Audit Executives Research Articles

The Role of Enterprise Risk Management and Organizational Strategic Flexibility in Easing New Regulatory Compliance

The impact of new regulatory requirements for internal control reporting on an organizations' ability to maintain strategic flexibility has been debated extensively. This paper uses a systems perspective to examine the relationship between an organizations' pre-regulatory effectiveness of enterprise risk management (ERM) processes and their reactiveness to new regulatory mandates. This focus on ERM processes first examines the influence of ERM on the ex ante development of organization structures (i.e. information technology systems compatibility and organizational strategic flexibility). These structures are then examined for their influence on the use of appropriate actions (i.e. control environment and comprehensive compliance processes) to mitigate the difficulty of compliance. Data were collected on these main constructs and related influential constructs from chief audit executives representing a broad range of North American organizations. We specifically focus on Section 404 of the U.S. Sarbanes-Oxley Act of 2002 (hereafter, SOX 404). Structural modeling was used to test the relationships simultaneously and to understand the predictive behavior of the various attributes. First, the results reveal a strong positive relationship between the effectiveness of ERM and strategic flexibility which is partially mediated by IT compatibility-the ability to capture and share data across an enterprise. Second, the results show a strong positive relationship between strategic flexibility and use of effective implementation processes for new compliance requirements over internal control reporting, but the relationship is fully mediated by the strength of an organization's control environment. Third, our structural model allows us to identify both direct effects of ERM effectiveness on the strength of the control environment and the indirect effects of ERM effectiveness on control environment via the interrelationships with IT compatibility and strategic flexibility. Measurement of these indirect effects captures a more complete view as to the influence of ERM effectiveness on the strength of the control environment; the combined direct and indirect effects increase by 16% the variance in strength of control environment explained by ERM. In brief, our research finds that organizations with effective ERM processes and flexible organizational structures already in place incurred little difficulty in implementing SOX 404 mandates, while organizations that lacked effective ERM processes prior to SOX 404 compliance had weaker implementation processes and had a more difficult experience in complying with the mandates. These findings provide key insights into the importance of ERM for creating an organizational form that can effectively deal with regulatory compliance issues in volatile environments.

Factors Associated with the Use of and Compliance with the IIA Standards: A Study of Anglo‐culture CAEs

Chief audit executives (CAEs) are required to use and comply with The International Standards for the Professional Practice of Internal Auditing (Standards). However, this study finds that 13.5 percent of CAEs in Anglo‐culture countries do not use the Standards. Furthermore, of those who use the Standards a significant number fail to comply with specific standards. Multivariate tests of data from CAEs in this study show that ‘Length of IIA membership’ and ‘Internal auditing certification’ are positively associated with use. Other significant variables are ‘Superseded by local/government regulations or standards,’‘Not perceived as value added by management/board’ and ‘Compliance not expected in the country’ that are inversely related to use. The length of training is also positively associated with compliance, while other significant variables are internal audit certification, ‘Standards are too costly,’‘Not perceived as value added by management/board’ and ‘Inadequate internal audit staff’ that are negatively associated with compliance. The paper ends with a discussion of the implications of these results for practice and research.

Identifying Organizational Drivers of Internal Audit Effectiveness

This study attempts to understand the organizational drivers of internal audit effectiveness in the light of recent changes in the ‘mission’ of internal auditing and its central role in corporate governance. On the basis of data from 153 Italian companies, our survey shows that the effectiveness of internal auditing is influenced by: (1) the characteristics of the internal audit team, (2) the audit processes and activities, and (3) the organizational links. Internal audit effectiveness increases in particular when the ratio between the number of internal auditors and employees grows, the Chief Audit Executive is affiliated to the Institute of Internal Auditors, the company adopts control risk self‐assessment techniques, and the audit committee is involved in the activities of the internal auditors.

Cultural Dimension as an Explanatory Variable in Use and Compliance with Internal Auditing Standards in Nineteen Countries

Chief audit executives (CAEs) and internal audit managers (IAMs) are responsible for the use and compliance with the International Standards for the Professional Practice of Internal Auditing (Standards) issued by The Institute of Internal Auditors (The IIA, 2008). However, significant deviations in use and compliance with Standards have been reported in the literature. Using a large sample of CAEs and IAMs from 19 countries in five distinct cultural clusters (per House et al. 2004) we investigate cultural dimension as an explanatory variable for variations in the use and compliance with Standards. As expected, we find differences between the five cultural clusters in the use and compliance with the Standards. Furthermore, we hypothesize and find that cultural dimension of uncertainty avoidance is inversely related to use, while assertiveness and human orientation are positively related to compliance with Standards. In addition we investigate several control variables and find positive effects for the length of IIA membership, professional certification in internal auditing, and hours of CPE training on both use and compliance. Education degree (graduate vs. undergraduate), major (accounting/auditing/internal auditing vs. others), and position (CAE versus IAM) are not significant in use or compliance models. Our results suggest the importance of certification, IIA membership and continuing professional education to use and compliance with Standards. The results also suggest that reduction of uncertainty in Standards can enhance use, while improvements in IIA members' assertiveness and human orientation can improve compliance with Standards.

