Listen on Apple Podcasts, Spotify and YouTube
Welcome to AccelPro Audit, where we provide expert interviews and coaching to accelerate your professional development. Today we’re featuring a conversation with Cassandra Estep, Assistant Professor of Accounting at Emory University’s Goizueta Business School.
As companies have grown more complex, so have their financial statements. In response, auditors have had to bring in various specialists in areas like IT, legal and valuation to help them understand these complexities. Estep started her career as one of those IT specialists at a Big Four firm. Now as an academic she researches how specialists can best work together with traditional auditors, what happens when these relationships break down and how new tech tools are changing the audit profession.
In this interview she offers tips for both frontline auditors and audit leaders about getting the best results from their collaborations with IT specialists, her predictions for how quickly the profession will embrace AI, what skills auditors should hone to cope with its tech-filled future and her own path from prospective math major to IT auditor to academic.
Listen on Apple Podcasts, Spotify and YouTube
Interview References:
Cassandra Estep’s Emory University Goizueta Business School profile.
1:47 | Bauer, Tim and Estep, Cassandra. One Team or Two? Investigating Relationship Quality between Auditors and IT Specialists: Implications for Audit Team Identity and the Audit Process. (December 18, 2019). Contemporary Accounting Research 36 (4): 2142-2177.
4:05 | Estep, Cassandra. Auditor Integration of IT Specialist Input on Internal Control Issues: How a Weaker Team Identity Can Be Beneficial. (February 12, 2021). The Accounting Review.
11:19 | Estep, Cassandra and Griffith, Emily Elaine and MacKenzie, Nikki. How Do Financial Executives Respond to the Use of Artificial Intelligence in Financial Reporting and Auditing?. (January 5, 2023). Review of Accounting Studies.
16:31 | Proposed Amendments Related to Aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form. (June 26, 2023). Public Company Accounting Oversight Board (PCAOB), Release No. 2023-004.
Supplemental Materials:
Benjamin P. Commerford, Sean A. Dennis, Jennifer R. Joe and Jenny W. Ulla. Man Versus Machine: Complex Estimates and Auditor Reliance on Artificial Intelligence. (September 24, 2021). Journal of Accounting Research, Volume 60, Issue 1, Pages 171-201.
TRANSCRIPT
I. WORKING WITH IT SPECIALISTS
Jessica Stillman, Host: I understand your research focuses on how audit teams work together with IT specialists. Can you walk me through your findings?
Cassandra Estep: I have a couple papers and so I'll talk about both of them, but the first one is with a co-author, Tim Bauer at the University of Waterloo. Over the last 20 years, companies have gotten more complex, which means audits of those companies' financials have gotten more complex. And so the traditional financial accounting based auditors have had to bring in specialists from different areas, including valuation, IT and legal. We have this idea of a collective audit team that includes both these kinds of traditional auditors and the specialists. How do those professionals view their relationship with the other group?
We interviewed auditors and IT specialists to get a sense of that. One of the first questions we asked was whether or not they viewed the other group as part of the audit team and whether they thought the other group viewed themselves as part of the audit team as well. Auditors said they viewed the IT specialists as part of the team, but they didn't think IT specialists always had that same viewpoint. And then from the IT specialists, we heard, ‘Well, we think of ourselves as part of the team, but we don't think the auditors always include us as part of the team.’
So there seemed to be kind of this mismatch in how they viewed the team, even though there seemed to be an underlying desire to operate as one team. But it didn't always happen in practice.
The other part of this project was how the audit process unfolds when the auditors and IT specialists view themselves as having a good relationship or a difficult relationship. Good relationships did seem to overlap with the idea of a stronger team identity, whereas difficult relationships seem to overlap with this idea of a weaker team identity. What we heard from both auditors and IT specialists was that difficult relationships tended to have a lot less communication, less coordination. They use the phrase ‘throwing things over the fence,’ where work papers would just get dropped into the files. They weren't working together to resolve issues.
