Chief Audit Executives Research Articles

A Framework for Evaluating Corporate Governance: Insights from Chief Audit Executives

A Framework for Evaluating Corporate Governance: Insights from Chief Audit Executives

Chief Audit Executive as Supervisory Board Member and Executive Compensation Contracts

This paper studies a unique phenomenon in China's corporate governance—that chief audit executives (CAEs) sit on supervisory boards (CAE duality)—and examines its effects on executive compensation contracts. Using a sample of listed firms between 2010 and 2018, we find a significant positive relation between CAE duality and pay‐for‐performance sensitivity, which suggests that the dual position helps integrate monitoring resources and reduces agency costs. This positive relation is more pronounced when companies face a stricter monitoring environment and in non‐state‐owned enterprises (non‐SOEs) than in SOEs. In addition, we find that the recent reforms on compensation strengthen the role of CAE duality in SOEs. Further analysis identifies the reliability of performance information (i.e., earnings quality) and reduced executive self‐interested behaviours (i.e., perquisite consumption) as the influencing mechanisms that increase the demand for performance‐based compensation and thus improve pay‐for‐performance sensitivity.

The Impact of Chief Audit Executive’s Leadership Style and Senior Management Support for Internal Audit Function on Corporate Governance Effectiveness with the Moderating Effect of Audit Committee Characteristics: Evidence from Yemen

The objective of this paper is to determine the relationship between the Chief Audit Executive's (CAE) leadership style and senior management support for the internal audit function (IAF) as determinants of IAF quality and corporate governance (CG) effectiveness in Yemeni commercial banks. This article also investigates the extent to which the characteristics of the audit committee (AC) influence the link between CAE leadership style, support senior management for IAF, and CG effectiveness. The data was acquired using questionnaires delivered to respondents in Yemeni commercial banks, of which 158 valid questionnaires were obtained for analysis. Smart PLS 3 was used to analyse the data and test the hypotheses. The PROCESS macro approach was also utilised to evaluate the influence of AC characteristics on the association between CAE leadership style, senior management support for IAF, and CG effectiveness. An affirmative substantial correlation was found between CAE leadership style and senior management support for IAF, and CG effectiveness. Furthermore, the study found that AC characteristics favourably influence the association between CAE leadership style and CG effectiveness. However, AC characteristics do not alter the association between senior management support for the IAF and CG effectiveness. The findings improve the IAF's quality of determinants to enhance CG in developing countries, such as Yemen.

Barriers to effective corporate governance principles in state-owned enterprises in Zimbabwe

The purpose of this article is to discuss the barriers to effective corporate governance principles in state-owned enterprises (SOEs) in Zimbabwe in order to have an influence on policy debates. This study used a qualitative research approach, and a case study research design was followed, in order to attain the objective of the research. Semi-structured interviews were carried to get the views of the respondents on barriers to effective corporate governance principles in SOEs in Zimbabwe. Respondents chosen were members of the audit committees (ACs), permanent secretaries (PSs), chief executive officers (CEOs), senior managers (SMs), board of directors (BoDs) and chief audit executives (CAEs). Respondents were chosen due to their ability to act on the study’s findings and recommendations. Data was analysed using Atlas.ti version 8. The study revealed that there are cases of poor and mis-governance in SOEs in Zimbabwe. Egregious cases include non-adherence to corporate governance rules and laws, degenerating against the Public Finance Management Act, [Chapter 22:19] as well as paying ignore in the submission of the financial statements which are audited. The article therefore, recommends that for an emerging country like Zimbabwe to enjoy the advantages of effective corporate governance principles, reviewing the legislations which are currently there as well as strengthening the enforcement strategies of the regulatory institutions is of paramount importance. The findings are limited to a Zimbabwean case study alone. Be that as it may, great lessons can be drawn for other developing economies from the case study. Apart from classifying cases of poor or mal-governance in SOEs in Zimbabwe, the article gives recommendations for policy in-order to improve corporate governance in SOEs in Zimbabwe. There is a dearth of study on barriers to effective corporate governance principles in SOEs in Zimbabwe; therefore, there is a gap in the literature. Hence, the paper makes an original contribution to the literature. Finally, the paper advocates fruitful avenues for future research on the future of corporate governance.

