The Position of Internal Auditing in different Corporate ... · The Position of Internal Auditing...
Transcript of The Position of Internal Auditing in different Corporate ... · The Position of Internal Auditing...
The Position of Internal Auditing in different Corporate Governance-
Systems – An empirical analysis for the European Countries
Prof. Dr. Marc Eulerich, Dipl.-Kfm. Jochen Theis, Dr. Patrick Velte
1. Introduction
Today the role of internal auditing in the field of corporate governance, which implies
especially interactions with the board, the audit committee and the external auditor, has met
with enlarged courtesy in management research and business practice. This is also highlighted
from an international perspective by standard setters such as the EU Commission and the US
lawmaker. Not only since the financial crisis of 2008/09 lawmakers try to improve the quality
of corporate governance (i.e. green papers of the EU Commission “Corporate Governance in
Financial Institutions and Remuneration Policies”, “Further Approach in the Area of Annual
Auditing” and “European Corporate Governance Framework”) (EC, 2010a; EC, 2010b; EC,
2011).
In particular, these measures aimed at strengthening the supervision activities performed by
the individual corporate governance entities (external auditor, supervisory board or non-
managing members of the board of directors including the audit committee and the internal
auditing). The existing discussion on the further development of corporate governance has
also an influence especially on the issue of the internal auditor’s position within the company.
In view of this fact, the present study investigates the design of corporate governance
structures with a European versus a US perspective on an explanatory basis with a focus on
the position of internal auditing and its cooperation with the audit committee. The intention of
our empirical analysis is to draw conclusions on the relevance of the internal auditing within
the overall governance construct and in connection with the audit committee. Using a
structural equation model allows us to analyze the relationship and interactions of internal
auditing with other governance bodies and prove which influence the internal auditing has on
the design and achievement potential of corporate governance.
The remainder of this paper goes as follows: In chapter 2 we shortly outline the limited prior
research in the field of interest before we introduce our hypotheses. The research design is
described in chapter 3. While the results of the empirical approach are presented in chapter 4,
a qualitative analysis of the empirical findings will follow in chapter 5. We finally conclude
with noting some limitations of our study and with outlining several ideas for future research.
2. Theoretical background and hypothesis development
Current scientific knowledge on the structure of internal auditing within the corporate
governance system is scarce and mixed. One reason for this may be that scholars have mainly
devoted their attention to the relationship between internal and external auditing (see for
instance Brody et al., 1998; Grant et al., 2009; Desai et al., 2010; Mihmet and Admassu,
2011). Until now, few studies have similarly investigated the mechanism of internal auditing
and the audit committee. However, whilst the practical wisdom tells us that internal auditing
is an integral part of good corporate governance, few empirical studies document that.
Based on the economic justification for the implementation of an internal auditing in the one-
tier as well as in the two-tier system according to the principal-agent theory, the key
hypotheses of empirical research shall be derived in the following despite the present study’s
exploratory character. Since studies sharing the principal objectives of the present analysis are
still largely inexistent, the deduction shall take place in an iterative manner and on the basis of
previous scientific findings. For this purpose, the relationship between the internal auditing
and the audit committee is analyzed in a first step before the relationship with the governance
structure is established in another step. As a basic principle, two different explanations are
possible to determine the position of the internal auditing within the governance structure:
Firstly, internal auditing can support the control function of the (supervisory) board and audit
committee and therewith the whole governance (Turley and Zaman, 2004; Hahn et al., 2008),
i.e. the internal auditors play the role of a principal supporter for the (supervisory) board for
topics like fraud, safeguarding of assets and integrity of financial information. Secondly,
internal auditing is an integral part of the governance structure on its own. Both ideas underlie
several determinants, which have to be integrated in our model.
To act conductively, the internal auditing first of all needs to have an adequate organization.
Especially as far as interaction with the audit committee is concerned, organization options
are conceivable in this context, in which the audit committee exerts influence on the activities
of the internal auditing for instance via the reporting line, via the possibility to appoint the
head of internal auditing (one-tier system) or make this appointment subject to its approval
(two-tier system) or through an assessment of the internal auditing activity. In addition,
compliance with the four professional principles of the Institute of Internal Auditors (IIA)
(independence, integrity, impartiality and confidentiality) leads to better cooperation with the
audit committee, since it provides the internal auditing with an acknowledged position in the
governance structure (Abbott et al., 2010; Gramling and Hermanson, 2006). This leads to the
following hypothesis H1:
H1: The internal auditing cooperates closely with the audit committee through a
structural component (organization) and a practical component (compliance with
the professional standards).
