Control Environment Condition and the Interaction between Control Risk, Account Type and Management's Assertions

Key Words: Control risk, Management assertions, Control environment. Data Availability: The data are available from the first author upon request. The control environment (CE) represents the collective effect of various factors on establishing, enhancing or mitigating the effectiveness of specific policies and procedures (AICPA 1995, AU 319.09). Along with the accounting system and control procedures, the control environment makes up a firm's internal control structure and is a primary component in the assessment of control risk (AICPA 1995, AU 326.27). In addition, within the CE, there appear to be several qualitative characteristics of management that represent what has been referred to as the "tone-at-the-top" (TATT). There have been frequent references to the "tone-at-the-top," particularly in the Committee of Sponsoring Organizations' report (COSO 1992) and the Report of the National Commission on Fraudulent Financial Reporting (NCFFR 1987). Based on interviews conducted with financial institution experts (Holstrum et al. 1994), the tone-at-the-top comprises the CE components: management's integrity, philosophy and attitude, and the board of directors and audit committee. The remaining control environment factors were referred to as the "non-tone-at-the-top" (NONT) factors. In short, the tone-at-the-top reflects the client's commitment and attitude toward good control and is commonly regarded as the most important factor the auditor considers in the evaluation of the CE. A priori, the tone-at-the-top may be the driving force behind the control environment's impact in assessing risk. The problem is that despite the control environment's overall importance, even if auditors adequately evaluate control environment strengths and weaknesses, there is some question as to the differential effect that variations in the CE condition have on the assessment of risks. Further, because account balances and classes of transactions vary in their degree of audit subjectivity and difficulty, it is likely that accounts that are more subjective and judgmental in nature will be affected more by changes in the control environment condition, particularly by changes associated with the more abstract tone-at-the-top CE components. The accounts used in this study are typical of those found in financial institutions. The financial institution industry has been chosen because of the industry's problems with failures experienced over the last decade. Many of these problems are alleged to be associated with the more qualitative and abstract factors of the control environment (e.g., management's philosophy and attitude, integrity and ethics). Given this problem, the purpose of this paper is to examine how different states (strong vs. weak) and characteristics (tone-at-the-top vs. non-tone-at-the-top CE components) of the control environment interact with different types o financial institution accounts (subjective/objective) to determine the control risks associated with management's assertions. Identifying the conditions where risks are considered highest for a particular account and assertion can be helpful by directing auditors to the areas needing the most audit attention and providing more efficient and effective audits. This study, while exploratory in nature, provides evidence that variations in aspects of the control environment condition have a significant effect on the assessment of risks independent of the other internal control structure elements, and that the extent of this effect is a function of the type of account and assertion under investigation. The remainder of the paper is organized as follows. The next section discusses the control environment, related empirical research, the financial institutions industry, and the assessment of risk. This is followed by a section discussing propositions concerning account types, management assertions and CE components. The remaining sections describe the research methodology, statistical results, analyses, limitations and concluding remarks. …