Good relationships were the flip side of that. There was a lot of communication. There was more collaboration. They were working together to resolve issues. Of course, those good relationships weren't perfect. There were still budget overruns, things like that, but the way they approached the audit and the way that they worked through those things did differ.
One of the takeaways from that paper is this idea that having good relationships between auditors and their specialists can lead to some better outcomes. But I want to caveat that a bit with another paper of mine, looking at how auditors integrate input that they receive from IT specialists. I conducted an experiment with auditors and found that actually having a weaker team identity with the IT specialist led to some benefits. They tended to put more weight to the input received on IT issues, to those issues where the IT specialists are viewed as experts. And for non-IT issues, they tended to do a better job of differentiating between the quality of input that they got.
The theory behind it is that when they had that weaker team identity with the IT specialist, it really made that expertise salient to them. And so they were able to pay attention more and not just kind of rely on blind trust. There seemed to be more thoughtful integration of the input.
And so when I think about these two papers together, there's not really an easy answer at the end of the day. Making sure you have a good relationship or a strong team identity with your specialist isn't necessarily going to solve all of your problems. You still have to be thoughtful about it. You still have to have good communication and coordination, but make sure you understand what those specialists are giving to you and that you're incorporating it into the audit in the right way so that you do achieve those better audit outcomes.
JS: You talked there about the importance of communication, but also the importance of being thoughtful about the information that you're given. Are there any other things that high functioning audit teams and IT specialists do differently?
CE: In those good relationships one of the common themes that we saw was mutual respect, with auditors seeing value in what the specialist is bringing to the table and specialists respecting and seeing value in what the financial auditors are bringing to the table. That mutual respect really seemed to be a kind of key underlying tenet of making sure that the specialists were integrated into the team and that they were achieving this effective communication and collaboration.
Something else that's a little bit more specific that we heard across a lot of the good relationship examples, but we did not hear very often in the difficult relationship examples, was the idea of IT specialists reviewing some of the auditors’ work. Audit standards require, of course, that the auditors review the IT specialist work because they are responsible overall for the audit opinion. The financial audit partner is the one that's going to be signing off on that opinion. Audit standards require that they supervise and oversee work of all other auditors and specialists that help them out. And so, the review of IT specialist work by the auditors was common across both good and difficult relationships, but the review of the auditor's work by the IT specialists tended to happen more in those good relationships.
IT specialists were able to provide some input and oversight, making sure that things weren't missing. For example, ensuring that the systems that produced financial statements which the auditors were relying on were included in the IT specialist scope of examining IT general controls. The IT specialist performing some of that review work is something we view as a practical thing that firms could consider.
JS: Is this good relationship between the IT specialists and the auditors something that comes from the top? What sets that tone in that relationship?
CE: We heard a little bit of this idea of tone at the top, this messaging that you need to view the specialist as part of the team. When you go to the client, consider your specialists as part of the team. So I'd say some of it did seem to come from firm messaging.
A few of the auditors, especially those that had been at firms a little bit longer, mentioned that the messaging had varied over the years and when other things were more important or when there was a lot of pressure around budgets, then it became harder to make sure your specialists were integrated. Specialists tend to be more expensive on audits as well. That's always a factor.
But I would say a lot of what it comes down to is the culture of the office, and even just the interpersonal relationships people develop with specialists on one team and then bringing those same specialists into work with another client. One of the questions we asked was, “As specialists, how do you get involved in audits?” Much of what we heard was informal networking and interpersonal relationships, this spillover of the good relationship across multiple clients.
And so I think firm messaging, leadership tone at the top, can help, but it’s not the only driving force. It served as a reminder of how you should be approaching the audit and especially how to present your team to the clients as well.
JS: It sounds like a possible takeaway for the audit professional themselves is to maintain those relationships, to work on those relationships.