As a result of the close cooperation described in H1, the audit committee becomes a more
efficient governance body within the overall system. The effect on the corporate governance
structure is thus increased in a verifiable way. For instance, this can be proved through the
resulting improved level of information of the audit committee. Moreover, an audit committee
receiving support from the internal auditing obtains a stronger position in the framework of
the three-lines-of-defense model. Insofar, the following hypothesis H2 can be derived:
H2: Through close cooperation between internal auditing and audit committee, the audit
committee is able to exert positive influence on the internal governance structure.
Compliance with the professional principles of the IIA determines the practical activity of the
internal auditing with respect to effectiveness and efficiency. Through this kind of orientation,
not only the company’s governance structure is to be enhanced, but also the functional
capability of the three-lines-of-defense model to be guaranteed. Furthermore, the professional
orientation of internal auditing activities provides added value to the company for instance
through the better revelation of inefficiencies, errors or fraud. Insofar, hypothesis H3 is as
follows:
H3: Through compliance with the professional principles, the internal auditing enhances
the governance structure and provides added value to the company.
The organization of the internal audit department exerts influence on the functional capability
of the internal auditing. Through a corresponding structural connection with the overall
organization, the internal auditing is able to act more effectively and therefore likewise
guarantees the functional capability of the three-lines-of-defense model and ensures
improvement of the governance structure. In addition, a productive internal audit organization
provides added value to the company, since the auditing processes are implemented more
efficiently (Arena and Azzone, 2009), as is expressed in hypothesis H4.
H4: A productive organization of the internal auditing enhances the governance
structure and provides an added value to the company.
Especially under the Sarbanes Oxley Act (SOA), the establishment of an internal auditing has
been made obligatory for the US one-tier board. In addition, the above-described theoretical
foundation in the one-tier board leads to improved cooperation with the audit committee. For
that reason, the integration of internal auditing into the governance structure is verifiably
greater in the US than in Europe, so that hypothesis H5 results. Figure 1 illustrates the overall
model including the individual hypotheses.
H5: Due to the increased regulatory density under the SOA, the findings gained for the
US deviate considerably from the findings for the EU, with the effect being more
extensive in the US than in the EU.
Figure 1: Overall model including all individual hypotheses
3. Research design
3.1 Data collection
The present study has drawn on data from the “Common Body of Knowledge (CBOK)” study,
which was conducted in 2010 on behalf of the Research Foundation of the IIA. In the
framework of the CBOK study, a data basis of 13,582 evaluable questionnaires from 107
countries was generated. As a basic principle, the CBOK study did not address itself explicitly
to a certain group of potential participants, but referred expressly to a wide group of target
persons with relations to the internal auditing sector. More than 30% of the survey
participants have passed the examination of “Certified Internal Auditor (CIA)”, and 22% of
the survey participants hold the position of “Chief Audit Executive (CAE)” in their
companies. In addition, more than 90% of the survey participants are members of the IIA.
For the present study, the available raw data were first grouped by countries. In this context,
the national association of the IIA, of which the survey participant was a member where
applicable, was not decisive for the allocation of a data set. Instead, the crucial point was the
country, in which the survey participant predominantly pursues his professional activity, since
the focus of the conducted country comparison was supposed to be on structural differences in
the company organization with regard to the internal audit division. Initially, it was possible
to identify 3,144 data sets (evaluable questionnaires) for the US. In contrast, data from a total
of 3,294 questionnaires were evaluated for the 26 EU member states. Due to the basic
configuration of the presented structural equation model and the questions included in the
modeling, the existence of an audit committee in the company is a necessary requirement for
a data set’s inclusion in the estimation of the structural equation model. In an international
comparison, there are different degrees of compulsion for the implementation of audit
committees in the one-tier and two-tier system. Following the elimination of all datasets,
where the respective company does not have an audit committee or where the questions
included in the structural equation model were answered only in an incomplete way, 254 and
306 evaluable data sets remain for the US and the EU respectively, which are included in the
estimation of the structural equation model. From the 304 evaluable data sets for the EU, 65
come from the United Kingdom, 41 from Germany and 40 from France.
3.2 Operational measures
All constructs in the presented model were specified reflectively. In this context, the
respective constructs are reflected by a number of indicators, which stand in an elsewhere
explained relationship with their constructs in terms of content and argumentation (see Table
1). The indicators of the constructs “Professional Ethics”, “Value Added”, “Governance” and
“Three Lines of Defense” are based on questions from the CBOK study, which had to be
answered in the questionnaire on a 5-point Likert scale. Whereas no adjustment to the data
material had to be made for the Likert-scaled indicators, recoding of the essentially
categorical data was required for the indicators of the constructs “Cooperation” and
“Organization”. As a rule, a dummy variable was established for each and every indicator, to
which the value 1 was assigned provided that the answer of the survey participant reflects the
intended relation with the audit committee. For the indicator “Appointment” of the construct
“Organization”, the dummy variable for instance assumes the value 1 if, when confronted
with the question “Who is involved in appointing the chief audit executive (CAE) or
equivalent?”, the survey participant has selected (among others) the predetermined answering
option “Audit committee/committee chairman”. All further interpretations of the initial data’s
recoding can be seen in Table 1. The validity of the constructs established in the present form
will be shown elsewhere through a discussion of the common validity figures (Cronbach's
Alpha, Composite Reliability, Average Variance Extracted).
