients changes, i.e. a positively signed coefficient implies that the degree of outsourcing decreases as the independent variable increases, and vice versa. Although the non-linear model better reflects the relations between the independent variables and the proportion of outsourcing, it is possible that the results of the tests we reported so far are strongly influenced by the fact that our observations are clustered at the zero outsourcing choice. Our sample includes 32 firms that have fully insourced the internal audit function, while 4 firms source all their internal audit services from external suppliers. A total of 30 firms partly rely on external providers, but perform other parts of their internal audit function internally. This particular distribution of sourcing behaviour may well be the major driver of our findings so far, i.e. it is possible that both the linear and the non-linear model perform so well because they are particularly good at predicting the behaviour of firms that do not outsource at all. Although W&S do not elaborate on this potential problem, it is also present in their study, as 59 respondents from their total sample of 83 firms do not outsource any internal auditing. To address this problem, we estimate a Tobit model, which is a regression technique especially suited to analyse limited (censored) dependent variables.7 Table 5 reports the results. Again, we find support for our hypotheses regarding the effects of asset specificity, frequency, and the interaction between them, their coefficients being significant in the hypothesized direction (all p-values are smaller than 0.0006, one-tailed). To facilitate comparison with the results of the linear and non-linear models, we also report the McKelvey–Zavoina statistic (in the version of Veall and Zimmermann (1994) to suit the Tobit case). This statistic is a pseudo-R2 measure which comes closest to the familiar R2 from OLS-regression (Veall and Zimmermann, 1994, 1996). Its value is 0.64. 4.3. Test of hypotheses for the sub-sample of co-sourcers In this section, we rerun our base model regressions, only using the sub-sample of co-sourcers, i.e. the firms that combine outsourcing and internally serviced internal auditing. This specific focus on the group of co-sourcers is interesting for two reasons. Firstly, it may be argued that for this group, the validity of the questionnaire responses (and our construct measures) is larger, especially regarding asset specificity. Following W&S, we asked our respondents to answer a number of questions both for outsourced and for insourced audit activities. Consequently, firms that either outsource all or none of their internal auditing were forced to report hypothetical scores. Only the co-sourcers were able to give experiencebased answers to all survey questions. Secondly, and perhaps more importantly, we coded the values of 7

We thank an anonymous reviewer for suggesting this possibility.

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

119

Table 6 Analysis of co-sourcers Coefficient Panel A: Base model (linear)a Intercept 0.206 AS −0.200 FREQ −0.121 AS × FREQ 0.232 R2

0.220

Panel B: Non-linear modela Intercept 1.566 AS 1.757 FREQ 1.245 AS × FREQ −2.151 R2

0.263

S.E.

t-Statistic

Probability (one-tailed)

0.035 0.086 0.045 0.126

5.849 −2.333 −2.684 1.832

0.0000 0.0139 0.0063 0.0392

Adjusted R2 0.271 0.868 0.700 1.418 Adjusted R2

0.130 5.782 2.025 1.778 −1.517

0.0000 0.0267 0.0436 0.0706

0.178

a Dependent variable: proportion of outsourcing; method: least squares; sample: 30; included observations: 30; White heteroskedasticity-consistent standard errors and covariance.

