Internal Controls and the Detection of Management Fraud

The purpose of this paper is to examine an auditor's decision to investigate for fraud, when a manager with exogenous incentives to misreport chooses the quality of internal controls. I extend the strategic auditing literature by allowing the manager both a choice with respect to fraud and a second choice that affects the error rate in the audit population. Consistent with the practitioner literature, I assume managers can commit fraud by overriding internal controls, and that audits conducted in accordance with Generally Accepted Auditing Standards (GAAS) do not always distinguish between errors and fraud. The study is motivated by the increasing importance of internal controls in auditors' fraud risk assessments. In 1997, the Auditing Standards Board issued Statement on Auditing Standards (SAS) No. 82: Consideration of Fraud in a Financial Statement Audit. This standard requires auditors to assess the risk of fraud on every audit and encourages auditors to consider both the internal control system and management's attitude toward controls, when making this assessment.1