Chief Audit Executives Research Articles

New guidance on internal audit – an analysis and appraisal of recent developments

Purpose – The purpose of this paper is to analyse and comment on recent enhanced pronouncements on internal auditing. Design/methodology/approach – The paper uses content analysis of five 2012-2013 sources of guidance, set out in the tables of this paper and summarised within the text, together with conceptual interpretations. Findings – Recent pronouncements respond, with considerable consensus, to stakeholder and public concerns and fill a partial vacuum left by The Institute of Internal Auditors' Standards. Principally this is about successfully enhancing the scope of internal audit and internal audit's independence from management. Research limitations/implications – While the paper is conceptual rather than empirical, it builds on the processes followed by the parties who developed the examples of enhanced guidance reviewed in this paper. Those processes included careful development by leaders in the field, public consultation of preliminary proposals, and final amended guidance based on feedback received. Practical implications – There are implications for staffing of internal audit functions and the seniority and calibre of chief audit executives. Originality/value – There has been no other attempt to map these developments. It has been done with a view to identifying possible ways forward for internal auditing, especially those which have a high degree of support and which are still to be incorporated into generally accepted internal auditing.

Governance, Strategic Risk, Internal Audit: What Auditors Need to Know

According to Richard Chambers, President and CEO of the Institute of Internal auditors (IIA), ideally internal audit should follow the risks. Yet as strategic business risks rank near the top of executive and audit committee concerns, Chief Audit Executives (CAEs) reported that such risks account for only 4 percent of audit plan coverage overall. It is not surprising that strategic risk is top of mind for boards and senior management. As regulators around the world increase expectations, many suggest objective, independent evaluation is a critical component that boards should take advantage of in fulfilling their oversight role. These developments present tremendous opportunity for internal auditors to provide much needed assurance on strategic risk. Taking advantage of this opportunity requires that internal auditors not only apply their expertise in effective risk governance, but also demonstrate their knowledge of strategy, and perhaps more importantly, their understanding of the relationship between risk and strategy. Given the changing landscape of the field of strategy and risk management, some internal auditors may feel that contributing to strengthening this area is beyond their capacity. However many tools are available to support auditors. Developing competency requires not only knowledge of the organization's strategy and associated risks, but also staying current on emerging thinking and best practices in the field of strategy and risk management as well as emerging expectations of regulators and standard setters. Providing assurance on strategic risk is a challenge, however one that is within our grasp through thoughtful, deliberate planning and action.

Corporate Governance and Internal Audit in the Modern Downsizedd Enterprise: The Case of Greece

The current financial crisis is affecting the entire operations of the modern enterprise. The main objective of this study is to identify and evaluate whether the current trend of downsizing impacts Internal Controls, Internal Auditors and Internal Audit departments. We will evaluate whether ‘downsizing’ may lead to less compliance with corporate governance best practices, as well as laws and regulations or excessive risk-taking.Also, Internal Audit departments have a multiple role to play in today’s downsized organizational environment. Moreover, “reengineered via downsizing” Internal Audit Departments are often tasked with special projects in which they may play a role that requires extensive application of consulting skills and competences. Internal Auditors direction towards economy, effectiveness and efficiency is a valuable input for every company that adopts change management. After analyzing the relevant literature review, we are forming a questionnaire that will be used in our case studies interviews regarding the impact of downsizing on Corporate Governance practices, Internal Controls, Internal Auditors and Internal Audit departments. The potential impact of downsizing will be critically discussed with selected members of the top management (executive and non executive), as well as Chief Audit Executives. Specifically, our research will be based on a case study analysis of five publicly listed enterprises. Three of them are traded in the high capitalization index of the Athens Stock Exchange, while the remaining two are traded in the medium – low capitalization index.

A Study of the Informal Interactions between Audit Committees and Internal Auditors in Australia

This paper finds evidence for the growing importance of informal interactions between the internal audit function and the audit committee (AC) in Australia – a relatively unexplored topic in the literature – using a survey of Chief Audit Executives (CAEs). It also describes the nature of these informal interactions. The most innovative elements of this paper are the findings that certain personal characteristics of CAEs, the specific knowledge and expertise of the AC chair, as well as some of the AC chair's personal characteristics are associated with the existence (and increase) of informal interactions.