a number of other survey items as zeros for respondents that either outsource all or no internal auditing again following W&S. This procedure, however, inflates asset specificity scores of firms adopting a ‘pure’ sourcing strategy relative to the co-sourcing group. This may have had a large impact on the full sample results (both in our analyses and in the W&S study), casting doubt on the quality of these results. Because this problem is absent in the group of co-sourcers, an analysis of this sub-sample is clearly informative. In the analysis of the sub-sample of co-sourcers, we (again) use mean-adjusted data (recalculated based on the raw scores for the sub-sample only). We retain our original variable compositions, after verifying continued construct reliability (for asset specificity and frequency, the newly computed Cronbach’s alphas are 0.884 and 0.901, respectively). Table 6, panel A presents the results of the base model regression for the sub-sample of co-sourcing firms.8 Apparently, our earlier findings are quite stable indeed. Again, we find support for hypotheses H1, H4, and H5. The coefficients for asset specificity, frequency, and their interaction still have the proper sign, and they remain significant at fully acceptable confidence levels (all p-values <0.04). However, the regression equation fits the data less well. The model explains 22% of the variance in sourcing behaviour in the sub-sample of co-sourcers (adjusted R2 = 0.13). The size of this R2 is quite in line with typical findings in management accounting research, but it compares unfavourably to the variance explained in the full sample analysis. In part, this may be an effect of the smallness of the sub-sample. But it is likely that the full sample results overstate the explanatory power of the TCE variables as a consequence of the measurement issue discussed above—both in our study and in the original work by W&S. For reasons discussed in Section 4.2, we also run a non-linear regression on the co-sourcer data, using the non-linear model specified earlier. Once again, we find that asset specificity, frequency, and their 8 We would have preferred not only to rerun the base model regression, but also the initial model (including the uncertaintyrelated variables and their interaction with asset specificity). However, the number of independent variables in the initial model is too large to allow this, considering the size of the sub-sample.

120

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

multiplicative interaction significantly affect sourcing behaviour in the expected direction. All p-values are smaller than 0.07, and the R2 equals 0.26 (adjusted R2 = 0.18).9 Table 6, panel B provides the details.

5. Conclusions and discussion Building from earlier research by Widener and Selto (1999), this study examined internal audit sourcing decisions, using data from 66 firms headquartered in the Netherlands. Based on TCE, we hypothesized that asset specificity and frequency of internal audit needs – both individually and in interaction – help to explain organizations’ sourcing behaviour with respect to internal auditing. We further hypothesized that neither environmental uncertainty, nor behavioural uncertainty affect internal audit sourcing decisions in any significant way. Although this hypothesis on the role of uncertainty disagrees with one of TCE’s main case predictions, it does not actually challenge TCE as a theory, because our perspective is in fact consistent with TCE’s explanatory apparatus and its general logic. We merely reemphasize the role of knowledge in governance and control – a theme that has always been central to TCE – and explicate its hitherto implicit consequences in the specific situation of activities that involve expert knowledge. We tested the hypotheses in various regression models, and consistently found considerable support for the TCE-based explanation in all models. Thus, we found asset specificity to be significantly associated with the organization of internal audit activities. If internal auditing requires firm-specific knowledge and if the audit function becomes more integrated with the management and operations of the firm, organizations are more likely to internalize internal auditing. Also, we found that frequency is significantly associated with the sourcing strategy. Larger firms and firms that are relatively heavy consumers of internal audit services tend to rely more on internal provision of these services, whereas smaller firms that are less audit-intensive are more likely to seek external supply. In addition, we found that the interaction of asset specificity and frequency significantly affects internal audit sourcing behaviour, suggesting that as expected, firms weigh the set-up cost of specialized governance when considering their sourcing options. And finally, we found no evidence of environmental or behavioural uncertainty influencing internal audit sourcing—neither as such nor in interaction with asset specificity. This last finding contradicts TCE’s default position on the effect of uncertainty on governance, but is consistent with our application of TCE’s general logic to the specific case of internal audit sourcing behaviour. It should be noted, however, that the uncertainty-related findings are provisional because of sample restrictions and potential measurement problems. These results closely match Widener and Selto’s (1999) findings, strengthening their overall conclusion that “concerns for the transaction costs caused by dimensions of asset specificity and frequency, both as main effects and interactions, influence the decision to outsource internal auditing” (Widener and Selto, 1999, p. 66). Because our study replicates their findings in a fully independent sample, at a different moment in time, and in a different institutional context, our study mitigates potential concerns as to the generalizability, reliability, and (continued) validity of the original W&S study, enhancing the credibility of the TCE-based explanation of internal audit sourcing behaviour. However, we also found evidence indicating that TCE’s explanatory power is in fact lower than W&S suggest, and that it is likely that the relatively high R2 they report is at least in part driven by the way in which asset specificity has been measured. 9

