_______________________________________ Chapter 3: The Internal Audit Function 73

CHAPTER 3
THE INTERNAL AUDIT FUNCTION:
AN INTEGRAL PART OF
ORGANIZATIONAL GOVERNANCE
T. Flemming Ruud

The Institute of Internal Auditors Research Foundation

74 Research Opportunities in Internal Auditing

_________________________________

I. Introduction
Chapter 1 provides considerable discussion on the evolution of the internal auditing profession
over the last 60 years. To better understand and position internal audit in the context of
contemporary global organizations, a conceptual framework containing several organizational
governance issues is introduced in this chapter. Furthermore, this conceptual framework
serves as a road map to key topics presented in the remainder of the monograph. Relevant
authoritative standards from the newly issued Professional Practices Framework are cited to
support, clarify, or expand upon this new role for internal audit.

II. The Core of the Conceptual Framework

An early governance study, the Cadbury Report (1992), defined governance as the system
by which companies are directed and controlled. Similarly, discussed in the ROIA chapter
by Hermanson and Rittenberg, other definitions of governance have emphasized the structure
through which objectives are set, and how these are achieved and monitored. As Exhibit 31 shows, based on the strategic direction formulated by the top management and the board
of directors, the organization develops specific objectives and goals attempting to turn the
broad direction into operating, process-oriented, value-creating measures. To ensure these
transformation processes, a thorough understanding of the risk threatening the whole
organization or elements thereof is needed. Further, different control measures with indicators
and signals are installed to measure specific performance, indicate necessary correction,
and provide feedback to the operating management as well as to the top management and
the board in aggregated form. The controller reports on process performance, the external
auditors examine the financial accounting, and the audit committee engages in assuring the
provision and reporting of internal and external information. Finally, the organization furnishes
its shareholders and stakeholders with financial and operational information for continued
decision-making.
Within this direction and control loop, the internal audit function takes on important roles of
organizational governance, integrates several other governance and control aspects, and
stands out as the most important, single mechanism for ensuring adequate and effective
organizational governance.
The rest of the chapter describes these relationships in more detail. Any of the indicated
relationships can be subject for in-depth studies and a number of research questions are
provided to exemplify relevant research areas.

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 75

Exhibit 3-1
Internal Auditing in an Organizational Governance Framework
Shareholders
Financial Markets

Creditors

Government

Nomination
Committee
BoD

DIRECTION

CEO

Remuneration
Committee
Audit
Committee

Vision

In
Control

Goals

te

rn

Strategies

al

External Audit

Au
d

it

Risk Management

Controlling

Customers

Value Creation Process

Suppliers

CONTROL

Public

Implementation
Indicators

Signals
Employees

(Source: Ruud & Bodenmann, 2001, p. 522)

Understanding the Organization and its Objectives

Based on the strategic direction of an organization defined in a vision and a mission
statement, management develops and implements agreed-upon, realistic, and attainable
business strategies and performance goals. Strategies indicate how an organization intends
to achieve its objectives, while goals translate objectives to a measurable and achievable
level. Many factors influence the operation of an organization and, consequently, determine
which objectives the organization can reasonably seek to accomplish. Factors such as the
type of operations, the organizational size and structure (e.g., centralized versus decentralized
organization structure), or the capital base and structure, including compensation schemes
(e.g., total share capital and debt employed, privately held versus public company, stock-

The Institute of Internal Auditors Research Foundation

76 Research Opportunities in Internal Auditing

_________________________________

based compensation and incentives) all influence the organizational objectives and
capabilities.
An in-depth understanding of an organizations objectives- and goals-hierarchy is a
prerequisite for every successful internal audit function. The alignment of the internal audit
functions objectives with the organizations goals is also explicitly recognized in Standard
2010, these factors strongly influencing the nature, scope, and purpose of the internal audit
function.
The chief audit executive should establish risk-based plans to determine the priorities
of the internal audit activity, consistent with the organizations goals. (emphasis
added)
This top-down organizational objective hierarchy is illustrated graphically in Exhibit 3-1. It
indicates how an organization at best in congruence with the expectations of its stakeholders
chooses its desired strategic directions, how these objectives and goals are turned into
operating measures, and how they become important parts of organizational governance.
Decisions as to changing the organizational structures and operations as well as developments
in management and organizational practices influence the organizational governance.
Understanding these organizational relationships thus also forms the basis for structuring an
effective internal audit function.

Developments in Management and Organizational Philosophy and Practices

Many recent, and ongoing, developments in management and organizational philosophy
and practices have important implications for todays contemporary internal audit function.
Web of Relationships. Advances in global communications technology have transformed
todays multinational companies into virtual communication networks. Organizations today
are largely networked, extended enterprises that look boundaryless, prevailing business
models in B2B and B2C commerce feature supply chain management (SCM), customer
relationship management (CRM) initiatives, and a host of arrangements of strategic alliances,
outsourcing arrangements, co-branding and cross-branding efforts, as well as other affiliations.
This has also been remarked by Kiernan (1996, p. 6). The organizational architecture of
German industrial giant Daimler-Benz is becoming increasingly typical: the company now
includes not only its permanent in-house employees, but also strategic alliances (IBM,
Mitsubishi), joint development and production initiatives (Thomson and Fiat), and crossstakeholdings (Deutsche Bank, Saab, Banque Nationale de Paris). It is increasingly difficult
to tell where companies begin and end, and theres less and less point in trying to do so.