Latent Variable Indicators Interpretation of Values
Professiona Ethics
x11 Credibility “Your internal audit activity is credible within your organization.” (1= strongly disagree, 5=strongly agree)
x12 Independence “Independence is a key factor for your internal audit activity to add value.” (1= strongly disagree, 5=strongly agree)
x13 Objectivity “Objectivity is a key factor for your internal audit activity to add value.” (1= strongly disagree, 5=strongly agree)
x13 Sufficiency “Your internal audit activity has sufficient status in the organization to be effective.” (1= strongly disagree, 5=strongly agree)
Organisation x21 Appointment 1=AC appoints CAE, 0=else
x22 Reporting Line 1=respondent reports to AC, 0=else
x23 Evaluation 1=AC evaluates respondent, 0=else
x24 Signature 1=AC chairman signs report on IC, 0=else
x25 Written Report 1=respondent prepares written report for AC, 0=else
Cooperation y11 Additional Private Sessions 1=respondent interacts with AC in addition to regular meetings, 0=else
y12 Appropriate Access 1=respondent has appropriate access to AC, 0=else
y13 Regular Private Sessions 1=respondent meets with the AC in private sessions during regular meetings, 0=else
y14 Regular Meetings Percentage of formal AC meetings attended by respondent
Value Added y21 Value Added “Your internal audit activity adds value.” (1= strongly disagree, 5=strongly agree)
Governance y31 Better Governance “One way your internal audit activity adds value to the governance process is through direct access to the audit committee (or equivalent).” (1= strongly disagree, 5=strongly agree)
y32 Integral Part of CG “Your internal audit activity is an integral part of the governance process by providing reliable information to management.” (1= strongly disagree, 5=strongly agree)
Three Lines
of Defense
y41 Governance Process “Your internal audit activity brings a systematic approach to evaluate the effectiveness of governance processes.” (1= strongly disagree, 5=strongly agree)
y42 Internal Control “Your internal audit activity brings a systematic approach to evaluate the effectiveness of internal controls.” (1= strongly disagree, 5=strongly agree)
y43 Risk Management “Your internal audit activity brings a systematic approach to evaluate the effectiveness of risk management.” (1= strongly disagree, 5=strongly agree)
Table 1: Indicators of the measurement model
3.3 Estimation
The present structural equation model consists of the six latent variables (constructs)
displayed in Figure 3. For estimation in the framework of the structural equation model, the
“Partial Least Squares (PLS)” method has been used. The need to apply the PLS method
largely results from the complex structure of the underlying data. Since, in addition, the
normal distribution assumption is rejected for the predominant number of variables included
in the structural equation model and, instead, unknown oblique frequency distributions have
to be assumed, the PLS method is preferable to other methods (such as the Maximum
Likelihood Method) within the described context (for a more far-reaching discussion, see for
instance Vilares et al., 2008 or Chin, 1998). All evaluations were conducted by using the
software SmartPLS (Ringle et al., 2007).
4. Results
4.1 Descriptive analysis
For the indicators based on 5-point Likert scalings, the arithmetic mean for the EU data set
ranges between 3.55 (y31 “Better Governance”) and 4.65 (x13 “Objectivity”) with a standard
deviation of at least 0.6 (x13) and no more than 1.16 (y31). Analogously, mean values in the
area between 3.76 (y31 “Better Governance”) and 4.61 (x13 “Objectivity”) and standard
deviations of at least 0.69 (x13) and no more than 0.89 (y31) result for the US (see Table 2).
For the indicators with binary recoding, it emerges for instance that in the EU area, the
chairman of the audit committees (among others) signs the “Report on Internal Controls” in
17% of the cases (in the US: 7%). For the EU, 85% of the survey participants said they had
adequate access to the audit committee; in the US, the corresponding share is 95%. On
average, survey participants in the EU are invited to 80% of the formal audit committees
meetings, whereas survey participants in the US receive invitations to even 95% of the
corresponding meetings.