A linear regression after performing a logit transformation on the proportion of outsourcing improves model fit, increasing R to 0.32 (adjusted R2 = 0.24). This model leads us to accept the same hypotheses (all p-values <0.007). 2

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

121

This study has several limitations that should be recognized when interpreting the evidence in this paper. One of these relates to the size of our sample. Although we found no indication of sampling bias, a larger sample size would have allowed an examination of additional factors that may be relevant in explaining internal audit sourcing, as for instance industry effects. Also, a larger sample would have allowed a more powerful test of the hypothesized non-existence of uncertainty-related effects. Other caveats include the following. Even though the hypotheses are built on efficiency arguments, the study does not establish the actual efficiency of observed sourcing practices. Therefore, while we found that firms behave pretty much as predicted, we cannot conclude that their sourcing decisions are actually rooted in efficiency motives. Neither can we conclude that a theoretically consistent sourcing strategy is in fact efficient. In addition, as the research design is purely cross-sectional, our study provides evidence on associations, not on causal relations. For this reason, the significant and negative relation between for instance asset specificity and outsourcing we documented cannot buttress the conjecture that a higher level of asset specificity actually causes a preference for internal sourcing of audit services. In fact, alternative explanations are possible. For example, it could be the case that the presence of an internal audit department results in audit activities that are more tailored to the specifics of the firm. Similarly, outsourcing may lead to a more generic approach to internal auditing. Consequently, what we pick up as high or low levels of specificity may be a consequence rather than an antecedent of the internal audit sourcing decision. The data do not allow us to differentiate between this alternative explanation and the theoretical model. Further research is necessary to redress the limitations of this study and to fill remaining knowledge gaps. A longitudinal study examining changes in internal audit sourcing behaviour over time may shed light on the issue of causality. Additionally, researchers may seek to address the relative performance of internal auditing under different governance regimes in different situations. Such research, however, requires operationalizing internal audit effectiveness and is bound to pose extremely challenging measurement issues. A less assuming research agenda might include studies that further examine the role of uncertainty in organizing internal auditing. We found some evidence that monitoring the performance of the internal audit function is easier if this function is internalized. These better monitoring properties, however, do not seem to affect sourcing decisions. This suggests that outsourcing offers some advantage to compensate for monitoring. A deeper insight in these matters would be welcome. A final suggestion for future research relates to the observation that a significant proportion of firms (43% of respondents) report that they do not use internal audit services at all. Given the importance of the internal audit function, our guess would be that these non-users have found some substitute for internal auditing elsewhere in their control structure (cf. also Widener and Selto, 1999). This guess could be explored in a study examining internal auditing explicitly as part of the larger management control structure, i.e. as an element of the organizational control package (Otley, 1980; Spekl´e, 2001). Such a perspective may greatly enhance our understanding of the role of internal auditing in the functioning of organizations.

Acknowledgements We thank Frank Selto and Sally Widener for generously providing us with valuable background information on their study of internal audit sourcing decisions. We also thank the two anonymous reviewers and the editor for their constructive comments. We appreciate the many helpful remarks

122

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

on earlier versions of the paper from Alexander Br¨uggen, Frank Hartmann, Martijn de Jong, Henk Langendijk, Leen Paape, Frank Verbeeten, and – especially – Thierry Post. The paper also benefited from comments by workshop participants at various occasions.

Appendix A. Survey questions 1. 2. 3. 4. 5. 6. 7. 8. 9.

10. 11.

12. 13.

14.

