Constructing the Audit Risk Assessment by the Audit Team Leader When Planning: Using Fuzzy Theory

Abstract

The aim of this study is to construct the assessment of the expected audit risk by the audit team leader (ATL) during the planification phase of the audit. The ATL plays an important role within the audit, and even more so regarding small and medium-sized (SME) audit firms. The audit risk assessment is critical as relying more (less) on internal controls implemented by the client leads to performing less (more) substantive audit procedures. This is determined by the ATL based on their professional judgement and previous experience. The use of fuzzy theory has powerful potential into the audit arena, as the audit risk assessment (outcome) is critically related to the auditors’ judgement and perception. We argue that ATL characteristics are core conditions in determining the audit risk assessment when planning. Using hand-collected and private data from Spanish SME audit firms, we find that a comprehensive set of conditions must be given for perceived high audit risk. The results indicate that female and inexperienced ATLs planning the audit of indebted firms with high proportions of capital assets, less profitability, and with a larger board sizes, as they are expected to have bad internal control. The same conditions are met when expecting errors, as well as shorter audit tenures. Finally, conditions such as the ATL’s experience gains importance in expecting irregularities. This paper extends our understanding of the role of ATL characteristics on the audit risk assessment when planning and raising awareness on studying SME audit firm behavior.

1. Introduction

Auditing is a collective process conducted by a professional accounting team with a range of skills, experience, and emotions [1]. An audit consists of collecting evidence to express and issue an audit opinion about whether the financial statements are prepared, in all material aspects, in accordance with an applicable financial reporting framework (ISA 200). Such opinion is on whether the financial statements are presented fairly, in all material respects, or given a true and fair view in accordance with the framework (ISA 200). The fundamental goal of an audit is to reduce uncertainty and enhance the degree of confidence of intended users in the financial statements. As stablished by the reference number 4 of ISA 315, “the objective of the auditor is to identify and assess the risks of material misstatements, whether due to fraud or error, at the financial statement and assertion levels, (…) including the entity’s internal control (…)”. Hence, the audit staff must evaluate and respond to risks caused by uncertainty in the information. Here, three key elements pop up because of their relevance on the auditing process: (i) the audit plan; (ii) the audit staff; and (iii) the audit risk. Of course, these concepts are interdependent.

The auditor shall undertake some preliminary engagement activities at the beginning of the audit engagement, such as performing procedures required by ISA 220, evaluating compliance with ethical and independence requirements, and understanding the engagement. According to ISA 300, the audit plan is more accurate than the overall audit strategy. Planning takes place over the course of the audit, so changes to early planning decisions may happen. Planning activities entail, among others, the auditor’s risk assessment procedures, the subsequent nature, timing and extent of further audit procedures and the consideration of those factors that, in the auditor’s professional judgement, are significant in directing the engagement team’s efforts.

Even though the audit partner is the person who firstly contacts the client, the role of the audit team leader (ATL) is critical, as they must allocate resources efficiently to lower audit risk up to an acceptable level, as indicated by the International Audit Standards (ISA). It is true that the audit partner will sign the audit report with an opinion, but such an opinion is the final outcome after a great audit effort. The audit effort is mainly carried out by those who are not the partners, and ATLs (named by the audit partner) are decisive to opt for and issue an opinion or other in the audit report [2,3]. Sincerely, lower-level audit team members gather most audit evidence, however, upward communication and knowledge sharing are decisive for effective and efficient audits [4,5]. In this aspect, audit team leaders play a critical role in easing such information exchange and in encouraging audit team members [6]. Audit leadership is expected to affect group performance [7]. Leadership style not only influences the levels of satisfaction, motivation, and performance of audit team individuals, but also may improve the audit quality practices. Furthermore, appropriate risk audit assessment of the client from the beginning of the audit by audit team leaders may be momentous for an effective and efficient audit execution. Relying more (less) on internal controls implemented by the client leads to performing less (more) substantive audit procedures, which is determined by audit team leaders based on their professional judgement and previous experience [8].

With respect to audit risk assessment, some clarifications must be made in order to understand the meaning of audit risk. According to the IAASB Glossary of Terms (1), audit risk is defined as the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated, so it is a function of material misstatement and detection risk. This term is difficult to measure, as it may be only estimated after the audit work is complete. For this reason, we center our attention in the audit risk assessment. The audit risk assessment is the imperative identification, analysis, and management of risks relevant to prepare the financial statements [9], and its procedures take place in the planning period of the audit. During the risk assessment time, the auditor inquires with management, entity staff, performs analytical procedures, observations and inspections, and understands business risks that may result in material misstatements. The audit risk assessment is fundamental to the audit process for several reasons. In accordance with ISAs, audits must follow the risk-based approach, because auditors may not check all transactions and must minimize the chance of giving an inappropriate audit opinion. Addressing insignificant risks in a high level of detail would be inefficient, and no one is prepared to pay for the auditors to do such amounts of work.

Setting aside the inherent risk for the difficulty in its estimation, we focus on the assessment of internal controls and the probability of detecting errors and irregularities by ATLs when planning. These terms are defined in ISA 315, and will be explained in more detail later. The audit risk assessment in the planification phase by the audit team leader (ATL) is highly based on subjective judgements. The ATL must evaluate internal control and the expected existence of errors and irregularities in the financial statements, so they determine if a risk is classified a key risk, material risk, or insignificant risk (it is not black or white, but there might be shades of gray). The application of fuzzy theory is particularly meaningful, as audit risk assessment involves people thoughts, inference, and perception [10], so fuzzy method retains a certain degree of fuzziness in such aspect. Compared to econometric analysis (symmetric approach), fuzzy method (asymmetric approach) does not draw a conclusion based on a single correct answer (reject or not a null hypothesis) but provides different solutions (decisions) based on consistency and frequency thresholds. In addition, fuzzy technique does not either show estimates of each hypothesized relationship through the net effects, but covers the influence of other variables, leading to various combinations of conditions.

The aim of this study is to construct the assessment of the expected audit risk by the audit team leader (ATL) during the planification phase of the audit. To do so, the use of fsQCA has powerful potential into the audit arena, as the audit risk assessment is critically related to auditors’ judgement and perception. We argue that ATL characteristics are core conditions in determining the audit risk assessment when planning.

This research has been made with data coming from a Spanish sample. Spain is classified as a code law country [11], unlike Anglo-Saxon countries such as USA or UK (common law) where the accounting and auditing culture is more developed by tradition and where private professional bodies played an important role in the organization of the audit profession from the beginning [12]. Differently, in Spain the main organisms in this sense are public. The Spanish environment is characterized by weak investor protection and low risk of litigation, where the fundamental stakeholders are families, banks, and industrial companies [13,14]. The banking sector dominates over the capital market, as a result, agency problems may arise. The average cost of debt of Spanish SMEs is 22%, compared to the 7% of the Eurozone as a whole [15]. According to Kim et al. [16], audits may contribute to reducing information asymmetries, and thus the cost of financing, so it may generate incentives to financial entities to preserve their dominance. In this context, no market-based institutional incentives exist (i.e., litigation costs, reputation loss, etc.) and auditor decisions may be influenced by managers and other parties. Despite the existence of great efforts to empower audit legislation and construct cohesive professional audit infrastructure aiming at solving these questions, pressures on the audit risk assessment by ATLs when planning can occur. In Spain, more than the 88% of Spanish audit firms are small- and medium-sized, shaping the real Spanish audit market behavior, unlike most of studies exploring the actions of the Big Four or second-tier audit firms. Audits of SME firms are likely to be conducted by a very small audit team. Presumably, complexity of audits should be lower (ISA 300), but coordination and audit team leader implication must be higher, so ATL characteristics (together with the pressure and progression within the audit firm) are supposed to directly affect audit risk assessment and audit team behavior. These reasons come to justify the relevance of the audit risk assessment (internal control, errors, and irregularities) in the Spanish scenario.