Whereas the merely descriptive analysis of Likert-scaled indicators initially does not allow to
draw any obvious conclusions on region-specific differences in the participants’ answering
behavior, the indicators with binary recoding provide initial indications of a more direct
connection of the internal audit division to the audit committee in the US in comparison to the
EU. This deviation may be attributable in particular to the diverging regulatory frameworks
for internal audit divisions in the two groups of countries.
Construct EU USA
Indicators Mean SD Loading Mean SD Loading
Professional Ethics
x11
x12 x13
x14
4.33 4.55 4.65 4.06
0.71 0.72 0.60 0.96
***0.84 ***0.68 ***0.72 ***0.75
4.334.474.614.10
0.80 0.81 0.69 0.97
***0.87 ***0.80 ***0.85 ***0.83
Organisation
x21
x22
x23
x24
x25
0.29 0.22 0.36 0.17 0.71
0.46 0.42 0.48 0.37 0.45
***0.77 ***0.55 ***0.80 ***0.26 ***0.29
0.700.420.670.070.46
0.46 0.49 0.47 0.25 0.50
***0.87 ***0.18 ***0.87 ***0.06 **-0.07
Cooperation
y11
y12
y13
y14
0.61 0.85 0.45 0.80
0.49 0.35 0.50 0.34
***0.80 ***0.66 ***0.72 ***0.76
0.830.950.770.95
0.37 0.21 0.42 0.17
***0.63 ***0.76 ***0.73 ***0.52
Value Added y21 4.32 0.65 - 4.43 0.74 -
Governance y31
y32 3.55 4.00
1.16 0.89
***0.89 ***0.85
4.174.10
0.89 0.86
***0.91 ***0.86
Three Lines of Defense
y41
y42
y43
3.77 4.34 4.07
0.88 0.69 0.82
***0.81 ***0.80 ***0.84
3.764.444.02
0.86 0.74 0.85
0.80 0.88 0.83
***: significant at <0.01 level (two-tailed test)
**: significant at <0.05 level (two-tailed test)*: significant at <0.10 level (two-tailed test)
Table 2: Means, standard deviations and standardized loadings of manifest variables
4.2 Measurement reliability and validity
To assess the reliability and validity of the structural equation model, the internal consistency
reliability of the reflective measurement model is to be discussed in the first instance (see
Table 3). Both for the data set USA and the EU, the values for Cronbach’s Alpha and for
Composite Reliability exceed the value of 0.7, which is generally considered as critical, for
most of the latent variables (constructs) (Nunally, 1978 and Fornell and Larcker, 1981). Only
for the latent variable “Organization” are the corresponding values for both data sets far
below the critical value. All in all, the analysis indicates a high internal consistency of the
indicators that find their way into in the respective constructs; in a first step, construct
reliability can therefore be confirmed for both data sets. Through consideration of the
“Average Variance Extracted (AVE)”, it can furthermore be concluded in most of the cases
that the respective measurement models are distinguished by a high level of convergence
validity. Only for the construct “Organization” does the observed AVE value range far below
the critical value of 0.5 both in case of the US and of the EU data set (Fornell and Larcker,
1981). This leads us to the conclusion that, by and large, the variances recorded by the latent
variables are significantly higher than the ones caused by measurement errors. Moreover, the
reliability of the measurement models and the convergence validity are proved through an
analysis of the constructs’ standardized loadings and the associated bootstrap-t-statistics
(Anderson and Gerbing, 1988). The loadings of the indicators are largely higher than 0.7 and
essentially significant for both data sets. Only the loadings of the indicators x22, x24 and x29 of
the construct “Organization” are far below the critical value.
Latent Variables
EU USA
Cronbach’s Alpha
CompositeReliability
Average VarianceExtracted
Cronbach’s
Alpha Composite Reliability
Average VarianceExtracted
Professional Ethics
0.74 0.84 0.56 0.86 0.90 0.70
Organisation 0.46 0.68 0.34 0.19 0.51 0.31
Cooperation 0.71 0.82 0.54 0.58 0.76 0.44
Value Added - - - - - -
Governance 0.68 0.86 0.75 0.73 0.88 0.78
Three Lines of Defense
0.75 0.86 0.67 0.79 0.88 0.70
Table 3: Reliability and validity measures
Through consideration of the Fornell-Larcker criterion (Fornell and Larcker, 1981), the
discriminant validity of the reflective measurement models can finally be represented as well.
According to this approach, a latent variable is supposed to explain the variance of its own
indicators in a better way than the variance of all other latent variables. In Table 4, the square
root of the Average Variance Extracted for each and every construct is therefore compared to
the correlations between the latent variables. The discriminant validity can be confirmed for
both data sets, since the square root of the Average Variance Extracted for each and every
construct is higher than the correlation between the construct and all other constructs.