Internal audit quality and resistance to pressure

PurposeThe work of internal auditors is relevant to their host entities' reporting processes; however, few researchers have examined how internal auditors’ competency and objectivity affect their resistance to pressure from host entities regarding their reports. Thus, the main objective of this study is to examine the influence of internal audit functions' (IAF) quality factors on chief audit executives' (CAEs) ability not to modify internal audit report.Design/methodology/approachThis study uses data from the Global Internal Audit Common Body of Knowledge to investigate the relationship between IAF quality and auditor resistance to pressure related to changes in internal audit reports. IAF quality is calculated using a composite measure comprising four IAF quality components. Auditors' resistance is measured using the extent to which internal auditors experienced a situation wherein they were directed to modify a valid audit finding in a report.FindingsThe analyses provide evidence that CAEs experience, certification, training and objectivity were all significantly associated with resistance to pressure. In other words, a greater quality of IAF leads to a greater ability to resist pressure to change their reports.Research limitations/implicationsDespite the statistically significant results that confirm the impact of IAF competence and objectivity on the resistance of CAEs to pressure, some other factors should be considered simultaneously in future research. In addition, the study sample contains 2,193 CAEs from different regions, environments, sectors and business areas. Focussing on a particular environment, sector or organisation size may generate different results.Practical implicationsThe following practical implications are proposed: First, internal audit regulators will find this study helpful in formulating strategies for creating balanced relationships between CAEs and other authorities and users. Second, CAEs can be encouraged to undergo constant training and complete professional development (as required by the Institute of Internal Auditors [IIA] standard). Finally, it would be interesting to apply this study to a particular environment, sector and size.Originality/valueThis study builds on the limited research that investigates the relationship between IAFs’ quality and the resistance of CAEs to pressure. It extends Calven’s (2021) study that investigates the impact of adherence to the IIA's Core Principles on the likelihood of IAFs modifying valid audit findings. This study examines the influence of IAF quality factors on CAEs' ability not to modify internal audit report.

Effectiveness of cybersecurity audit

The aim of this paper is to analyze the effectiveness of internal audit of cybersecurity. We developed a Cybersecurity Audit Index composed of three dimensions – planning, performing and reporting – to address this question. We hypothesize that cybersecurity audit effectiveness is positively related to cyber risk management maturity and negatively to the probability of a successful cyber attack. We tested our hypotheses in a survey with auditors and Chief Audit Executives from various countries and industries. We found that Cybersecurity Audit Index scores significantly vary, with a mean of 58 on a scale from 0 to 100. While the planning and performing phases are strongly and positively correlated, they are less strongly related to reporting about cyber risk management effectiveness to the Board of Directors. As predicted, the Cybersecurity Audit Index is positively associated with maturity, but contrary to expectations, it is not related to the probability of a successful cyber attack. This is the first paper that comprehensively measures the effectiveness of cybersecurity audit and its effects on cyber risk management.

Information Asymmetries and Intra-Company Monitoring: an Empirical Analysis of Nonlinear Relationships Between Company Characteristics and the Size of the Internal Audit Function

The internal audit function (IAF) has become one of the main pillars of good corporate governance. Empirical findings show that the size of the IAF varies considerably across companies. This study analyzes the relationships between selected company characteristics as determinants of intra-company information asymmetries and the size of the IAF as an indicator of intra-company monitoring. We test these relationships by analyzing comprehensive survey data obtained from chief audit executives from 283 Austrian, German, and Swiss companies. Using a nonparametric regression approach, we identify significant nonlinear relationships between company characteristics and IAF size. The empirical analysis identifies threshold levels for several metric company characteristics, such as the number of employees and the number of subsidiaries, whose relationships with the size of the IAF change its intensity.

