Abstract

Introduction

Conceptional and Operational Framework

Sample, Variables, and Methodology

Results

Discussion

References

Funding

Author information

Ethics declarations

Additional information

Supplementary Information

Rights and permissions

About this article

Abstract

The internal audit function (IAF) has become one of the main pillars of good corporate governance. Empirical findings show that the size of the IAF varies considerably across companies. This study analyzes the relationships between selected company characteristics as determinants of intra-company information asymmetries and the size of the IAF as an indicator of intra-company monitoring. We test these relationships by analyzing comprehensive survey data obtained from chief audit executives from 283 Austrian, German, and Swiss companies. Using a nonparametric regression approach, we identify significant nonlinear relationships between company characteristics and IAF size. The empirical analysis identifies threshold levels for several metric company characteristics, such as the number of employees and the number of subsidiaries, whose relationships with the size of the IAF change its intensity.

Introduction

The level of acceptance of internal auditing as a crucial element of good corporate governance has been increasingly acknowledged (e.g., Carcello et al. 2020; Eulerich and Eulerich 2020; Gramling et al. 2004). Internal auditing can be seen as “a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes” that can “add value and improve an organization’s operations” (Institute of Internal Auditors 2016). In this context, the Institute of Internal Auditors, the worldwide standard-setting body, as well as other regulating institutions, such as the United States Securities and Exchange Commission and the New York Stock Exchange, require listed companies to implement an internal audit function (IAF). While the benefits of an effective IAF are manifold and well documented in the literature, research that provides reliable empirical insights on IAF is still incomplete (DeFond and Zhang 2014; Christ et al. 2021).

We investigate from an organizational perspective whether and to what extent several company characteristics that largely determine intra-company information asymmetries are associated with different sizes of the IAF of European companies. A special feature of the empirical method applied in this paper is that it takes into account nonlinear relationships between metric company characteristics and the size of the IAF. Also, it directly estimates the effective nonlinear relationships based on the available observations. The empirical results show that there are significant nonlinear relationships between company characteristics, such as the number of employees, the number of subsidiaries, and the intensity with which different stakeholders use IAF, and IAF size. We identify threshold levels for these metric company characteristics whose relationships with the size of the IAF change its intensity. As a result, the identified nonlinear relationships create a more holistic understanding of the determinants of the size of the IAF.

1- Introduction

2- Institutional background and regulations of internal control in Taiwan

3- Literature review and hypothesis development

4- Research design

5- Results

6- Additional analysis

7- Discussion and conclusion

References

Abstract

The internal audit function (IAF) assists management in improving internal controls over operations, reporting, and compliance. While many studies examine the association between the IAF and the internal control over financial reporting (ICFR), little is known about internal control over operations and compliance. Using a unique dataset from Taiwan, this paper examines the association between IAF quality and internal control deficiencies in operations and compliance. The results suggest that a larger internal audit team can enhance internal audit performance for both operations and compliance, whereas internal auditor competence is positively associated with the effectiveness of internal control over compliance, but not operations. This study contributes to the literature by shedding light on the determinants of the achievement of operations and compliance objectives. It also provides important implications for stakeholders and practitioners, as a company’s control over operations and compliance may mutually influence its ICFR and ultimately its business success.

Introduction

An effective internal audit function (IAF) can ensure quality corporate governance by assisting management in improving internal controls (Chartered Institute of Internal Auditors, 2015). The key responsibilities of internal auditors are to examine, evaluate, and monitor the adequacy and effectiveness of internal control objectives over operations, reporting, and compliance (American Institute of Certified Public Accountants [AICPA], 2008; Committee of Sponsoring Organizations of the Treadway Commission [COSO], 2012; Institute of Internal Auditors [IIA], 2012).1 While many studies investigate internal control over financial reporting (ICFR) (e.g., Abbott et al., 2016; Ege, 2015; Lin et al., 2011; Prawitt et al., 2009), data constraints have ensured that so far there has been relatively little empirical research that assesses internal control over operations and compliance.

