Institute Of Internal Auditors Research Articles

The impact of internal audit system on performance: evidence from emerging markets

This paper examines the impact of internal audit (IA) practices on the performance of commercial banks. Six factors were investigated, including the application of international IA standards, the independence and objectivity of the IA, the quality and professionalism of IA members, gender diversity within the IA department, the size and frequency of meetings, and management support for IA. Using questionnaires, data were collected from 34 commercial banks in five Arab countries: Saudi Arabia, Yemen, Sudan, Somalia, and Djibouti. Structural equation modeling (SEM) was performed using SmartPLS 3.3.3. The results demonstrate the significant and direct influence of the examined factors on the performance of commercial banks, except for the professional competence of internal auditors. Additionally, the study reveals that the performance of internal auditors, as a mediating variable, does not significantly affect the relationship between the internal audit system (IAS) and bank performance. This paper makes a significant contribution to the field of auditing as it is the first study to examine IA in Arab countries using multiple factors. The findings of this study can be utilized by regulators, such as the Institute of Internal Auditors (IIA), bank owners and managers, government agencies, and central banks.

THE EFFECT OF AUDIT CHARACTERISTICS ON FINANCIAL REPORTING QUALITY AND THE MEDIATING ROLE OF AUDIT QUALITY: EVIDENCE FROM MALAYSIAN PUBLIC COMPANIES

Our paper examines the effect of audit characteristics on financial reporting quality (FRQ) and the role of audit quality (AQ) as a mediator. The study adopted 201 companies listed in Malaysian Bursa from 2017 to 2019 to achieve our objective. The study used Stata to analyze the data to estimate the effect proposed in the hypotheses. Findings show that only audit fees affected FRQ positively. At the same time, audit fees and company size have positively influenced AQ. On the other hand, AQ has improved the link between audit characteristics and FRQ since the results show a positive effect of audit tenure, audit fees, and audit company size on FRQ through the mediator. This research can help the Institute of Internal Auditors and the Association of Certified Fraud Examiners improve their rules and regulations by enhancing audit characteristics, technical competence, and functionality to help organizations improve AQ. The study's findings are relevant to governments and investors worldwide worried about FRQ and want to guarantee that operations in Malaysia and other emerging markets are closely monitored.

Unravelling the three lines model in cybersecurity: a systematic literature review

Enterprise risk management frameworks have gained popularity after the Global Financial Crisis for companies to be more in control of their risks. Since then, the Three Lines of Defence model (based on defence-in-depth approaches) has become one of the primary risk management frameworks in the Western world. Yet, its application in the cybersecurity space, one of the fastest-growing areas of risk for modern organisations, has been fragmented at best. In this article, we conducted a systematic literature review on the application of the Three Lines of Defence model in cybersecurity. The model has been recently renamed the Three Lines Model. After the seminal publication by the Institute of Internal Auditors in 2013, academics and practitioners have either referenced this model as the primary governance framework for risk management or analysed it in depth in various areas. To the best of our knowledge, this is the first systematic literature review on the topic. We have performed a methodical analysis of existing research using best practices in the field and adopted the grounded theory approach as the theoretical underpinning of our investigation. This way, we unraveled details, critiques and possible alternatives to the Three Lines Model in cybersecurity. Our study expands our understanding of the Three Lines Model and its application in cybersecurity, highlighting the status quo of research in the space and offering practical recommendations for organisations interested in exploring its implementation to mitigate the impact of cyber-risks.

AI COMPETENCIES FOR INTERNAL AUDITORS IN THE PUBLIC SECTOR

This article examines the critical integration of Artificial Intelligence (AI) competencies within the realm of internal auditing, particularly in the public sector. It addresses the existing gap in understanding the specific AI-related competencies as presented by The Institute of Internal Auditors (IIA) and explores their practical application for internal auditors. The study begins by tracing the origins and evolution of AI, highlighting its increasing significance across various sectors, including internal auditing. It delves into the transformative impact of AI on audit practices, emphasizing the need for internal auditors to adapt and develop new competencies in response to this technological evolution. The paper underscores the importance of AI in enhancing the quality and efficiency of auditing by automating tasks like fraud detection and anomaly identification. It articulates the imperative for internal auditors to possess a comprehensive understanding of AI, its risks, and opportunities, and to apply these insights in their audit processes. The study further explores the role of continuing professional education in equipping auditors with the necessary AI competencies, reflecting on the IIA’s emphasis on education and competency development in light of AI integration. By elucidating the link between AI theoretical knowledge and its practical application in internal audits, the article aims to empower internal auditors with the tools and insights necessary to navigate the evolving landscape of audit practice in the era of AI. It concludes by emphasizing the synergy between AI sophistication and human competence as indispensable for achieving optimal audit results and maintaining the integrity and effectiveness of the audit process in the digital age.