EU USA
Pro
fess
iona
l E
thic
s
Org
anis
atio
n
Coo
pera
tion
Val
ue A
dded
Gov
erna
nce
Thr
ee L
ines
of
Def
ense
Pro
fess
iona
l E
thic
s
Org
anis
atio
n
Coo
pera
tion
Val
ue A
dded
Gov
erna
nce
Thr
ee L
ines
of
Def
ense
Professional Ethics
0.75 0.05 -0.05 0.44 0.44 0.53 0.84 0.19 0.25 0.56 0.68 0.61
Organisation 0.58 0.39 0.09 0.29 0.10 0.56 0.39 0.07 0.24 0.12
Cooperation 0.73 0.05 0.39 0.07 0.66 0.14 0.37 0.16
Value Added
- 0.38 0.51 - 0.55 0.61
Governance 0.87 0.44 0.88 0.62
Three Lines of Defense
0.82 0.84
Numbers shown in boldface denote the square root of the average variance extracted
Table 4: Correlations between latent variables
4.3 Model estimation results
To first of all assess the explanatory potential of the structural equation model, the R2 values
of the endogenous latent variables will be discussed in the following (see also Table 5). For
the construct “Cooperation”, the lowest R2 results both for the data set of the EU (0.16) and
the data set of the US (0.19). The explanatory potential of the constructs “Value Added”,
“Governance” and “Three Lines of Defense” results from an R2 value of 0.20 (US: 0.31), 0.38
(US: 0.50) and 0.29 (US: 0.38). It turns out that the explanatory potential of the structural
equation model is consistently higher when the estimation of the model is based on US data
than when the EU data set is used. A comparison with the R2 values found in other studies
also permits the overall conclusion that the explanatory potential of the presented structural
equation model is good and, consequently, supports the study’s validity (Mertenskötter, 2011,
p. 171).
EU USA
Criterion Predictors R² Path coefficient f² R² Path coefficient f²
Cooperation Professional Ethics 0.16 -0.07 0.19 **0.18 0.04
Organisation ***0.39 0.18 ***0.36 0.15
Value Professional Ethics 0.20 ***0.44 0.24 0.31 ***0.56 0.43
Added Organisation 0.04 -0.04
Cooperation 0.06 0.01
Governance Professional Ethics 0.38 ***0.45 0.24 0.50 ***0.62 0.67
Organisation **0.13 0.02 0.05
Cooperation ***0.37 0.17 ***0.19 0.06
Three Lines Professional Ethics 0.29 ***0.53 0.38 0.38 ***0.61 0.56
of Defense Organisation 0.04 -0.003
Cooperation 0.08 0.01
***: significant at <0.01 level (two-tailed test); **: significant at <0.05 level (two-tailed test) *: significant at <0.10 level (two-tailed test)
a Effect size measures the relevance of each predictor of a dependent latent variable and is based on the relationship of determination coefficients when including or excluding a particular predictor from the structural equation.
Table 5: Structural model results and effects sizesa (f2)
In the following, the estimated path coefficients of the model and the associated significances
are shown separately for the EU and the US data set (Table 5). In the event of the model’s
estimation by using the EU data set, a significantly positive, moderately strong (effect size f2
> 0.15; see Wilson et al., 2007) effect from the exogenous construct “Organization” on the
endogenous construct “Cooperation” emerges with a loading of 0.39. Moreover, a
significantly positive, moderately strong effect results from the exogenous construct
“Professional Ethics” to the endogenous construct “Value Added” with a loading of 0.20. The
constructs “Professional Ethics”, “Organization” and “Cooperation exert significantly positive
influence on the endogenous construct “Governance” in a moderately strong, weak (effect
size f2 > 0.02) and moderately strong way respectively through loadings of 0.45, 0.13 and
0.37 respectively. In case of the endogenous construct “Three Lines of Defense”, by contrast,
a significantly positive interdependence has emerged only with the exogenous construct
“Professional Ethics” [strong effect (effect size f2 > 0.35) with a loading of 0.53].
Where data from the US are used for the estimation of the model, significantly positive
influence on the endogenous construct “Cooperation” is exerted both by the exogenous
construct “Professional Ethics” and by the exogenous construct “Organization” (weak and
moderately strong effect with a loading of 0.18 and 0.36 respectively). For the endogenous
construct “Value Added”, a significantly positive impact is found by the exogenous construct
“Professional Ethics” (strong effect with a loading of 0.56). In the event of the US data, only
the constructs “Professional Ethics” and “Cooperation” exert significantly positive influence
on the endogenous construct “Governance” with loadings of 0.62 (strong effect) and 0.19
(weak effect) respectively. For the construct “Three Lines of Defense”, it has been found that
a strong, significantly positive effect with a loading of 0.61 is caused by the exogenous
construct “Professional Ethics”. As a rule, loadings can be confirmed in the event of both data
sets at a significance level of 1%, but at least at a significance level of 5%.
