Internal Audit: Is the ‘Third Line of Defense’ Effective as a Form of Governance? An Exploratory Study of the Impression Management Techniques Chief Audit Executives Use in Their Annual Accountability to the Audit Committee

Abstract

Our exploratory study considers whether the internal audit function is an efficient “third line of defense” for risk management and control as proposed by The Institute of Internal Auditors. To that end, we interview chief audit executives (CAEs) and experienced internal auditors to examine whether (and how) CAEs manage the impressions of audit committee members in the annual accountability process. We also provide an illustration of impression management techniques through a documentary case that explores a unique and exclusive dataset consisting of the main guidance, framework, and accountability documents of one of these organizations. Our analysis highlights how several macro- and microimpression management techniques were used to burnish the image of internal auditors and, more importantly, the management team. Rather than monitoring managers, the CAEs team up with them. Our findings cast doubts on the conceptualization of internal audit as the independent third line of defense envisioned to be a keystone of the governance mosaic. This study supports other research that questions the effectiveness of internal auditing as a governance mechanism. It also contributes to the impression management literature by exposing impression management practices that occur through a private reporting channel—the internal audit function’s annual accountability to the audit committee. Last but not least, significant ethical concerns are raised in regard to internal audit, and research is urged in that area.