Internal control through the lens of institutional work: a systematic literature review

Oliver Henk

doi:10.1007/s00187-020-00301-4

Abstract

Despite the growing interest in research on the topic of internal control, there is confusion about the concept in both theory and practice. This study addresses this lack of clarity by systematically structuring the literature that uses the concept by investigating what we know from previous studies about the practice of internal control and how it is institutionalized. To examine the existing literature in this field, the paper utilizes the theoretical lens of ‘institutional work’. The review finds that the understanding of internal control is currently divided: one part of the literature understands the concept as internal control over financial reporting, while the other part has a more global and strategic understanding of the term. Internal control is institutionalized by different organizational actors at the micro level in an attempt to implement internal control systems that are not a simple act of compliance but present an added value for the organization. At the same time, it is noteworthy that not all categories of institutional work could be identified in the internal control literature, indicating that the actors are largely limited by their institutional embeddedness. The paper also presents an aggregated understanding of the term internal control, which can therefore significantly supplement the efforts of practitioners and regulators to implement internal control procedures that add value for the corporate governance of organizations.

Highlights

Research on internal control is increasing and has focused on many different aspects of the subject, such as the design and implementation of internal controls (e.g. Dikan et al 2014; Bogdan 2014), the determinants (e.g. Jokipii 2010), as well as the effect that internal controls have on organizations (e.g. Lee et al 2016; Brown and Lim 2012)
One of the problems for researchers and practitioners relates to the fact that the understanding of the term internal control that is institutionalized through legal requirements such as the Sarbanes–Oxley Act (SOX) of 2002 in the USA and the 2015 Audit Directive in the EU is substantially different from other official guidelines and frameworks that define internal control in a more holistic way (e.g., COSO, or the Three Lines of Defense Model)
It was my goal to find out how internal control might be defined in terms of how it is used in practice

Summary

Introduction

Research on internal control is increasing and has focused on many different aspects of the subject, such as the design and implementation of internal controls (e.g. Dikan et al 2014; Bogdan 2014), the determinants (e.g. Jokipii 2010), as well as the effect that internal controls (or the lack of) have on organizations (e.g. Lee et al 2016; Brown and Lim 2012). Jokipii 2010), as well as the effect that internal controls (or the lack of) have on organizations The purpose of this study is to provide a systematic literature review that investigates the different streams and meanings of internal control in the research. This review goes beyond other systematic reviews in the field by employing a theoretical framework that enables a content analysis of what internal control means in practice. While management control aims at steering organizations through the organizational environment toward the achievement of both short-term and long-term goals (Otley and Soin 2014), internal control contributes to this process by providing reasonable assurance regarding the effectiveness and efficiency of operations, reliable financial reporting, and compliance with laws, regulations and policies (COSO 2013). One of the problems for researchers and practitioners relates to the fact that the understanding of the term internal control that is institutionalized through legal requirements such as the Sarbanes–Oxley Act (SOX) of 2002 in the USA and the 2015 Audit Directive in the EU is substantially different from other official guidelines and frameworks that define internal control in a more holistic way (e.g., COSO, or the Three Lines of Defense Model)

Objectives

Methods

Results

Conclusion