We use hand-collected and private data taken from legal applications declared by audit firms to the national public oversight board (ICAC), spanning 2001 to 2015. The sample consists of a balanced panel of 1338 Spanish firm-year observations. The audit risk assessment is set to be the outcome. Consistent with ISA 315, we use three outcomes: (i) the absence of internal control; (ii) the presence of expected errors; and (iii) the presence of expected irregularities. A complete set of contrasted conditions has been used to explain the focus outcomes. The analysis of necessity reveals that there is no exclusive necessary condition, but a comprehensive set of conditions must be given for perceived high audit risk when planning (expected bad internal control and expected errors and irregularities in the financial statements). More specifically, four conditions are the most significant drivers of the outcome, either for their higher consistency values or for the wider difference between their presence and absence: the presence of female ATLs, inexperienced ATLs, old-audited clients, and large board sizes. The sufficient analyses show that more than one possible configuration (i.e., combination of conditions) happens, and that causal asymmetry may occur. Regarding the absence of internal control, the results demonstrate that female and inexperienced ATLs planning the audit of firms with a high proportion of property, plants and equipment, high leverage ratios, less profitability and large board sizes are expected to have bad internal control. For the presence of expected errors, the likelihood of expecting error in the financial statements increases as perceived internal control worsens (same conditions are met), and also when the audit tenure is shorter. Lastly, for the presence of irregularities, conditions such as experience gain importance. Irregularities are intended errors, and experienced ATLs are capable of expecting or forecasting irregularities because of their widespread background and prior accumulated know-how.

The contribution of this work is threefold. First, we focus the research on the audit risk assessment by the audit team leaders (ATLs), who are the pivotal audit members in the planification phase, and thus in the subsequent test of controls and substantive audit procedures. Secondly, the use of fuzzy-set modelling allows us to deal with the fuzziness when assessing audit risk. In addition, primary objective data connected to internal control and the probability to uncover errors or irregularities have been used. As far as we know, this is the first study doing so. One may find the application of fuzzy theory fundamentals to auditing so as to explain the formation of an effective quality audit team [17], to construct and check the effectiveness and efficiency of an artificial intelligence audit tool compared to human auditors [18], to design a more precise audit detection risk assessment system [10], to gain additional insights into the relationship between firm characteristics and audit fees [19], or to propose a client acceptance method in order to improve audit firms’ risk management [20], among others. However, no one refers to the ambiguity or vagueness when assessing audit risk in the planification regarding internal control and the expectation to find errors and/or irregularities. Last, but not least, this study is responsive to the call from regulators to consider audit team attributes, in particular, ATL characteristics, as important factors that affect audit quality practices [21], which is directly influenced by the audit risk assessment when planning.

The remainder of the paper is structured as follows. Section 2 outline the basics of fuzzy-set qualitative comparative analysis aiming at showing its potentiality in the auditing arena. In Section 3, a prior study about ATL designation and their audit risk assessment of the client in the planification stage is re-visited. We briefly describe the role of ATLs of SMEs audit firms on the audit risk assessment and also explain the selection of the outcome and conditions. Sample and descriptive statistics state in Section 4. Section 5 shows the empirical fuzzy-set results, and finally Section 6 concludes, with a brief discussion on the treated topic and some limitations are exposed.

2. Fuzzy-Set Qualitative Comparative Analysis (fsQCA)

2.1. Fuzzy Set Basics

The fuzzy set theory seeks to solve fuzzy data in realistic context. It means a set signifying conditions with specific and apparently clear properties but imprecise boundaries. We may mathematically articulate the fuzzy set as follows:

The universal set or universe of discourse is called “U”; a set “A” is any well-defined collection of objects; an object in a set is called “a_i”, which represents an element or member of that set. Sets are defined by simple statements and the fact whether a particular object having a certain property belongs to a particular set may be described as A = {a₁, a₂, a₃, …, a_n}. If the elements “a_i” (i = 1, 2, 3, …, n) of a set “A” are subset of universal set “U”, then set “A” may be mapped for all members x ϵ X by its characteristic function μ_A (x) = 1 if x ϵ X, 0 otherwise (note that the fuzzy subset A on U means that for any X ϵ U, there is a real number) However, fuzzy logic consists of many degrees of membership [0, 1], and all are allowed. In this sense, when the universe of number of A is {0,1}, then the membership function of A becomes μ_à (x): A → [0, 1] to x ϵ U, where the maximum degree of membership is the top heigh of the fuzzy set (equals to 1) and the minimum degree of membership is the bottom heigh of the fuzzy set (equals to 0). Note that à is one fuzzy subset on U and μ_à (x) ϵ [0, 1] is one number for each x ϵ U to show membership degree of x for Ã, which is the membership degree of U.

2.2. Key Points to Keep in Mind

Firstly, it is required to define all elements that will constitute the pathway of the fuzzy logic. To that end,

Table 1. Symmetric vs. asymmetric concepts.

Symmetric Concepts	Asymmetric Concepts	Explanation
Dependent variable	Outcome	Consequence or variable of interest. The researcher may decide to either compute the presence (full membership) or the absence or negation (full non-membership) of the outcome.
Independent variable	Condition	Variable, element, object, factor, cause, or predictor that is supposed to drive the outcome. Configuration refers to a combination of conditions to obtain the outcome.
Measurement	Calibration	Re-express data to values between 0 and 1 (where 0 denotes full non-membership and 1 full membership).
Net effects	Causal recipes, solutions	Variables that are traditionally considered as control variables may be part of the solutions and be combined to explain the outcome. There are three types of solution sets: ▪ Complex: represents all the possible combinations of conditions, but its interpretation becomes rather difficult and often impractical. The number of configurations is usually large, whose interpretation becomes difficult and impractical for the researcher. ▪ Parsimonious: simplified version of the complex solution, based on simplified assumptions. It presents the most relevant conditions (core conditions) which cannot be left out from any solution. ▪ Intermediate: the result when performing counterfactual analysis on the complex and parsimonious solutions. It should be consistent with the theoretical and empirical knowledge, and by default, the presence or absence (negation) of the variables is computed. While core conditions appear in both parsimonious and intermediate solutions, peripheral conditions only appear in the intermediate solution, which enhances the complexity in favor of increased consistency.
Correlation matrix	Truth table	It computes all possible combinations of conditions that may happen, providing 2k rows, where k represents the number of outcome predictors and each row every possible configuration
Coefficient of determination (R2)	Coverage	It represents to what extent the fact of belonging to an input group (recipe) drives the output (outcome). Hence, it indicates the empirical relevance of a solution (the higher the better). In other words, it displays how many cases with the outcome are represented by a particular causal condition.
Correlation	Consistency	It responds to what extent the hypothesis is coherent. That is, the degree to which configurations that share conditions lead to the same outcome. In order to decide which combinations to include in the final solution, we must pick a cut-off value for consistency scores, so rows with high consistency indicate combinations that almost always lead to the outcome.
N/A	Boolean signs	Fuzzy set operations. For instance, given X to be the universe set and à and Ë to be fuzzy sets with μÃ(x) and μË(x) as their respective membership functions: ▪ Union: μÃ∪Ë (x) = max{μÃ(x), μË(x)} ▪ Intersection: μÃ∩Ë (x) = min{μÃ(x), μË(x)} ▪ Complement: μÃ(x) = 1 − μÃ(x)

Note: symmetric concepts are just tabulated for informational and comparative purpose. The explanation alludes to asymmetric concepts.

is presented, following Valaei et al. [22]. We display three columns: (i) symmetric concepts that are mostly used in regression terminology; (ii) asymmetric concepts that are most frequently used in fuzzy set nomenclature; and (iii) a brief explanation of such terms.

