Internal Audit Department Research Articles

Intentions to Report Questionable Acts: An Examination of the Influence of Anonymous Reporting Channel, Internal Audit Quality, and Setting

The Sarbanes–Oxley Act of 2002 requires audit committees of public companies’ boards of directors to install an anonymous reporting channel to assist in deterring and detecting accounting fraud and control weaknesses. While it is generally accepted that the availability of such a reporting channel may reduce the reporting cost of the observer of a questionable act, there is concern that the addition of such a channel may decrease the overall effectiveness compared to a system employing only non-anonymous reporting options. The rationale underlying this concern involves the would-be reporter’s likelihood of reporting, the seriousness with which the organization treats an anonymous report, and the organization’s ability to thoroughly follow-up the report. Thus, we explore the extent to which the availability of an anonymous reporting channel influences intended use of non-anonymous reporting channels. Further, in response to Sarbanes–Oxley and the environment of financial scandals that led to its passage, many firms are strengthening their internal audit departments, and providing them with greater independence from upper management’s direct control. Accordingly, our examination tests whether the intended use of the internal audit department as an internal reporting channel is greater when the internal audit department is of “high” versus “low” quality. Finally, the study investigates intended reporting behavior across three different cases (e.g., settings).

The Role of Internal Auditors in Malaysian Local Authorities

Good governance is a precondition for competitiveness of a firm, market and economy. As part of the government machineries, local authorities also should observe and maintain good governance as they are entrusted with public money. Overseas literature has shown the importance of internal auditing in the management of local authorities. Additionally, local internal auditing literature also reveals the importance of internal auditing as important governance structure in organisation. With respect to internal audit function in Malaysia, Treasury circular 2/79 requires all government department including local authorities to establish internal audit department. It then was replaced by Treasury Circular 9/2004. The function and responsibility of internal auditors in government department are specified in that circular. This study provides empirical evidence on the existence and scope of internal auditing in Malaysian local authorities. The same variables used in the study done by Zakaria, Selvaraj and Zakaria (2006) are tested on internal auditors in Malaysian local authorities. The sample of this study consisted of head of internal auditor in local authorities of all states in the West Coast of the Peninsular Malaysia. Given the importance of internal auditing in every type of organisation, it is hoped that this study will benefit the institutions and its stakeholders in their effort towards establishing and maintaining good governance. © Common Ground.

Continuous monitoring of business process controls: A pilot implementation of a continuous auditing system at Siemens

In this paper we report on the approach we have developed and the lessons we have learned in an implementation of the monitoring and control layer for continuous monitoring of business process controls (CMBPC) in the US internal IT audit department of Siemens Corporation. The architecture developed by us implements a completely independent CMBPC system running on top of Siemens’ own enterprise information system which has read-only interaction with the application tier of the enterprise system. Among our key conclusions is that “formalizability” of audit procedures and audit judgment is grossly underestimated. Additionally, while cost savings and expedience force the implementation to closely follow the existing and approved internal audit program, a certain level of reengineering of audit processes is inevitable due to the necessity to separate formalizable and non-formalizable parts of the program. Our study identifies the management of audit alarms and the prevention of the alarm floods as critical tasks in the CMBPC implementation process. We develop an approach to solving these problems utilizing the hierarchical structure of alarms and the role-based approach to assigning alarm destinations. We also discuss the content of the audit trail of CMBPC.

Internal audit in Italian organizations

PurposeTo describe the main characteristics of Internal Audit Departments in six Italian companies and investigate the influence of enacted regulations on their development.Design/methodology/approachThe research has been carried out through a multiple case study, which compared the Internal Audit Departments of six Italian companies, gathering evidence by interviews with chief internal auditors, by obtaining examples of internal audit reports, policy documents and corporate briefing notes.FindingsThe range of situations considered highlighted the diversity in Internal Audit Department characteristics, confirming the relevance of institutional pressures, but also providing evidence of the influence of additional elements in their development.Research limitations/implicationsResults provided by this research cannot be regarded as generally applicable or generalizable, although this study should contribute to the development of a deeper understanding of the characteristics of Internal Audit Departments.Practical implicationsThis paper highlights some elements which can influence the development of Internal Audit Department characteristics, with a focus on value added activities.Originality/valueThis paper has referred to institutional theory to examine the development of Internal Audit Departments and provides a valuable framework for future research. Further it provides evidence of different structural characteristics and factors which can influence companies' choices in the development and support of their Internal Audit Departments.