The internal audit function (IAF) is an important component of high-quality corporate governance. We study how the head of internal audit perceives the executive management team and the audit committee to rely on the IAF’s work. It is not obvious from prior work or professional anecdotes whether the IAF satisfies the needs of both groups. If multiple factors influence the IAF’s work, chief audit executives (CAEs) may find themselves in a situation with competing demands, which could then compromise quality for all stakeholders. Based on a unique dataset from CAEs, two logistic regression models identify factors that influence the degree to which IAF’s results are perceived as being used by both executive management and the audit committee. The results show the existence of various factors that are relevant either to both groups (e.g., strategic project reports and IAF quality) or to only one (e.g., only audit committees are interested in risk management reports while only executive management teams are interested in internal control reports), depending on whether the IAF focuses on assurance or consulting work.

Introduction

In order to fulfill its duties as an objective and independent provider of assurance and consulting services, the internal audit function (IAF) reports to both executive management and the audit committee, both of whom need specific information provided by the IAF (Abbott, Parker, & Peters, 2010). However, these two stakeholders differ in their specific duties; thus, their intended uses of IAF-provided information and their requests of the IAF differ. For example, executive management likely depends on the IAF’s work to help them minimize the company’s risks and to improve the operations of the company; that is, they have a managerial focus. On the other hand, the interests of the audit committee are likely more focused on monitoring; that is, they seek stronger internal controls, regulatory compliance, or quality of financial reporting (e.g., Paape, Scheffe, & Snoep, 2003). The divergent objectives of these two stakeholders present potential confusion and can divide the attention of the IAF. In recent studies by two Big 4 accounting firms, IAF stakeholders (specifically audit committees, boards of directors, and senior executives) note a decreased satisfaction with their IAFs (KPMG, 2017; PwC, 2017), reporting overall satisfaction at only 44%, the lowest number reported since the measure has been collected. Among those respondents who report some satisfaction with IAF results, more than half still expect more from their IAF (PwC, 2017). Specifically, these stakeholders reported wanting more value in the areas of potential revenue enhancements, cost savings, or smarter capital expenditures. These findings indicate that both executive management and audit committees expect more; however, because both stakeholders have different expectations of IAFs (Lourens & Coetzee, 2018), IAFs might struggle to decide how to satisfy both groups, given their limited resources. To help internal audit better serve both stakeholders, it is important to understand what each group values about IAF work. Prior research has not examined what factors are associated with greater use of internal audit results by executive management teams and audit committees.

Recently, internal audit functions (IAFs) have gained increasing prevalence and enhanced status in companies. Such developments have been prompted by worldwide regulatory pressure for improved corporate governance owing to major financial scandals in the early 2000s. In the US, the New York Stock Exchange (NYSE) has mandated that listed companies formalise their IAFs since 2004, and the NASDAQ has considered adopting a similar rule (Securities and Exchange Commission (SEC) 2013). Outside the US, IAFs remain largely voluntary, but they are recommended as a ‘best practice’ for corporate governance in numerous countries (e.g. the UK, Denmark, Switzerland, and Sweden) and have become a common feature of medium to large companies worldwide (Mennicken and Power 2013). Evidence from prior studies shows that a high-quality IAF may have various benefits for firms, for instance, by improving internal controls, constraining earnings manipulation and fraud, reducing audit costs, and enhancing audit efficiency (Felix et al. 2001, Prawitt et al. 2009, Lin et al. 2011, Messier et al. 2011, Ege 2015, Pizzini et al. 2015). Because of the increasing prevalence and importance of IAFs and increasing regulatory attention on IAFs to enhance the quality of corporate governance worldwide (National Association of Corporate Directors (NACD) 1999, SEC 2002, Gramling et al. 2004, SEC 2004, Glover et al. 2008), there is a growing need to understand IAF quality in the current corporate governance context (Sarens 2009). Do variations occur in IAF quality? What are the internal and external factors that incentivise firms to establish high-quality IAFs? Given the complexity of corporate governance structures, what are the relationships between IAFs and other parties in the corporate governance mosaic? These questions are the impetus of our study. We extend prior research by exploring organisational and environmental factors that are associated with high-quality IAFs in an international context. Despite the significant increase in the number of studies on IAFs, most studies have been limited to single-country settings. An international setting offers more diverse levels of internal organisational structures, additional levels of operational complexity, and various external environmental conditions. A better understanding of the factors that influence firms’ incentives to develop high-quality IAFs in an international setting not only adds to our knowledge of IAFs but also facilitates awareness of governance practices worldwide