Secondly, apart from the previously defined concepts, for appropriate use of the fsQCA, some assumptions or application hypotheses must be taken into consideration [23]:

I.

Model specification [24]. A theoretical basis is imperative so as to demonstrate the causal impact of each condition on the outcome variable. Additionally, avoid non-contrasted supposition to improve artificially the results.

II.

Construct clarity [25]. The use of new definitions or metrics is not recommended to avoid an additional undue “forking point”. In addition, wherever possible, measure conditions directly and objectively with no subjectivity.

III.

Difficulty of interpreting fsQCA results. Results (outcomes) are hardly ever driven by a single condition (cause), but a combination of them. Different configurations of causes may trigger the same focus outcome, but it is not possible to extract all possible combinations. In other words, a causal combination is not usually 100% sufficient.

IV.

Parameter sensitivity [26]. When sample size is small (n < 50), set coverage and consistency thresholds should be higher. It is generally accepted that cut-off consistency values ranging 0.7 to 0.8 are good starting points to look at [27,28], but the higher the cut-off point (higher consistency), the lower the coverage will be (lower empirical importance of a solution). This is particularly challenging regarding large samples.

V.

Unfounded claiming. There are two main mistakes to avoid: (i) claiming that antecedents variables are necessary conditions when they do not, and (ii) claiming that the absence or negation of a condition means “non-importance”. First, running necessity analysis is fundamental to assert that antecedent variables (conditions) are effectively drivers of the outcome; second, the absence or negation of a condition is also important to the outcome.

The third aspect to bear in mind is the order and number of steps that are cardinal so as to run appropriately the fuzzy pathway. The indispensable stages are as follows:

Step 1—Substantial theoretical and empirical knowledge of the matter of interest. The state of art is essential to be controlled. Fuzzy logic is far away from mixing many ingredients (conditions) to cook a recipe (outcome), so “more” does not mean “better”. It is true that in qualitative analysis certain subjective bias can be introduced by researchers, but their own knowledge of the field of study also lead to a richer analysis and understanding of the data.

Step 2—Data calibration. Data treatment can be considered the most important step in fuzzy modelling. Unlike traditional approaches, data are transformed from ]−∞, +∞[ to [0, 1], that is, into degrees of membership in the target set, where 0 meaning full non-membership (absence/negation) and 1 full membership (presence). To avoid misunderstandings, researchers have to clearly define the cut-off points that will determine the degree of membership. Differently from crisp sets, whose variables may discretely take values of 0 or 1, conditions are usually calibrated through an n-value fuzzy set, specifying the values of an interval-scale variable that correspond to n-qualitative breakpoints [27]. For instance, a three-value fuzzy set is one of the most used direct log-odd transformation methods, where the 95th percentile (0.95) is the threshold for full membership, 5th percentile (0.05) is the full non-membership threshold, and the cross-over point (0.50) is the threshold for “ambiguous” or “do not care” cases.

Step 3—Necessity conditions. The analysis of necessity for the presence and the absence or negation of the outcome is prerequisite before proceeding with the scrutiny.

Step 4—Truth table. To undertake sufficiency analysis, we must generate the truth table that reveals which combinations of conditions or configurations are sufficient for the focal outcome to occur.

Step 5—Boolean algebra. Once the Truth table is generated, all configurations (2k rows) are not significant, so the number of cases and Boolean logic must be employed. Researcher must remove those low frequency settings and leave out redundant clauses to reduce the initial 2k configurations to simplified combinations. For this purpose, consistency and coverage must be defined.

Thus, having said the above, the theoretical an empirical framework of this study is to apply the fuzzy theory to construct the assessment of the expected audit risk by the audit team leader (ATL) during the planification stage of the audit work of their audited clients.

3. Re-Examining the Data of a Prior ATLs and Audit Risk Assessment Study

The goal of this study is not to provide a fully comprehensive and instructional guide about fuzzy-set Qualitative Comparative Analysis (fsQCA). One may find in the existing literature complete guides of fuzzy-set modelling on management (e.g., [29]), entrepreneurship (e.g., [23,30]), artificial intelligence, expert systems, control engineering, and multi-principle decision making and risk assessment [31,32,33] for the presence of ambiguity. Undoubtfully, the problem of imprecision also appears in accounting and auditing (e.g., [34]), where concepts such as materiality, fair value, reliability or risk assessment are not essentially two-dimensional but a scale of degrees. It is noticeable that it does not refer to the uncertainty of the occurrence or not occurrence of an event, but the lack of clarity in the assessment and judgements, which directly affects usefulness and predicting power of accounting information. Instead, we pursue to sketch out the method for those who are interested in employing this qualitative approach to their fields of study, especially in the auditing arena.

The word “fuzzy” means “vagueness” or “ambiguity”, and fuzziness occurs when the boundary of a piece of information in not clear-cut. Zadeh [35] proposed the fuzzy set theory, which is an extension of classical set theory where components have a degree of membership. Classical set theory establishes evident sharp (crisp or exact) boundaries with apparently no uncertainty associated (i.e., black–white, true–false, good–bad, etc.); contrarily, fuzzy set theory considers ambiguous boundaries (e.g., the gray color exists between black and white; describing human reasoning by true or false is frequently insufficient; audit risk evaluation is not only good or bad). Hence, running fsQCA facilitates to incorporate imprecise values to obtain non-symmetric relationships (necessary and sufficient conditions).

The fsQCA approach is based on complexity theory following the principles of conjunction, equifinality, and causal asymmetry. Conjunction refers to the notion that conditions interacts interdependently reveling combinations of sufficient conditions for the outcome. Equifinality denotes the existence of multiple equally effective combinations of conditions to reach the same high outcome score. Causal asymmetry indicates that conditions driving an outcome in one combination may be simultaneously unrelated or even oppositely related in another configuration linked with the same outcome [36].

The aim of this study is, therefore, to spotlight the potentiality that fsQCA have into the auditing arena, in particular, for the audit risk assessment by audit team leaders (ATLs) during the planification level. Next, we will use this powerful qualitative technique to re-visit data from earlier research that had used symmetric quantitative approaches. We select the investigation carried out by [37], who operated with multiple regression analysis, consistent with what is commonly performed in the risk aversion associated with female gender [38,39,40], female appointment decisions (e.g., [41]), and gender diversity in audit risk assessment and quality (e.g., [42,43]).

The audit risk assessment is highly based on audit personnel’s subjective judgements. Auditing is a process of collecting evidence to express and issue an audit opinion about on whether the financial statements are prepared, in all material aspects, in accordance with an applicable financial reporting framework (ISA 200). Such opinion is on whether the financial statements are presented fairly, in all material respects, or give a true and fair view in accordance with the framework (ISA 200). The general purpose is to reduce uncertainty and enhance the degree of confidence of intended users in the financial statements. To do so, the audit staff must evaluate and respond to risks caused by uncertainty in the information. The application of fuzzy theory is particularly meaningful, as audit risk assessment involves people’ thoughts, inferences, and perception [10], so fuzzy method retains a certain degree of fuzziness in such respect.

We selected the Porcuna-Enguix et al. [37] study for four main reasons. First, it represents the first work in analyzing audit team leader (ATL) attributes, while most studies look to audit partners. ATLs have a substantial role when issuing the audit report, since they have direct contact with the audit client and the potential risks compared to the signing audit partners. Second, the first work that explores the effect of the gender attribute of ATLs when appointed by the audit partner to an audit engagement, especially, in the audit risk assessment. Third, the Spanish context illustrates a peculiar but representative setting worldwide, in spite of limited related SME studies. Fourthly, using the same data as that earlier study allows us to both demonstrate whether or not fsQCA may report different results about alternative routes to audit risk assessments, and avoid subjectivity that would be linked to collecting a new sample.