Perceived Security Threats of Computerized Accounting Information Systems in the Egyptian Banking Industry

This paper investigates the perceived security threats to computerized accounting information systems (CAIS) in the Egyptian banking industry (EBI) by surveying the entire population of the EBI. Differences between the respondents' opinions regarding the perceived security threats have been identified and investigated in the context of the EBI. The results of the study reveal that accidental entry of bad data by employees, accidental destruction of data by employees, introduction of computer viruses to the system, natural and human-made disasters, employees' sharing of passwords, and misdirecting prints and distributing information to unauthorized people are the most significant perceived security threats to CAIS in the EBI. In all cases, the heads of internal audit departments reported higher occurrence frequencies of CAIS security threats compared to the heads of computer departments.

Making The Decision To Outsource A Service Department: Who Should Deliver Internal Audit Services?

The 2001-2003 wave of financial fraudulent reporting, aggressive earnings management, and overall management integrity issues highlight the important role that an internal audit function can have in protecting organizations and demonstrate how important it is that internal auditors operate with independence and objectivity. This paper highlights the issues organizations face when contemplating the internal audit outsourcing market. The illustrative materials provide exposure to the strategic, analytical, financial and operational decisions involved with retaining or outsourcing a corporate internal audit department.

Internal auditing practices and internal control system

PurposeTwo main objectives and they are: to determine whether the internal audit department of the companies listed in the Bursa Malaysia complies with the Standards for the Professional Practice of Internal Auditors IIA (2000); and, to determine whether compliance to SPPIA will affect the quality of the internal control system of the company.Design/methodology/approachTwo sets of questionnaires were used in the study. Internal auditing practices was measured by the items listed in the SPPIA and the internal control was measured by means of the statement on internal control: guidance for directors of public listed companies. The population used in this study was all the companies listed in the Bursa Malaysia in 2001. This study used both descriptive and inferential analyses.FindingsIt was found that management of internal audit department, professional proficiency, objectivity and review significantly influence the monitoring aspect of the internal control system. Scope of work and performance of audit work significantly influences the information and communication aspect of the internal control system while performance of audit work, professional proficiency and objectivity significantly influence the control environment aspect of the internal control system. The study also shows that management of internal audit department, performance of audit work, audit program and audit reporting significantly influences the risk assessment aspect of the internal control system. Lastly, performance of audit work and audit reporting significantly influences the control activities aspect of the internal control system.Research limitations/implicationsThe research has contributed to the agency theory with respect to the bonding costs that management has to pay to the internal auditors for the best interest of the principals of the companies. Another important implication pertains to the extent of the internal auditing practices among internal auditors in Malaysian public listed companies. Research has also shown that the compliance with internal auditing practices partially influence certain aspects of the quality of the internal control system.Originality/valueThis is the first empirical study that has linked the compliance of the internal auditing function to the SPPIA and its effect on the internal control system.

System access hotspots: Are auditors ignoring danger?

AbstractA recent survey found that only 54 percent of internal audit departments think information technology general controls are a critical part of complying with Sarbanes‐Oxley (SOX) Section 404. But management can't determine how effective its internal controls are without an in‐depth investigation of systems access security. Some internal auditors may be ignoring a lurking danger. So, the authors give detailed advice on how to secure hazardous system access hotspots. © 2005 Wiley Periodicals, Inc.

Internal Audit, Sarbanes-Oxley And Athletic Departments: An Examination And Recommendations For Reform

During the past fifteen to twenty years the integrity of intercollegiate athletics has been seriously questioned as a result of an increased awareness of problems associated with institutional controls over athletic departments. Limited empirical evidence has been used in the debate regarding institutional controls pertaining to the athletic department. This paper provides empirical evidence regarding the use of the internal audit function as an institutional control. Our findings indicate that while the internal audits of athletic departments are adequate, the communication of these audit results is inadequate. We also discuss the applicability of recent legislation, Sarbanes-Oxley Act of 2002, to colleges and universities. Recommendations to enhance institutional controls regarding intercollegiate athletics are provided.