Evaluation of the strength of the internal audit function (IAF) has taken on increased significance due to stronger regulation around the evaluation of internal controls after SOX (2002) (Desai et al., 2011). When the IAF is strong, external auditors may choose to rely on their work (Public Company Accounting Oversight Board, PCAOB, 2007; International Federation of Accountants, IFAC, 2012). Recently, the literature has highlighted the need for more research on the degree of reliance the external auditor places on the work of the internal auditor (Messier et al., 2011; Weisner and Sutton, 2015). In addition, results of practice inspection reports of the Public Company Accounting Oversight Board (PCAOB) indicate external auditors often rely either too much or too little on the work of the internal auditor (Public Company Accounting Oversight Board, PCAOB, 2009). Understanding the structure of the external auditor’s strength judgment is a crucial first step to understanding their ultimate IAF reliance decision (Gramling et al., 2004) Bame-Aldred et al. (2012) note that results of prior studies examining how external auditors judge the strength of their clients’ IAF have been mixed and inconclusive. According to Krishnamoorthy (2002), this is likely because the interrelationships between the three internal auditor qualities that auditing standards dictate must be assessed by external auditors, i.e., work performance (W), competence (C) and objectivity (O) are complex. In addition, the way external auditors make judgments of the strength of the client’s IAF (i.e., how evidence is combined, weighted etc.) is largely unobservable. Thus, it is difficult to break apart the final strength judgment into component parts without some guidance from theory. Desai et al. (2010) develop a prescriptive model based on belief function theory [see Shafer (1976) and Srivastava and Mock (2002)] to better understand how auditors make these complex judgments. They argue that this model, due to its conceptual and intuitive appeal, is a particularly good candidate to act as the basis for an audit decision aid designed to guide auditors in forming this relatively complex, multi-input judgment.1 The objective of the current study is to examine how the Desai et al. (2010) model performs relative to the judgments of a group of external auditors experienced in evaluating the strength of their clients’ IAFs. We focus on two specific areas where we believe the strength outputs of the model may differ from the judgments of our sample of experienced external auditors. First, the model assumes that the impact of positive and negative evidence about the quality of the IAF on auditors’ judgments regarding the inter-relationships between W, C and O will be symmetric.2 Since auditors are trained to be skeptical, it is likely they will react more strongly to negative evidence than they will to positive evidence of the same magnitude (Butt and Campbell, 1989; Ashton and Ashton, 1988; Knechel and Messier, 1990). We formally test this prediction in H1. Second, the IAF strength judgment is complex and involves the evaluation and weighting of several preliminary judgments into one overall judgment. When individuals are faced with complex decisions, they tend to fall back on heuristics or simplifying decision rules (Payne et al., 1993). This can reduce the quality of decisions if individuals don’t take into account all available pieces of information. In the current context, IAF strength judgments based on convergent judgments about W, C and O (i.e., W, C and O are all judged to be high or low) are likely to be much less complex than are judgments based on conflicting evidence (i.e., some of W, C and O are judged to be high while others are low). Therefore, we predict that the judgments of our external auditor participants will be significantly different from the beliefs derived from the model when judgments about W, C and O are conflicting. We formally test this prediction in H2.