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 77

Indeed, organizations seem involved in an intricate web of relationships they are

consequently accountable to an ever-expanding stakeholder constituency, that is, they owe
responsibility to numerous parties or groups affected directly or indirectly by the organizations
actions and decisions.
Outsourcing Non-Core Functions. Organizations focusing on what they deem to be their
core competencies tend to exhibit a strong preference for outsourcing of non-core business
functions (Rittenberg & Covaleski, 1997, p. 1) In such contexts, the internal audit function
is less concerned with assuring the steps of the (internal) business processes, but instead
devotes more attention and resources to ensuring that the negotiated outsourcing contracts
are yielding the expected level of service quality, are being met timely, and are cost efficient.
This is exemplified by the new Standard 2110 and 2120 stating that compliance include
those of laws, regulations, and contracts.
Soft Controls. An emphasis, in many organizations, on softer organizational values,
ethics, and culture changes the control form as well as structure (COSO, 1992). The relevant
question in this context is: How should internal auditors audit business processes and aspects
where the controls have shifted and compliance of guidelines and policies can no longer be
audited in a traditional way? Control risk self-assessment is one method for providing
assurance by putting more emphasis on self-evaluation on the part of managers and employees
as process-owners.
Reengineering. Organization-wide reengineering, involving a fundamental rethinking and
radical redesign of business processes to achieve dramatic improvements in critical
contemporary measures of performance such as cost, quality of service, and speed, is
becoming commonplace (Gupta, 2001). These management-driven business process redesigns
and enhancements have had significant implications for the internal audit function, which
was charged with monitoring the change management efforts and providing feedback as to
whether they were successful.
Role of the Internal Audit Function. In todays business environment, the internal audit
function has become a major support function for management, the audit committee, the
board of directors, the external auditors, and other key stakeholders. When properly designed
and implemented, the internal audit function can play a key role in promoting and supporting
effective organizational governance. This is depicted in Exhibit 3-1 by the overarching
umbrella where some of the stakeholders are mentioned. Standard 2130 defines governance
processes as the procedures utilized by the representatives of the organizations stakeholders
(e.g., shareholders, etc.) to provide oversight of risk and control processes administered by
management. The internal audit function certainly fits within this definition.

The Institute of Internal Auditors Research Foundation

78 Research Opportunities in Internal Auditing

_________________________________

A Process-Oriented View of Value Creation and Risk Management

A key element of the new definition of internal audit is the focus designed to add value and
improve an organizations operations (IIA, 2002). Given todays complexity in an
organizations business activities, as well as of its business environment, the management of
isolated business activities and the negligence of the relationships between them have not
proven successful. Rather, a process-oriented management approach that integrates the whole
value chain (Porter, 1985) or the value network or value shop (Stabell/Fjeldstad,
2000) is necessary to ensure an organizations viability and prosperity. One of the main
business principles in this approach is the enhancement of customer satisfaction for both
internal and external customers. This is depicted in Exhibit 3-1 by the horizontal valuecreating process, ultimately linking the customers desires with the transforming processes
and vendors through procurement.
In order to provide most value-adding services, the internal auditing function needs to assume
a process-oriented audit approach as well (Roth, 2002). Indeed, given the organizationwide in-depth knowledge internal auditors accumulate throughout their careers, they are
particularly familiar with an organizations value creation and are therefore ideal consultants
for the improvement of an organizations processes. The improvement of internal processes
is likely to have a positive effect on suppliers and customers (e.g., cost savings, reduced
production times, improved quality of products), thus the internal audit function is also able
to add value to external parties. Assessing information all along the value creation process,
the internal audit function contributes to more reliable and relevant information than if isolated
information is evaluated. This also allows an improved relationship and cooperation between
the internal and external auditors and leads to more effective organizational governance
(see also Felix, Gramling, & Maletta, 1998).
A disciplined approach to value creation requires an organization to manage all significant
and likely risks effectively. Risk can be considered both at the macro or portfolio level
(enterprise-wide risk management) as well as the micro or departmental level. In Exhibit
3-1, risk management is indicated on the right side of the pyramid, and can be performed
internally or externally. Important to realize, however, is that the ultimate responsibility for
conducting risk management remains with top management and the board.
Just as crucial as it is to understand an organizations goals, is it crucial for an internal audit
function to understand the risks that either threat the achievement of objectives and goals
(Standard 2110) or that fail to identify and explore new opportunities for the organization.
Internal auditing is therefore expected to apply an integrated, process-oriented approach to
the evaluation of risks in order to evaluate both upside and downside risks. Apart from

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 79

understanding risks, the internal audit function needs to assess risk management processes
in order to determine whether structure, functioning, and control processes are appropriate
to manage the identified risk factors. Assurance Standard 2010.A1 states:
The internal audit activitys plan of engagements should be based on a risk
assessment, undertaken at least annually. The input of senior management and the
board should be considered in this process.
Over the last few years, The IIA Research Foundation has released several excellent
publications on the topic of risk and risk management, viz., McNamee & Selim (1998), the
Tillinghast-Towers Perrin Study on Enterprise Risk Management (2001), and more recently
the study by Walker et al. (2002). The internal audit functions role in risk management is
explored further in the ROIA chapter by Kinney.