In Porcuna-Enguix et al. [37], the audit risk assessment in the planification phase is measured in three ways as required by ISA 315. The evaluation of internal control (intcontrol) uses a Likert scale ranging discretely from 1 to 5, with 1 being bad internal control and 5 good internal control. The probability of expected errors (error) follows the same Likert-scale as intcontrol, with 1 being unlikely to uncover errors and 5 more likely. The probability of expected irregularity, with 1 being less likely to uncover irregularities and 5 more likely. Therefore, these are expected or perceived “audit risk assessment” in the planification stage, unlike the term “audit risk”. The study has several “interest” and “control” variables seeking to determine whether female ATLs are appointed to riskier clients and whether female ATLs are more likely to be conservative or prudent when assessing audit risk in the planification stage of the audit engagement.

Table 2. Ordered probit sample selection results for Audit Risk Assessment [37].

	EVAL_IC			PROB_ERROR			PROB_IRREG
	Coef.		(z-Stat)	Coef.		(z-Stat)	Coef.		(z-Stat)
INTERCEPT	−2.558		(−1.56)	−2.610	**	(−2.18)	−2.695		(−1.63)
GENDER	−0.742	***	(−3.33)	0.960	***	(4.08)	0.513	***	(3.42)
EXP	−0.124	***	(−4.08)	−0.001		(−0.05)	0.088	***	(2.79)
GENDER*EXP	0.098	***	(3.00)	0.049	**	(1.98)	−0.048		(−1.50)
SIZE	0.079		(1.64)	−0.030		(−0.78)	−0.093	**	(−2.19)
PPE	0.142	**	(2.19)	0.187	**	(2.39)	0.300	***	(5.75)
CATA	0.131		(0.69)	−0.029		(−0.14)	−0.457	**	(−2.45)
LEV	−0.814	***	(−2.69)	0.929	***	(2.94)	−0.172		(−0.51)
ROA	−0.042	*	(−1.67)	0.520	***	(3.98)	0.146	***	(5.46)
COMPULSORY	−0.412		(−1.40)	0.428		(1.39)	0.197		(0.92)
YAUDITED	−0.049	***	(−5.68)	0.026	***	(3.29)	0.031	***	(3.86)
NEW	0.040		(0.26)	−0.134		(−0.54)	−0.004		(−0.02)
BOD	−0.383	***	(−6.00)	0.243	***	(6.87)	0.394	***	(5.40)
N	1559			1559			1,559
Censored	811			811			811
Uncensored	748			748			748
White correction	Yes			Yes			Yes
Year dummies	Yes			Yes			Yes
Industry dummies	Yes			Yes			Yes
Log Pseudolikelihood	−1285.18			−1452.04			−1386.91
		Chi2	p-value		Chi2	p-value		Chi2	p-value
Wald test of indep. eqns.		11.090	0.001		16.630	0.000		11.680	0.001

***, **, and * indicate statistical significance at the 1%, 5%, and 10% level, respectively.

presents the results from the ordered probit sample selection model (regression equation). The variable of interest “GENDER” was previously estimated (selection equation), but untabulated, and was then incorporated into the regression equation. This symmetric procedure was chosen so as to control for existing endogeneity problems [44]. We found that riskier audited clients were assigned to female ATLs (untabulated results). From the regression equation, we observed that female ATLs are more likely to uncover deficiencies in the internal control of the client and are more likely to find expected errors and irregularities during the planification phase. In addition, further analysis, also untabulated, demonstrates a more indulgent or tolerant attitude of experienced female ATLs towards possible internal control weaknesses and to inform about irregularities, attitudes traditionally attributed to males. Note that auditing is male-conditioned environment, so there might exist an intrinsic motivation to enhance their job opportunities such as promotion or just to not jeopardize their surveillance in the audit firm.

In order to align the fsQCA with that Heckman modelling study, we considered including all the same antecedent variables used by Porcuna-Enguix et al. [37] as conditions in our configural model, with the exception of “SIZE”, “CATA” and “COMPULSORY” for two reasons: (i) SIZE (log of total assets) and CATA (current assets to total assets) were not statistically significant in all cases; and (ii) COMPULSORY was removed because the final balanced fuzzy set consists of firms that must be audited, as indicated in Spanish audit law. The three dependent variables of audit risk assessment represent the outcomes.

3.1. The Role of the Audit Team Leaders (ATLs) of Some Audit Firms on the Audit Risk Assessment

Audit work is labor-intensive, resulting in high staff costs [45]. Audit firms often adopt aggressive pricing strategies [46], which place pressure on audit engagement. As a result, efforts by audit teams to work with short deadlines and to lower costs may compromise audit quality [47], and undoubtedly this price–time–effort conflict influences audit team members’ behavior and thus audit practices. Of course, the audit partner possesses a high degree of autonomy to exert professional judgment [48], and this autonomy includes the possibility to alter audit prices (i.e., maximize audit fees) and planned hours (i.e., minimize audit effort). The audit partner also holds the decision of designating the audit team leaders [ATLs] [49], who are presumed to be the main character of the audit team appointed. When an audit partner agrees with the client to carry out an audit engagement, they must adjudicate which audit member is going to be responsible (audit team leader) for the audit team. This arrangement is not meaningless, as individual characteristics are vital for the planification and audit risk management [50]. Therefore, the determination of the ATL is significantly affected by audit evidence collected when planning the audit. In turn, audit evidence hinges on detection risk, among others.

The role of the ATL is critical as they must allocate resources efficiently to lower audit risk up to an acceptable level, according to the International Audit Standards (ISA). Even though the audit report is signed by the audit partner, the audit effort is mainly carried out by those who are not the partners, and ATLs are decisive to opt for and issue an opinion or other in the audit report [2,3]. The ATLs act as the pivotal character in an audit engagement. The ATLs duties are mainly associated with assigning functions to audit team members, evaluating risk management activities within the client, and ensuring compliance with established internal control procedures by examining records, operating practices, reports, documentation, etc.

Human resources are the most important asset for all audit firms, and a balance between the skills of audit members and the complexity of audit engagements is needed. The optimal point is to avoid under-auditing (not taking unnecessary risks) or over-auditing (keep costs at a competitive level). This time and economic effectiveness must be properly provided by the ATL [8], which depends on their professional judgement and prior accumulated experience. Their leadership must prevail, facilitating upward communication and knowledge sharing, while also promoting good group relationships within the audit team members to perform more effective and efficient audits [5,6].

To allocate resources, the audit team members have to gather information and the ATL must keep the audit risk at an acceptable level. The assessment of the audit risk in the planification phase by the ATL is critical. This really determines the confidence in the internal control of the client and the subsequent substantive audit procedures. For instance, after the initial evaluation of the audit risk when planning, if the ATL concludes that internal controls are more effective than they actually are and that a material misstatement in the financial statement assertions does not exist when in fact it does, it affects the audit effectiveness, leading to issuing an inappropriate audit opinion (under-auditing). Contrarily, if the ATL concludes that internal controls are less effective than they actually are and that material misstatements in the financial statements assertions exists when in fact it does not, it hurts the audit efficiency increasing audit costs (over-auditing). A deficient audit risk assessment boosts sampling risk, that is, the risk that the auditor’s conclusion based on a sample may be different from the conclusion if the entire population were subjected to the same audit procedure (ISA 530), inducing to the two already mentioned erroneous conclusions.