Does your organization have its own internal audit department? Did your company use internal audit services (either in-house or outsourced) during fiscal 2003? In 2003, approximately how many in-house man-hours were devoted to internal auditing? In 2003, approximately how many man-hours of internal audit effort were provided by outside service providers? In 2003, what was the approximate proportion of time your in-house internal audit department spent on financial audits relative to operational audits (1 = 100% financial; 5 = 100% operational)? In 2003, what was the approximate proportion of time your external service provider spent on financial audits relative to operational audits (1 = 100% financial; 5 = 100% operational)? In 2003, how much time did in-house internal audit personnel spend working with proprietary information (1 = 0% of the time; 5 = 50% or more)? In 2003, how much time did the outside provider of internal audit services spend working with proprietary information (1 = 0% of the time; 5 = 50% or more)? Please indicate your agreement or disagreement with the following statements. If you had both inhouse and outsourced internal audit services during 2003, please complete both the ‘in-house’ and the ‘outsourced’ columns. Otherwise complete only the appropriate column (1 = strongly disagree; 5 = strongly agree). 9.1 Internal audit activities contribute to firm credibility by ensuring compliance with policies and procedures. 9.2 Internal audit activities provide feedback and prevent surprises. 9.3 Internal audit activities require a high degree of interaction with management. 9.4 Internal audit activities contribute to achievement of strategic plans. 9.5 Internal audit activities contribute to the identification of process improvement potential. 9.6 Internal audit activities contribute to the identification of market opportunities. 9.7 Internal audit activities contribute to the success of certification programmes. In 2003, was the in-house internal audit department used as a part of the management development plan (1 = no; 5 = all positions in the IAD were used as part of the MP plan)? How long, on average, does an employee spend in the in-house internal audit department before being rotated to another position within the company (1 = less than a year; 5 = more than 5 years; 6 = no rotation)? In 2003, how much time was required for a newly-hired internal auditor with experience in the industry to perform unsupervised work (1 = immediately; 5 = more than 12 months)? In 2003, how much variation in business activities was there among auditees? Think of an auditee as a sub-unit or department that requires a separate plan, a separate audit, or a separate audit report (1 = all auditees were very similar; 5 = all auditees were very different). In 2003, how predictable was the need for internal audit services (1 = very predictable; 5 = very unpredictable)?

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

123

15. If applicable, how difficult was it to determine if the provider of outsourced internal audit services performed according to contractual obligations (1 = very easy; 5 = very difficult)? 16. Whether you outsource internal audit activities or not, which statement best describes your view of evaluating the quality of outsourced internal audit activities in your company (1 = evaluating outsourced internal auditing is much more difficult; 5 = evaluating outsourced internal auditing is much easier)? 17. Approximately how many auditees does your organization have in total? Think of an auditee as a sub-unit or department which requires a separate plan, a separate audit, or a separate audit report. 18. In fiscal 2003, how many internal audit reports were issued by the outside service providers for your company? 19. In 2003, how many internal audit engagements (including audits but also special projects, fraud analysis, etc.) were performed for your company? 20. What would be a good argument for outsourcing part or all of the Internal audit function (open question)?