Concludingly, the total effects in the structural equation model are to be presented in Table 6.
The most significant total effects for both the EU and the US data set can be found for the
exogenous construct “Professional Ethics”. For the three constructs “Value Added”,
“Governance” and “Three Lines of Defense”, total effects of 0.44, 0.43 and 0.52 result in case
of the EU data. In this context, the total effects result from a combination of path coefficients
of the direct paths between the construct “Professional Ethics” and the respectively
considered construct, and from the indirect relationship via the construct “Cooperation” (see
Figure 3). In the event of the US, the corresponding total effects are comparatively higher and
amount to 0.56, 0.65 and 0.61. Furthermore, significant total effects result both in case of the
EU and the US data between the construct “Organization” and the construct “Governance”.
These total effects amount to 0.27 (EU) and 0.12 (US), with the total effect being composed
of a direct influence as well as of an indirect influence via the construct “Cooperation”.
As regards the hypotheses, the results described above can be summarized as follows:
Whereas H1 can be fully confirmed for the US, this is only partially possible for the
EU.
H2 is basically confirmed for the US and the EU. However, a comparison of effect
sizes shows that the effect of cooperation between the internal audit division and the
audit committee on the governance structure is stronger in the EU than in the US.
H3 can be assumed as fully applicable. A significantly positive effect of compliance
with the professional principles on the governance structure and on the creation of
added value is verifiable for the US as well as for the EU.
H4 is to be assumed only for the correlation with the governance structure in the US,
whereas a positive effect on the three-lines-of-defense model or the creation of added
value cannot be verified. In the EU, all respective relationships are insignificant.
The differences outlined in H5 for the US and the EU are likewise confirmed in
principle. Whereas compliance with the professional principles has a significantly
positive effect in both systems, the extent of effects is different. The same applies to
the organization of the internal audit division and to the cooperation with the audit
committee.
Whereas a purely statistical presentation of results from the estimation of the structural
equation model was given in the above section, the qualitative analysis and evaluation will be
realized in Chapter 5.
Predictor
Criterion
EU USA
Coo
pera
tion
Val
ue A
dded
Gov
erna
nce
Thr
ee L
ines
of
Def
ense
Coo
pera
tion
Val
ue A
dded
Gov
erna
nce
Thr
ee L
ines
of
Def
ense
Professional Ethics -0.07 0.44 0.43 0.52 0.18 0.56 0.65 0.61
Organisation 0.39 0.06 0.27 0.07 0.36 -0.04 0.12 0.00
Cooperation - 0.06 0.37 0.08 - 0.01 0.19 0.01
Table 6: Total effects
5. Summary of the Results
Point of departure of this research was the ambiguity in the current knowledge on the
organization of internal auditing within the internal corporate governance structure and the
cooperation of internal auditing and audit committee. This study distributes empirical support
for a direct and indirect effect of the internal auditing’s work on the internal governance
structure and the three-lines-of-defense model, thereby providing important implications for
internal auditing theory and practice.
According to the principal-agent theory, which underlies the present analysis, as well as to the
basic standards of empirical research, the activities of the internal auditing are of central
importance in the framework of corporate governance. This applies both to the one-tier
system (board of directors, for instance in the US) and to the two-tier system, which is
compulsory in a number of EU member states (executive and supervisory board, for instance
in Germany and Austria). On the question of which specific tasks are performed in detail by
the internal auditing und how the cooperation with other corporate governance entities (such
as the audit committee or the external auditor) is shaped, has not been subjected yet to a
comprehensive empirical analysis from a perspective that ranges across the different countries
and systems. The presented hypotheses illustrate which essential features and attributes can be
assigned to the internal auditing. Against this backdrop, the available results make an
empirical contribution focusing on the internal auditing’s position in the governance system
and the relationships between the individual core elements. In addition, the comparison of
country-specific results allows us to integrate the influence of changing regulatory
requirements into the analysis.
The fact that the work of the internal auditing exerts significant influence on the design of the
governance structure can be considered as positive. In this context, the presented system
illustrates the two key components of the internal audit function, i.e. the practical component
of compliance with the professional principles on the one hand and the structural component
of the internal auditing’s adequate organization in the company on the other. Furthermore, the
relationship between the internal auditing and the audit committee, which is analyzed in a
number of empirical studies, is another integral part of the internal governance structure, with
both the structural and the practical internal audit component being taken into consideration in
this context.