ISA 300 establishes information about “considerations specific to smaller entities”. The above explanation applies to all audit firms and audit engagement, nevertheless, small- and medium-sized audit firms are singular for their available resources. In an audit engagement, the entire audit may be conducted by a small audit team compared to others. With a smaller team, the role of the ATL is essential to favor coordination, communication, and member motivation. The audit is not so complex and time-consuming, but losing clients because of a deficient audit risk assessment is costly. The market share of small- and medium-sized audit firms is strikingly lower than that of the Big Four and second-tier audit firms. Small- and medium-sized audit firms usually have a lower diversified client portfolio, so if things go wrong, they spread through the market by word of mouth very easily and quickly. According to these discrepancies, we may appreciate two main differences between ATLs in SME audit firms from those in Big Four or second- tier audit firms: (i) pressure and (ii) progression. First, time pressure is considerably more notable for ATLs in SME audit firms. Being efficient is imperative and the opposite might be very costly. Dysfunctional auditing behaviors might be expected because of such pressures [51]. Consequently, evaluating those factors or combination of them affecting audit risk assessment by ATLs in SME audit firms is determinant as they are the most representative figure (in number) in the audit market, shaping market behavior. Secondly, Big Four and second-tier audit firms have many employees at different levels. For instance, n-degrees of entry-level employees (e.g., assistant auditors), n-degrees of senior level (e.g., auditor, senior auditor, lead auditor or audit team leader, etc.), a partner with their own degrees of advancement, and finally director or managing director level (top management positions). In case of SME audit firms, progression is shorter with fewer levels such as assistant, audit team leader, and partner. As seen, promotion in SME audit firms is not as long, slow, or tough as their larger mates. Why is this relevant? Investors perceive a lower quality of accounting information when the audited client’s management exerts influence on auditors (e.g., [52]), and auditor–client identification on audit client’s acquiescence to client-preferred treatment occurs in non-Big 4 firms [53]. Understanding the factors that might alter or modify audit risk assessment when planning is crucial as it determines the subsequent audit procedures. Moreover, client familiarity is desirable but may threaten auditor objectivity, and this is closely linked with the auditor position within the firm, affecting the audit quality practices.

Having exposed the above, we find contrasting results in the existing literature on this matter. Small- and medium-sized audit firms usually face the handicap of offering a lower quality audit in comparison to larger ones. There is a certain and questionable “bigness syndrome” because size indicates sufficient staff to carry out the audit engagement, which may ensure quality or independence [54,55] or higher prices when clients go public [56]. Other arguments reinforce the appointment of larger audit firms [57]: to reduce agency costs; to reduce information asymmetry; etc. However, less complexity (“the larger the more to lose” or “size matters” hypotheses) does not imply less attention or worse audit risk assessments. In fact, Lawrence et al. [58] show that the differences in proxies for audit quality between Big 4 and non-Big 4 auditors are more likely due to client characteristics. Boone et al. [59] explained that little evidence exists of a difference in audit quality between Big 4 and second-tier audit firms. Comprix and Huang [60] find no evidence that small audit firms are associated with real activity manipulation. Oppositely, Svanström [51] described, using a sample of Swedish small audit firms, a positive association between perceived time pressure (time budget pressure and time deadline pressure) and dysfunctional auditing behavior (e.g., superficial reviews of client documents, premature signing-off or accepting weak client explanations). Even though less audit complexity in small audit firms exists, time pressure is more marked as resources are more limited. Furthermore, Svanström [51] finds that training activities may reduce such dysfunctional audit behavior, nevertheless, small audit firms have limited opportunities to arrange such training activities with invited experts.

Therefore, we argue that ATLs of small- and medium-sized audit firms play a crucial role in assessing the audit risk in the planification phase. Furthermore, the ATL characteristics are core conditions to evaluate and determine management risks.

3.2. Outcome and Conditions

Based on a review of prior research, the aim of this study is to forecast the expected or perceived audit risk assessment by the ATL, especially by female ATLs. This outcome is supposed to depend on the presence or negation/absence of several conditions. Therefore, we expect several configurations to explain the same outcome as audit risk assessment involves skepticism and judgments by auditors. As established by reference number 4 of the ISA 315, “the objective of the auditor is to identify and assess the risks of material misstatements, whether due to fraud or error, at the financial statement and assertion levels, (…) including the entity’s internal control (…)”. In this sense, our main focus outcomes will be the assessment of internal control (intcontrol), the probability to expect errors (error) and the likelihood to expect irregularities (irreg) in the planification phase. Conditions, together with outcomes, are briefly described in

Table 3. Description of outcomes and conditions.

Variables	Label	Description
Outcomes
Expected internal control	intcontrol	Discrete evaluation of internal control ranging from 1 to 5, with 1 being bad internal control and 5 being good internal control
Expected error	error	Discrete probability of expected error ranging from 1 to 5, with 1 being unlikely and 5 being likely
Expected irregularity	irreg	Discrete probability of expected irregularity ranging from 1 to 5, with 1 being unlikely and 5 being likely
Conditions
Economic and financial features
Property, Plant and Equipment	ppe	Ratio property, plant and equipment to total assets
Leverage	lev	Leverage ratio
Return on Assets	roa	Return on assets
Audit team leader features
Gender	gender	It takes value 1 if the audit team leader is female and 0 if male
Experience	exp	Years of experience
Audit client features
Years audited	yaudited	Years that the client is being audited by the audit firm
New audit	new	It takes value 1 if the client is new and 0 otherwise
Board of Directors	bod	Personnel belonging to board of directors

, and explained in detail below.

The focus outcomes are three to enrich the analysis. As established in ISA 315, the internal control is the internal “process designed, implemented and maintained by those charged with governance, management and other personnel to provide reasonable assurance about the achievement of an entity’s objectives regarding reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations. The term “controls” refers to any aspects of one or more of the components of internal control”. Material misstatements due to errors or mistakes are supposed to be unintended, with no fraud, such as arithmetic errors, misinterpretations, inadvertences, or incorrect application of accounting principles and standards without intent to cause harm by act or omission. Unlike errors, irregularities relate to intended acts or omissions with fraud, such as record and document manipulation, falsification or alteration, misappropriation, and irregular use of assets, record fictitious operations, or the improper and intentional application of accounting principles and standards.

With respect to the economic and financial features of the audited client, the ratio property, plant and equipment to total assets (ppe), leverage ratio (lev), and return on assets (roa) have been selected. Capital assets are purchased (bought or constructed) to be used in a business and are often the largest accounting item on a balance sheet. Even though the value is usually high, the risk associated is often low or moderate. Overall, these assets are depreciated (accounting expense record) over their useful life and are presented in a balance sheet by the book value (cost minus accumulated depreciation). Though appreciation in market value is not allowed, decreases are booked known as impairments, which may be reversed if those circumstances that originated the impairment disappear. Property, plant and equipment walkthrough consists of looking for ways that this item might be overstated, though understatements may also occur. Concerns about who authorizes the purchase, reconciliations, consistent depreciation methods, adequate records, the existence of controls, segregation of duties, period physical inventories and custody, schedules upon sale, capitalization of repair expenses (not expensed), etc. are questions to look at (primary risks). The higher capital assets, the wider gap for discretion or managerial choice.

Information asymmetry and uncertainty about the use of funds (loans) by insiders, such as managers or shareholders, are problems that all creditors (debtholders) face when granting such loans. Insiders may take actions that contribute to their wellness at the expense of creditors (agency conflicts). Basically, once insiders obtain the financing, they may undertake riskier investments or underinvest (e.g., [61]). Riskier decisions sometimes threaten future repayments to creditors and renouncing positive net present value projects because they may benefit creditors. It is true that this opportunistic behavior may be limited through covenants in creditors’ debt contracts in terms of accounting numbers. However, again, restrictions may encourage managerial accounting choices such as income-increasing or -decreasing practices [62]. The higher the leverage, the greater the probability for discretion and the more need for reliable monitoring of accounting information.