References Ahlawat, S.S., Lowe, D.J., 2004. An examination of internal auditor objectivity: in-house versus outsourcing. Audit. J. Pract. Theory 23 (2), 147–158. Aiken, L.S., West, S.G., 1991. Multiple Regression: Testing and Interpreting Interactions. Sage Publications, Newbury Park. Aldhizer, G.R., Cashell, J.D., Martin, D.R., 2003. Internal audit outsourcing. CPA J. 73 (8), 38–42. Arru˜nada, B., 2000. Audit quality: attributes, private safeguards and the role of regulation. Euro. Account. Rev. 9, 205–224. Barr, R.H., Chang, S.Y., 1993. Outsourcing internal audits: a boon or bane? Manage. Audit. J. 8, 14–17. Boerner, C.S., Macher, J.T., 2002. Transaction cost economics: an assessment of empirical research in the social sciences. Working paper. Caplan, D.H., Kirschenheiter, M., 2000. Outsourcing and audit risk for internal audit services. Contemporary Account. Res. 17, 387–428. Chadwick, W.E., 2000. Keeping internal auditing in-house. Internal Audit. 57 (3), 88. Cohen, J., Cohen, P., West, S.G., Aiken, L.S., 2003. Applied Multiple Regression/Correlation Analysis for the Behavioral Sciences, third ed. Lawrence Erlbaum Associates, Mahwah. Covaleski, M.A., Dirsmith, M.W., Rittenberg, L., 2003. Jurisdictional disputes over professional work: the institutionalization of the global knowledge expert. Account. Organ. Soc. 28, 323–355. David, R.J., Han, S., 2004. A systematic assessment of the empirical support for transaction cost economics. Strategic Manage. J. 25, 39–58. DeAngelo, L.E., 1981. Auditor size and audit quality. J. Account. Econ. 3, 183–199. Hartmann, F.G.H., Moers, F., 1999. Testing contingency hypotheses in budgetary research: an evaluation of the use of moderated regression analysis. Account. Organ. Soc. 24, 291–315. IIA (Institute of Internal Auditors), 1998. A perspective on outsourcing of the internal audit function, Professional Practices Pamphlet 98-1, www.theiia.org. Ittner, C.D., Larcker, D.F., 2001. Assessing empirical research in managerial accounting: a value-based management perspective. J. Account. Econ. 32, 349–410. Jaccard, J., Turrisi, R., Wan, C.K., 1990. Interaction Effects in Multiple Regression. Newbury Park, Sage Publications. Luft, J., Shields, M.D., 2003. Mapping management accounting: graphics and guidelines for theory-consistent empirical research. Account. Organ. Soc. 28, 169–249. Lindsay, R.M., 1995. Reconsidering the status of tests of significance: an alternative criterion of adequacy. Account. Organ. Soc. 20, 35–53. Martin, C.L., Lavine, M.K., 2000. Outsourcing the internal audit function. CPA J. 70 (2), 58–59.

124

R.F. Spekl´e et al. / Management Accounting Research 18 (2007) 102–124

Merchant, K.A., 1985. Control in Business Organizations. Ballinger Publishing Company, New York. Nooteboom, B., 1993. Research note: an analysis of specificity in transaction cost economics. Organ. Stud. 14, 443–451. Otley, D.T., 1980. The contingency theory of management accounting: achievement and prognosis. Account. Organ. Soc. 5, 413–428. Otley, D., Pollanen, R.M., 2000. Budgetary criteria in performance evaluation: a critical appraisal using new evidence. Account. Organ. Soc. 25, 483–496. Petravick, S., 1997. Outsourcing internal audit isn’t only the big firms’ game. CPA J. 67 (5), 62–63. Rittenberg, L.E., Covaleski, M., 1999. Outsourcing the internal audit function: the British government experience with market testing. Int. J. Audit. 3, 225–235. Rittenberg, L., Covaleski, M.A., 2001. Internalization versus externalization of the internal audit function: an examination of professional and organizational imperatives. Account. Organ. Soc. 26, 617–641. Spekl´e, R.F., 2001. Explaining management control structure variety: a transaction cost economics perspective. Account. Organ. Soc. 26, 419–441. Spira, L.F., Page, M., 2003. Risk management: the reinvention of internal control and the changing role of internal audit. Account. Audit. Account. J. 16, 640–661. Veall, M.R., Zimmermann, K.F., 1994. Goodness of fit measures in the Tobit model. Oxford Bull. Econ. Stat. 56, 485–499. Veall, M.R., Zimmermann, K.F., 1996. Pseudo-R2 measures for some common limited dependent variable models. J. Econ. Surveys 10, 241–259. Widener, S.K., Selto, F.H., 1999. Management control systems and boundaries of the firm: why do firms outsource internal audit activities? J. Manage. Account. Res. 11, 45–73. Williamson, O.E., 1975. Markets and Hierarchies: Analysis and Antitrust Implications. Free Press, New York. Williamson, O.E., 1985. The Economic Institutions of Capitalism. Free Press, New York. Williamson, O.E., 1996. The Mechanisms of Governance. Oxford University Press, New York. Williamson, O.E., 1999. Strategy research: governance and competence perspectives. Strategic Manage. J. 20, 1087–1108.