Audit firm tenure impacts the quality of audit work and the disclosure of material internal control weaknesses. Public firms are required by the Sarbanes Oxley Act of 2002 (SOX) Section 302 to disclose material internal control weaknesses. Researchers debate whether audit firm rotation is necessary for improving audit quality (Chen, Lin, & Lin, 2008). Generally, an auditor needs sufficient time to become familiar with a client's business in order to enhance effective controls and financial reporting. However, long tenure may diminish auditor independence, and in turn reduce the quality of audit work and encourage a client to violate SOX disclosure requirements. Therefore, it is expected that the disclosure of material internal control weaknesses is less likely given long audit tenure. Prior studies consider many variables that impact the disclosure of control weaknesses, except audit tenure. Further, prior studies do not address the issue of whether familiarity or independence explains non-disclosure. This dissertation investigates the role of audit firm tenure and concludes that the disclosure of material internal control weaknesses is more likely given short tenure. Further, familiarity with the client's business, which is associated with long tenure, explains non-disclosure and not the lack of independence. Therefore, audit firm rotation may not be necessary.

Small businesses have an important role to play in the U.S. economy. However, employee fraud can jeopardize the sustainability of small businesses. Grounded on Cressey's fraud triangle theory, the purpose of this multiple case study was to explore strategies used by selected managers and owners of small retail businesses to detect and prevent employee fraud. Ten participants from 5 small retail businesses participated in the study. Nine participated in a face-to-face semistructured interview, and 1 participated in a telephone interview. These participants included 5 owners and 5 managers of small retail businesses in the state of Michigan in the United States who have implemented strategies to detect and prevent employee fraud. Through a process of methodological triangulation, casual observations and documentary evidence supplemented data collected through semistructured interviews. Using thematic analysis by coding narrative segments, the research findings included themes of controls and communication, cash register accountability, segregation of duties, monitoring, and action against perpetrators. Managers and owners of small businesses may benefit from the findings of this study by gaining awareness of the need to detect and prevent employee fraud. The implications for positive social change may include the potential to increase appropriate controls over employee fraud, thus enabling owners of small retail business an opportunity to operate effectively and efficiently, which could increase employment opportunities. Increased employment opportunities could create a positive effect on other small retail businesses and allow local communities to prosper.

The creation of excessive budgetary slack can be costly, causing organizations to implement internal controls to motivate employees to report more honestly. Internal control research explores many control-related motivations; however, the behavioral effects of autonomy in expanded organizational hierarchies are not well understood in budgeting contexts. This paper examines managerial autonomy and firms’ rationales for the implementation of internal controls in a setting that extends the common participatory dyad utilized in prior literature to an organizational hierarchy that includes owners, mid-level managers, and employees. This setting is explored through the lens of self-determination theory and psychological reactance theory, which offer complementary yet opposite conceptualizations of autonomy. This paper posits that owner restrictions on mid-level manager autonomy can spillover and indirectly influence budgeting decisions. Additionally, the potential for this spillover to influence the relationship between a firm’s rationale for the implementation of internal controls and subsequent budgetary decisions is examined. Findings indicate that the autonomy of mid-level managers has a spillover effect that influences manager’s rejection rates between rounds, but not across rounds and does not interact with a firm’s control implementation rationale.

There have been significant advances in the information systems (IS) literature about the business value that can be realized through information technology (IT) investments and the mechanisms through which IT creates different facets of business value. We identify three important gaps in understanding the literature on IT business value. First, it is unclear how risk arising from deficiencies in a firm’s information environment, along with internal and external contextual factors, affects a firm’s IT implementation choices. Second, it is unclear how IT resources in a focal domain need to be combined with knowledge resources in the same domain and IT resources in other domains to develop process capabilities and create process-level benefits. Third, it is unclear what risks IT-enabled process innovations create for different process stakeholders and what controls can be applied to mitigate these risks. My dissertation addresses the above three gaps in three essays. The first essay examines the influence of a firm’s information risk on its prioritization of accounting enterprise systems (AES) relative to complementary enterprise systems and the moderation of this relationship by the weaknesses of internal controls and environmental uncertainty characteristics. The second essay focuses on the impact of AES implementation on a firm’s internal controls process, and the complementary roles of managerial competence and enterprise systems implemented in other domains related to the internal controls process of the firm. The final essay explores the risk factors that can arise for buyers and suppliers due to the use of reverse auctions, and the controls that can be applied to mitigate the key risk factors. In terms of research methods, the first two essays apply econometric analysis to panel datasets constructed from multiple sources and the third essay uses a combination of Delphi studies and semi-structured interviews. Collectively, the essays advance our understanding of (1) the factors underlying a firm’s prioritization of IT investment choices; (2) the mechanisms through which IT resources, in combination with human expertise, create business value; and (3) the risks introduced for different stakeholders by the adoption of IT-enabled process innovations and the controls that can be used to effectively mitigate them.