РАЗВИТИЕ КРИТЕРИЕВ ОЦЕНКИ ЭФФЕКТИВНОСТИ СИСТЕМ ВНУТРЕННЕГО КОНТРОЛЯ В СОВРЕМЕННЫХ УСЛОВИЯХ

The relevance of the study is due to the need to improve the effectiveness of internal control systems in a rapidly changing external environment and increasing requirements for transparency and reliability of the organization’s activities. The authors of the article emphasize the importance of the problems of determining the criteria for the effectiveness of internal control, which have become the object of research by many domestic and foreign scientists, due to the need to improve this tool for managing economic activity. The article examines the approaches of various authors to the definition of criteria for evaluating the effectiveness of internal control systems. Based on the analysis, interpretations of the content of the most frequently used criteria for evaluating the effectiveness of the internal control system (effectiveness, efficiency, cost-effectiveness, expediency, timeliness) are formulated. The author conducts a study of criteria defined by leading international professional organizations (COSO, the Basel Committee on Banking Supervision, the Institute of Internal Auditors, the Association of Audit and Control of Information Systems). According to the author, the criteria for the effectiveness of the internal control system should not only reflect the current state of the internal control system, but also serve as a basis for its further development and improvement. As a result of the study, a systematization of the criteria for the effectiveness of the internal control system was proposed, which includes five groups involving an assessment of the level of organization of the internal control system; the level of human resources involved in the internal control system; the level of information, technical, technological and financial support for the internal control system; the state of the environment of the internal control system; the level of quality of internal control measures control within the framework of the internal control system. The proposed systematization of the criteria for the effectiveness of the internal control system allows for a deeper understanding of the essence and content of internal control and can become an effective management tool and contribute to the achievement of the tasks set. The systematization proposed by the author of the study can serve as a basis for the development and improvement of internal control systems in organizations. The results of the study can be useful for managers and specialists in the field of risk management, audit and control, as well as for anyone interested in improving the efficiency of organizations.

프랑스의 반부패규율 정책의 함의와 시사점

Corruption acts that negatively affect the our macroeconomy as well as distortion of resource allocation vary considerably in their type and scope of persons involved, so the regulation for them should also be secured at a multi-faceted and systematic level. Considering that several acts that cannot be seen as violations of the legal provision can also be classified as types of corruption, such as solicitation through indirect strings and distortion of decision-making using influence within and between organizations, the need for more diverse and flexible regulation against corruption can be admitted. It is also important to set corruption acts as punishable acts through elements of a crime and to specify the regulations for them. However, the situation, such as the diverse type of corruption, difficulty in setting the category of related persons who commits corrupt, and the emergence of continuous new types of corruption acts, make us to acknowledge the necessity and validity of proactive regulative measures rather than passive, that is, post-punishment. Accordingly, the Institute of Internal Auditors has recently thrown up the topic of internal audit, that is, 3 Line Model, and France is focusing on various regulative activities against corrupt centered on anti-corruption agencies such as Cour Des Comptes France, AFA etc. We are also focusing on corruption regulations through various laws, including the Public Servant's Ethics Act, Conflict of Interest Prevention Act for Public Officials and the Act on the Establishment and Operation of the Anti- Corruption and Anti-Corruption and Civil Rights Commission, and various organizations such as the Board of Audit and Inspection and the Anti-Corruption and Civil Rights Commission etc. These acts mainly deal with specific restrictions on behavior and there are many cases of overlapping regulations, and there is no primary institution functionally responsible for corruption regulations. On the other hand, there are various corruption regulation measures such as AFA in France and thus we can consider the policy of France in our policy on regulation against corruptions. And furthermore, considering the experience of France, we are able to take into account of the policy that the full-fledged implementation of internal audits in that there are difficulties in swift legal response.

