The purpose of this paper is to examine an auditor's decision to investigate for fraud, when a manager with exogenous incentives to misreport chooses the quality of internal controls. I extend the strategic auditing literature by allowing the manager both a choice with respect to fraud and a second choice that affects the error rate in the audit population. Consistent with the practitioner literature, I assume managers can commit fraud by overriding internal controls, and that audits conducted in accordance with Generally Accepted Auditing Standards (GAAS) do not always distinguish between errors and fraud. The study is motivated by the increasing importance of internal controls in auditors' fraud risk assessments. In 1997, the Auditing Standards Board issued Statement on Auditing Standards (SAS) No. 82: Consideration of Fraud in a Financial Statement Audit. This standard requires auditors to assess the risk of fraud on every audit and encourages auditors to consider both the internal control system and management's attitude toward controls, when making this assessment.1

Some companies now outsource their internal audit function to public accountants. Internal auditors and accounting firms disagree about the merits of outsourcing. Each type of auditor claims to provide more cost‐effective services and appears to claim superior expertise. This paper uses agency theory to examine outsourcing and reconciles the outsourcing debate without resorting to differential auditor expertise. Under the assumptions that public accountants' “deep pockets” provide incentives to outsource and their higher opportunity cost provides a disincentive, we characterize the optimal employment contract with each auditor. We find that public accountants provide higher levels of testing, but possibly for a higher expected fee. This result supports both the internal auditor's claim as the lower cost provider, and the public accountant's claim of higher quality. We also find that incentives to outsource generally increase in various measures of risk, including the risk that a control weakness exists and the size of the loss that can result from an undetected control weakness.

Some companies now outsource their internal audit function to public accountants. Internal auditors and accounting firms disagree about the merits of outsourcing. Each type of auditor claims to provide more cost-effective services and appears to claim superior expertise. This paper uses agency theory to examine outsourcing and reconciles the outsourcing debate without resorting to differential auditor expertise. Under the assumptions that public accountants' “deep pockets” provide incentives to outsource and their higher opportunity cost provides a disincentive, we characterize the optimal employment contract with each auditor. We find that public accountants provide higher levels of testing, but possibly for a higher expected fee. This result supports both the internal auditor's claim as the lower cost provider, and the public accountant's claim of higher quality. We also find that incentives to outsource generally increase in various measures of risk, including the risk that a control weakness exists and the size of the loss that can result from an undetected control weakness.