Qualifications, diversity and workplace practices: an investigation of higher education internal audit departments

Internal audit is getting recognition thanks to media coverage of alleged fraudulent activities and new regulations that require the evaluation of internal controls. Given this attention, Harrington (2004) identified what organizations should look for when hiring a director of internal audit. This paper reports an investigation of college and university internal audit departments that determines if the directors hold the suggested qualifications and if the qualifications differ based on gender. Differences among the directors of internal auditor include demographic information such as salary, experience and number of staff members as well as who hires the director, and whether the institution has a governing board audit committee. Even with the differences, college and university internal audit directors are very much alike.

An examination of the relationship between internal and external audit in the Saudi Arabian corporate sector

This paper uses questionnaires from and interviews to examine the level of co‐operation and co‐ordination between directors of internal audit departments, and partners and managers in external audit firms in Saudi Arabian companies. The results revealed that external auditors expressed concern about the independence, scope of work and small size of many internal audit departments. Internal auditors considered co‐operation between internal and external audits to be limited, although external auditors were more positive about the extent of co‐operation when the internal audit department was of high quality. The extent of reliance by the external auditor on the work of the internal auditor varied with the quality of the internal audit department. External auditors suggested that the objectivity, competence and work experience were important factors affecting the reliance decision. They felt that the internal audit function in many Saudi companies lacked professionalism and independence from management, which adversely affected its work and the potential for reliance thereon.

The Role of Quality Auditing in the Continuous Improvement of Quality: Lessons from Pakistani Experience

Internal auditing is widely recognized as an important business tool in the area of quality management. This article examines the technique and role of internal audits in the continuous improvement of the quality of the sports goods industry in Pakistan. Toward this goal, a survey of 100 ISO 9000 certified companies was conducted at the end of 2001 and 88 usable questionnaires were obtained. It was observed that about 70 percent of the firms have established internal quality audit departments with an average duration of 2.5 years. Since then, the rejection rate has been reduced to an average 2.8 percent from the initial 7.9 percent defects. Moreover, the internal auditors are well trained, their professional skills are highly rated and they enjoy good relations with the production staff and/or auditees. The management of the sports goods industry benefited in terms of reduction in cost, defects, non‐conformity, rejection and also better and improved ways of doing their routine work. It is anticipated that the finding of this study will work as a benchmark for other industries in the region.

The Effects of Internal Audit Structure on Perceived Financial Statement Fraud Prevention

This study examines whether internal audit reporting structure and internal audit sourcing arrangement affect financial statement users' perceptions of ability of the internal audit function to prevent financial statement fraud. A survey of lending officers finds that in-house internal audit departments that report to senior management are perceived as less able to provide protection against fraudulent reporting compared to in-house departments that report solely to the board of directors' audit committee. This finding is particularly important in light of the SEC's recent consideration of whether the audit committee should be directly responsible for oversight of the internal auditor. This study does not find a difference in users' perceptions of financial statement fraud prevention between outsourced internal audit teams and in-house internal audit departments when both report to the audit committee. Results suggest that increases in perceived audit expertise may occur with outsourcing, but such increases may not significantly enhance user confidence in the internal audit function because users perceive outsourced teams to have less in-depth knowledge of the company than in-house internal audit departments.

Internal auditors and the external audit: a transaction cost perspective

Questions exist regarding the extent to which internal auditors should participate in the external audit, and wide variations are observed in practice. Many professional bodies increasingly advocate the view that increased coordination between the internal and external auditors, including increased use of the internal auditor for the external audit, provides more efficient and effective audit coverage. However, others maintain that internal auditors should not focus on areas that are the subject of external audit interest. This article attempts to shed light on this debate by using insights from transaction cost economics (TCE) to identify conditions under which organizations encourage internal audit participation in the external audit. An analysis of survey data collected from directors of Canadian internal audit departments indicate that some (TCE) variables, particularly transaction‐specific investment, are significantly associated with internal audit participation in the external audit.

