Do Client-Prepared Internal Control Documentation and Business Process Flowcharts Help or Hinder an Auditor's Ability to Identify Missing Controls?

SUMMARY: The purpose of this study is to examine the extent to which client-prepared internal control documentation and business process flowcharts affect auditors' ability to detect missing internal controls. A total of 395 experienced auditors participated in a two (internal control matrix: blank or client-prepared) by two (business process flowchart: absent or present) between-participants experiment. The research findings indicate that auditors who were supplied with a blank internal control matrix and a business process flowchart identified significantly more missing controls relative to the three other treatment conditions, among which there were no differences in the number of identified missing controls. The results indicate that when auditors are evaluating the effectiveness of a client's internal control system for a significant business process, they should be provided with a flowchart of the business process under examination and complete their internal control design evaluation before reading client-prepared internal control documentation.