III. Organizational Governance

Organizational governance can be understood in the context of the needs of and the
relationship to the stakeholders of an organization. The IIA Standards define governance
processes as the procedures utilized by the representatives of the organizations stakeholders
(e.g., shareholders, etc.) to provide oversight of risk and control processes administered by
management.
Organizational governance has changed fundamentally over the last decade due to numerous
large business failures, some of them in the wake of massive management fraud. Huge
financial losses have led to an increasing focus and demands on organizational structure
from investors, creditors, and other constituencies. In this context, it has become important
to inquire as to how organizations assure that planned activities and guidelines are in fact
being implemented and are functioning as intended. Internal audit functions can take on
important roles in providing such assurance, thus promoting organizational governance.

Internal Stakeholders
The board of directors, top management, operational management, and employees as main
internal stakeholders have direct responsibility for the organizational activities.
Shareholders and investors charge the board and top management with the responsibility
of managing their invested funds. Direction and control are top managements main
instruments to assume this responsibility (see Exhibit 3-1). Middle managements

The Institute of Internal Auditors Research Foundation

80 Research Opportunities in Internal Auditing

_________________________________

responsibilities are primarily defined at the operational level. Middle management redefines
strategies and objectives defined by top management as organizational goals, which are
further broken down into key performance indicators and signal systems. These key
performance indicators and signal systems can be analyzed in order to ensure the proper
functioning of systems and processes, and to eventually answer the question as to whether
the organization functions as intended. Employees perform operational activities. However,
given trends such as a higher knowledge level of employees, empowerment, enhanced
automation or in-line controls, management can increasingly delegate control activities.
The board of directors, as a special group of internal stakeholders, is mainly charged with
the definition of the overall strategic direction and with the supervision of operational activities.
The board of directors should be adequately diversified and have a sufficient number of
qualified members, without being too large for efficient decision-making. Two types of
board systems are prevalent the two-tier or dualistic system with a management and a
supervisory board (e.g., found in continental Europe and particularly in France, Germany)
and the one-tier or monistic system with one board of directors found, for example, in the
UK and U.S. Several countries feature board systems with elements of both the monistic and
the dualistic type.
The board of directors is commonly divided into subcommittees in order to take advantage
of the board members special knowledge, experience, and expertise. Typical committees
are the nomination and the remuneration (or compensation) as well as the audit committee,
the latter being most important in the context of internal auditing.
The audit committee functions as the coordinator between the external, financial audit, and
the internal audit function as well as other assurance functions (e.g., risk management,
compliance, code of conduct, legal matters, etc.). Typically, the audit committee is mandated
with the financial monitoring (Blue Ribbon Committee, 1999). An interesting feature in
some organizations is that the audit committee has a broader responsibility and oversees
both operational and financial aspects of governance. An excellent example of this is the
Swiss pharmaceutical company, Hoffmann La Roche, where the audit committee coordinates
both financial and operational issues, while a separate financial committee considers the
financial aspects.
To be able to assume its role as representative of shareholders interests, the board of directors
is supported by different organizational functions, e.g., risk management, organizational
compliance, and organizational controlling and organizational security that help ensure the
existence of adequate and effective governance. Risk management has gained widespread
acceptance as mentioned earlier. Typically, the function is positioned high in the organization,

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 81

often reporting directly to the CEO. Offering an enterprise-wide, comprehensive risk analysis,
the internal audit function can base its own planning on risk managements results. The
organizational compliance function is typically located at the board secretary level and focuses
on compliance of legal and regulatory issues. In addition, depending on the structuring of
the organization, functions such as organizational controlling and organizational security as
well as other organizational bodies such as information security can offer assurance to internal
and external stakeholders. A close relationship of the described functions with the internal
audit function can lead to better cooperation between assurance functions and offer a higher
level of organizational assurance. For the purpose of this report, these activities are not
being further considered here; however, several research issues as to the relationship of the
differing functions can be identified and explored. The conceptual framework in Exhibit
3-1 illustrates these potential relationships.
Depending on the organizational structure, the audit committee organizes and coordinates
further governance promoting activities such as the risk management, corporate compliance,
corporate controlling, and corporate security. A key issue here is that the internal audit
function can take on varying assurance assignments to improve organizational governance.

External Stakeholders
An organization faces different groups of external stakeholders, i.e., shareholders, financial
markets, customers, suppliers, regulators, government, neighbors, and the public at large.
These stakeholders are not directly involved in the business activities, but have an interest in
the activities of the organization (ref. Standard 2130). Further, they influence the organization
through their decision-making (for example, shareholders influence the market valuation of
companies, or financial creditors offer or restrict credit).
Offering assurance as to the functioning of the organization to these external decisionmakers is an issue of utmost importance as organizations struggle to make themselves attractive
to investors, creditors, suppliers, and customers. As explained, the internal audit function
can contribute effectively to improve governance in several aspects.
To investors, the issue is to ensure capital availability and liquidity as well as keeping the
cost of capital within reasonable ranges. By offering assurance on information and on
operational processes, the internal audit function can contribute in analyzing the needs for
capital and liquidity, reduce the probability of a capital and liquidity squeeze, as well as
provide creditors and investors with assured information as to the standing of the organization.
It is to be expected that the cost of capital should be lower in a company where a high level
of assurance is offered as compared to a company with higher uncertainty and risk.