Probing the Discriminatory Power of Characteristics of Internal Audit Functions: Sorting the Wheat from the Chaff

The purpose of this paper is to identify, examine and evaluate characteristics of an internal audit function (IAF) that help to distinguish between two groups of IAFs with sharply contrasting levels of perceived effectiveness. Based on survey data from 46 heads of internal audit (chief audit executives, CAEs) in private organizations in Germany, we differentiate IAFs that indicate varying and contrasting levels of internal auditing (IA) effectiveness. In doing so, this study plants the seeds for a potential general theory of IA effectiveness – a theory that may also have relevance in other countries. Extant theory highlights the multi‐faceted aspects of IA effectiveness and these are considered in the study to sort its ‘wheat from the chaff’. We suggest four key dimensions or categorical blocks: organization, IA resources, IA processes and IA relationships. Within these dimensions, statistically valid discriminatory characteristics and features identified in the study include: the existence of an IA charter that is agreed by the board/audit committee (AC); possible career progression after a tenure in IA; some degree of co‐sourcing and outsourcing of IA services; the level of training and professional qualification of IA staff and CAEs; the use of IA technology and risk‐based IA; whether IA makes recommendations for improving the governance process and rates individual findings and grades the overall report; whether the CAE has appropriate access to the board/AC; whether the CAE benefits from senior management's (SM) and the board/AC's input to the IA plan; and the CAE's informal contact with SM. Appropriately employed, a mix of these characteristics contribute to a theoretical grounding that may help explain IA effectiveness.

Enterprise Defense Management - Internal Auditors to the Fore

Keynote Address: ACIIA Chief Audit Executive Leadership Forum and IIA India Annual Conference 2013, Mumbai, India, 9th May 2013. The Asian Confederation of Institute of Internal Auditors (ACIIA) is a confederation of eighteen Institute of Internal Auditors (IIA) affiliates in the Asia Pacific region comprising Australia, Azerbaijan, China, Hong Kong China, India, Fiji, Pakistan, Indonesia, Japan, Korea, Malaysia, New Zealand, Papua New Guinea, Philippines, Singapore, Sri Lanka, Chinese Taiwan and Thailand. The 2013 Asian Chief Audit Executive (CAE) Leadership Forum focused on understanding the challenges ahead as well as leveraging the available opportunities for the Internal Audit (IA) profession to help organizations achieve their desired goals. The conference aimed at providing the stage for the IA profession to tackle IA challenges, bringing together international thought leaders to share knowledge and ideas on the theme, Enterprise Defense Management - Internal Auditors to the Fore. The keynote address at the 2013 CAE Leadership Forum was delivered by Sean Lyons, the architect of the concept of Corporate Defense Management (CDM). CDM is aimed at helping organizations ensure that their multidimensional corporate activities are managed in a co-ordinated manner so that they are strategically aligned, tactically integrated, and operating in unison toward common objectives. It involves incorporating and extended five lines of defense model to help provide appropriate oversight to address organizational challenges relating to responsibilities, accountabilities and transparency. It addresses the challenges facing enterprises which are constantly changing and evolving. Lyons suggests that to comprehensively and effectively defend against the chaos and help preserve value, Internal Audit is best positioned by offering an overarching and comprehensive enterprise-wide management framework cutting across the myriad of mechanisms such as governance, risk, compliance, intelligence, security, resilience, controls and assurance. This paper is a transcript of the above keynote address.

Informal interactions between audit committees and internal audit functions

PurposeThis paper aims to recognise the importance of informal processes within corporate governance and complement existing research in this area by investigating factors associated with the existence of informal interactions between audit committees and internal audit functions and in providing directions for future research.Design/methodology/approachTo examine the existence and drivers of informal interactions between audit committees and internal audit functions, this paper relies on a questionnaire survey of chief audit executives (CAEs) in the UK from listed and non‐listed, as well as financial and non‐financial, companies. While prior qualitative research suggests that informal interactions do take place, most of the evidence is based on particular organisational setting or on a very small range of interviews. The use of a questionnaire enabled the examination of the existence of internal interactions across a relatively larger number of entities.FindingsThe paper finds evidence of audit committees and internal audit functions engaging in informal interactions in addition to formal pre‐scheduled regular meetings. Informal interactions complement formal meetings with the audit committee and as such represent additional opportunities for the audit committees to monitor internal audit functions. Audit committees' informal interactions are significantly and positively associated with audit committee independence, audit chair's knowledge and experience, and internal audit quality.Originality/valueThe results demonstrate the importance of the background of the audit committee chair for the effectiveness of the governance process. This is possibly the first paper to examine the relationship between audit committee quality and internal audit, on the existence and driver of informal interactions. Policy makers should recognize that in addition to formal mechanisms, informal processes, such as communication outside of formal pre‐scheduled meetings, play a significant role in corporate governance.