Factors associated with the adoption of data analytics by internal audit function

PurposeThe benefits of data analytics in the internal audit function (IAF) are clear; less is known about IAF adoption of analytics. The purpose of this study is to examine the factors driving IAF adoption of analytics.Design/methodology/approachThe Common Body of Knowledge of Internal Auditing Database (IIA, 2015) provides auditor responses on key variables of analysis.FindingsThe results of this study indicate the most critical adoption factor is data-specific IT knowledge in the IAF. Critical thinking skills and business knowledge of chief audit executive (CAEs) also contribute to adoption. IAFs with fraud risk detection responsibly are more likely to adopt. IAFs in technologically advanced cultures are more likely to adopt analytics.Originality/valueThe results of this study document the critical factors driving adoption of audit analytics, benefitting both industry and research.

The role of stakeholders' perception in internal audit status: the case of Iran

PurposeThe purpose of this study is to explore the internal audit actors and stakeholders' perceptions of the IA status in Iranian companies, and those actors and stakeholders' roles in shaping the current situation of IA in Iran.Design/methodology/approachThis paper uses the interpretive qualitative method. Data comprises of semi-structured interviews with board of directors, audit committees, chief executive officers and chief audit executives. The paper analyzes internal audit policy documents, reports and legislations.FindingsThe results illustrate that the internal audit in Iran is perceived as a “perfunctory” practice among its stakeholders due to being recognized as an inefficient process. The key actors and stakeholders in internal audit process–including executive and board managers, audit committee members and chief audit executives–play important roles in shaping the current status of internal audit via their perceptions and actions.Practical implicationsThe fact that internal audit in Iran is perceived as an inefficient process and is used as a perfunctory practice highlights the importance of addressing this issue at the standardization and regulation level. The deficits in the roles of key actors and stakeholders need to be considered as the legislative guide in different levels.Originality/valuePrior studies mostly focus on the role of internal audit in organizations. In contrast, this study focuses on the role of key actors and stakeholders of internal auditing process in shaping the current perceived role of internal audit in organizations. Also, the study examines an emerging economy, which differs from advanced economies in important ways, including regulations, organizational culture, internal control structure and internal audit.

Fraud Reporting within an Organization and the Use of the Internal Audit Function as a Training Ground for Management

ABSTRACTThis study examines the effects of using the internal audit function as a management training ground (MTG) and fraud magnitude on internal fraud reporting decisions. Two experiments examine (1) internal auditors' reporting behaviors, and (2) other employees' willingness to report directly to internal audit. In the first experiment, experienced internal auditors indicate that the use of internal audit as a MTG may negatively impact fraud reporting likelihood by internal auditors to the Chief Audit Executive (CAE). Further, using the internal audit function as a MTG inhibits the sense of urgency internal auditors feel to report large fraudulent acts. The second experiment compares management accountants' preferences for reporting to an anonymous third-party hotline versus reporting directly to internal audit. The results indicate a preference for the hotline that increases with a MTG. This preference is fully mediated by the perceived trustworthiness of internal audit, which is negatively impacted by a MTG.Data Availability: Contact the authors.

Do Chief Audit Executives Matter? Evidence from Turnover Events

SUMMARYWe investigate the chief audit executive's (CAE) internal audit supervisory role by examining the change in internal audit monitoring effectiveness following the turnover of CAEs. Using a sample of firms listed on the small and medium enterprise board of China's stock exchange, we find that CAE turnover is accompanied by a reduction in financial reporting/internal control quality and that the reduction is more pronounced for firms whose successor CAEs have lower financial expertise than their predecessors. Further analysis shows that the negative association with financial reporting/internal control quality is stronger when the turnover is for personal reasons than when it is for internal transfer of the CAE. These findings are robust to a battery of sensitivity checks, including placebo tests and matching diagnostics. Our results highlight the importance of the CAE for a firm's internal audit functions.Data Availability: Data are available from the public sources cited in the text.JEL Classifications: G34; M42; M51.