The Institute of Internal Auditors Research Foundation

82 Research Opportunities in Internal Auditing

_________________________________

To suppliers, the main focus is to stay as an attractive partner, which can negotiate favorable
conditions.
To customers, a primary interest lies in the delivery of products and services that satisfy
their needs in a timely and economic way.
Further external stakeholders such as the public at large and the government have other
interests. Through development of regulations, supervision of their compliance as well as
the judicial processes against potential infringement, the government plays several roles of
significance to organizations. The pressure from the national and local government is not to
be underestimated and, consequently, this importance should be understood.
Different stakeholders may have very different needs for information and assurance.
Furthermore, between the organization and the stakeholders, there are different potential
conflicts of interest. For example, the organization may not want to supply certain types of
information to a financial creditor because of a potentially higher interest rate. Or similarly,
investors may want more and assured information to make a buy-or-sell decision.
Many of these potential situations can be explained through the concept of an asymmetric
information situation where the manager has better in-depth knowledge and understanding
than the organizational body supervising him or her. In order to alleviate this information
bottleneck situation where some people are better informed than others, internal or external
assurers such as the internal audit function can offer assurance to the decision makers that
the information is factual and correct.
The asymmetric information issue can also be exemplified between a one-tier (monistic)
and a two-tier (dualistic) board of directors system. In situations where the chairman of the
board also functions as CEO, the person has superior knowledge, which mostly is efficient
for the daily business and decision-making. However, the supervisory role of the board is
lacking and becomes more of a challenge.
The internal audit function can take on a more extensive role in systems with adequate and
effective organizational governance. A key issue in this context is how the role and function
of the internal audit function differ under the two systems of boards. This could be studied
empirically across organizations as well as across nations with varying governance systems.

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 83

IV. Role of the Internal Audit Function in Promoting

Effective Governance
In order to analyze what the internal audit function can offer, it is important to understand
the needs and expectations of the internal and external decision makers toward the internal
audit function. Also, different industries have varying needs for assurance services. For
example, banks and insurance companies typically define the objective of the internal audit
as one with primary focus on assuring the money flow, i.e., monitoring and supervising
processes in order to prevent monetary losses and safeguarding assets. On the other hand,
the manufacturing industry and the transportation sector has for some time used a more
operationally oriented audit approach, as reengineering and process improvement within
the areas of supply chain management, customer relationship management, production,
marketing, accounting etc., were undertaken. A third group would be the public sector,
which focuses on serving the public at large and the individual citizen. Obviously, these
different sectors have different desires for assurance and thus needs for different internal
audit services. Depending on the needs and desires of the organization and users, the internal
audit function can take on different roles.
Interesting in this perspective is to consider recent organizational trends and how organizations
function in a modern management and organizational perspective. These issues were discussed
in the Competency Framework for Internal Auditing (CFIA) (Birkett et al., 1999), as well as
in the preceding analysis (cf., e.g., Porter, COSO).

The Formulation of the Role of the Internal Audit Function in the Audit Charter
Understanding the role and the functioning of the internal audit function begins with an indepth understanding of the organizational objectives- and goals-hierarchy. Standard 2010
states:
The chief audit executive should establish risk-based plans to determine the priorities
of the internal audit activity, consistent with the organizations goals.
The agreed role of the internal audit function needs to be linked closely to what the organization
is doing and must be formulated in the audit charter (Purpose, Authority, and Responsibility).
Standard 1000, Purpose, Authority, and Responsibility, states:

The purpose, authority, and responsibility of the internal audit activity should be
formally defined in a charter, consistent with the Standards, and approved by the
board.
The Institute of Internal Auditors Research Foundation

84 Research Opportunities in Internal Auditing

_________________________________

1000.A1 - The nature of assurance services provided to the organization should

be defined in the audit charter. If assurances are to be provided to parties outside
the organization, the nature of these assurances should also be defined in the
charter.

1000.C1 - The nature of consulting services should be defined in the audit charter.

The internal audit function is the single most important internal assurance provider. It is
essential for top management and the board to employ the available assurance functions in
an optimal fashion, i.e., to evaluate how and what each assurance function contributes to the
overall desired assurance level. In addition to the responsibility of the chief audit executive,
this is to be decided upon by the relevant organizational level such as top management or
the board. Standard 2050 says:
The chief audit executive should share information and coordinate activities with
other internal and external providers of relevant assurance and consulting services
to ensure proper coverage and minimize duplication of efforts.
This standard relates to the external audit function, but internal assurance providing functions
such as risk management and corporate compliance can similarly contribute effectively to
total assurance coverage.