Effective working relationships between audit committees and internal audit—the cornerstone of corporate governance in local authorities, a Welsh perspective

This research looks at the working relationship between audit committees and the internal audit function within Welsh local government. The focus is primarily on the working relationship from the perspective of the head of internal audit, also known as the Chief Audit Executive or Chief Internal Auditor [Head of internal audit will be used synonymously with that of Chief Audit Executive and Chief Internal Auditor]. Is it a marriage of convenience or a working relationship where the two can capitalise on what they both bring to the corporate governance arena? Reluctance by local government in Wales to embrace the merits of audit committees in the late 1990s means that local government is playing catch up with other public sector organisations. This in turn affects the recognition of the benefits of an effective audit committee capable of working with the internal audit function to promote sound corporate governance. Published guidelines by the UK public sector accountancy body in 2005 on the implementation of audit committees within local government made those organisations yet to establish an audit committee to rethink the situation, and were encouraged by the seemingly positive benefits of audit committees. Wales was no exception, and the 22 local authorities considered embracing the concept of audit committees. Consequently, this placed the internal audit function and head of internal audit under the spotlight in terms of the expectations of the audit committee members. Audit committees roles and responsibilities mean that they should assist councils and officers to ensure they undertake their responsibilities with probity and effectiveness, especially in respect of financial control. It is imperative that committee chairs and internal audit can function as a working team in order to be effective. Audit Committees have a role to assess the performance of the internal audit function, appoint heads of internal audit, support and promote the audit function within the organisation. It is therefore important that the heads of internal audit have confidence and respect for the audit committee and its chair in terms of the skill and knowledge it has of the audit role in relation to the financial and non-financial aspects of the organisation. Laura Spira (2003) comments on how very little research has been undertaken in relation to the audit committee activities, within the private sector, consequently very little is known about what they actually do, let alone how effective they are in undertaking their role. In a similar vein, the same is true of the public sector audit committee activities, especially when they have tended to adopt the private sector audit committee as a blue print to their own audit committee development.

Knowledge reuse in creating audit plans

In this research the question of knowledge reusability in creating more reliable IT audit plans has been investigated. With the use of appropriate simulation techniques and statistical analysis, it has been proved that the explicit usage of self-reflection in IT auditing enables more precise audit plans, therefore the execution might become more effective. This self-reflection means that auditing methodologies are largely depending on the results of previous examinations of certain areas. In fact, the most widespread methods and guidelines are also based on the experience gained through previous examinations. If the results gathered in this way are being used, more precise audit plans can be made and the designation of the areas to be examined can become more accurate. If the fact that audit methodologies are primarily based on practical experience is accepted and explicitly formulated, then, with the use of the information acquired in previous audits, better and more precise audit plans can be created. In other phrases: the assignment of control objectives in certain situations of examination can be done based on the experiences from previous audits. Additionally, the audit plans created in this way enable the cost-effective execution of audits, without sacrificing accuracy and reliability. The results of the simulation confirm these statements.

Internal Audit Professionalism and Section 404 Compliance: The View of Chief Audit Executives from Northeast Ohio

This study explores the notion that the recently heightened regulation over United States public company reporting limits the amount of professional judgment required by internal auditors, and in the long run may reduce the overall value and professionalism of the internal audit group. Our assessment is based on face‐to‐face interviews conducted with Chief Audit Executives (CAEs) from 17 publicly listed companies located in Northeast Ohio, United States, and is in general agreement with the extant literature on the topic. We find that despite several short‐term benefits from the Section 404 work for the individual auditor (e.g., increased pay and job security), the compliance work may indeed be a threat to the long‐term reputation of the internal audit profession. Based on the existing literature and the CAEs’ responses, the Section 404 work does appear to be driving the internal audit profession down a new path.

