Archive | March, 2013

Reflections on the internal auditing profession: what might have gone wrong?

21 Mar

The marginalized role of Internal Audit (IA) in the aftermath of the financial crisis that began in 2007 serves as the starting point of this paper, which reviews the profession’s situation between that time and 2010. The absence of IA from the governance debate has been marked and the relevance of IA has become a contentious issue in practice. In having no one clear boss and no single clear role, IA is exposed as trying to be many things to many people, to the point where no one is really sure who it is for and what it delivers. The analysis suggests that, to become a more relevant stakeholder in the corporate governance arena, the IA profession should consider clarifying both the perspective and the purpose of IA, that is, determining to whom IA should be accountable (the perspective from which its added value is judged) and clarifying/concentrating the IA’s service offering (its purpose).

It is striking that the IA profession has hardly been considered by other governance stakeholders as a source of solutions to the problems that led to the financial crisis. Post-financial-crisis activities have remained almost completely silent about IA’s role. Thus, the IA profession has been marginalized in the corporate governance debate since the financial crisis that started in 2007. IA is still searching for an identity and a unique selling proposition in order to play a more important role in that governance arena. There are limitations, some self-inflicted, regarding the role of IA as a core principle of good corporate governance: IA has multiple customers to serve and IA aspires to render both assurance and consulting services.

IA has no clear chief stakeholder: The IIA recommends a dual reporting relationship in which the CAE reports functionally to the board (or the audit committee of the board) and administratively to a senior management executive, and the IIA acknowledges that there may be conflicts when IA tries to “serve two masters” . When IA serves two masters, senior management and the board, what IA reports to the board may be filtered by management, such that only what is palatable to management is communicated.

Value of IA questioned: Having an IA function (IAF) is not the same as having a value-adding and effective IAF, as several stakeholder surveys have indicated. There are big gaps in practice when comparing factual and targeted scope of IA services. There is an absence of clear conveyance of the value added to major stakeholders. There are overly optimistic self-assessments by internal auditors.

This paper suggests viewing the oversight authority (board/audit committee) more clearly as the prime customer group, which abandons the IIA’s traditional view of IA as an “agent of the board”, and at the same time positions IA as a “partner to management”. Following that path may be the way IA can leverage the governance opportunity. The aspiration to broaden the scope of IA beyond the assurance arena may not be helpful in establishing IA as a profession, as doing so may move IA farther away from what matters most to boards and audit committee. There is significant room for improvement for IA in the arena of assurance, which is to be exploited, as otherwise other professions may fill the gap.

The two key conclusions of this paper are first that positioning IA as the agent to the board/audit committee and, at the same time, as partner to management is challenging in practice. The IA function should clarify the customer dimension in its organizational context. Second, assurance and consulting may be a confusing combination in practice that dilutes the value proposition. Consolidating IA around its core function of providing assurance is argued as the way forward.

Rainer Lenz, Gerrit Sarens, (2012), Reflections on the internal auditing profession: what might have gone wrong?, Managerial Auditing Journal, Vol. 27 Iss. 6, pp. 532 – 549

PhD-dissertation about the effectiveness of internal audit (forthcoming blogs)

14 Mar

My doctoral dissertation includes five related working papers that provide valuable contributions to the understanding of internal audit (IA) and its effectiveness. Paper 1 is a literature review that uses the perspective of new institutional theory as a framework and acknowledges that IA effectiveness is largely still viewed as a “black box” that is under-explored in academic research. Paper 2 is an explorative work that studies the variables that are theoretically associated with the IA function’s active role in corporate governance. This paper was published in the Journal of Applied Accounting Research (JAAR 2012). Paper 3 is a conceptual essay that discusses the status of IA as a profession and questions why the IA profession has not generally been seen as playing a significant role in the financial crisis, either as part of the problem or as part of the solution. This paper was published in the Managerial Auditing Journal (MAJ 2012). Paper 4 is an empirical survey that clarifies the discriminatory power of characteristics suggested by practitioners and academic research that may indicate IA effectiveness. Paper 5 is a qualitative research paper that breaks new ground in applying role theory (Kahn et al. 1964) in combination with the theory of relational coordination (Gittell 2006) to the research context of IA effectiveness. This dissertation builds on an exhaustive literature review, provides a mix of different methods and perspectives and offers innovative and complementary insights that open the door for further research.

Lenz, Rainer (2013): Insights into the effectiveness of internal audit: a multi-method and multi-perspective study, Université catholique de Louvain – Louvain School of Management Research Institute, Doctoral Thesis

PhD thesis (link to homepage of UCL/LSM)

lenz, r. (2013), diss.

Public defense (PPT)


Having an Internal Audit Function or having an effective Internal Audit Function?

10 Mar

The NASDAQ is presently considering a rule change that will require its listed companies to establish and maintain an Internal Audit Function (IAF). Similarly, the New York Stock Exchange (NYSE) listing rules mandate the presence of an IAF (NYSE Section 303A.07).

However, the NYSE does not address the effectiveness of the IAF. While some coercive force can be an important factor that may help to bring the best out of Internal Audit, having an IAF is not the same as having a value-adding and effective IAF. The NASDAQ may consider demanding organizations to establish and maintain an effective IAF. Academic research and more practitioner geared publications may provide helpful pointers what an effective IAF looks like.

What do you think?