Positioning of the Internal Audit Function

Among other functions within an organization, the position of the internal audit function is
fairly unique in terms of: (1) its advantageous position within the organization, (2) the wide
range of functional areas that it examines as well as the different types of audits capable of
being performed, and (3) the multidisciplinary backgrounds of individual auditors comprising
the internal audit team (Rittenberg & Schwieger, 1997). These desirable features continue to
exist in most in-house functions and co-sourcing arrangements, but are somewhat diminished
in the context of full outsourcing of internal audit services. Nevertheless, in every situation,
the organizational status, positioning, and independence of the internal audit function is of
paramount consideration.
Most importantly, a complete and sound understanding of the governance structure of the
organization is a precondition for establishing an effective and independent1 internal audit
function Mautz (1964, p. 471) presciently observed: The matter of independence is always
a difficult one for an internal auditing function. It will of necessity report to someone within
the company organization and therefore lacks the final degree of independence possessed

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 85

by public accountants. On the other hand, if it reports to an appropriate level of authority

within the enterprise, it can well have sufficient independence to make itself effective.
Accordingly, in order to ensure that the internal audit function can operate effectively and
achieve the desired results, it is tantamount that the mandate is given from an adequately
high organizational level. An optimal structure is achieved when the chief audit executive
(CAE) reports directly to the audit committee (rather than the chief financial officer),
alternatively, directly with the board of directors. This structure is indicated in Exhibit 3-1
with a clear reporting line to the audit committee. Another solution is the direct relationship
with the chief executive officer; however, such a positioning makes the effective supervision
of the CEO difficult and may increase the information asymmetry problem.
Internal auditors should refrain from assessing specific operations, and to avoid conflicts of
interest, they have to be objective and independent (Standard 1100). The independence of
internal auditors is a professional obligation to fulfill an objective, unbiased, unrestricted
opinion, and to report matters as they are rather than as some executive would like to see
them. (Sawyer, 1996, p. 63). In this connection, Rittenberg & Schwieger (1997, p. 758)
usefully observe that the internal auditor frequently confronts difficult practical and ethical
situations when there may be a conflict between loyalty to the company and the need to
dissociate themselves from undesirable or even potentially illegal activities. A fuller
examination of the concepts of independence and objectivity in the context of internal audit
functioning appears in the ROIA chapter by Mutchler.

Internal Audit Activities: Assurance and Consulting Services

The internal audit function offers two main services: assurance and consulting services.
Assurance services are defined as providing an independent assessment on risk management,
control, and governance processes of the organization. Examples may include financial,
performance, compliance, system security, due diligence engagements (Standards, Glossary).
To provide the described assurance services internal auditors need to be independent and
objective, implying integrity, competence, due care, and ethical behavior.
Assurance services differ from consulting services in that the latter are Advisory and related
client service activities, the nature and scope of which are agreed upon with the client and
which are intended to add value and improve an organizations operations. Examples include
counsel, advice, facilitation, process design, and training (Standards, Glossary). These
aspects are addressed in the ROIA chapter by Anderson.

The Institute of Internal Auditors Research Foundation

86 Research Opportunities in Internal Auditing

_________________________________

The nature of work of the internal audit function (according to Standard 2100):
...is to evaluate and improve the effectiveness of the following three processes:

Risk management processes identification and evaluation of potential risks

that might affect the achievement of objectives of an organization and determination
of adequate corrective actions. A link can here be made to critical success factors.

Control processes policies, procedures, and activities which ensure that risks
are kept within the limits defined by management in the risk management process.

Governance processes procedures which allow stakeholders to evaluate risk

and control processes defined by management.

The internal audit function can thus contribute both by evaluating the systems functioning
and reliability (assurance services) and supporting the design of these systems by providing
specific recommendations (consulting services). The services actually provided by the internal
audit function depend on the positioning in the organization as well as on its intended function.
Internal audit can contribute to effective governance in several ways. First, it can assist in
the identification of risk factors, the analysis of the consequences, as well as in assisting
management in the prioritization of risk management and control systems. Internal audit can
add assurance that the risk management processes in fact are functioning as intended. Through
consulting services, the internal audit function can furthermore assist management and the
board by improving risk management and control processes.
The internal audit function can then assume an important role as an in-house advisory function
that offers analyses and assurance to the board as to the functioning of the risk management
and internal control systems.

Relationship with the Independent Public Accountant

An important cooperation of assuring information lies in the coordination of the external
and internal audit function (see Exhibit 3-1 for the direct relationship). Although the external
auditors mostly carry out the audit of the financial statements, internal auditors can contribute
greatly through business, process, and activity knowledge as well as profound understanding
of the risks facing the organization. In this way, the external auditors can conduct their audit
more efficiently and provide a higher assurance level.

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 87

Felix et al. (1998) characterize the general current status of the relationship between the
internal and external auditors as follows:
1. Internal and external auditors independently develop and then share information
on risk analysis.
2. Some attempts are made to coordinate audit plans.
3. When joint auditing is performed, the external auditor typically determines when
and where such joint activities take place.
However these authors point out that the quality of communications between the two groups
can be enhanced and that internal audit participation and assistance at the consolidated
financial statement level can further be optimized. This coordination of different audit
functions (internal and external audit) is known as total audit coverage.2 Clearly, this is one
area where existing governance structures and processes can be reviewed and further
optimized for the benefit of all parties concerned.

