Archive | Internal Audit Profession RSS feed for this section

What is the most significant internal audit event in the last 30 years?

7 Oct

See discussion in Chief Audit Executives Group @ LinkedIn (Tom McLeod)

There are excellent proposals, including the Cadbury report in the UK, Cynthia Cooper as Vice President of Internal Audit at WorldCom, or the integration of Risk Assessment /Management into the internal auditing function and so forth.

Here is my suggestion:

I can imagine that COMBINED ASSURANCE could become a watershed event, a true game changer. That concept has come on the agenda via the King code on corporate governance for South Africa (also known as King III). Combined Assurance is still pretty fresh and hardly implemented, yet, certainly outside of South Africa. However, I see much value and potential in that concept, possibly upgrading Internal Audit (IA) into INTEGRATED ASSURANCE (IA), eventually: that is, speaking with one solidified voice, providing an holistic perspective on residual risk and so forth. IA would then render potentially much more (perceived) value to the board and senior management, once silos and the 3+ lines of defense have become more integrated. This forthcoming trend – as I see it – may help the IA profession, provided internal auditors can step up to the plate and lead that change. That, however, remains to be seen. Who will drive that change? Change possibly towards establishing a “Corporate Governance Officer” or so someday. Who will be taking that seat at the table? There is competition … IA may come out stronger or IA may be further marginalized. Action is needed.

Views welcome.



Read the most highly cited articles from Managerial Auditing Journal

19 Mar

Addressing the relation between theory and practice in auditing and assurance, the journal explores trends, paradigms and perspectives. The below articles from Managerial Auditing Review are freely available until 6 April.

Reflections on the internal auditing profession: what might have gone wrong?

Rainer Lenz, Gerrit Sarens

Keywords: Internal auditing, Corporate governance, Professions

A synthesis of empirical internal audit effectiveness literature pointing to new research opportunities

23 May

This co-authored paper with Ulrich Hahn was accepted for publication in the Managerial Auditing Journal in January 2014 (forthcoming in MAJ first edition 2015).

Purpose – Ten years after Bailey, Gramling and Ramamoorti (2003) presented research opportunities in Internal Audit (IA) this paper provides a synopsis of what academic literature says about IA effectiveness. A new set of research questions that may help to bring the best out of IA is proposed.

Design/methodology/approach – Empirical studies based on internal auditors’ self-assessments (“inside-out”) and empirical studies based on other stakeholders’ perspectives (“outside-in”) are reviewed through an “effectiveness lens”. The “outside-in” perspective is regarded as particularly valuable.

Findings – First, we identify common themes in the empirical literature. Second, we synthesize the main threads into a model comprising macro and micro factors that influence IA effectiveness. Third, we derive promising future research paths that may enhance IA’s value proposition.

Practical implications – The “outside-in” perspective indicates a disposition to stakeholders’ disappointment in IA: IA is either running a risk of marginalization (IIA, 2013; PWC, 2013) or has to embrace the challenge to emerge as a recognized and stronger profession. The suggested research agenda identifies empirical research threads that can help IA practitioners to make a difference for their organization, be recognized, respected and trusted, and help the IA profession in its pursuit of creating a unique identity. This paper wishes to motivate researchers to explore innovative research strategies and probing new theories as well as benefitting from cross-fertilization with other research streams.

Originality/value – This paper summarizes the state of research on IA effectiveness and proposes a guide for future IA research. It provides pointed questions that may further advance the understanding of what constitutes IA and how IA can enhance its value proposition.

Keywords – Internal audit, effectiveness, positioning, relevance, profession, relationship, board, stakeholder, new research opportunities

Paper type – Literature review, conceptual paper

The internal audit ban could result in “two ships passing in the night” but may also be a chance for the emancipation of internal audit from financial auditing

21 Jun

The Financial Reporting Council has confirmed that it is to prohibit internal auditors from helping out the external audit team ( In today’s comment Richard Chambers fears that the new UK FRC restrictions on internal and external audit cooperation could result in “two ships passing in the night”. I share his concern.