In conclusion, the presented components are distinguished by having a positive effect on the
governance structure. In addition, positive relationships can be proved with the value
component and the three-lines-of-defense model, reflected in the risk management, the
internal control system and the effectiveness of the governance process. These relationships
differ in terms of strength. All in all, the study reveals a strong empirical correlation capable
of proving the proposed hypotheses. Based on the agency-theoretical modeling, the results
show that internal auditing also exerts positive influence on the governance structure as a
separate corporate governance body. By contrast, the reinforcing effect of cooperation with
the audit committee can be proved only conditionally. A significant correlation between
cooperation with the audit committee and the quality of corporate governance can only be
proved for the construct “Governance”. A more profound analysis of the effect sizes shows
that these effects are higher in the EU than in the US.
The two constructs “Professional Principles” and “Organization” have different levels of
influence, with precisely the practical component of the professional principles having a
verifiably positive impact on the areas “Governance”, “Three-Lines-of-Defense” and “Value
Added”. In contrast, the organizational form of the internal auditing does not exert any
significant influence on these three constructs. However, a significant correlation is verifiable
for the cooperation with the audit committee. Cooperation between the internal auditing and
the audit committee has a significant impact only on the organization of the governance
structure with no significant influence being exerted on the other two constructs.
In international comparison, it emerges that charges in the model are higher for the US than
for the EU in a majority of the correlations. This is identifiable at least for the relevant
relationships. In particular, the impact of the professional principles is higher in all areas in
the US. This result is attributable to better institutionalization of the profession on the one
hand and to the fact on the other that regulatory requirements under the SOA are more case
law-based in comparison to those in the EU. The professional principles have a significant
impact especially as far as cooperation with the audit committee is concerned. Whereas a
significant correlation cannot be verified in the EU, the professional principles are a
significant part of this cooperation in the US. Against the backdrop of the SOA, it can be
referred to particularly to the codification of the internal control sections. Both for the EU and
for the US, neither the organization of the internal auditing nor the cooperation with the audit
committee have a verifiable positive effect in the area of the “value added” function. The
effects on the construct “Governance” are highly significant both for the EU and for the US.
Only the aspect of organization shows no significant correlation for the US.
In an overall view, it emerges that the internal auditing is a key element of the governance
structure and has a positive impact on the efficiency of corporate governance. In this context,
the three constructs “Governance”, “Three-Lines-of-Defense” and “Value Added” illustrate
the actually most important objectives of the internal auditing. The latter is supposed to be a
crucial actor with regard to the revelation of grievances and problems in the company in the
framework of the three-lines-of-defense model and hence to support the governance structure.
In addition, however, the internal auditing also acts as a key governance body and supporting
entity in performing the supervisory function towards the executive board and the supervisory
board (two-tier system) or the board of directors (one-tier system). Finally, the internal
auditing is also supposed to create “value added” for the company either within the meaning
of revealing problems and grievances or in the sense of precautionary protection. The results
provide evidence that, in particular, the practical component of the internal auditing unit,
represented through compliance with the professional principles, provides a significant
contribution to accomplishing the objectives. By contrast, the organization of the internal
auditing seems to achieve this goal only in individual cases. Whereas a significant effect is
verifiable in the EU, this is not the case for the US, with the aforementioned differences in
terms of regulation (such as the SOA) being capable of serving an explanation. The close
cooperation between the internal auditing and the audit committee, which is often emphasized
in the literature as a key element of corporate governance, can only be confirmed
conditionally within the context of this study. Although there is a positive effect or influence
of the internal auditing on the activities of the audit committee and, in addition, on the
governance structure, this effect is only of a low (for the US) to medium scale (for the EU).
By contrast, the direct impact without cooperation with the audit committee is to be
considered as high. The stronger position of the internal auditing in the US in terms of its
direct effects seems to produce a lower level of contribution as far as cooperation with the
audit committee is concerned in comparison to the EU, where the internal auditing still
achieves a less significant effect.
Summarizing the results against the backdrop of the different regulatory frameworks, a clear
picture emerges. Both in the US, which is subject to strict regulation under the SOA, and in
the EU, which is characterized by a lower density of regulation with regard to the internal
auditing, internal auditing acts as a key body of corporate governance. In its current green
papers on corporate governance and external auditing, however, the EU Commission plans
far-reaching reform measures to strengthen the quality of the governance bodies (internal
auditing, audit committee, external auditor). In this context, especially the contribution of the
internal auditing to protect the company within the meaning of the three-lines-of-defense
model and the creation of “value added” for the company is supposed to be increased.