Knowledge, Skills, and Competencies Needed for Fulfilling the

Internal Audit Functions Role
Derived from the defined and agreed role, the internal audit function needs to analyze how
it can fulfil its role with its competency and capacity. Due personnel planning represents the
basis for an optimal staffing of the internal audit function. Apart from external recruitment,
internal auditors are commonly recruited from within the organization. The organization
can encourage employment in the internal audit function by using it as a stepping stone.
That is, serving in the internal audit function can, for example, be a requisite for further
advancement and as grooming for leadership positions within the organization. Some of the
personnel issues for the internal audit function, including hiring the best recruits from outside
or from within the organization, on-the-job training and professional development, mentoring,
and other matters regarding the management of the internal audit function, are covered in
the ROIA chapter by Prawitt.
An important question as to the role and status of the internal audit function is who provides
what activities (internal audits nature of work risk management, control, and governance)
and the type of service (assurance or consulting services). Even more often the internal audit
function draws capacity and competency through in-sourcing or co-sourcing. Potential
providers here are the large accounting firms, consultancies, business service providers, and
others. The issue is then how the organization ensures that it achieves sufficient assurance
from internal and external assurance providers. If it turns out to be insufficient resources in
terms of capacity and/or competency for the internal audit function, necessary skills through
in-sourcing and/or co-sourcing can be obtained.
The Institute of Internal Auditors Research Foundation

88 Research Opportunities in Internal Auditing

_________________________________

A related topic as to who is providing the internal audit services is the cost of the internal
audit function, especially in the case of employing external service providers. Commonly,
the internal audit function is regarded as a fixed cost pertaining to a separate function within
an organization. With the introduction of new and more flexible organizational forms, and
by contracting with external firms for in-sourcing, co-sourcing, or outsourcing, the costs of
the internal audit function can be classified, at least partly, as a variable cost. It would be an
interesting research project to investigate why some organizations regard the costs of the
internal audit function as fixed, while others classify them as variable.
In terms of questions regarding capacity and/or competency, a current research topic is to
consider the developments in the market for externally provided internal audit services.
Regulators in countries such as Brazil and the U.S., citing the dangers of compromising
auditor independence, have introduced rules prohibiting public accounting firms from offering
internal audit services to audit clients.

Systematic Process of Internal Auditing

The characterization of internal auditors as professionals makes the adoption of a disciplined,
systematic approach to conducting an audit a natural expectation from internal audit
practitioners. Similarly, internal auditors are assumed to have adequate training and experience
to exercise sound professional judgment when the circumstances require so. Further, a unique
advantage of the internal auditing profession is that it is standards-based. The newly issued
Professional Practices Framework3 only underscores The IIAs commitment to raise the
profile of internal auditors, provide authoritative guidance, and generate confidence in the
quality of their work within organizations. As such, it is extremely important that internal
auditors base their work on documented, rigorous approaches and methodologies that can
be defended if their work is ever questioned by any of the organizations key stakeholders.
Many of these issues are discussed in the ROIA chapter by Lemon and Tatum.
The central importance of experience and the interaction of judgment with professional
expertise are captured in several works devoted to understanding, evaluating, and improving
professional judgment. Indeed the exercise of judgment is not only essential to the practice
of disciplines such as law, medicine, and accounting, but is also what distinguishes these
domains as professions (Boritz, Gaber, & Lemon, 1987, cited in Gibbins & Mason, 1988).
In an environment calling for greater accountability for professional judgments, the basis for
the exercise of professional judgment is increasingly coming under scrutiny (Ramamoorti,
1995).

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 89

In addition to carrying out research with the aim of understanding, evaluating, and improving
professional judgment, it is also important to consider the use of decision aids and technologybased tools for conducting more efficient and effective audits. This may include the use of
statistical sampling applications, ACL, IDEA, Microsoft Excel, CAATs, and other information
systems auditing tools, as well as regression analysis and other statistical techniques. The
IIAs Systems Auditability and Control (SAC) product from the 1970s has been updated to
accommodate the needs of e-commerce, and the eSAC guidance is now available online.
More recently, innovations such as Benfords Law for identifying errors and discrepancies,
as well as the use of artificial intelligence techniques such as neural networks (see Ramamoorti
& Traver, 1998), have made their debut. It should be noted that data warehousing procedures
go hand-in-hand with data mining applications, and internal auditors with an eye toward the
future need to gain familiarity with this burgeoning but highly relevant literature in computer
science, database management and applications, expert systems, and artificial intelligence.
The professional internal auditing environment continues to be dynamic, uncertain, and
complex, and has continually dictated that internal auditors gain industry specialization.
Internal auditors are specializing by gaining industry-specific experience and/or by qualifying
for specialty designations in governmental auditing, control self-assessment, or financial
services.4 This trend toward more proliferation of certifications and designations is likely to
continue. What is required today is a combination of both experience and industry expertise,
and internal audit practitioners are struggling to cope with the resulting information overload.
In this connection, The IIAs Professional Practices Framework supplemented by the periodic
issuance of Practice Advisories and other Guidance are helpful to the chief audit executive
and the practitioner. This is an area in which academics interested in the internal auditing
profession can play pioneering roles in advancing the goals of education, research, and
practice.