THE DEVELOPMENT OF INTERNAL AUDIT IN SAUDI ARABIA: AN INSTITUTIONAL THEORY PERSPECTIVE

This paper uses institutional theory to interpret the results of two questionnaires and research interviews concerned with internal audit in the Saudi Arabian corporate sector. The results show that internal audit is not well developed. Where it does exist it operates in departments that are inadequately resourced, lack qualified staff, have restrictions on their degree of independence, concentrate on compliance audit rather than performance audit, and where internal auditors are not accepted by management and auditees. Using institutional theory it is suggested that the state should play a more coercive role by encouraging organizations to establish internal audit departments and organize their activities in the manner specified in internal audit standards.

Determinants of internal audit efficiency

This paper describes a case study in which Data Envelopment Analysis (DEA) methodology was combined with regression analysis to evaluate the efficiency of an Internal Audit (IA) department over twelve consecutive months. Efficiency of audit projects was first estimated using DEA. These results were then used as one of the outputs to perform a multi-period DEA study with a choice of other inputs and outputs specific to the Internal Audit department under review. The efficiency of audit projects is viewed as one of the key outputs of an IA department and an explanation of these efficiencies would therefore be useful (necessary) to enhance insights gained from the DEA model applied to the twelve months. To assist in this explanation a multiple regression model was employed in which the efficiency score obtained from the DEA computations for the audit projects was used as the dependent variable. Following a description of the models and data, the results are discussed and notes are made of certain aspects pertaining to the department reviewed.

Corporate Governance in Bahrain

Corporate governance is developing rapidly in many countries across the world. In this paper we analyse the existing state of corporate governance in a country in the Middle East: Bahrain. We employ a survey methodology, with a questionnaire being sent to all of the companies listed on the Bahrain Stock Exchange Market. An analysis of the responses reveals that Bahraini companies have in place some of the features of corporate governance best practice with boards dominated by non–executive directors, for example, and the separation of the roles of Chair and CEO. However, it is not clear how effective the nomination/appointments process is and directors tend to be fairly entrenched. In terms of risk management and control, the majority of Bahraini companies have an internal audit department and risk management control. Overall, it seems that Bahraini companies have a number of key corporate governance structural features in place, but that there remains further progress to be made.

Enron's Lesson: Rebuild Internal Auditing Now!

AbstractThe Enron debacle proves that outsourcing the internal audit department is a bad idea. Now is the time to get rid of the outsourcers and strengthen your own internal auditing. The author gives some valuable tips on making it stronger, smarter, and flexible. © Canaudit Inc.: The Canaudit Perspective, February 2002

The importance of intellectual capital and its effect on performance measurement systems

The first objective of this paper is to provide evidence concerning the relationship between selected organizational characteristics and the perceived importance of intellectual capital. The second objective is to relate the relative importance of intellectual capital to characteristics of the organization’s performance measurement systems. Due to their in‐depth knowledge of their entities’ business operations, internal auditors are used to provide the data for this study. The results of a survey administered to 54 internal auditors indicate that the industry of a company is not related to that company’s attitude about intellectual capital. The size of the internal audit department is related to a company’s attitude about intellectual capital. Companies with larger internal audit departments believe that intellectual capital is very important. Finally, the evidence suggests that business performance measurement systems are being implemented to a larger extent at entities that place a greater emphasis on intellectual capital.

The UniCast Company: A Case Illustrating Internal Auditor Involvement in Consulting

The UniCast Company, a cable television service company, has experienced rapid growth through a combination of aggressive management and acquisitions (UniCast is a fictionalized version of an actual company). This case requires you to assume the role of a staff auditor in UniCast's internal audit department and complete a review of the company's lockbox arrangements. The case emphasizes internal audit's evolving role from a focus on traditional audit tasks (e.g., account balance evaluation and compliance testing) to also performing business consulting projects with the goal of adding value to the organization. You will consider cash management, internal audit's role, the similarities and differences between external and internal audit, and the potential impact of technology and the Internet on cash management. You also will be required to demonstrate report-writing skills and research skills (e.g., library and Internet).