Internal auditors' perception about their role in risk management

PurposeThe purpose of this paper is to describe and compare in a qualitative way how internal auditors perceive their current role in risk management within US and Belgian companies.Design/methodology/approachIn order to get adequate data, Chief audit executives from 10 different companies were interviewed and relevant documents were analyzed.FindingsIn the Belgian cases, internal auditors' focus on acute shortcomings in the risk management system creates opportunities to demonstrate their value. Internal auditors are playing a pioneering role in the creation of a higher level of risk and control awareness and a more formalized risk management system. In the US cases, internal auditors' objective evaluations and opinions are a valuable input for the new internal control review and disclosure requirements mentioned in the Sarbanes Oxley Act.Research limitations/implicationsGiven the qualitative nature of this study, generalization to all Belgian and US companies is not possible. The time specific character of the subject is an opportunity for future longitudinal research.Practical implicationsIn Belgium, the internal auditing profession is actually in a kind of “transition phase”. In order to survive this transition phase, internal auditors need to assume a “teaching role” vis‐à‐vis the different management levels to make them aware of their responsibilities in risk management. After this transition period, internal auditors will be able to focus more on their core activities.Originality/valueIn addition to a number of quantitative studies, this paper extends in a qualitative and comparative way the understanding of the specific role of internal auditors in risk management within US and Belgian companies.

Audit committee pre‐Enron efforts to increase the effectiveness of corporate governance

PurposeThis study of audit committee effectiveness, performed in the period immediately preceding the Enron collapse, seeks to determine whether audit committees were beginning to accept more responsibility for corporate governance before such behavior became mandatory.Design/methodology/approachThe period studied was approximately two years prior to the Sarbanes‐Oxley Act of 2002 and roughly one year after the Blue Ribbon Committee published its recommendations on audit committee effectiveness. The efforts of 296 audit committees to improve their effectiveness as reported by Chief Audit Executives (CAEs) to the Global Audit Information Network (GAIN) database maintained by the Institute of Internal Auditors (IIA) were investigated.FindingsIt was found that audit committees' responsiveness to each of eight effectiveness steps was surprisingly high. For instance, almost all (w99.6 percent) audit committees meet with CAEs. It is recommended that audit committees focus more on big picture/strategic concerns in their discussions with CAEs.Research limitations/implicationsThe study's chief limitation is that only companies with internal audit functions were studied and thus the results cannot be generalized to companies without internal audit functions.Originality/valueThis study was the first to utilize the GAIN database and provides specifics about 15 different topics that CAEs might bring to audit committees for discussion. Topics of communication more often focused on specifics such as “significant audit findings” (95.9 percent) and less often dealt with big picture/strategic concerns such as “overall corporate control environment” (68.9 percent).

Factors Associated with U.S. Public Companies' Investment in Internal Auditing

Internal auditing has been the focus of much attention in recent years. This study examines factors associated with U.S. public companies' investment in internal auditing. Data from a survey administered to Chief Audit Executives of midsized U.S. public companies were supplemented with publicly available data. Based on data from 217 companies, the results indicate that total internal audit budgets (inhouse plus outsourced portions) are related to several factors associated with company risk, ability to pay for monitoring, and auditing characteristics. Specifically, we find evidence that internal audit budgets are positively related to company size, leverage, financial, service, and utility industries, relative amount of inventory, operating cash flows, and audit committee review of the internal audit budget. Total internal audit budgets are negatively related to the percentage of internal auditing that is outsourced. This study contributes to our understanding of internal audit services, and it allows companies to benchmark their investment in internal auditing.

E‐commerce impact on Canadian public sector audit practice

PurposeThis paper reports on the research conducted into the adaptations Canadian public sector auditors have made to the emergence of e‐commerce and e‐business in the delivery of public services.Design/methodology/approachA comprehensive review of the literature was completed as a foundation for creating a semi‐structure interview questionnaire used in a series of interviews with audit executives from 20 audit organizations in Canada's public sectors.FindingsThe study found a distinct disconnect between what is reported in the literature and what has actually happened in practice. Practicing auditors do have a significant interest in the impact of e‐business on the audit profession specifically and on their client organizations generally. But there is significant disagreement about whether e‐business constitutes just another set of technologically mediated changes, not much different from the many others of the past 30 years, or whether e‐business is truly disruptive in nature. The consequence of this disagreement is difference in audit practice among constituencies and highly variable dependency on external expertise in favour of developing internal capacity.Research limitations/implicationsThe research is limited to internal auditors of public sector organizations in Canada.Practical implicationsA key area for future research is the impact on e‐business on horizontality of management practice in the public sector and the need for more holistic audit interventions.Originality/valueThe paper identifies key differences between what is said in the literature and what is done on the ground. It identifies key lessons from audit experience related to evolving e‐government, including the management of new risks. The research is valuable to both researchers and practicing public sector audit executives alike.