This, however, may also be a chance for the emancipation of internal audit from financial auditing. To date, external audit often views internal audit as auxiliary to what external audit is tasked to do, that is auditing the financial statements. From that perspective, internal audit is not recognized – and will not be recognized – as a full profession but as a subordinate profession.

A PwC survey (2009) demonstrated, only 13% of internal audit functions spent 25% or more of their resources on strategic and business risks, while these two risk areas are the prime causes of value destruction (60%), followed by operational problems (20%), and only 15% stem from financial risks and a mere 5% from compliance-related risks. That signals that internal audit functions tend to allocate time and resources poorly, and may often examine the wrong issues, exerting too much effort towards auditing financial reporting and compliance controls at the expenses of more critical and relevant strategic, business and operational audit subjects. From that perspective, the internal audit ban represents an opportunity to clarify the internal audit value proposition in practice – which may well be quite different from what external audit is doing.

Please share your view on this.

Reflections on the internal auditing profession: what might have gone wrong?

21 Mar

The marginalized role of Internal Audit (IA) in the aftermath of the financial crisis that began in 2007 serves as the starting point of this paper, which reviews the profession’s situation between that time and 2010. The absence of IA from the governance debate has been marked and the relevance of IA has become a contentious issue in practice. In having no one clear boss and no single clear role, IA is exposed as trying to be many things to many people, to the point where no one is really sure who it is for and what it delivers. The analysis suggests that, to become a more relevant stakeholder in the corporate governance arena, the IA profession should consider clarifying both the perspective and the purpose of IA, that is, determining to whom IA should be accountable (the perspective from which its added value is judged) and clarifying/concentrating the IA’s service offering (its purpose).

 It is striking that the IA profession has hardly been considered by other governance stakeholders as a source of solutions to the problems that led to the financial crisis. Post-financial-crisis activities have remained almost completely silent about IA’s role. Thus, the IA profession has been marginalized in the corporate governance debate since the financial crisis that started in 2007. IA is still searching for an identity and a unique selling proposition in order to play a more important role in that governance arena. There are limitations, some self-inflicted, regarding the role of IA as a core principle of good corporate governance: IA has multiple customers to serve and IA aspires to render both assurance and consulting services.

IA has no clear chief stakeholder: The IIA recommends a dual reporting relationship in which the CAE reports functionally to the board (or the audit committee of the board) and administratively to a senior management executive, and the IIA acknowledges that there may be conflicts when IA tries to “serve two masters” . When IA serves two masters, senior management and the board, what IA reports to the board may be filtered by management, such that only what is palatable to management is communicated.

Value of IA questioned: Having an IA function (IAF) is not the same as having a value-adding and effective IAF, as several stakeholder surveys have indicated. There are big gaps in practice when comparing factual and targeted scope of IA services. There is an absence of clear conveyance of the value added to major stakeholders. There are overly optimistic self-assessments by internal auditors.

This paper suggests viewing the oversight authority (board/audit committee) more clearly as the prime customer group, which abandons the IIA’s traditional view of IA as an “agent of the board”, and at the same time positions IA as a “partner to management”. Following that path may be the way IA can leverage the governance opportunity. The aspiration to broaden the scope of IA beyond the assurance arena may not be helpful in establishing IA as a profession, as doing so may move IA farther away from what matters most to boards and audit committee. There is significant room for improvement for IA in the arena of assurance, which is to be exploited, as otherwise other professions may fill the gap.

The two key conclusions of this paper are first that positioning IA as the agent to the board/audit committee and, at the same time, as partner to management is challenging in practice. The IA function should clarify the customer dimension in its organizational context. Second, assurance and consulting may be a confusing combination in practice that dilutes the value proposition. Consolidating IA around its core function of providing assurance is argued as the way forward.

Rainer Lenz, Gerrit Sarens, (2012), Reflections on the internal auditing profession: what might have gone wrong?, Managerial Auditing Journal, Vol. 27 Iss. 6, pp. 532 – 549