150 likes | 274 Views
University of Waterloo Centre for Information Integrity & Information Systems Assurance 6 th Bi-Annual Research Symposium October 1 – 3, 2009 Continuous Monitoring (CM) and the Status Quo Effect Hunton, Mauldin, Wheeler Discussant’s Comments
E N D
University of WaterlooCentre for Information Integrity &Information Systems Assurance 6th Bi-Annual Research SymposiumOctober 1 – 3, 2009Continuous Monitoring (CM) and the Status Quo Effect Hunton, Mauldin, Wheeler Discussant’s Comments Jerrard B. GaertnerCA•CISA/IT, CGEIT, CISSP, CIA, CFI, ITCP
The Observation • Continuous monitoring appears to increase a manager’s (Bob’s) risk aversion beyond the “optimal” level, while at the same time, reducing the incidence of earnings management (manipulation of results).
The Question • Why does risk aversion appear to increase under conditions of CM?
The Proposed Explanation • CM causes Bob to believe his decisions are more likely to be detected and questioned (than under periodic monitoring). • Bob consequently believes that he will have to justify his decisions. • Bob believes the status quo will be easiest for him to defend. • Bobmake sub-optimal investment decisions (status quo) rather than leave himself open to possible rebuke from superiors.
The Formal Hypotheses • H1: The decision to maintain the current level of investment in an ongoing and viable project (status quo) will be perceived ‘easier to defend’ than either increasing or decreasing the current level of investment in an ongoing and viable project. • H2: A decision to maintain (status quo), or increase, the current level of investment in an ongoing and viable project will be perceived acceptable to a manager’s superiors, while a decision to decrease the current level of investment in an ongoing and viable project will be perceived unacceptable to a manager’s superiors.
The Experimental Method • Ask 61 test subjects to evaluate Bob’s performance and elucidate his supposed motivation, based on various scenarios (vignettes) following from Hunton (2008).
The Results • H1 and H2 both confirmed by the research methods employed.
Did we ask the right questions? [3] • Experiment confirms that the test subjects “looking over Bob’s shoulder” believe he will perceive: • CM as an incremental “threat” • Increased risk of being required to justify decisions • Status quo as the most defensible course of action • However, no questions were asked in respect of any alternative theory (next slide). • Test subjects could agree or disagree with the interpretation offered, but not offer any other. • Agreement (non confrontation) is easier!
Alternate Theories [3] • CM perceived by Bob as lack of trust by his superiors leading to resentful or work to rule performance • CM perceived by Bob as a mandate to increase his emphasis on compliance, process and control and hence manage more “by the book” (less risk)
Does the theory of Bob’s perception represent reality? [1] • In practice, CM is often hidden from the subject. • CM generates mountains of data – difficult to analyze • CM deployed for audit purposes usually has specific targets, scope, materiality • Therefore, Bob may be unaware of CM or not believe that it does represent a significant risk his decisions will be subject to review.
Do test subjects have to be business people? [6] • Generalized Linear Model (GLM) multi-variate analysis shows no relationship between demographics of test subject and responses. • Are test subjects too homogenous – what does this mean for the results? (66% Fin Inst., 75% male) • Would doctors, lawyers or high school students have the same views, given the same questions? • Is this a business ethics issue or a social ethics issue?
Assumptions? [4, 5] • Superiors favour profitability (over what - risk aversion, survival, shareholder comfort level)? • Economic downturn may have “tainted” test subjects or invalidated the generality of the statement • If so, status quo becomes the optimal decision, not increasing quality control expenditures • High credibility and trustworthiness equate to acceptable decision. Not always?
Leading questions? [2] • If Bob is asked to justify his decisions to his superior, how difficult will it be for him to defend his decision? • If Bob is asked to justify his decisions to his superior, how easy will it be for him to defend his decision? • How likely is it that Bob’s superiors will find his decision defensible?
Future research • Extending testing to all sub scenarios • Extending testing to non-business groups • Formulating and testing alternative hypotheses regarding cognitive processes of Bob • Interviewing Bob’s in the field • Investigating the sensitivity of responses to varying degrees of monitoring (between once every year and continuous) • Investigating the impact of sharing monitoring results proactively with Bob • Investigating the impact of non-audit monitoring (regulatory, police, self-monitoring, academic)