O Tribunal de Contas da União (TCU) e a gestão ambiental brasileira: experiência recente

A Constituição de 1988 ampliou a esfera de competência do Tribunal de Contas da União (TCU), assegurando-lhe maior poder de atuação, inclusive na área ambiental. A partir de 1998, com a definição de sua estratégia de atuação nessa área, e de forma crescente, o TCU vem desempenhando um importante papel na avaliação das políticas ambientais públicas do governo federal. A realização de diversas auditorias operacionais em instituições e programas governamentais têm resultado em minuciosos diagnósticos e relevantes recomendações, no sentido de tornar mais efetivas as políticas públicas ambientais. Este estudo descreve e comenta a evolução da fiscalização do TCU sobre a gestão ambiental brasileira nos últimos anos. Também é lembrada a atuação de entidades de fiscalização superiores de outros países na área ambiental. São analisados os critérios da estratégia de atuação ambiental do Tribuna de Contas, bem como as determinações e recomendações de algumas recentes deliberações envolvendo a gestão de recursos hídricos, o licenciamento ambiental e a avaliação ambiental estratégica. Este artigo procura relacionar a atuação do TCU na área ambiental com a busca por um controle preventivo, pedagógico e orientador da gestão pública, em substituição ao tradicional modelo de controle formalista e a posteriori. O artigo conclui que a atuação do tribunal é positiva para a sociedade, recomendando que seja ampliada.

Developing a strategic internal audit‐human resource management relationship: a model and survey

Presents a model for analyzing the potential for value creation of the internal audit (IA) function, the human resource management (HRM) function, and the IA‐HRM pairing. A survey of 161 chief audit executives indicated that virtually all IA functions are risk managing in their audit approaches, while a great majority of HRM clients are also moderately or strongly strategic in their outlook. Findings included that a productive working relationship was strongest when a risk m anaging IA function is paired with a strategic HRM function. Also, the IA planning process was found to be more strategic in the presence of the same pairing. Analysis of written examples of strategic findings related to HRM supplied by the respondents suggested that there may be a significant gap between auditors’ knowledge of strategic HRM practices as developed in the literature and their self‐reported examples. Future research should use both HRM and IA responses to reduce bias. Additonally, there is a need for case studies of the IA‐HRM partnership.

Modified Audit Reports, Executive Compensation and CEO Turnover

This paper shows that unfavourable audit reports cause significant falls in executive compensation. Economically, the effects are larger than accounting and market performance measures, and are particularly strong when: reports are modified for issues other than going-concern uncertainties; or, reports are newly modified. The first finding is consistent with the view that managers control the quality of financial reporting whereas going-concern uncertainties can arise due to exogenous changes in operating conditions. The second finding is consistent with prior evidence that newly modified reports signal more serious problems than repeated modified reports. Finally, there is a weak positive association between modified reports and CEO turnover. Overall, the results indicate that modified reports are costly to company executives.

A Statistically-Based Process for Auditing Clinical Data Listings

In October 1995, members of the DuPont Merck Biometrics and Quality Assurance staffs met to discuss improvements in the audit process for clinical data listings. With the advent of the International Conference on Harmonization (ICH) good clinical practices (GCPs), they were concerned about assuring that the procedures and processes for managing incoming clinical data and reporting to regulatory agencies were appropriately rigorous to ensure complete and accurate processing of clinical trial data. The following article describes a statistically-based audit plan that takes into consideration the phase of the trial, the importance of the trial to regulatory filings, and key study variables. The audit plan also includes a procedure for randomly selecting studies and patients for audit, and establishes statistically-based acceptance and rejection criteria. This audit process has been in use for six months and has resulted in more efficient planning and execution of clinical data audits. Due to the randomness of the process and high standards for acceptable quality levels (AQL), internal quality control (QC) procedures have been strengthened to assure that all data listings meet these standards.

The Need for Pretrial Audits in Clinical Trials — an Investigator's Perspective

The advantages of and the need for performing pretrial audits as a prerequisite to the commencement of clinical trials in the FARMOVS Institute are discussed. The objective of the pretrial audit is to ensure that prior to starting the clinical trial all the necessary pretrial documentation and preparations have been completed to the standards required by both good clinical practice (GCP) guidelines and in-house standard operating procedures (SOPs). The execution of pretrial audits includes the scrutiny of the protocol, case record form (CRF), randomization schedule, ethics approval, informed consent, enrollment of subjects, safety data, trial medication, analytical procudures, apparatus, other disciplines involved, investigator's brochure and in-house SOPs. The main advantage of a pretrial audit is the timely identification of errors and problem areas, thereby ensuring maximum effectiveness during the execution of the trial.