Effects of digitalisation of organisations on internal audit activities and practices

PurposeThis paper aims to investigate how the internal audit function (IAF) modifies its activities and practices in relation to the digitalisation the organisation. This paper specifically examines the use of data analytics and the performance of consulting activities by internal auditors.Design/methodology/approachThis paper is based on a survey conducted with 82 chief audit executives based in the USA and members of the institute of internal auditors.FindingsResults indicate a positive relation between the organisation’s level of digitalisation and the use of data analytics by internal auditors during their missions. Results also indicate that the organisation’s level of digitalisation has an indirect effect on the proportion of the internal audit planning dedicated to consulting activities. Specifically, the use of data analytics mediates the relationship between the organisation’s level of digitalisation and the proportion of the internal audit planning dedicated to consulting activities.Research limitations/implicationsThis research was conducted amongst internal auditors based in the US Future research could investigate the insights of other internal audit stakeholders and investigate different legal contexts.Practical implicationsResults show that digitalisation increases the use of data analytics by internal auditors and the performance of consulting activities. The results, therefore, highlight the importance of these two aspects for the IAF to continue to bring value to organisations.Originality/valueThis research provides more insights on internal audit working practices. The digitalisation of the organisation leads the IAF to use more data analytics and perform more consulting activities.

BLOCKCHAIN AND INTERNAL CONTROL: THE COSO PERSPECTIVE: AN INTRODUCTION AND BRIEF REVIEW

As the title says this is an introduction and brief review of a long and rather complex study of issues related to internal controls over financial reporting (ICFR) and auditing the new distributed ledger technology known as Blockchain Ledgers. The report points out many of the control issues related to Blockchain Ledgers (BC), including potentially advantageous characteristics such as immutability and shared ledgers. It also addresses the new risks and needs for additional controls for which the search for solutions continues. Audit procedures have always followed technology advances, but they will never impede the innovation and related creative destruction that come with advancing business models. Much more work lies ahead, nevertheless, this COSO report is an excellent summary that will inform discussions about new control methods and methodologies. The COSO report has value for all readers including GRC professionals as well as C-suite and board members. However, the primary beneficiaries will be in tech support to the CFO and Chief Audit Executives, BC developers in company operations, and BC specialists in public accounting firms. This summary should inform all readers.

The impact of audit committee characteristics on internal audit professionalization: empirical evidence from Greece

PurposeThis paper aims to provide empirical evidence of the association between audit committee characteristics and internal audit quality through internal audit professionalization.Design/methodology/approachThe investigation of the research question was based on 45 usable responses that were received from a survey of chief audit executives from firms listed on the Athens Stock Exchange and combined with publicly available information from annual reports.FindingsThe results indicate that audit committee characteristics (independence, diligence through frequent meetings and interaction with internal audit through valuation) influence internal audit professionalization. In addition, they demonstrate that internal audit professionalization is also influenced by CEO duality and firm’s external auditor.Practical implicationsThe findings of this study have implications for audit committees wishing to improve their overall effectiveness, by identifying areas with substantial impact on internal audit quality. Moreover, regulators of corporate governance bodies can also benefit from the results to strengthen audit committee’s efficiency regarding internal audit function oversight.Originality/valueThe results add to the literature on the discussion of internal audit professionalization and complement the work of other researchers in the field of audit committee’s impact on internal audit quality/effectiveness. This study attempts to fill a gap in the literature on the effect of audit committee characteristics on internal audit professionalization, an element introduced from an institutional theory perspective.

Assessment of the Purpose of the Use of GAS

This article explores the purpose for which GAS, as a data analytics tool, is utilised by internal audit functions in Australia. A quantitative research method was applied, and the data was analysed using descriptive statistics. The total number of online questionnaires returned was 50 (i.e., a response rate of 15.53%) from the total research population of 322 chief audit executives of internal audit functions of organisations that are registered members with the IIA-Australia. The purpose of descriptive statistics is to describe what the data looks like and to compare variables numerically; therefore, no inferences or extrapolation of the data results were made. The results of the study can be used as a benchmark that may enable CAEs to identify whether they are staying abreast of current best practice in the area of technology-based tools and techniques for tests of controls.

COVID-19: Lessons learned and next steps for internal audit

This article describes the issues and challenges faced by chief audit executives (CAEs) in supporting their organisation during the COVID-19 pandemic. It describes the range of most urgent issues arising from the changes made by — and imposed upon — organisations, together with the various responses deployed by different CAEs in different sectors and at various stages of the pandemic. The insights provided are based on the experiences of clients of the Gartner Audit Leadership Council. The article concludes with some reflections on how CAEs can support organisational resilience.