Is it Time for an IT Governance Audit?

This article is the first in a series to be published throughout 2013 based on The Institute of Internal Auditors’ Global Technology Audit Guide ® (GTAG) series. The GTAGs are a part of the International Professional Practices Framework (IPPF), the conceptual framework that organizes authoritative guidance promulgated by The Institute of Internal Auditors (IIA). The IIA provides internal audit professionals worldwide with authoritative guidance organized in the IPPF as mandatory guidance and strongly recommended guidance. The GTAG series is classified as strongly recommended guidance. The primary goal of the GTAGs is to help chief audit executives and other internal auditors become more knowledgeable of the risk, control, and governance issues surrounding technology.

Correlates of Co-Sourcing/Outsourcing of Internal Audit Activities

SUMMARY:I use responses from 1,059 chief audit executives (CAEs) of organizations located in Australia, Canada, New Zealand, South Africa, the U.K./Ireland, and the U.S. to investigate several correlates of co-sourcing and/or outsourcing (hereafter, simply “outsourcing”) of internal audit activities. An important finding of the study is that audit committee involvement is positively and significantly associated with outsourcing of internal audit activities. Interactions of audit committee involvement with organization size and location generally indicate that medium and large international/multinational organizations with audit committee involvement outsource more than medium and large local/national organizations with no audit committee involvement. Analysis of control variables produces significance for an inverse relationship between outsourcing and value-added activities of the internal audit function, and for positive relationships between outsourcing and missing skill set and audit staff vacancies. Other control variables, such as CAE age, college degree (graduate/undergraduate), major (accounting versus others), internal audit certification, and regular meetings with the audit committee do not show significant associations with outsourcing. Also, country of residence (U.S. versus other Anglo-culture countries) is not significant, but for-profit organizations outsource significantly more of their internal audit activities than not-for-profit/governmental organizations.Data Availability: Please contact the Institute of Internal Auditors Research Foundation, which owns the CBOK (2010) database used in this study.

'Serving Two Masters' and the Chief Audit Executive's Communication: Experimental Evidence About Internal Auditors’ Judgments

The position of an internal audit function (IAF) as a “servant of two masters” (i.e., management and the audit committee) may lead to a conflict of priorities. In this setting, the tone at the top set by the Chief Audit Executive (CAE) plays a critical role in balancing the potentially competing priorities of the “two masters.” We test two hypotheses in a mixed experimental design with the communicated preferences of the CAE to subordinates (cost reduction vs. effectiveness of internal controls) as a between-subjects factor, and levels of ambiguity (low, medium, high) manipulated within-subjects. Findings suggest that the emphasis in the CAE’s message can influence internal auditors’ judgments, and such influence is more pronounced when task ambiguity is high, resulting in the elimination of a significantly greater number of internal controls and the design of less effective processes. We discuss implications of our results for modern IAFs and the role of the CAE.

Informal Interactions between Audit Committees and Internal Audit Functions: Exploratory Evidence and Directions for Future Research

This paper provides evidence on the prominence of informal interactions between audit committees and internal audit functions and exploratory evidence on factors associated informal interactions. The findings, based on a questionnaire survey of chief audit executives (CAEs) in the UK, suggest that in addition to formal pre-scheduled meetings, audit committees rely on informal interactions with internal audit functions to undertake their monitoring role. The evidence also shows that informal interactions have a positive significant association with both audit committee independence and the knowledge and experience of the audit committee chair. Emphasizing the need for further research to better understand the nature and quality of audit committees’ informal interactions the paper encourages further research focusing in particular on: (i) the effect of both audit committee and internal audit/CAE knowledge and objectivity on informal interactions; (ii) the nature, quality and variations in informal interactions; (iii) the antecedents and consequences of informal interactions; and (iv) the institutional and organizational contexts within which audit committees operate and within which informal interactions take place.