DO CONCEITO À PROPOSTA DE IMPLEMENTAÇÃO: AS LINHAS DE DEFESA À LUZ DA NOVA LEI DE LICITAÇÕES E CONTRATOS (LEI 14.133/2021)

In the face of Law 14.133/2021, although at risk of successive extensions, the required innovations are remarkable. After 30 years of coexistence with Law 8666/1993, the legislator brought a robust structure arising from themes targeted by judgments, regulations, normative instructions and even international standards. In this way, art. 169 which, aiming at a governance risk management practice, used the internal audit template “The Institute of Internal Auditors – IIA”, a standard recognized worldwide for the three lines of defense in organizations. Comparing the estimated assumptions to the realities of public entities, some inconsistencies are identified, remedied through forthcoming regulations. Using the deductive method and the bibliographic technique, this article aims to conceptualize and structure the demand for regulation of Art. 169 of Law 14.133/2021 based on the perspectives and realities of the interested public entity. It is therefore concluded that, even if it is necessary to previously establish the Risk Management Policy, Governance and Compliance Policy and the organizational structure of the Central Internal Control Body and, even if there are inconsistencies in the letter of the law on the subject, it is appropriate for regulation in the form of definitions of competences, as drafted in this work.

Internal Auditing in the Arab World: A Systematic Literature Review and Directions for Future Research

This study provides a systematic review of the literature on internal auditing (IA) research in 17 Arab countries. It focuses on four key aspects, namely the quality and effectiveness of IA, the objectivity and independence of IA, the consequences of IA, and the challenges facing IA in Arab countries in order to provide insights and avenues for future research in this field. Ninety-one (91) articles collected from the Scopus database between 1996 and April 2022 were analyzed in this study. The results show that there has been an increase in the number of studies that discussed IA, especially in the last 6 years. Most of these studies have focused on the quality of IA and its functions. It also shows that Jordan and the Kingdom of Saudi Arabia dominate the literature published so far in terms of the number of studies. Also, most of the studies were based on agency and institutional theory evaluating the various aspect of IA. This study highlights the lack of in-depth qualitative research that allows researchers to challenge the theories developed in the auditing field, add nuances to the existing theoretical framework, and unpack new theoretical directions. Furthermore, the results also show that the IA literature did not contribute significantly to the knowledge of internal audit functions (IAFs) as specified by the Institute of Internal Auditors (IIA). This study contributes to the body of knowledge by determining future research directions and surveys by interested researchers and regulators, including IIA.

The Impact of Domain-Specific Internal Audit Education on Financial Reporting Quality and External Audit Efficiency

SYNOPSISWe investigate how the geographic distribution of domain-specific internal audit education impacts financial reporting quality and audit efficiency in the U.S. Using universities with Centers for Internal Auditing Excellence as proxies for robust internal audit education, we find that companies headquartered in close proximity to these programs have fewer material weaknesses in internal controls over financial reporting, fewer financial statement misstatements, and shorter audit lags, and sometimes pay lower audit fees compared with a matched sample of companies not in close proximity to these programs. These findings have implications for practitioners responsible for the staffing and quality of their internal audit functions, the Institute of Internal Auditors in its education-collaboration initiatives, and higher-learning institutions responsible for educating future audit practitioners. These findings also contribute to the academic debate on the value of internal audit and determinants of internal audit function quality.Data Availability: Data are available from sources cited in the text.

STUDY OF THE EXPERIENCE OF DIGITAL TRANSFORMATION OF EDUCATION WITHIN THE EUROPEAN UNION

The article is devoted to consideration of the problems and trends of strengthening the economic and social potential of the country through quality management of state finances, which is a priority task of the state and its institutions in the conditions of increasing the use of state resources and overcoming the consequences of the global financial and economic crisis. The financial stability and security of the country, the effectiveness of state policy, the level of the population's quality of life, the achievement of social -economic goals of the state. Therefore, in the process of ensuring the quality of management and the use of state resources, the role of state financial control institutions, the effectiveness of the tools and methods they use in the process of activity is important (without exaggeration). The experience gained in this direction proved the low effectiveness of the tools used and proved the need to improve state financial control and audit. The need for careful study and implementation into practical activity of the positive experience of building a state control system existing in developed countries, one of which is the Kingdom of the Netherlands, is justified. There are three levels of control in this country, and all the functions necessary for the state (in particular, regarding financial control) are first determined in the state administration system, and then they are distributed among the bodies, which makes it possible to clearly distinguish the powers and competences of different bodies, including controlling The procedure for introducing internal control systems in every institution and organization of the Netherlands, merging internal audit units into the Central Government Audit Service under the Ministry of Finance, and introducing mechanisms to further limit the minister's influence on implementation deserve attention for the implementation of positive experience in the practical activities of the state financial control bodies of Ukraine. control, the existence of an independent external financial control body (audit court), cooperation and exchange of information between the Central Government Audit Service, the Court of Auditors, the Institute of Internal Auditors, the Netherlands Organization of Accountants, private audit firms, the European Commission (in matters of control over EU funds), and also with universities that train personnel in the relevant field. Keywords: digitalization, educational environment, digital technologies, education system, digital competence, digital skills, digital education, digital transformation.