V. Summary
This chapter of the ROIA monograph has attempted to demonstrate the important relationships
between the internal audit function and other organizational units. The exhibit introduced
initially in the chapter graphically shows these relationships and issues presented throughout
the chapter. In each and every one of these relationships, interesting research topics can be
identified and explored. In the Appendix to this chapter, several relevant research questions
are outlined.

The Institute of Internal Auditors Research Foundation

90 Research Opportunities in Internal Auditing

_________________________________

VI. Appendix I: Chapter Research Questions

Organizational Governance

How does the structure of the board of directors influence the organizational
governance and the role of the internal audit function? What are the differences
between the unitary vs. the dualistic board system and its effect on the internal audit
function and organizational governance?

What national differences are there to the structure and role of boards of directors?

What is the role of the internal audit function in establishing and ensuring effective
organizational governance?

How can the internal audit function best contribute to reduce information asymmetries
between internal and external stakeholders?

How will recent developments in organizational governance influence the role of

the internal audit function? What will be the change in audits and focus?

Which communication channels are the optimal ones to create between the board
and the internal auditors? For example, how often and to what board members (audit
committee) should the internal auditors report to ensure adequate and effective
organizational governance?

What is (are) the potential impact(s) of having the internal audit function report to
different organizational levels (e.g., board of directors in general, audit committee,
the CEO, the COO, the CFO)?
1. In terms of the impact on the effectiveness of organizational governance.
2. In terms of the impact on other organizational issues.

For the outsourced internal audit function, does communication between the board
and the internal auditors differ?

Internal Audit Function and Structure

What are the current trends of the structure and content of internal audit charters?
What changes were performed after the introductions of the new definition? How do
these trends differ across countries?

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 91

Have there been changes in independence/objectivity with the introduction of the

new definition of internal audit? Is the discussion independence vs. objectivity
changing the role of the internal audit function?

What national differences are there to the structure and role of internal audit function?

Are communication processes for internal audit functions performing consulting

services different from those functions primarily offering assurance services?

How is the coordination between the internal audit function and other assurance or
organizational governance functions (e.g., risk management, organizational
compliance, external auditing)? What is the best practice?

The Internal Audit Activity

What are the consequences of changing the scope of work to the nature of work
for internal auditors (from the 300 Standards to the 2100 Standards):
1. How is the role of the internal audit function affected?
2. How does this change the needs for changing competencies of the internal audit?
3. Which consequences are to be identified for the audited organization?

What is the level of assurance offered?

How does the emphasis on soft factors (competency, trust, understanding the
importance of culture, ethics, moral, etc., replacing detailed guidelines and regulations,
teamwork and transparency) influence the internal audit activity? For example, one
could assess the importance of change in management and organizations, or how
empowered organizations function and what the effects on internal audit are. Further,
in-depth understanding of the organizational goals and objectives and the value
drivers replace formal communication.
1. What are the effects of organizational changes on the structuring and assignments
of the internal audit function?
2. How do auditors have to base the audit in an empowered organization? How in
case of a changing control environment?
3. How do auditors have to audit the ethical climate and the softer issues of the
organization (importance, methods, effects, and consequences)?

Why do some organizations regard the costs of the internal audit function as fixed,
while others classify them as variable?

The Institute of Internal Auditors Research Foundation

92 Research Opportunities in Internal Auditing

_________________________________

Why are there differences in the internal audit function across industries? A
comparative study as to the differing roles of the internal audit function in industry
sectors (for example, banking vs. industry or transportation sector).

Relationship between Internal Audit, External Audit, and Other External

Services Providers

What is the relationship between external and internal auditors and the audit
committee?

What is the consequence of recent developments as to the market for externally

provided internal audit services, such as CPA firms having to stop offering internal
audit services to external audit clients due to the independence?

What is the nature of coordination between the internal audit function and other
assurance or organizational governance functions (e.g., risk management,
organizational compliance, external auditing)? What is the best practice?

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 93

Footnotes
1

The notion of independence as it is construed with respect to internal and external auditors
is different. An external auditor must be independent, in fact and in appearance, in the eyes
of those outside the organization that place reliance on the external auditors opinion on the
financial statements. An internal auditor, on the other hand, must be seen as independent
and objective by those who rely on his or her work inside the organization, viz., management
and the board of directors (Rittenberg & Schwieger, 1997).

For further information about total audit coverage, see Felix et al., (1998).

The recently issued title in the IIA Handbook Series, Implementing the Professional Practices
Framework by Chapman & Anderson (2002), is an important resource for practitioners and
educators.