CE: Yeah, for sure. In the auditing world, it's always a trade off of professional responsibilities that the auditor has to uphold, but it's still a professional service. You still have clients that at the end of the day, you have to work with and need to be happy. Ultimately it's the audit committee that hires and fires the auditors, but you're working with management. This idea of maintaining relationships with clients is very commonplace for auditors, and I think exactly the same idea can apply to specialists. Thinking about how you work with your specialists, maintaining those relationships, having effective communication and collaboration is going to make things go more smoothly.
JS: Can you talk about the consequences for audit quality when teams do have difficult relationships with their IT specialists?
CE: Obviously this was an interview-based study, so I don't want to overstate the implications. Doing a larger archival type study looking at actual outcomes could provide even more broad, generalized results, but from the perceptions of the auditors and IT specialists that we talked to, I would say they had more comfort in the end product.
It wasn't that the difficult relationships ended up with an audit opinion that they didn't think was supported. It was that getting to the point of an unqualified opinion that the auditors were comfortable issuing, felt like a smooth process even if you had IT issues that came up, even if you had to work through something last minute.
I don't think there were any big differences in the good versus difficult relationships in regards to the number of material weaknesses or significant deficiencies that were identified. But again, I would say the process of working together to resolve an issue gave them a lot more comfort because they knew that they had communicated both sides of things: the IT risks, the financial risks and doing the necessary procedures to get comfortable, to be able to ultimately issue in most cases an unqualified opinion.
JS: Is there any other practical advice you would give audit professionals regarding how to maintain good, strong relationships with IT specialists?
CE: The projects I've been talking about are a few years old now, and so I think it's actually interesting to revisit as data analytics and more technology assisted audits are coming to the forefront.
In some ways auditors are having to up their technology skills. They're performing more data analytics and those types of things, so some might argue, ‘Well then maybe IT specialists become less important.’ But I think in some ways they become even more important because they already have that background and expertise. And so it’s important that those things are being leveraged across all aspects of the audit now, and not just isolating it to the IT controls or the IT risks. Thinking about those things more broadly is important.
With how technology-reliant audits are becoming these days, I think it’s a good idea for auditors to improve their technology skills and leverage, hopefully, those IT resources they have within the firms.
—
II. ON AI AND AUDITOR SKEPTICISM
JS: That's a great segue into the question of your most recent research. You looked into the use of AI in the finance world and whether executives have trust in these tools. Can you give me a sense of how open to AI tools audit professionals are? What doubts or worries do you commonly hear about AI in the audit space?
CE: For the project that I have on AI, we looked at the financial executive perspective. We focused on CFOs, controllers, people in positions that are responsible for the financials within a company—more on the client side versus the auditors themselves.
I can speak more generally to this new line of research that is coming out. There's been a few papers published now looking at how auditors view AI and the few papers with auditors as participants tend to see this idea of what we call algorithm aversion. They're a little bit hesitant to rely on AI. And typically this is compared to human specialists, who are what we have traditionally seen doing these types of things that these studies are looking at. Part of that stems from not really understanding the black box of what's going on with AI, even though that same idea could apply to a human specialist. That idea of a human being responsible for it, sharing responsibility, can give auditors a little bit more comfort.
One of the published studies that looks at this finds that this idea of not feeling fully comfortable relying on AI tends to increase when the area is more subjective. We have difficulty really trusting technology to make some of these more subjective judgments or decisions, especially when we think about auditing and financial reporting. Yes, we have all these rules written down, but there's a lot of judgment that goes into how to apply those rules, how the financial statements should look to comply with US GAAP, for example. I think that's what makes it a little bit difficult for auditors to fully rely on AI.
In our study where we focused on the client side or the financial executive side of companies, we did both a survey and an experiment. And in the survey we just asked them about their general perceptions, and the sentiment overall was a pretty positive outlook on AI. They felt it would have applicability at their companies. A lot of them were already seeing it used. It's not quite being used in the financial reporting space too extensively yet, but they're feeling hopeful about it. There's, of course, the typical reservations of how expensive it’s going to be and how many mistakes it’s going to make until we get it right, though.