The role of auditors in the financial statement has been and continues to be an important issue for the auditing profession. Historically, Humphrey et al. (1992) argue that some hints of “audit expectation gap” (AEG) can be found on the back in the 19th century with the introduction of companies auditing, which appeared to exist for more than 100 years. Meanwhile, the roles of auditors are directly related to the function of management’s supervision, with the curatorship being regarded in the narrow sense of honesty and integrity (Flint, 1988). However, in early 1970s, Liggio was first used the word of ‘AEG’ in the literature, and continues to be debated on until today (Liggio, 1974; Lee et al., 2010). Liggio (1974, p.2) define it as the difference between the levels of expected performance “as envisioned by the independent accountant and by the user of financial statements”. In turn, Ruhnke and Schmidt (2014, p.573) define the expectation gap as “when auditors’ performance fails to meet the public’s expectations, an expectation gap occurs”. In reviewing study investigation the AEG and the development of the standard auditor’s report (Porter et al., 2009), it was noted that the AEG is not new, nor is limited geographically. Additionally, it has been 2 reported that the main reason for the gap derived from a failure by the profession, which ceased to keep pace with the changing situations in business, and in this view the onus lies with the auditing process and not with the users (The Cohen Commission AICPA (1978). However, this then resulted in concerns being raised about the auditor’s report becoming long, complex and less understandable. Porter (1991), states that the gap exists due to a deficiency in an auditor’s performance and auditing standards. However, most recently an empirical study conducted by Humphrey (1997), classified issues about the AEG in four key areas: audit reports and ensuring audit, audit independence and audit regulation. To solve the problem, due attention has been paid to the issue of the expectation gap by both the auditing professional societies and researchers all over the world. Numerous empirical studies in advanced countries conducted on the issue of the AEG including the USA (AICPA, 1978; Schelluch, 1996; Frank et al., 2001; Almer and Brody, 2002), the UK (Holt and Moizer, 1990; Hatherly et al., 1991; Humphrey, 1991; ICAI, 1992; Sikka et al., 1992; Innes et al., 1997), Australia (Gay and Schelluch, 1993; Schelluch and Gay, 2006), Canada (CICA, 1978), Germany (Ruhnke and Schmidt, 2014), and New Zealand (Porter and Gowthorpe, 2004). Most have focused on establishing whether an AEG exists in the country where they study was conducted and identifying some of its contributing factors.

The purpose of this paper is to investigate the contribution of internal audit function and audit committees’ effectiveness on accountability in Statutory Corporations (SCs) in Uganda in a single study. Accountability of State Owned Enterprises (SOEs) (also known as statutory corporations in some jurisdictions) is a crucial and growing topic in public management. In their guest editorial, Grossi, Papenfuß and Tremblay (2015), exemplify the importance of SCs but lament the scant empirical studies available on the topic. Yet in Uganda, for example, the Auditor General (AG) has for a number of years lamented and discovered accountability failures in this country. Thus, questions continue to abound about which models, mechanisms, instruments and processes SCs could employ for effective, efficient and sustainable accountability. According to Brennan and Solomon (2008) board composition, existence and performance of audit committees, external audit, institutional investors and functioning of internal audit can explain variances in accountability. However, according to Khongmalai, Tang and Siengthai (2010) most studies have focused on the private sector rather than the SCs’ sector, and focused on only one practice of corporate governance. For example, the board of directors or governing boards (Michie and Oughton, 2001; Nkundabanyanga, et al., 2015), internal control (Giroux and McLelland, 2003), internal audit (Xie et al., 2003), or risk management (Crawford and Stein, 2004). Except for the study of Khongmalai, Tang and Siengthai (2010), whose study’s value lay in the demonstration of the multi-attribute nature of the corporate governance model in SOEs in Thailand, to our knowledge, there is no study that has empirically tested the role of internal audit function and audit committee effectiveness in explaining accountability in the SCs, in a single study. Initially, we reason that since one of the audit committee roles is to review corporate accounting information and yet also internal audit must evaluate and contribute to improvement of internal controls, internal audit function and audit committee effectiveness should hybridize in order to obtain better accountability. Like in purely private corporations, this is possible in the SCs because King III (2009) has for instance introduced a combined assurance model that considers internal assurance units (e.g. internal and audit committee functions) as one of the three lines of defense along with management and external assurance providers. Within the context of accountability on the African scene, King III (2009) requires internal assurance mechanisms such as the audit committee function to ensure the integrity of financial disclosures considered one of the accountability mechanisms. Similarly, the government of Uganda enacted the Public Finance Management Act (PFMA) in 2015 which requires every government agency to have an internal audit function. Theoretically, because SCs are run by individuals with private interests yet such corporations are public in nature, we expect that to reduce the risk of principals (the public/ tax payers) making adverse judgements on the agent’s likelihood to pursue the principal’s interests, management of SCs are likely to seek the services of an internal auditor.