Related to managerial accounting choices, those more profitable audited firms may have used discretion to achieve such strong economic positions. Profitability does not necessarily mean bad practices, however, high profitability may be the result of confusing accounting practices, and may increase the likelihood of uncovering material misstatements in the financial statements (unreliable accounting numbers) by independent auditors. Proving this behavior, Hardies et al. [42] found evidence that higher return-on-assets values increase the likelihood that an auditor issues a going concern opinion, as an indicator of audit quality.

Regarding audit team leader (ATL) features, we may distinguish two characteristics: gender and experience. The gender diversity on ATLs is not trivial. The ATL may be chosen by the audit firm or the audited client to meet operating and contracting environment [63]. Attitudes towards corporate social responsibility [64], preference to overlap audit quality to cost reduction [65], or riskier positions may precipitate female appointments’ decisions [41], because of their more prudent posture when assessing audit risk when planning. Moreover, women take more time to plan in an audit engagement, which directly influences the subsequent work execution [66]. Experience is another ATL attribute that affects audit work and the professional judgment of the ATL to assess audit risk. The experience (competence characteristic) of the audit personnel is listed as one of the main audit quality indicators [67,68]. Experience promotes general and industry expertise and enhances the ability of auditors to identify and assess audit risk. Professional background and experience make auditors stay alert and focused and make their clients feel higher audit quality which leads to audit premium. Experienced auditors are more accurate in interpreting, judging, and assessing information, so the audit risk assessment becomes more reasonable and targeted to carry out further audit procedures [69]. Therefore, the accumulation of this professional competence facilitates interpretation, judgment, problem-solving skills, the allocation of audit resources and the evaluation of audit risk, which is the cornerstone. Experimental studies such as Koch et al. [70], for example, demonstrate that experienced auditors are more likely to issue unqualified audit opinions, as a signal of either client internal control deficiencies and/or the existence of uncorrected material misstatements in the financial statements, due to fraud or error.

Associated to audit client features, we have chosen the number of years that the client is being audited by the audit firm (yaudited), whether the audit work for certain client is new (new) and the total board of directors (bod). The length of the audit–client relationship (audit tenure) is fully related to information and insurance roles and firm risk affects auditor behavior [71]. Nevertheless, the directional effect is still unanswered [72] because time might (not) threaten auditor independence. For instance, on the one hand, some argue that longer audit tenure erodes agency costs (less information asymmetry), which leads to better audit quality [54]. Shorter audit tenure denotes lack of adequate knowledge of the clients and the industry during the early years of the audit engagement [73] and widens the lag between hiring an auditor and the motivation to engage in earnings management by the client [74]. In this respect, Myers et al. [75] found that the use of discretionary accruals diminishes as audit tenure increases. In addition, changing auditors is costly and may influence audit quality because less effort may trigger less audit adjustments as a consequence of a weaker audit risk assessment. Meanwhile, others proclaim that longer audit tenures jeopardize objectivity and skepticism, which also influences audit quality. According to these different points of view, the Spanish audit law 22/2015 (which incorporated the Directive 2014/56/UE into the national law) tried to find the midpoint. Thereby, overall, the duration of an audit engagement may be no shorter than three years and no longer than nine years counting from the date on which the first year to be audited starts (Article 22.1, Audit law 22/2015). The explanation being new clients are in line with the precedent reasoning. Finally, despite considering small- and medium-sized firms, our sample consists of compulsory audit engagement, so differences between ownership and control should presumably be assumed. This is the so-called board size effect: communication and coordination problems rise as group size increases [76], which broadens management–board conflicts (agency problems).

4. Sample and Descriptive Statistics

The data to run the fuzzy analysis came from 24 small- and medium-sized audit firms, with the information taken from their legal application declared to the national public oversight board, that is, to the Spanish Accounting and Auditing Institute (ICAC) spanning 2001 to 2015. These audit firms were randomly chosen regarding their size and areas of activity. Finally, the required information about the assessment of audit risk was sent by 13 audit firms, including their evaluation of internal control, error, and irregular probabilities of the client, and were assessed by the audit team leader during the planification phase.

Our hand-collected data values are original and no estimation process which would imply a high subjectivity charge has been employed in our sample. Our sample consists of a balanced panel of 1338 firm-year observations.

Untabulated distribution by economic sector shows that service is the most audited industry, followed by construction, manufacturing, agriculture and supplies. In addition, an untabulated correlation matrix does not suggest any multicollinearity problem associated with quantitative variables.

Table 4. Balanced sample descriptive statistics and calibration parameters for fsQCA.

Variable	N	Mean	s.d.	Min.	Median	Max.	Full In (95%)	Max’m Ambig. (50%)	Full Out (5%)
intcontrol	1338	3.556	1.362	1.000	3.000	5.000	5.000	3.000	1.000
error	1338	2.093	1.091	1.000	2.000	5.000	4.000	2.000	1.000
irreg	1338	2.050	1.110	1.000	2.000	5.000	4.000	2.000	1.000
gender	1338	0.646	0.478	0.000	1.000	1.000	1.000	1.000	0.000
exp	1338	9.609	4.802	0.000	9.609	25.000	19.000	9.609	3.000
ppe	1338	0.269	0.450	0.000	0.200	9.707	0.681	0.200	0.002
lev	1338	0.129	0.143	0.000	0.080	0.850	0.410	0.080	0.000
roa	1338	0.151	1.860	−1.880	0.020	58.550	0.150	0.020	−0.080
yaudited	1338	7.611	5.970	1.000	6.000	25.000	20.000	6.000	1.000
new	1338	0.122	0.327	0.000	0.000	1.000	1.000	0.000	0.000
bod	1338	3.256	2.496	1.000	2.000	12.000	12.000	2.000	1.000

displays the descriptive statistics of the original quantitative data and of the calibration cut-off points. As shown, we have used three qualitative breakpoints at 95%, 50% and 5%. It is important to say the dummy variables such as gender and new have not been calibrated for logical reasons. On the one side, the gender attribute of an audit team leader (ATL) will take value 1 if female and 0 if male, so “do not care” values do not exist; on the other hand, variable new will take 1 if first-time audit by the ATL for a specific client and 0 otherwise, so “ambiguity” values do not exist either.

5. Empirical Results

5.1. Necessary Analysis of Conditions for Audit Risk Assessment Outcomes

Table 5. Analysis of necessity for the absence of internal control and for the presence of expected errors and irregularities.

	Outcome:	~fs_intcontrol	Outcome:	fs_error	Outcome:	fs_irreg
Conditions Tested	Consistency	Coverage	Consistency	Coverage	Consistency	Coverage
gender	0.662917	0.381944	0.668419	0.465185	0.672636	0.450081
~gender	0.337084	0.354009	0.331583	0.420634	0.327368	0.399284
fs_exp	0.567980	0.468703	0.580491	0.578624	0.534463	0.512216
~fs_exp	0.757912	0.513483	0.705986	0.577750	0.683201	0.537560
fs_ppe	0.675169	0.542541	0.638614	0.619863	0.642138	0.599266
~fs_ppe	0.649335	0.449872	0.626441	0.524248	0.584106	0.469984
fs_lev	0.651747	0.548364	0.600049	0.609837	0.566567	0.553621
~fs_lev	0.656667	0.437981	0.661832	0.533205	0.660421	0.511566
fs_roa	0.728020	0.525049	0.702243	0.611758	0.658915	0.551895
~fs_roa	0.684792	0.526255	0.644054	0.597855	0.609810	0.544256
fs_yaudited	0.638448	0.516251	0.597671	0.583759	0.595263	0.559004
~fs_yaudited	0.696602	0.480041	0.673107	0.560291	0.629113	0.503492
new	0.118160	0.360859	0.131964	0.486810	0.121565	0.431166
~new	0.881840	0.373599	0.868036	0.444212	0.878437	0.432213
fs_bod	0.860242	0.608017	0.789237	0.673813	0.759116	0.623124
~fs_bod	0.700299	0.550116	0.639280	0.606594	0.568642	0.518776

