Can nudging with descriptive norms help internal auditors stop runaway information systems projects?

Abstract

Although internal auditors are expected to play an important role in corporate governance, they are not always effective in bringing their message to management’s attention when they observe that a risky course of action is being taken that could harm the organization. When information systems projects go awry, for example, internal auditors often struggle to get managers to listen to their warnings. Instead, managers may turn a deaf ear to the auditor’s warnings. In this paper, we build on the idea that internal auditors can follow an approach that combines two elements to reduce this so-called deaf effect: (1) the auditor can apply communication techniques to more effectively deliver the message, and (2) the internal auditor can develop a relationship with the manager such that the auditor is viewed as a ‘partner’ rather than an ‘opponent.’Following a mixed method approach, we examined how ‘nudging with a descriptive norm’ as a communication technique could help internal auditors to reduce the deaf effect and how this can be understood in the context of the auditor-manager relationship (AMR). We conducted two experiments showing consistent evidence that both (1) nudging with a descriptive norm and (2) AMR, had significant indirect effects on the deaf effect that were mediated through perceived social norms. A complementary series of ten interviews with Chief Audit Executives shed further light on how internal auditors could apply ‘nudging with a descriptive norm’ as a communication technique, and what should be considered, including the auditor-manager relationship. Implications for both internal audit research and practice are discussed.