Auditing and internal controls for offshored accounting processes: a research agenda

• Pages: 310-326
• Date: 05 October 2015
• Published date: 05 October 2015
• DOI: https://doi.org/10.1108/IJAIM-10-2014-0072
• Author: Partha Mohapatra,Dina F El-Mahdy,Li Xu
• Subject Matter: Accounting & Finance,Accounting/accountancy,Accounting methods/systems

Auditing and internal controls

for offshored accounting

processes: a research agenda

Partha Mohapatra

Texas Tech University, Lubbock, Texas, USA

Dina F. El-Mahdy

Department of Accounting and Finance, Morgan State University,

Baltimore, Maryland, USA, and

Li Xu

Washington State University, Richland, Washington, USA

Abstract

Purpose – The purpose of this study is to develop a research agenda on internal controls for offshored

accounting processes. It further develops a linkage between internal controls of offshored accounting

processes and auditing of the organization. Offshoring of accounting processes has become a common

business practice, pursued by rms to reduce costs and focus on core competencies. However, our

understanding about internal controls of these offshored processes is limited.

Design/methodology/approach – Grounded in theory that is supported by prior literature and

interviews with practitioners, this paper attempts to develop a research agenda on internal controls for

offshored accounting processes.

Findings – The main ndings of our study suggest that while offshoring saves costs and allows the

clients to focus on their core competencies, it also poses risks to the clients’ organizations. To mitigate

these risks and comply with the regulatory requirements of the countries where the clients are located,

clients and their offshore vendors need to effectively establish adequate internal controls for offshored

business processes. Clients should seek those vendors who have appropriate processes in place and are

willing to provide Service Organization Control (SOC) reports (or at least are capable of getting a SOC

report in the near future). Moreover, clients should avoid offshoring the processes that would exist in

defective internal control systems. Similarly, vendors should avoid undertaking those processes for

which they are incapable of maintaining efcient internal controls.

Practical implications – Our study has implications for academicians as well as practitioners on

understanding the determinants and consequences of internal control for offshored processes.

Originality/value – While internal controls for offshored accounting process and related regulatory

changes have been increasingly important topics, little research has been devoted to explore their

implications on accounting and auditing literature. We attempt to bridge this gap by synthesizing prior

The authors would like to thank Mr Sanjoy Sen (former Partner, PriceWaterhouseCoopers), Mr

Brian Geffert (former Partner, Deloitte), Curtis Stewart (Partner, Deloitte and Touche), A.

Sivakumar (Manager, Deloitte and Touche), S.R. Sidhu (Manager, Deloitte and Touche) and

Rahaju Pal (Director, PricewaterhouseCoopers) for their valuable input into this paper. We also

thank participants of the 2009 American Accounting Association’s Mid-Atlantic Region for their

feedback and suggestions. An earlier version was accepted at Annual meeting of American

Accounting Association, 2010.

The current issue and full text archive of this journal is available on Emerald Insight at:

www.emeraldinsight.com/1834-7649.htm

IJAIM

23,4

310

Received 30 October 2014

Revised 14 January 2015

Accepted 15 January 2015

InternationalJournal of

Accountingand Information

Management

Vol.23 No. 4, 2015

pp.310-326

©Emerald Group Publishing Limited

1834-7649

DOI 10.1108/IJAIM-10-2014-0072

research on internal controls and auditing, and further developing a set of research questions for

academic research. Our hope is to spur a new area of research that has not been explored before.

Keywords Offshoring, Internal control, SSAE-16

Paper type General review

Presumably, what happened in Satyam was a failure of internal controls. That raises the

question about whether its SAS 70 reports can be relied on by customers.

–Compliance Week, October, 2009.

1. Introduction

Even though offshoring[1] of business processes has existed for many decades, it has

increased substantially during the past decade. According to the Computer Economics

report (2014/2015), the median spending on outsourcing in the information technology

(IT) budgets of large, medium and small organizations is 7.4, 6.1 and 4.6 per cent,

respectively. Forrester Research estimates that by 2015, about 3.3 million jobs will be

offshored from the USA, and this trend is continuing at an accelerated pace

(Subramanian and Sharma, 2008). Increasingly, companies are offshoring any process

that can be digitized to decrease costs and focus on core competencies (Friedman, 2007).

Blinder (2009) estimates approximately 22 to 29 per cent of all US jobs are potentially

offshorable. For example, accounting processes such as billing services, internal

auditing, accounting and auditing functions, tax processing, credit and collections, bank

reconciliations, pension accounting, activity-based costing and project accounting are

all candidates for offshoring. General Electric (GE), Dresdner Bank, British Telecom,

Ford, American Express, HSBC, Citibank, BP, Standard Chartered, EXL (part of

Conseco) and Hewlett-Packard are some of the Fortune 500 rms that have already

offshored their accounting function (Nicholsan and Aman, 2008).

The increasing trend of offshoring accounting processes places challenges on US

rms, particularly in reference to maintenance of their internal controls in the

post-Sarbanes Oxley Act 2002 (SOX, hereafter) era. Specically, SOX Sections 302 and

404 mandate that all public companies establish and maintain efcient and effective

internal control over nancial reporting (ICFR). After SOX became effective, the Public

Company Accounting Oversight Board (PCAOB) requires user organizations

(henceforth called onshore-client rms, OCFs)[2] that have outsourced key accounting

processes (or underlying IT applications/infrastructure) to obtain assurance as to the

design and operating effectiveness of the vendors’ ICFR. To satisfy the regulatory

requirements, the client is responsible for making sure the business processes have

appropriate internal controls, even when the entire process is offshored. Thus, offshore

outsourcing does not absolve the auditor’s client from its responsibilities of maintaining

effective ICFR. As pointed out by PCAOB:

Rather user management should evaluate controls at the service organization, as well as

related controls at the user company, when making its assessment about internal control over

nancial reporting (Auditing Standard [AS] No. 2 & No. 5, PCAOB).

In spite of the PCAOB’s clear guidelines, a number of PCAOB inspection reports nd

clients’ auditors decient in obtaining sufcient competent evidential matter related to

reports generated by service organizations (Bierstaker et al., 2013). Thus, organizations

that offshore their accounting processes should be particularly cautious about the

311

Auditing and

internal

controls