Note: The symbol “~” indicates logical NOT which means the absence/negation of a condition or the absence/negation of the outcome. All variables are defined in Table 2. Those conditions that have been calibrated are preceded by the “fs_” prefix, so dummy conditions such as gender or new do not have it.

indicates the necessity conditions. As introduced in previous sections, the necessity analysis comes to explain whether necessary conditions exist. The consistency score has to be higher than 0.9 for a condition to be necessary [77]. To simplify the necessary analysis, we focus the research on the expectation of detecting audit risk in the planification phase. The objective of the auditor is to “identify and assess the risks of material misstatements, whether due to fraud or error, at the financial statement and assertion levels, (…) including the entity’s internal control (…)” (ISA 315, reference [4]). In this sense, the fact of uncovering risks prevails, that is, the existence of expected significant risks, if true, is more relevant than expecting insignificant risks. Therefore, we are interested in those necessary conditions to expect higher audit risk levels, that is, to expect bad internal control (~fs_intcontrol—absence of internal control), to be likely to expect errors (fs_error—presence of expected errors), and to be likely to expect irregularities (fs_irreg—presence of expected irregularities).

As shown in Table 5, there is no exclusive necessary condition, so audit risk assessment does not happen because of any one single condition. Therefore, a comprehensive set of conditions must be given for expected high audit risk (i.e., bad internal control, and expected errors and irregularities in the financial statements). More specifically, four conditions are the most significant drivers of the outcome, either for their higher consistency values or for the wider difference between their presence and absence to explain the expected audit risk in the planification phase. At a glance, we firstly observe that female ATLs (gender) are more demanding when evaluating audit risks; secondly, less experience (~fs_ppe) propitiates conservative attitudes reinforcing the detection of risks; thirdly, displaying the highest consistency value (87.61% in average), the attribute of being an old client (~new) clearly indicates a stricter audit risk assessment. According to our data, old clients (~new) are audited by inexperienced ATLs (less than 3 years) in the short term (less than 1 year), so their knowledge about their client is still scarce and they are more rigorous at work. Finally, in fourth place, a crowded board of directors (fs_bod) leads to a more meticulous audit risk assessment in the planification stage. Setting aside board composition, board size matters. Traditional literature emphasizes the board size effect: communication and coordination problems increase as group size boosts, thereby leading to potential agency problems [76,78,79]. In our sample, the board size exceeds 12 people (full membership) and, because all sample firms have to be audited compulsorily, conflicts of interests may easily arise stressing agency problems between management and control. This circumstance may encourage accounting discretion by managers and thus earning management practices (e.g., [79]) and also may decrease firm value [76,78]. In this scenario, some procedures of the internal control may fail, be adulterated, or even not exist, and/or the financial statements as a whole are not likely to be free from material misstatements, whether due to fraud or error.

5.2. Sufficiency Analyses for Audit Risk Assessment Outcomes

In this section, we will explore the causal relationships obtained in the different equally effective configurations. It is important to say that, in all three focus outcomes, there is more than one plausible combination, and that causal asymmetry may occur. The combinations leading to the absence of internal control and to the presence of expected errors and irregularities are presented in

Table 6. Configurations sufficient for the absence of internal control (Outcome: ~fs_intcontrol).

		Solution (Frequency Cutoff: 1; Consistency Cutoff: 0.801661)
Configuration		1	2	3	4	5	6	7	8	9
Economic and financial. features	fs_ppe				●	●	●	⊗		●
	fs_lev	●	●	●			●		●	⊗
	fs_roa		●		⊗	⊗	⊗	●	⊗	⊗
ATL features	gender	●	●	●	●	●		●	●	⊗
	fs_exp	⊗				⊗		⊗	●	⊗
Audit client features	fs_yaudited		⊗	⊗	⊗		●	●	⊗
	new	⊗		·	⊗	⊗	⊗	⊗	●	●
	fs_bod	●	●	●	●	·	●	●		·
Consistency		0.762	0.787	0.712	0.786	0.776	0.807	0.802	0.782	0.821
Raw Coverage		0.280	0.263	0.037	0.229	0.252	0.287	0.194	0.015	0.018
Unique Coverage		0.016	0.015	0.002	0.015	0.013	0.099	0.019	0.000	0.018
		Overall solution consistency:					0.747
		Overall solution coverage:					0.545

Note: Black circles (●) indicate the presence of a condition. Crossed-out circles (⨂) denote the absence or negation of a condition. Large circles are core conditions while small circles are peripheral conditions. “Do not care” conditions are displayed in blank spaces. All variables are defined in Table 2. Those conditions that have been calibrated are preceded by the “fs_” prefix, so dummy conditions such as gender or new do not have it.

,

Table 7. Configurations sufficient for the for the presence of errors (Outcome: fs_error).

		Solution (Frequency Cutoff: 1; Consistency Cutoff: 0.802642)
Configuration		1	2	3	4	5	6	7	8	9	10	11	12
Economic and financial. features	fs_ppe						·	●	●	●	·	⊗	●
	fs_lev			●	●	⊗	●	⊗	●	●	⊗	●
	fs_roa						⊗	⊗	⊗		·	·
ATL features	gender	●	●	●	●	⊗	●		●		●	●	●
	fs_exp		●		⊗	⊗	⊗			⊗	·	●
Audit client features	fs_yaudited		⊗	⊗	⊗	⊗		⊗	⊗	●	⊗	⊗	⊗
	new	⊗			⊗	●	⊗	●	·	⊗	⊗	●
	fs_bod	●	●	●		●		●		·			·
Consistency		0.711	0.796	0.828	0.766	0.766	0.803	0.841	0.786	0.828	0.817	0.840	0.809
Raw Coverage		0.473	0.262	0.272	0.208	0.031	0.190	0.036	0.018	0.271	0.149	0.016	0.277
Unique Coverage		0.126	0.002	0.007	0.009	0.015	0.003	0.001	0.000	0.089	0.002	0.000	0.001
		Overall solution consistency:					0.700
		Overall solution coverage:					0.662

Note: Black circles (●) indicate the presence of a condition. Crossed-out circles (⨂) denote the absence or negation of a condition. Large circles are core conditions while small circles are peripheral conditions. “Do not care” conditions are displayed in blank spaces. All variables are defined in Table 2. Those conditions that have been calibrated are preceded by the “fs_” prefix, so dummy conditions such as gender or new do not have it.

and

Table 8. Configurations sufficient for the presence of irregularities (Outcome: fs_irreg).

		Solution (Frequency Cutoff: 1; Consistency Cutoff: 0.801226)
Configuration		1	2	3	4	5	6
Economic and financial. features	fs_ppe	●	●	●		⊗	●
	fs_lev	⊗		⊗	●	⊗	⊗
	fs_roa				●	●	⊗
ATL features	gender	●	●	●	·	●	●
	fs_exp	●	●	⊗	●	●
Audit client features	fs_yaudited	⊗	⊗	●	⊗	●	⊗
	new		●	⊗	●	⊗	⊗
	fs_bod	●	●	·	●	●	·
Consistency		0.815	0.827	0.802	0.828	0.804	0.822
Raw Coverage		0.182	0.027	0.191	0.019	0.159	0.172
Unique Coverage		0.011	0.001	0.042	0.004	0.039	0.012
		Overall solution consistency:		0.789
		Overall solution coverage:		0.316

Note: Black circles (●) indicate the presence of a condition. Crossed-out circles (⨂) denote the absence or negation of a condition. Large circles are core conditions while small circles are peripheral conditions. “Do not care” conditions are displayed in blank spaces. All variables are defined in Table 2. Those conditions that have been calibrated are preceded by the “fs_” prefix, so dummy conditions such as gender or new do not have it.