One of the big takeaways we saw is that they're very excited for AI to be a support tool, being able to analyze this large volume of data that people just don't have the cognitive capacity to do. But at the end of the day, it's going to be a support function to humans still making the judgments. They don't foresee any time soon a machine spitting out an answer and everyone then going with it unquestioningly.
We did an experiment with financial executives as well, looking at how willing they were to accept audit adjustments proposed by their auditors, and we varied whether the company themselves used AI or not for generating a complex estimate that was part of their financials and whether the auditor used AI in evaluating that estimate or not.
We found that financial executives were most open to accepting the audit adjustment proposed by their auditors if both their company and the auditor used AI. We don't necessarily find any evidence of algorithm aversion in our study. It was more of an algorithm appreciation when executives had AI and the auditor had AI. They actually viewed it as more accurate, so there can be some trust with this idea.
JS: I know none of us has a crystal ball, but when you look at how these tools including AI are going to transform the audit profession over the next few years, how do you see it unfolding?
CE: Honestly, I do think they're going to be integrated and used in a lot of different ways. They're already being used for repeated, manual tasks, both within companies and by auditors— just checking the access of an application or a system within a company and making sure everything is right. They can automate a lot of those things now. RPA (Robotic Process Automation) is the official term a lot of people use. That's a very simple form of AI that's already being implemented.
It's probably going to be slower than some people would have expected, in terms of using data analytics on audits. I think that's taken longer than we would have expected, and partly because auditors are hesitant to use these new tools for the valid reason of making sure regulators are going to be comfortable. When the PCAOB comes in to inspect their work, are those inspectors going to say that they did a good job? Did they follow the audit standards? Did they meet their professional obligations in performing the audit?
One of the most advanced ways to use AI is using it for complex estimates, being able to pull in data from a lot of different sources to come up with an actual accounting estimate for a warranty reserve or an intangible asset of some kind. Using these large sets of data to help estimate the numbers that show up on financial statements is somewhere that I think they can and will go with AI. But again, getting comfortable using those tools both within the companies and from an auditor perspective, getting surety that the regulators are going to be okay with them using these tools, is a critical point.
The PCAOB released a proposal to revise a couple of the audit standards to incorporate data analytics. They're very clear that this does not apply to AI. It just formally incorporates data analytics. In the past three or four years, we've really seen the audit firms fully move to a more data-based approach to audits. Even though they've had the tools and the methods probably for about 10 years, it took a few years to make sure that inspectors would be okay with it. Often they were doing things both the old manual way as well as the more data analytic-driven way.
That cycle will probably continue a little bit as these tools get integrated and as the regulators come on board and understand what auditors are doing. What's the most effective? Effectiveness is still the top concern of those regulators. But also thinking about efficiency and making sure that they're not increasing client audit fees just to increase them. But again, performing an effective audit that the inspectors will be comfortable with and that the auditors are comfortable issuing their opinion on, is one of the potential obstacles to these tools being integrated as quickly as the popular press would have you believe.
JS: I want to bring it back to the takeaway for the individual audit professional. Is there any practical advice you have for the individual auditor to prepare for this future where analytics tools and AI become a bigger part of the audit process?
CE: Upping your IT skills is a good idea, but it's not even just your skills. It's more, I think, your openness. Your openness to understanding and questioning things. We talked about auditors not just blindly trusting other team members. The same thing applies to technology. You don't want to blindly trust the technology, but you don't want to be afraid of it either. You want to see the value in investing time and understanding it.
What I've heard just from auditors in practice, from having conversations with them, is that younger generations of auditors coming in that are more used to having technology are more used to different ways of doing things. They are really a driving force in the firms in terms of coming up with new ways to perform an audit test or a new audit procedure using a more data-driven or advanced methodology.
My advice would be “Don't be afraid to speak up.” If you have an idea, it might be worth it to invest. It might be a little bit more time upfront, but then over multiple years, if you're using that same tool, the benefits will accumulate and offset that initial investment.