6. Limitations and Further Research
Some limitations of our research are worth noting. The research has been conducted for two
regions (USA and EU). Although our results are very consistent within the two regions, the
empirical model should be tested in other regions and countries, too. We might expect that the
relative importance of internal auditing and the audit committee is different in other countries.
The relative importance of the internal auditing determinants may depend on the level of
regulation of the governance body, the board-model and a range of possibilities in the legal
regulations. Therefore, the place of internal auditing in the governance structure may be
greater or smaller than in other countries. Also the importance of the moderating effects may
vary across countries.
Moreover, it needs to be noted that a study initiated by the IIA may be characterized by
deficits in terms of objectivity. Due to the high sample size, however, this restriction is to be
considered as only limited. In addition, it has to be pointed out that the questions of the
CBOK study were not developed originally to reflect the indicators used in the structural
equation model.
Future research should also test these models for other regions. In addition, a differentiated
consideration of industries or company sizes may be able to produce more far-reaching
insight. Finally, while we do provide an answer on the question whether internal auditing is
an integral part of corporate governance or not, we leave the question unanswered what other
“players” determine the governance.
Literature
Abbott, L.J., Parker, S., Peters, G.F., 2010. Serving two masters. The association between
audit committee internal audit oversight and internal audit activities. Accounting
Horizons 24 (1), 1-24.
Anderson, J.C., Gerbing, D.W., 1988. Structural Equation Modeling in Practice: a Review
and Recommended Two-Step Approach. Psychological Bulletin, 103 (3), 411-23.
Arena, M., Azzone, G., 2009. Identifying Organizational Drivers of Internal Audit
Effectiveness. International Journal of Auditing 13 (1), 43-60.
Brody, R.G., Golen, S.P., Reckers, P.M., 1998. An empirical investigation of the interface
between internal and external auditor. Accounting and Business Research 28 (3), 160-
172.
Chin, W.W., 1998. The Partial Least Squares Approach to Structural Equation Modeling. In:
Marcoulides, G. A. (Ed.), Modern Methods for Business Research, chapter 10, NJ
Lawrence Erlbaum Associates.
Desai, V., Roberts, R.W., Srivastava, R. 2010. An analytical model for external auditor
evaluation of the internal audit function using belief functions. Contemporary
Accounting Research 27 (2), 537-575.
EC, 2010a. Grünbuch. Weiteres Vorgehen im Bereich der Abschlussprüfung. Lehren aus der
Krise. KOM(2010) 561 endgültig, abrufbar unter: http://eur-
lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2010:0561: FIN:DE:PDF
EC, 2010b. Grünbuch. Corporate Governance in Finanzinstituten und Vergütungspolitik.
KOM(2010) 284 endgültig, abrufbar unter: http://ec.europa.eu/internal_market/company/
docs/modern/com2010_284_de.pdf
EC, 2011. Grünbuch. Europäischer Corporate Governance-Rahmen. KOM(2011) 164/3,
abrufbar unter: http://ec.europa.eu/internal_market/company/docs/modern/com2011-
164_de.pdf
Fornell, C., Larcker, D.F., 1981. Evaluating Structural Equation Models with Unobservable
Variables and Measurement Error. Journal of Marketing Research, 18 (1), 39-50.
Gramling, A., Hermanson, D., 2006. What role is your internal audit function playing in
corporate governance? Internal Auditing 2010 (6), 37-39.
Grant, C.T., Park, N., Wheeler, S. W., 2009. Non audit, external audit, and internal audit
services in a post-SOX world Internal Auditing 24 (1), 28-35.
Hahn, U., Quick, R., Mandre, S., 2008. Corporate Governance-Frameworks und Interne
Revision. Schweizer Treuhänder 82 (9), 695-706.
Mertenskötter, M., 2011. Qualität, Vertrauen und Akzeptanz im Kontext der Internen
Revision. Josef Eul Verlag, Köln.
Mihret, D.G., Admassu, M.A., 2011. Reliance of External Auditors on Internal Audit Work.
International Business Research 4 (2), 67-79.
Nunnally, J. C., 1978. Psychometric Theory (2nd Ed.). McGraw-Hill, New York.
Ringle, C.M., Wende, S., Will, A., 2007. SmartPLS 2.0 M3, University of Hamburg.
Turley, S., Zaman, M., 2004. The corporate governance effects of Audit Committees. Journal
of Management and Control 8 (3), 305-332.
Vilares, M.J., Almeida, M.H., Coelho, P.S., 2010. Comparison of Maximum Likelihood and
PLS estimators for structural equation modeling. A simulation with customer satisfaction
data. In: Vinzi, V., Chin, W., Henseler, J., Wang, H. (Eds.). Handbook of Computational
Statistics - PLS and Marketing, Springer, Heidelberg/New York.