HOW WE FOUNDED THE ASSOCIATION OF INTERNAL AUDITORS OF SERBIA

The foundation of the Association of Internal Auditors of Serbia as an affiliate of the Institute of Internal Auditors (IIA) was a kind of project that, prompted by the needs of the profession and by support from the international environment, was realized by virtue of enormous enthusiasm and voluntary work of internal audit professionals. The quality of the work of all participants in this project contributed to its becoming a full member of the IIA in a relatively short period of time.

STUDY OF FOREIGN EXPERIENCE OF THE BASIS OF CONSTRUCTION OF THE SYSTEM OF STATE CONTROL

The article is devoted to consideration of the problems and trends of strengthening the economic and social potential of the country through quality management of state finances, which is a priority task of the state and its institutions in the conditions of increasing the use of state resources and overcoming the consequences of the global financial and economic crisis. The financial stability and security of the country, the effectiveness of state policy, the level of the population's quality of life, the achievement of social -economic goals of the state. Therefore, in the process of ensuring the quality of management and the use of state resources, the role of state financial control institutions, the effectiveness of the tools and methods they use in the process of activity is important (without exaggeration). The experience gained in this direction proved the low effectiveness of the tools used and proved the need to improve state financial control and audit. The need for careful study and implementation into practical activity of the positive experience of building a state control system existing in developed countries, one of which is the Kingdom of the Netherlands, is justified. There are three levels of control in this country, and all the functions necessary for the state (in particular, regarding financial control) are first determined in the state administration system, and then they are distributed among the bodies, which makes it possible to clearly distinguish the powers and competences of different bodies, including controlling The procedure for introducing internal control systems in every institution and organization of the Netherlands, merging internal audit units into the Central Government Audit Service under the Ministry of Finance, and introducing mechanisms to further limit the minister's influence on implementation deserve attention for the implementation of positive experience in the practical activities of the state financial control bodies of Ukraine. control, the existence of an independent external financial control body (audit court), cooperation and exchange of information between the Central Government Audit Service, the Court of Auditors, the Institute of Internal Auditors, the Netherlands Organization of Accountants, private audit firms, the European Commission (in matters of control over EU funds), and also with universities that train personnel in the relevant field. Keywords: state resources, state financial control, state financial audit, efficiency, effectiveness, transparency.

Internal Audit Process in eHealth

Background Internal audit operates within international professional practices established by the Institute of Internal Auditors (IIA). It contains an independent role from the organizational structure and represents the third line of defense in the implemented model of government, risk management, and internal control. Internal audit provides reasonable safety regarding the quality of the processes, including reporting to management about internal control and risk management. Objective Internal control processes and risk management in the scope of the processing of calls and the charging of the outsourcing company. Formulate recommendations for performance improvement in the ambit of health policies. Methods For its fulfilment, this work was based on international norms for professional practice in Internal Audit. The risk management methodology – COSO ERM (Enterprise Risk Management – Integrating with Strategy and Performance) and COSO (Internal Control – Integrated Framework) were also used for the analysis of internal control. Results There were identified two risks of operational nature and internal origin, two risks of a strategic nature related to the market, and three risks of a technological nature. Conclusions The recommendations described in the report are based on the relationship between public and health policies that have gained importance in recent years with the Covid-19 pandemic, since the beginning of 2020, accelerating the digital transition process in Portugal. Contributing to outstanding dissemination of Teleconsultations, technological development and privileging paperless recipes, meeting the guidelines for EU Digitization by 2030. What is already known on this topic? The European Commission sees eHealth as a priority and encourages the creation of a global strategy in the countries of the European Union, with the objective of developing the transformation, the Telehealth Contact Center sorting system has been optimized with the introduction of Artificial Intelligence in the branching of the algorithms and in the conclusion diagnosis. Main contribution to Evidence-Based Practice In the current context, with the growing tendency to health digitalization and the market potential in telehealth, the role of internal audit has been gaining an indispensable position in the success of a company, fomenting quality and rigor in decision making. In this way, internal audit is capable of significatively contributing to risk reduction and the improvement of management quality, converting itself into lucrative processes for the company. Implications for healthcare practice The relation between the diagnosed risks and the improvement recommendations allowed the correlation of internal policies with public health which sustains the sector.