, respectively. In order to improve the presentation and readability of the findings, we transformed the solutions from fsQCA output into tables that are easy to interpret. Following Fiss [80], the presence of a condition is indicated with a black circle (●), absence/negation with a crossed-out circle (⨂), and the “do not care” condition with a blank space. The distinction between core and peripheral is made by using large and small circles, respectively. Of course, overall consistency and coverage values will be also presented.

Table 6 presents the configurations for the absence of internal control, that is, what might determine that the audit team leader (ATL) expected to uncover internal control deficiencies within the firm. Holding a high capital assets proportion is core condition in four out of nine configurations (44%), which is a sign of managerial choices. Indebted clients denote high probability of expecting bad internal control in five out of nine cases (56%). In the 56% of cases too, less profitable firms are perceived to have internal control shortcomings. We expected the opposite result, but there might be an explanation. Less profitability might be what triggers income-increasing practices by managers. Female ATLs are confirmed to be a clear sufficient condition in 78% of combinations. When planning, women are more conservative and have more prudent behavior. They dedicate more effort in the planification phase to detect anomalies in internal control mechanisms, so they are more likely to uncover deficiencies. In four out of nine cases, the absence of experience is determinant. We expected its presence, but its absence means that ATLs will be more demanding when they are inexperienced auditors. Similarly, ATLs are more skeptic with shorter audit tenures, so they will be more objective. The new condition seems to be more affected by causal asymmetry than the others, because the results are not decisive. Finally, as with gender, the probability of expecting bad internal control increases as board size increases in 89% of cases (in six out of nine cases is a core condition), denoting agency problems as a result of the coexistence of various interests. In short, when female and inexperienced ATLs audit firms with high proportions of capital assets, high leverage ratios, less profitability and large board sizes, they expect bad internal control in the planification stage.

Table 7 presents the configurations for the presence of expecting errors in the financial statements. Beyond explaining again all the conditions individually, it is more fruitful to conclude to have a broad view of detecting errors in the annual accounts when planning. Gathering information stemming from the twelve configurations, overall we may assert that the likelihood of expecting error in the financial statements increases as perceived internal control worsens (same conditions are met), and when the audit tenure is shorter (distinctive condition compared to Table 6). Table 8 indicates the combinations of conditions for the presence of expected irregularities. Unlike errors, irregularities are intentionally made. For this reason, conditions such as experience (fs_exp) gain importance. Experienced ATLs are capable of expecting or forecasting irregularities because of their widespread background and prior know-how.

6. Conclusions, Discussion and Limitations

Auditing is a collective process conducted by professional accounting individuals whose skills, experiences, and emotions differ. The goal of an audit is to reduce uncertainty in the information and improve the degree of confidence of intended users in financial statements. Thereby, auditors aim to identify and assess risks of material misstatements at the financial statements’ assertions, including the internal control of the client. To do so, it is fundamental an appropriate planning of the audit, which includes the audit team leader (ATL) appointment, an audit risk assessment, the subsequent nature, timing and extent of further audit procedures and the consideration of those factors, in the auditor’s professional judgement, are significant in directing the engagement team’s efforts.

The audit risk assessment is critical. Audits must follow a risk-based approach due to the impossibility to check all transactions within the client. A correct audit risk assessment lowers the audit risk to an acceptable level and avoids incurring two types of erroneous conclusions as a consequence of under-audits (issuing an inappropriate opinion) or over-audits (costly inefficient effort). There is no doubt that lower-level audit team members gather most audit evidence, however, the ATL plays a crucial role from the planification stage until the audit report, with the audit opinion issued and signed by the audit partner, and are decisive for an effective and efficient audits. The audit risk assessment is mainly carried out by the ATL, and this evaluation is highly based on subjective judgements. The ATL must assess internal control and the expected and perceived existence of errors (unintended misstatements) and irregularities (intended misstatements) in the financial statements’ assertions. Thereby, ATLs determine if a risk in an accounting area or transaction is classified as a key risk, material risk, or insignificant risk. This “ambiguity” or “fuzziness” in determining the risk level makes the application of fuzzy theory particularly meaningful, as audit risk assessment involves people’ though, inference and perception, and thus retaining certain degree of such fuzziness. Therefore, this study extends our understanding of the role of ATL characteristics on the audit risk assessment when planning. Furthermore, smaller audit firms have attracted limited attention both in practice and in academic research since PCAOB inspections were implemented and reinforced at international level. This paper adds knowledge in this respect, raising awareness that the study of SME audit firms is essential and concerns the whole market. Even though the audit market is often dominated by Big 4 and second-tier audit firms, small- and medium-sized audit firms shape the market behavior.

Using hand-collected and private data taken from legal applications declared by audit firms to the national public oversight board (ICAC), spanning 2001 to 2015, the results from the fuzzy-set modelling are substantial. The analysis of necessity reveals that there is no exclusive necessary condition. This evidences the fact that SME audit firms conduct more complex audits than we initially believed. Concretely, four conditions are the most significant drivers of the outcome (expected bad internal control and expected errors and irregularities in the financial statements): the presence of female ATLs, inexperienced ATLs, old audit clients, and large board size. This supports previous evidence on that audit risk assessment (or related audit quality practices) are not only influenced by auditor’ features, but also by client characteristics. The sufficient analyses show the existence of more than one possible configuration, and that causal asymmetry happens. With respect to the absence of internal control (the ATL expects to find deficiencies in the internal control of the client when planning), the results indicate that female and inexperienced ATLs planning the audit indebted firms with high proportions of capital assets, less profits, and with large board sizes as being expected to have bad internal control. Women are more demanding and prefer quality to reduce costs; in addition, the lack of experience makes them be more prudent and conservative when assessing the audit risk. In the case of firm characteristics, the presence of high levels of leverage and larger board size denote the presence of high agency costs and more conflicts of interests as the number of parties increases, which incentivizes bad practice. For the presence of errors in the financial statements’ assertions, the same conditions are met, and also in shorter audit tenures. The lack of prior knowledge of the client triggers more demanding conducts and more checks in detail. Finally, but not least, conditions such as the ATL’s experience gains importance to expect irregularities. Irregularities are intended errors, and experienced ATLs are capable of forecasting irregularities because of their widespread and accumulated background. Sometimes manager discretion is difficult to guess, so experienced ATLs are more alert for discretionary practices that are not adequately revealed in the financial statements.

From a managerial point of view, the literature has demonstrated that the client’s management may exert influence on auditors, which is more relevant in countries where no market-based institutional incentives exist, such as the Spanish context. Additionally, the audit risk assessment implies that the auditor must inquire with management, among other parties. These arguments, which are more pronounced in SME audit firms, come to confirm the existence of managerial pressures on auditors and thus on their assessment of the audit risk in the initial stage of the audit work, which will determine the subsequent audit procedures and the allocation of available resources. Our results evidence that ATL characteristics, such as gender, are core conditions to evaluate and determine management risks.

When interpreting the results, some limitations must be considered. First, fuzzy theory establishes combinations of conditions that, in the judgement of the researcher, have high values of consistency and coverage but, however, causal asymmetries may happen. Second, despite the sensitive nature of our data, the results may not be able to be generalized to audit practices outside Spain, as potential differences and consensus in audit work environments exist across countries. Future research on ATL characteristics, designation, and audit risk assessment should consider endogeneity problems, as the appointment of the ATL is not trivial, so the audit partner might indirectly influence the audit risk assessment from the beginning of the audit. As well, exploring various existing audit environments at international and size levels would show us cultural differences and size behaviors between larger and smaller audit firms.