Effectiveness of Internal Audit

A decade ago, Bailey et al. (2003) presented research opportunities in the field of internal auditing, which helped strengthen internal auditing by encouraging the academic internal auditing community. After ten years, this research provides an overview of what the relevant academic literature says about the effectiveness of internal auditing. Empirical studies based on self-assessment by internal auditors and empirical studies based on the perspectives of other stakeholders (outside-in evaluation) have been examined based on the “effectiveness” perspective. After identifying common areas, the main topics have been combined into a model consisting of macro and micro factors influencing internal auditing. Then, an updated set of research opportunities in internal auditing is presented. The valuable and innovative aspect of this research is the suggested pathways for future studies.
Creating and maintaining organizational fit are key challenges for any support function (mission), including internal auditing. Understanding the concepts of efficiency and value addition, as well as grasping the fundamental role of internal auditors—employees who are not directly linked to the profit and loss account—is not a simple task (Noble, 2010). Currently, the perceived value and professional image of internal auditing among stakeholders outside the internal auditing community are far from what professionals and the internal auditing community aspire to. When we take a closer look at reality (PricewaterhouseCoopers Audit, 2013), a degree of frustration is observed among internal auditing stakeholders regarding the role and relevance of internal auditing before and after the latest financial crisis that began in 2007.
Anderson (2009, p. 26) notes: “Non-executive managers and heads of audit committees often express in surveys that internal audit heads and supervisors are not performing their duties well, and internal auditing lacks sufficient independence… and the roles envisioned for internal auditing are not well-defined.”
The KPMG auditing institute (2009) concludes that only about a quarter of audit committee members have full awareness of internal audit activities and considerable confidence that the internal audit function of the company is creating value for the organization as expected. In the vast majority of cases, internal audit activities and their value remain somewhat ambiguous. The results of a study by Ernst & Young (2012, p. 1) indicate that 80% of internal audit functions have the potential for improvement.
The findings of the PricewaterhouseCoopers auditing institute (2010) indicate that “internal auditing should take advantage of opportunities to increase its relevance.” Lenz and Sarens (2012) point to the uncertainty regarding who the primary stakeholder of internal auditing is and the ambiguity in the areas of assurance and consulting services, stating that these issues potentially harm the legitimacy and status of the internal auditing profession. The PricewaterhouseCoopers auditing institute (2010), based on observing the phenomenon of “stakeholder misalignment, challenged capacities, and less-than-optimal engagement and value addition of internal auditing,” warned about the internal auditing function (mission) turning into a marginal activity.
The business community of internal auditors faces serious issues that have motivated the writing of this research. Internal auditing is in a sensitive position (Institute of Internal Auditors, 2013) and may either become a marginal function (mission) among various other duties such as assurance, compliance, and risk management, or emerge as a recognized and stronger profession. The world of internal auditing, especially the world of internal audit consulting, is filled with professional firms active in selling internal audit services, offering numerous responses and explanations on how the internal audit function (mission) should be and how it should operate. However, we still have limited information on the best positioning of internal auditing. Fundamental concepts such as assurance are used in practice, but one can doubt the existence of a shared understanding of their true meaning. Why is this the case? Part of this challenge is because internal auditing is a credence good, meaning it holds different meanings for different people at different times and in different contexts (Kashuli, 2009).
Now is the appropriate time to examine the empirical knowledge related to the effectiveness of internal auditing and to identify and combine common areas, presenting a new set of research questions to enhance our understanding of the components of internal auditing and how it creates value. This study offers a new set of research questions that can yield the best outcomes from internal auditing, as we believe that academic research can add value by addressing fundamental issues affecting the effectiveness of internal auditing.
In the second section of this study, we review the existing empirical research literature on the effectiveness of internal auditing. This article complements the study conducted by Gramling et al. (2004), which examined the research background related to the quality of internal audit performance, primarily from the perspective of independent auditors. The third section of this research combines the main topics into a model consisting of macro and micro factors influencing internal auditing. In the fourth section, we explore a set of new research opportunities in internal auditing, categorized around the main themes. These research questions constitute the added value and primary innovation of this study. The fifth section provides a summary and conclusion of the article.
What can be learned from the academic literature on the effectiveness of internal auditing?
Providing evidence of added value and effectiveness is one way to make key stakeholders consider a function (mission) as legitimate. Ridley (2008, p. 287) claims that modern internal auditing is built on three concepts that start with the letter “E” in English: “Effectiveness,” “Efficiency,” and “Economy.” Chambers (1992, p. 22) defines effectiveness as “doing the right thing,” efficiency as “doing things in the best way,” and economy as “doing things at a low cost.” Among these three concepts, effectiveness is the most important factor. If internal auditing lacks effectiveness, ultimately, the provision of services, regardless of high efficiency or low economic cost, becomes meaningless and futile. Dittenhofer (2001, p. 450) believes that what truly matters to an organization is effectiveness, as efficiency in an activity devoid of effectiveness is futile and offers no advantage. Highly unrelated areas can be audited in a very efficient manner.
We consider the effectiveness of internal auditing as “a risk-based concept that helps the organization achieve its goals by positively influencing the quality of corporate governance” (Lenz, 2013, p. 257). Internal auditing is considered a concept that serves the organization. An effective internal audit is expected to examine key risk areas to positively influence the quality of corporate governance and assist in achieving the company’s objectives. Consequently, the extent to which internal auditing achieves its intended goals is linked to its impact on corporate governance. The proposed definition for governance as a broad concept includes risk management and internal control. However, we know that the effectiveness of internal auditing is context-dependent, and the provided definition may not be universally applicable or relevant, as internal audit performance may pursue different objectives within its specific organizational context.
To review the academic research background on the effectiveness of internal auditing, we typically examine articles published since 1999, as the latest version of the definition of internal auditing (The Institute of Internal Auditors Research Foundation, 2013, p. 2) outlines the objectives, nature, and fundamental scope of internal auditing as follows:
“Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”
Previous studies have been included if they are specifically relevant to the topic. When reviewing existing empirical research on the effectiveness of internal auditing, two distinct streams can be identified: The “supply-side” perspective, i.e., empirical studies based on the self-assessment of internal auditors, and the “demand-side” perspective, i.e., empirical studies based on the views of other stakeholders. In both streams, common themes have been identified:
Stream number one examines the “supply-side” perspective, i.e., the background of empirical research in which internal auditors, often the head of the internal audit unit (chief audit executives), describe how they assess their own effectiveness.
Stream number two explores the “demand-side” perspective and includes empirical literature that discusses and analyzes how clients, customers, and stakeholders perceive the value of services provided by internal auditors. “Internal auditing is a service to the company, and the company, in general, should determine the type of internal auditing it requires,” as Chambers (1992, p. 24) notes. Drucker (1985, p. 172) believes that “the quality of a product or service is not what the supplier wants, but what the customer wants and is willing to pay for.”