Probing into the Power of Independence and Standards Usage as Value-Added Attributes and Implementation of Recommendations

This study investigates the perspectives of internal auditors and their stakeholders on whether independence, objectivity, and standard usage will lead to value-added and implementation of the recommendations of internal audit function (IAF). Using a survey, we collected data from 142 Institute of Internal Auditors (IIA) members in Ghana and 139 stakeholders. We used PLS SEM to test the hypothesis. The findings suggest that independence, objectivity, and compliance with standards would add value, as perceived by both internal auditors and their stakeholders. The results from stakeholders suggest that independence and objectivity, compliance with standards, and value-added will lead to the implementation of recommendations. However, internal auditors perceive that compliance with standards and value-added will not automatically result in the implementation of recommendations. This study represents the first effort to investigate the impact of independence and objectivity, compliance with standards on value-added, and the implementation of recommendations.

Effectiveness of Internal Audit Implementation at BPJS of Employment

Abstract This study aims to analyze the effectiveness of implementation of internal audit in BPJS Ketenagakerjaan. This study involved 8 informants consisting of the Assistant Head of the Internal Audit Department, Internal Auditor, and the Branch Head. Measurement of the effectiveness of internal audit in this study uses the IPPF Practice Guide: Measuring Internal Audit Effectiveness and Efficiency from the Institute of Internal Auditors which consists of basic measures, services to stakeholders, technical development, innovation, and human resource development. The results showed that in a basic measure, clients (auditees) felt satisfy with the services provided by SPI. Internal auditors also feel satisfied in terms of the field of work and salary or facilities provided by management. The findings obtained by internal auditors at this time are more on administrative errors and do not lead to fraud. The recommendations by the internal auditor are always followed up by the auditee and this is also the support of management. Repeated findings are still at a reasonable level and the numbers are not many. The existence of SPI greatly helps management in achieving organizational goals. SPI allocates a budget for internal auditor technical development, but this is done in turn because of budget constraints. Internal auditors are also involved in professional organizations, but their nature is only passive. All internal auditors already have certification and auditor rotation is carried out in accordance with the needs and management policies. Keywords: internal audit, effectiveness of internal audit, internal audit department

Breaking the Barrier: On the Use of Joint Audits in the Internal Audit Profession

ABSTRACT With the growing relevance of internal auditing, academics and practitioners emphasize the importance of an adequate and adaptable staffing approach. Because internal audit resources are considered a crucial component of internal audit quality, we investigate why internal auditors perform audits with experts from within or outside the organization. These joint audits augment resources and represent a viable alternative to additional staffing or full outsourcing of the internal audit function (IAF). Using survey data from three national chapters of the Institute of Internal Auditors (IIA), we consider three IAF dimensions (i.e., structure and resources, activities and processes, environmental factors) associated with resource augmentations. Our findings provide evidence that joint audits are used when the IAF is comparatively small and competent, when the IAF focuses on risk and strategy-related tasks, and when the IAF is decentralized. Our findings also suggest that joint audits can strengthen the auditor-auditee relationship. Data Availability: Please contact the authors. JEL Classifications: M42; M49.

THE FUTURE OF INTERNAL AUDITING: GARDENER OF GOVERNANCE

Internal Auditing is a profession at crossroads. On the micro level, in organizations and institutions, stakeholders may see less and less value in the contributions from internal auditing and on a macro level, this projection jeopardizes the legitimacy and relevance of internal auditing as a profession. The good and bad news is that the future is uncertain. This article suggests five main fields of action and focus for the IIA Global – The Institute of Internal Auditors, its local chapters, internal auditors and academia that will determine the future role of internal auditing, its legitimacy, its relevance and its organizational and societal significance. The purpose of this article is to provide comprehensive content suggesting five concrete paths for the betterment of internal auditing. The five directions that deserve development are planet, public, profession, prosperity and people. Ultimately, positioning internal auditing as Gardener of Governance is a promising metaphor to strengthen its value proposition, both on a micro and on a macro level. Metaphors are an important way to convey ideas and make ideas stick.