Mapping the changing governance control paradigms of public universities

Drawing on a multi-theoretical approach to governance, interviews with chief audit executives of seven universities worldwide, and published literature, this study maps and demonstrates that as public universities shift from state controlled, public sector and collegial managerialism to corporate managerialism, they experience different range of controls to be monitored at the board, operational and assurance levels of governance. These differences suggest there is no one fit for governance policies of public universities. Instead, there is an onus on the board and management of each public university to identify their own particular multi-theoretical governance control paradigm. These findings have accountability implications for council members, senior management and control mechanisms such as external and internal audit

English

Organisations are constantly striving to maximise shareholder wealth by improving effectiveness and efficiency of operations. There has been an emerging trend since the early 1980’s to outsource functions which were considered non-core and have now moved into the internal audit sphere, a function which was previously maintained in-house. This paper explores similarities and differences between public and private sector internal auditing in South Africa and the perceptions of the Internal Audit Function (IAF) in both these sectors. The sample selected varied in terms of education and experience of participants that were mainly Chief Audit Executives (CAEs) and Internal Audit Managers (IAMs). Results from statistical analysis suggest that there was no significant difference in the consideration of outsourcing of internal audit function by sector. The private sector was significantly more likely to consider internal audit a core activity when compared to the public sector while the public sector was more uncertain. The value of this research study contributes to the existing body of knowledge by means of bridging the gap between the theory and practice from a developing economy and emerging market perspective, by highlighting the status and perceptions of the IAF. Key words: Chief audit executive, internal audit, internal audit manager, outsourcing, perceptions, private sector, public sector, status, service providers, South Africa.

Governance Paradigms of Public Universities: An international comparative study

This study aims to develop a conceptual model of the wider influencing forces impacting the governance paradigms of public universities. It draws on the multi-theoretical governance concept and seeks to identify these forces through the lens of chief audit executives using a qualitative research approach. The interview data supported by published literature reveal universities are affected differently by a number of common influencing forces, resulting in different governance paradigms. These findings provide insights as to the causal factors that shape a public university’s governance paradigm. The practical implications of the findings are that these forces need to be taken into account in future governance studies of universities as it provides the basis to determine their stakeholder base; consequent contractual obligations with them; and the governance control mechanisms and processes to be developed and implemented at the board, operational and assurance levels of governance.

The effects of internal audit role and reporting relationships on investor perceptions of disclosure credibility

PurposeThe purpose of this paper is to assess whether internal audit role and reporting relationships affect investor perceptions of disclosure credibility.Design/methodology/approachThe experiment involved a 2 × 2 design with internal audit role and reporting relationship randomly assigned among 84 MBA students serving as proxies for nonprofessional investors.FindingsThe results indicate that participants perceived disclosure credibility to be significantly higher when the Chief Audit Executive reported functionally to the audit committee and administratively to the CEO (versus both strategically and administratively to the CFO). The results reveal no significant differences in perceived disclosure credibility from the differing audit roles (i.e. primarily assurance versus primarily consulting).Originality/valueThe findings contribute to the internal audit and corporate governance literatures by providing further evidence of the importance of internal audit in investor judgement and decision making.

Factors associated with the internal audit function's role in corporate governance

PurposeThe purpose of this paper is to investigate several variables that are theoretically associated with the internal audit function (IAF) having an active role in corporate governance.Design/methodology/approachThe paper uses responses from 782 US Chief Audit Executives (CAEs) in the CBOK (2006) database for the investigation. The paper makes the assumption that an IAF has only one CAE, thus the dataset represents 782 US IAFs.FindingsIt is found that an IAF having an active role in corporate governance is significantly and positively associated with the use of a risk‐based audit plan, existence of a quality assurance and improvement program, and audit committee input to the audit plan. Control variables such as stock exchange listing, firm size, the existence of an internal control framework, and a CAE with an internal auditing qualification also are positively associated with the IAF having an active role in corporate governance.Research limitations/implicationsA limitation of this study is that CAE perceptions may deviate from actual practice. Also, the sample is limited to the US CAEs who are also IIA members, thus it may not reflect the views of non‐members and the CAEs from other countries.Practical implicationsThe results have implications for CAEs who wish to increase the chance for their IAFs to play an active role in corporate governance. The IIA may benefit from these results in its supporting role for the internal auditing profession.Originality/valueThe study is complementary to the literature on the existence and size of the IAF and reveals several avenues for further research.