O Risco Operacional nas instituições financeiras foi normatizado com a Resolução nº 3.380 em 29 de junho de 2006, emitida pelo Conselho Monetário Nacional. Desde então, entidades autorizadas a funcionar pelo Banco Central do Brasil tiveram de adequar suas estruturas e procedimentos com o intuito de aumentar os controles sobre eventos internos e externos à instituição, com a finalidade de reduzir perdas financeiras a partir da mitigação deste tipo de risco. Dessa forma, a presente dissertação tem como objetivo apresentar como um banco comercial precisa agir para adequar seus processos às novas exigências legais diante de um assunto com uma importância tão significativa. Este trabalho, além de apresentar os procedimentos de gestão de riscos em uma entidade, procura também elucidar como o risco operacional, no departamento de Call Center da instituição financeira escolhida, pode afetá-la, no caso da inobservância dos procedimentos a serem adotados com vistas à mitigação das falhas já identificadas e de possíveis ocorrências que possam comprometer a continuidade da organização. Os resultados obtidos na pesquisa mostram que o banco em estudo, em relação a outras instituições financeiras pesquisadas, ainda apresenta-se em uma etapa de desenvolvimento da sua área de gestão de riscos, trabalhando em conformidade com a legislação vigente e buscando aperfeiçoar suas técnicas de identificação e mensuração dos riscos operacionais. / Operational risk in financial institutions was normalized with Resolution No. 3380 on June 29, 2006, issued by the National Monetary Council. Since then, entities authorized to operate by the Central Bank of Brazil had to adapt its structures and procedures in order to tighten controls on internal and external events to the institution, in order to reduce financial losses from this type of risk mitigation. Thus, this paper aims to present as a commercial bank must act to adjust its processes to the new legal requirements before a subject with a very significant importance. This paper, besides presenting the procedures for managing risks in an entity, also seeks to clarify how operational risk, the department's Call Center financial institution chosen may affect it, in the case of a failure of procedures to be adopted in order mitigating the flaws already identified and possible events that could endanger the continuity of the organization. The results obtained from the survey show that the bank under study in relation to other financial institutions surveyed, still comes in a stage of development of their area of risk management, working in accordance with current legislation and seeking to improve their techniques identification and measurement of operational risks.

O presente trabalho tem por objetivo identificar de que forma a auditoria interna pode contribuir com o atingimento dos objetivos da organização tendo em vista o seu papel atual dentro do contexto de instabilidade financeira que ocasiona o aumento dos riscos inerentes ao negócio fazendo com que este departamento seja desafiado a gerir os riscos presentes, futuros, juntamente com a pressão por reduzir custos e agregar valor à organização. A importância da auditoria interna é destacada como sendo uma área que possui alto potencial dentro da organização dados seu conhecimento acerca dos riscos e processos internos e que pode ampliar sua atuação em áreas que possuem relevância sob o ponto de vista da alta administração. / This final paper focus on identify how internal audit can contribute to the achievement of organizational goals with a view to its current role within the context of financial instability that causes the increase of inherent business risks and therefore this department is challenged to manage the present and future risks, along with the pressure to reduce costs and add value to the organization. The importance of internal audit is highlighted as an area that holds great potential within the organization given their risk knowledge and internal processes that can expand its activities in areas that are relevant from the point of view of top management.

O principal objetivo deste estudo foi verificar a importância da gestão de riscos e controles internos como resposta a riscos empresariais. A relevância do assunto é respaldada na crescente necessidade apresentada pelas empresas para mitigar seus riscos empresarias com objetivo de enfrentar o mundo globalizado e a acirrada concorrência, além de buscar diferencial na qualidade de gestão empresarial e proporcionar maior valor agregado a seus acionistas. Adicionalmente, foram realizadas pesquisas de mercado, sobre assuntos afins ao tema principal, por meio de aplicação de questionários junto a Unidades de Relacionamento com investidores de grandes empresas brasileiras e a empregados de empresas de auditorias independentes com grande experiência de mercado, permitindo ao leitor visão panorâmica da situação atual dos referidos temas. A metodologia utilizada foi a pesquisa documental e bibliográfica, com utilização de documentos de trabalho e relatórios de consultorias privadas e uso de material acessível ao público em geral como livros, artigos, dissertações, seminários e legislações publicados. Como conclusão, é apresentada seleção contemplando 15 importantes lições. / The main purpose of this study was to verify the importance of risk and internal controls management as a response to corporate risks. The subject relevance is supported by the growing need presented by companies to mitigate corporate risks in order to face the globalized world and the fierce competition, seek distinction in corporate management and achieve a larger value added to its shareholders. Furthermore, market researches on topics related to the main theme have been carried out through the use of questionnaires alongside the Units for Relationship with major Brazilian companies investors and independent auditors companies employees who have great market experience thus leading the reader to a wider view of the present situation on the aforementioned themes. The methodology used in this thesis was the document and literature research, through the use of work documents and private consulting reports as well as information available to the general public such as published books, articles, theses, seminars and laws. As a conclusion, the selection is presented and brings about fifteen important lessons.