The Post Office IT scandal – why IT audit is essential for effective corporate governance

The Post Office Horizon scandal is possibly the most serious corporate failure in the United Kingdom in living memory, and possibly for more than a century. This is because of its disastrous consequences for hundreds (perhaps thousands) of individuals who were wrongly prosecuted by the Post Office and who lost their livelihoods, and often their homes, on the basis of incomplete and misleading evidence from its Horizon computerized accounting system. That corporate failure has given rise to the most extensive miscarriage of justice in English legal history, with an unprecedented number of wrongful convictions now in the process of being reversed.The Post Office Horizon scandal had many features and causes, but a significant contributory failure was that of corporate governance. There were many warning signs over the years, which should have been acted upon by Post Office Internal Audit and in particular, by specialist IT auditors. The evidence is clear that the Post Office failed to live up to its commitment to corporate governance, and that this failure was neither detected nor acted upon by the government, if civil servants and ministers were aware of the failure, until too late. An effective IT audit function would have contributed significantly to a prevention of the scandal.
 Index words: Post Office, Horizon, Fujitsu, IT audit, internal audit, corporate governance, Three Lines of Defence, Institute of Internal Auditors, IIA, AICPA, IAASB, SSAE 16, SSAE 18, ISAE 3402, SAS 70, ISAE 3000, SOC-1, SOC-2, SOC-3, Trust Services Criteria, processing integrity, Justice for Subpostmasters Alliance, Ernst & Young

Impacts of reporting lines and joint reviews on internal audit effectiveness

PurposeThis paper aims to examine the extent to which two commonly recommended information sharing and communication interventions, direct reporting lines between the internal audit function (IAF) and the audit committee (AC) and their joint reviews of internal audit standards and procedures, improve the internal audit in the continuous audit control and monitoring efforts.Design/methodology/approachThis study uses data from the Audit Intelligence Suite-Benchmarking (AIS) Report for the years 2007 to 2016 published by the Institute of Internal Auditors. The authors test the research hypotheses using the ordinary least squares regression method.FindingsFunctional reporting lines from the IAF to the AC positively impact the internal audit, but administrative lines have a negative impact. Reviews conducted jointly between the IAF and the AC positively influence the internal audit. The impacts of reporting lines and joint reviews are also associated with accounting complexity within a given industry, organizational control structure, organizational scope and the level of IAF’s responsibilities over internal control environment to comply with Sarbanes–Oxley (SOX) Act of 2002.Research limitations/implicationsBecause the study uses AIS data, operationalization of variables is constrained to items in the given data set. Future studies, including field studies, may identify other variables and measures using diverse data sources. This study expands the knowledge of effective means of information sharing and communication to enhance interactions between the IAF and the AC.Practical implicationsThe results suggest that the use of reporting lines should correspond to accounting complexity, organizational control structure, organizational scope, and reliance on the IAF in handling SOX responsibilities. They also highlight the importance of joint reviews between the IAF and AC in ensuring a high-quality internal audit.Originality/valueThe authors envisioned reporting lines and joint reviews as an excellent tool to balance the relationship between the IAF and the AC for continuous internal auditing beyond generating internal audit reports according to the US Committee of Sponsoring Organizations of the Treadway Commission framework Principle 14.

Three lines of defence — is it the right model?

Despite the plethora of legislation, regulatory requirements and industry guidance that financial institutions need to follow, there is an ever-increasing number of scandals involving risk management, governance and compliance failings. Each time a scandal hits the headlines, supervisory bodies, and organisations themselves, consider how to respond and further strengthen the control environment and enhance policies and the related procedures to prevent the same or similar instances occurring. This paper describes the Three Lines of Defence model within financial organisations, considers the Wells Fargo customer account fraud scandal and the departure of Citigroup’s Chief Risk Officer and debates whether the revisions to the Three Lines of Defence model proposed by the Institute of Internal Auditors will strengthen the risk and compliance frameworks within organisations and provide a more robust system of corporate checks and balances, endorsed by both the industry and the regulators.