Factors Influencing Internal Audit Fund Sufficiency

This study is motivated by the lack of internal audit (IA) fund research and examines the influence that the following elements have on IA fund sufficiency: IA quality factors (experience, certification and training), the independence and objectivity of Chief Audit Executives (rotation, reporting line and appointment), IA characteristics (IA department size and age), budget changes, and IA risk assessment activities. This study identifies 2,205 Chief Audit Executives and uses logistic regression to examine the impact of internal audit quality, independence, characteristics and activity on IA fund sufficiency. The results show that IA quality variables, independence and objectivity variables, IA size, age and budget changes all contribute to predicting fund sufficiency for the model IA department. The results also demonstrate that the risk assessment variable does not contribute to the model. The value of this study is that it provides empirical evidence regarding identifying factors that influence internal audit fund sufficiency. This study’s evidence has implications for policymakers and practitioners, as the actual issue of IA fund sufficiency has yet to be examined.

Internal Auditing’s Role in Preventing and Detecting Fraud: An Empirical Analysis

Internal auditing is a core function in detecting and preventing fraudulent activities. However, the orientation and role of internal auditing in dealing with fraud varies considerably in different companies. Against this background, this study examines the connection between internal au-diting and fraud and provides new insights into the as-is practice of internal auditing. Using 311 observations from Chief Audit Executives, we find that the corporate governance environ-ment significantly affects the level to which internal auditing strives for detecting and prevent-ing fraud. We also emphasize the overall ethical impact regarding fraud in organizational struc-tures. Shedding light on the positioning of internal auditing between management and the audit committee with respect to fraud, our results show that additional meetings with management have a positive effect on the level of activities to prevent and detect fraud, while additional meetings with the audit committee have the opposite effect. Our results not only underscore the significance of technologically advanced working methods but also holistically address the am-biguity regarding the responsibility for detecting and preventing fraud. Our results have impli-cations for building an appropriate protection against the steadily increasing risk of fraud within organizations.

Key drivers of cybersecurity audit effectiveness: the neo-institutional perspective

We analyze which factors explain the effectiveness of internal audit in providing assurance about cybersecurity risk management. Based on neo-institutional theory, we hypothesize that coercive (cybersecurity regulation), normative (internal auditors' academic background, cybersecurity certifications, and training) and mimetic forces (outsourcing) positively contribute to cybersecurity audit (CSA) effectiveness. We extend the model of isomorphic forces by the Board's support, Board's competencies, and the level of internal auditors’ cooperation with the first and the second line of defense. To test our hypothesis, we conducted a survey involving 183 IT auditors and Chief Audit Executives from various industries, organizations of different sizes, and countries. We examined the relationships between CSA effectiveness and the hypothesized factors in a series of regression analyses and with a machine learning method – LASSO. We find that normative forces (cybersecurity certifications of the internal auditors) and human agency factors significantly explain CSA effectiveness. While regulation is associated with CSA effectiveness indirectly, we find no support for the effect of outsourcing as a mimetic force. The paper is an original analysis that advances our understanding of key drivers of CSA effectiveness and their relationships.

Good Cop or Bad Cop: What Drives the Self-Image of Internal Audit Functions?

The internal audit activity’s stereotype as a “corporate watchdog” has dominated practice for decades despite efforts to shed this image in favor of a trusted advisor role in which it partners with management to protect and add value to the organization. Using a sample of 256 Chief Audit Executives, we find that a mix of professional and interpersonal characteristics representative of the components of trustworthiness (ability, benevolence, and integrity) are associated with the perception of the internal audit activity as a trusted advisor to the organization. Additionally, we find evidence that internal audit activities perceived as trusted advisors provide observable benefits to the organization in the form of audit effectiveness, efficiency, and usability. Our findings contribute to the growing academic knowledge of internal auditing and equip practitioners with an operationalizable set of incentives and goals for shifting the perception of their internal audit activity to that of a trusted advisor.