An Equilibrium Without Collusion: Observability, Strategic Inattention, and the Recurrence of IT-Related Control Deficiencies

Abstract

Recurring control deficiencies are conventionally traced to one of two sources: active collusion among the parties, or the principal–agent conflict between auditor and client. This paper argues for a third. It develops a three-player model—core auditor, IT specialist, and audited entity—in which recurring IT-related deficiencies arise as an equilibrium without collusion: no party deviates, no side payment changes hands, yet deficiencies persist. The mechanism is a single structural parameter, the observability $\lambda$ of the specialist’s work to the core auditor, which scales both the reward for recognized expertise and the penalty for an attributable miss. When $\lambda$ is low, the specialist rationally withholds effort, detection falls below the level that would discipline the client’s control choice, and weak controls become self-sustaining. The paper then endogenizes $\lambda$ as the core auditor’s own choice and shows that declining to understand the specialist’s work can be the auditor’s best response—a pattern the paper terms strategic inattention—because greater observability concentrates otherwise-diffused blame onto the auditor. One implication cuts against a common regulatory intuition: stiffening the individual penalty on auditors need not raise observability and can lower it, deepening inattention, whereas making specialist work legible and rewarding recognized contribution are the levers that bite. The source of audit failure is thereby relocated from misaligned incentives to the structure of responsibility within the audit team itself.