On the Use of Checklists in Auditing: A Commentary

Abstract

SUMMARY: Experimental studies concerning fraud (or ''red flag'') checklists often are interpreted as providing evidence that checklists are dysfunctional because their use yields results inferior to unaided judgments (Hogan et al. 2008). However, some of the criticisms leveled against checklists are directed at generic checklists applied by individual auditors who combine the cues using their own judgment. Based on a review and synthesis of the literature on the use of checklists in auditing and other fields, we offer a framework for effective use of checklists that incorporates the nature of the audit task, checklist design, checklist application, and contextual factors. Our analysis of checklist research in auditing suggests that improvements to checklist design and to checklist application methods can make checklists more effective. In particular, with regard to fraud risk assessments, customizing checklists to fit both client circumstances and the characteristics of the fraud risk assessment task, along with auditor reliance on formal cue-combination models rather than on judgmental cue combinations, could make fraud checklists more effective than extant research implies.

The Personality Factor of Conscientiousness on Skills Requirement and Fraud Risk Assessment Performance

“…Fraud, by its term, involves wilful misconduct, designed to evade detection. As such, the risk of fraud must be assessed to participate in strategic thinking to anticipate the behaviour of the perpetrator of potential fraud teams (Boritz & Timoshenko, 2014). As noted by (AICPA) and (ACFE), fraud risk evaluation must include three rudiments:…”

Reflecting on Whether Checklists Can Tick the Box for Cloud Security

“…They question the quality of the costbenefit trade-off decisions that were being made especially by small firms who might see the additional cost as prohibitive, but don't fully assess the potential costs of undiscovered fraud. Boritz and Timoshenko [57], which we will return to later, try and map out the issues that need to be addressed in making the use of a checklist more robust in delivering broad objectives (as opposed to answering a myriad of subsidiary questions). They present their concerns in a diagram that we generalize and adapt below.…”

“…Having recognised the inherent failings of the checklist, we need to consider how we might go about improving this situation. We return to Boritz and Timoshenko [61], who produced an interesting diagram to characterise factors which might be incorporated to improve the effectiveness of the checklist. Fig.…”

“…1. Factors Affecting the Effectiveness of a Checklist Flowchart Adapted from Boritz and Timoshenko [61] We have adapted this diagram to suit the particular needs of cloud computing. For each question included in a checklist, we must consider the context in which it will apply, taking into account any appropriate environmental factors.…”

Compliance with standards, assurance and audit

“…Audit is also potentially very expensive if done well by the best experts in the field and there is a temptation to reduce the experts' role to one of advising, often writing checklists to be administered by qualified technicians. Boritz and Timoshenko [14] discuss the use of checklists and it is clear that a great deal of care and adaptation is necessary if they are to be more effective than individual judgement and the checklist becomes more of a thought-starter than a series of boxes to tick.…”