A Post-SOX Examination of Factors Associated with the Size of Internal Audit Functions

SYNOPSIS This study develops and tests a conceptual model articulating factors associated with internal audit function size in the post-SOX era. These factors include audit committee characteristics, internal audit characteristics and mission, internal audit activities performed by others (including outsourced providers and other divisions within the organization), and organization characteristics. Results from a survey of 173 public and private companies reveal that internal audit function size is positively associated with: (1) better audit committee governance, (2) greater organizational experience of the chief audit executive, (3) missions involving IT auditing, (4) the use of sophisticated audit technologies, (5) the use of a staffing model in which internal audit is used for rotational leadership development, (6) organization size, and (7) the number of foreign subsidiaries that the organization possesses. Further, internal audit function size is inversely associated with: (1) the percentage of internal audit employees that are Certified Internal Auditors, and (2) the extent of assurance and compliance activities outsourced to outsiders. These results contribute to prior literature on internal audit function size by considering a variety of factors that are associated with internal audit function size in the contemporary era. Data Availability: Contact the authors.

Chief Audit Executives' Evaluations of Whistle-Blowing Allegations

ABSTRACTThis study examines the effects of the source of whistle-blowing allegations and potential for allegations to trigger concerns about reputation threats on chief audit executives' handling of whistle-blowing allegations. The participants for this study, chief audit executives (CAEs) and deputy CAEs, evaluated whistle-blowing reports related to financial reporting malfeasance that were received from either an anonymous or a non-anonymous source. The whistle-blowing reports alleged that the wrongdoing resulted from either the exploitation of substantial weaknesses in internal controls (suggesting higher responsibility of the CAE and internal audit) or the circumvention of internal controls (suggesting lower responsibility of the CAE or internal audit). Findings indicate that CAEs believe anonymous whistle-blowing reports to be significantly less credible than non-anonymous reports. Although CAEs assessed lower credibility ratings for the reports alleging wrongdoing by the exploitation of substantial weaknesses in internal controls, they allocated more resources to investigating these allegations.

How Effective are Organizations' Internal Controls? Insights into Specific Internal Control Elements

SUMMARYBased on survey responses from approximately 500 Chief Audit Executives (CAEs) and other internal auditors, this article provides an insider's view of the perceived strength of organizations' internal controls (i.e., internal control over financial reporting) in the Control Environment, Risk Assessment, and Monitoring components of the Committee of Sponsoring Organizations' (COSO 1992a) Internal Control—Integrated Framework. Although the respondents largely rate control strength as relatively high, we identify several areas for potential improvement of internal controls, especially related to assessing the “tone at the top,” as well as following up on deviations from policy and management override of controls. In analyzing individual control elements, we find that public companies' controls are consistently rated as more effective than those of other organizations. We also find a number of interesting differences across key industries, especially in the Monitoring component, where banks and other financial services firms appear to have more robust Monitoring controls than do healthcare and other services firms. The component-level analysis reveals that internal control component strength is positively related to the CAE reporting primarily to the audit committee, public company status, and the average tenure of the internal audit function staff, among other findings. Based on the survey findings, we describe key implications relevant to internal and external auditors, accounting researchers and educators, and management.

Correlates of Co-Sourcing/Out-Sourcing of Internal Audit Activities

Responses from 1,059 chief audit executives (CAEs) are used to investigate a number of variables that are theoretically associated with co-sourcing/out-sourcing (COUTing) of internal audit activities. The CAE responses represent Anglo-culture organizations located in Australia, Canada, New Zealand, South Africa, the U.K./Ireland, and the U.S. I hypothesize and find evidence that while value-added activities are negatively associated with COUTing, missing skill sets and audit staff vacancies are positively associated with COUTing. Among several control variables investigated, organization size is negatively associated, and audit committee involvement is positively associated with COUTing, but at marginal significance levels. No other control variable is statistically significant, lending support for robustness of the main findings.