Having that problem-solving mindset, thinking about things in different ways, critical thinking skills, I think all of those become even more important in a world where technology is able to do the easy tasks for us. Having that professional judgment and being able to use tools in new and effective ways - I think those are going to be the real differentiators for audit professionals as they move forward in their careers.
—
III. THE CAREER PATH OF AN IT SPECIALIST
JS: We always finish by talking about the guest's own career trajectory. Can you talk me through how you found your way into the world of audit and how you got to where you are today?
CE: When I started college, I thought I wanted to be a math major. And so I started taking a lot of math classes and I realized I hated writing pages of proofs. That was not fun, and that didn't seem to be stopping anytime soon if I was going to take a lot of advanced math classes.
And so, at the University of Virginia where I went for undergrad, both financial and managerial accounting are prerequisites to get into the undergrad business program. I really loved those classes, so I decided, well, maybe accounting is a good fit. It's math, but with some social interaction and judgment and things like that.
I ended up pursuing accounting as my major and I had an interest in IT. Actually before I even went to college I thought I might be a computer science major. So when I went to do an internship the summer between my third and fourth year of college, I decided to pursue an internship in IT audit because I wanted to see if it was going to be too technical for me. I essentially did a major in accounting and a minor in IT, and I wasn't sure if I had enough of the IT skills to do that. I found that my background was actually a great fit because I had the strong accounting background and just enough IT interests or openness to learn that aspect more deeply on the job.
I joined one of the Big Four firms, EY, after I graduated and I spent six years in IT audit. Because I loved my internship so much, I decided to just stay. I spent three years in a big office outside of DC and then three years in a smaller office in Raleigh, North Carolina.
I feel as though I'm one of the lucky ones that had a great experience working at a Big Four firm. I had a lot of flexibility and autonomy and that was something that I knew I wanted even after I left public accounting. I'm someone who started at the firm and knew I didn't want to be partner. That just wasn't a goal of mine. But I also wasn't someone that was looking for a steady 40 hour a week job. I didn't mind working a lot. I didn't mind traveling. I loved working on different teams for different clients, and so I was trying to figure out what would be my next move whenever I was ready to move on from public accounting.
I think it was about my third year at the firm, the Accounting Doctoral Scholars program came out to encourage those with practice experience to go back and get PhDs. And so I said, maybe academia is a good fit for me.
I did decide I wanted to stay through manager at the firm. During my first year as manager, I applied to PhD programs and ended up going to the University of Illinois. My professional background ended up being a great fit. A lot of my research interests stemmed from that experience, and now I've been on faculty here at Emory for a number of years. Time really flies.
JS: A philosophy of the AccelPro Audit community is that peers talking to peers can be a really valuable way to develop professionally and gain important insights. So I wanted to talk to you about how you rely on peers, inside and outside your organization, to deal with tough situations or manage career decisions.
CE: I feel like throughout my career I've been very lucky to fall into jobs and positions where I end up having a very strong peer network. And looking back, I cannot imagine how I would have gotten through it without those peers.
One of the biggest things I can think of is the decision to go into academia. When I was leaving the firm, I was talking to peers who were currently PhD students, who were able to talk to me about both the pros and the cons of changing careers, of going into a whole new space. It prepared me a little bit more for the shift.
I was a manager at a Big Four firm. I was typically the one with all the answers. When you start a new career being the one who knows nothing, especially your first year, you're just floundering around feeling like there's so much to learn. Having a peer network of people who have done that and are now able to pay it forward and talk to others who have been interested in following that career path - I think that is one of the things that stands out the most. Having those peer relationships just makes it so much easier.
This AccelPro audio transcript has been edited and organized for clarity. This interview was recorded on August 8, 2023.
Listen on Apple Podcasts, Spotify and YouTube
AccelPro’s expert interviews and coaching accelerate your professional development. Our mission is to improve your day-to-day job performance and make your career goals achievable.
Send your comments and career questions to questions@joinaccelpro.com. You can also call us at 614-642-2235.
If your colleagues in any sector of the audit field might be interested, please let them know about AccelPro. As our community grows, it grows more useful for its members.
