INTRODUCTION

To maintain and develop its organizational relevance, the internal auditing function (IAF) must add value for its stakeholders. The most common definition of stakeholders (Freeman, 1984, p. 46) identify them as “any group or individual who can affect or is affected by the achievement of the organization’s objectives.” Applying this definition to the internal audit context, nowadays the IAF deals with a wide range of groups (e.g. the board, audit committee, risk committee) and individuals (CEO, senior and operating managers, risk manager, compliance officer, etc.) with a direct or an indirect interest in the IAF’s activities and the results these activities produce. The number of the IAF stakeholders varies between organizations, industries, and countries. Practitioners and academics maintain that effective stakeholder relationships are crucial to the IAF’s ability to achieve its goals and objectives. For instance, IIA Australia (Institute of Internal Auditors Australia, 2016) argues that fostering and strengthening stakeholder relationships helps to build confidence in internal auditor (IA) work and develops in stakeholders an understanding of the roles internal audit can and should play in an organization. To date, academics have focused mainly on the relationships between the IAF and three of its stakeholders: senior management (SM), the audit committee (AC), and external auditors (EAs). Studies have long considered SM and AC the IAF’s “two masters” by maintaining that satisfying their expectations increases the IAF’s organizational relevance (Abbott, Parker, & Peters, 2010; Hoos, Messier, Smith, & Tandy, 2014; Roussy, 2015; Soh & Martinov‐Bennie, 2011). The IA literature considers auditees to also be an IAF stakeholder because, in line with Freeman’s seminal definition, auditees are affected by the IAF’s activities and may also influence the effectiveness and efficiency of these activities. Studies hold that auditees’ behaviors may affect the IAF’s effectiveness, defined as “the ability to help the organization to achieve its objectives by improving the quality of internal control (IC), risk management (RM) and corporate governance (CG) systems” (Lenz & Hahn, 2015, p. 7). For instance, an auditee who is reluctant to work with the auditors, by, for instance, retaining relevant information or refusing to cooperate, could reduce the IAs’ ability to detect IC and RM weaknesses or to investigate the root causes of problems in order to propose solutions to them (Dittenhofer, 2001). A reluctant auditee also increases the likelihood that IAs do not detect a problem during an audit process, which may damage the IAs’ reputation among the primary stakeholders if such a problem surfaces after the audit. Since IAs on their own are unable to enhance an organization’s IC, RM, and CG systems, they should gain support from auditees without comprising their independence and objectivity. In this perspective, they must pay attention to auditees’ legitimacy interests and should carefully manage relationships with them. Relationships between auditees and IAs are very sensitive and could lead to conflicts. This is particularly true when the auditees see IAs as the police and are reluctant to communicate clearly and transparently with them (Sakka & Manita, 2011). But, since this relationship is bidirectional, ineffective interactions can also be the result of poor attitudes, skills, and behaviors on the part of IAs. Chambers and McDonald (2013) considers relationship‐building a high‐value non‐technical capability that IAs should possess in order to succeed in an organization, as this helps them to foster mutual trust and credibility and to reduce friction and conflict.