abstract: Accounting estimates are developed in a bottom-up fashion; subordinates generate estimates that are reviewed by managers. The anchoring heuristic suggests managers may be highly influenced by subordinates’ initial estimates. However, motivated reasoning theory predicts that reporting incentives will bias managers’ review in favor of estimates that are incentive consistent, and managers will selectively attend to information that supports their preferred conclusion, including their perceptions of the subordinate. Using experimental methods I manipulate the consistency of the subordinate estimate with management reporting incentives, and the narcissistic description of the subordinate. Consistent with motivated reasoning theory, I find that managers anchor on incentive consistent subordinate estimates, regardless of subordinate narcissism, but anchor less on incentive inconsistent subordinate estimates, especially when the estimate comes from a narcissistic subordinate. I also find evidence that managers believe narcissistic subordinates act strategically in their own self-interest, and selectively attend to this belief to adjust away from incentive inconsistent subordinate estimates, but not incentive consistent subordinate estimate. My results reveal two potential weaknesses in the management review process: susceptibility to subordinate anchors, and bias created by reporting incentives. / Dissertation/Thesis / Doctoral Dissertation Accountancy 2016

O principal objetivo deste estudo foi verificar a importância da gestão de riscos e controles internos como resposta a riscos empresariais. A relevância do assunto é respaldada na crescente necessidade apresentada pelas empresas para mitigar seus riscos empresarias com objetivo de enfrentar o mundo globalizado e a acirrada concorrência, além de buscar diferencial na qualidade de gestão empresarial e proporcionar maior valor agregado a seus acionistas. Adicionalmente, foram realizadas pesquisas de mercado, sobre assuntos afins ao tema principal, por meio de aplicação de questionários junto a Unidades de Relacionamento com investidores de grandes empresas brasileiras e a empregados de empresas de auditorias independentes com grande experiência de mercado, permitindo ao leitor visão panorâmica da situação atual dos referidos temas. A metodologia utilizada foi a pesquisa documental e bibliográfica, com utilização de documentos de trabalho e relatórios de consultorias privadas e uso de material acessível ao público em geral como livros, artigos, dissertações, seminários e legislações publicados. Como conclusão, é apresentada seleção contemplando 15 importantes lições. / The main purpose of this study was to verify the importance of risk and internal controls management as a response to corporate risks. The subject relevance is supported by the growing need presented by companies to mitigate corporate risks in order to face the globalized world and the fierce competition, seek distinction in corporate management and achieve a larger value added to its shareholders. Furthermore, market researches on topics related to the main theme have been carried out through the use of questionnaires alongside the Units for Relationship with major Brazilian companies investors and independent auditors companies employees who have great market experience thus leading the reader to a wider view of the present situation on the aforementioned themes. The methodology used in this thesis was the document and literature research, through the use of work documents and private consulting reports as well as information available to the general public such as published books, articles, theses, seminars and laws. As a conclusion, the selection is presented and brings about fifteen important lessons.

O presente trabalho tem por objetivo identificar de que forma a auditoria interna pode contribuir com o atingimento dos objetivos da organização tendo em vista o seu papel atual dentro do contexto de instabilidade financeira que ocasiona o aumento dos riscos inerentes ao negócio fazendo com que este departamento seja desafiado a gerir os riscos presentes, futuros, juntamente com a pressão por reduzir custos e agregar valor à organização. A importância da auditoria interna é destacada como sendo uma área que possui alto potencial dentro da organização dados seu conhecimento acerca dos riscos e processos internos e que pode ampliar sua atuação em áreas que possuem relevância sob o ponto de vista da alta administração. / This final paper focus on identify how internal audit can contribute to the achievement of organizational goals with a view to its current role within the context of financial instability that causes the increase of inherent business risks and therefore this department is challenged to manage the present and future risks, along with the pressure to reduce costs and add value to the organization. The importance of internal audit is highlighted as an area that holds great potential within the organization given their risk knowledge and internal processes that can expand its activities in areas that are relevant from the point of view of top management.