The Institute of Internal Auditors Research Foundation

94 Research Opportunities in Internal Auditing

_________________________________

References
Birkett, W.P., M.R. Barbera, B.S. Leithhead, M. Lower, and P.J. Roebuck, Competency
Framework for Internal Auditing (CFIA) (Altamonte Springs, FL: The Institute of Internal
Auditors Research Foundation, 1999).
Blue Ribbon Committee, Report and Recommendations of the Blue Ribbon Committee on
Improving the Effectiveness of Corporate Audit Committees (New York, NY: New York
Stock Exchange and National Associations of Securities Dealers, 1999).
Cadbury Committee, The Committee on the Financial Aspects of Corporate Governance:
Report of the Financial Aspects of Corporate Governance (London, 1992).
Chapman, C., and U. Anderson, Implementing the Professional Practices Framework
(Altamonte Springs, FL: The Institute of Internal Auditors, 2002).
COSO, Report of the Committee of Sponsoring Organizations of the Treadway Commission:
Internal Control Integrated Framework (New York: American Institute of Certified
Public Accountants, 1992).
DeLoach, J.W., Enterprise-wide Risk Management: Strategies for Linking Risk and
Opportunity (London, UK: Financial Times, 2000).
Felix, W., A. Gramling, and M. Maletta, Coordinating Total Audit Coverage: the Relationship
between Internal and External Auditors (Altamonte Springs, FL: The Institute of Internal
Auditors Research Foundation, 1998).
Gibbins, M., and A.K. Mason, Professional Judgment in Financial Reporting. CICA Research
Study (Toronto: Canadian Institute of Chartered Accountants, 1988).
Gupta, P.P., Internal Audit Reengineering: Survey, Model, and Best Practices (Altamonte
Springs, FL: The Institute of Internal Auditors Research Foundation, 2001).
Hilb, M., Integriertes Personal-Management: Ziele, Strategien, Instrumente (Neuwied:
Luchterhand, 1998).
Kiernan, M.J., The Eleven Commandments of 21st Century Management: What Cutting-Edge
Companies are Doing to Survive and Flourish in Todays Chaotic Business World
(Englewood Cliffs, NJ: Prentice Hall, 1996).

The Institute of Internal Auditors Research Foundation

_______________________________________ Chapter 3: The Internal Audit Function 95

Mautz, R.K., Fundamentals of Auditing, 2nd Ed. (New York: John Wiley & Sons, Inc., 1964).
McNamee, D., and G.M. Selim, Risk Management: Changing the Internal Auditors Paradigm
(Altamonte Springs, FL: The Institute of Internal Auditors Research Foundation, 1998).
Moeller, R., and H.N. Witt, Brinks Modern Internal Auditing, 5th Ed. (New York: John Wiley
& Sons, Inc., 1999).
Porter, M.E., Competitive Advantage: Creating and Sustaining Superior Performance (New
York: Free Press, 1985).
Porter, M.E., Competitive Strategy: Techniques for Analyzing Industries and Competitors:
With a New Introduction (New York: Free Press, 1998).
The Professional Practices Framework. (Altamonte Springs, FL: The Institute of Internal
Auditors, 2002).
Ramamoorti, S., Decision Framing and Efficiency-Effectiveness Trade-Offs in Auditors
Planning Materiality Judgments. Unpublished Ph.D. Dissertation. The Graduate School,
The Ohio State University, Columbus, Ohio, 1995.
Ramamoorti, S., and R.O. Traver, Using Neural Networks for Risk Assessment in Internal
Auditing: A Feasibility Study (Altamonte Springs: The Institute of Internal Auditors
Research Foundation, 1998).
Reeve, John T., Internal Auditing, pp. 8-1 to 8-39. In Cashin, J.A., P.D. Neuwirth, and J.F.
Levy, (eds.), Cashins Handbook for Auditors, 2nd Ed. (Englewood Cliffs, NJ: Prentice
Hall, 1986).
Report of the Guidance Task Force to The IIAs Board of Directors, A Vision for the Future:
Professional Practices Framework for Internal Auditing (Altamonte Springs, FL: The
Institute of Internal Auditors, 1999).
Rittenberg, L.E., and M. Covaleski, The Outsourcing Dilemma: Whats Best for Internal
Auditing (Altamonte Springs, FL: The Institute of Internal Auditors Research Foundation,
1997).
Rittenberg, L.E., and B.J. Schwieger, Auditing Concepts for a Changing Environment, 2nd
Ed. (Fort Worth, TX: The Dryden Press, 1997).

The Institute of Internal Auditors Research Foundation

96 Research Opportunities in Internal Auditing

_________________________________

Roth, J., Adding Value: Seven Roads to Success (Altamonte Springs: The Institute of Internal
Auditors Research Foundation, 2002).
Ruud, F., and J. Bodenmann, Corporate Governance und Interne Revision. In: Der Schweizer
Treuhnder, 6/7, 2001, S. 521 534.
Sawyer, L.B., and M.A. Dittenhofer, Sawyers Internal Auditing: The Practice of Modern
Internal Auditing, 4th Ed. (Altamonte Springs, FL: The Institute of Internal Auditors,
1996).
Stabell, C., and Fjeldstad, On Value Chains, Value Networks, and Value Shops, The Strategic
Management Journal, 2000.
Standards for the Professional Practice of Internal Auditing. [Online] www.theiia.org. (August
21st 2002), The Institute of Internal Auditors.
Tillinghast-Towers Perrin Study, Enterprise Risk Management: Trends and Emerging Practices
(Altamonte Springs, FL: The Institute of Internal Auditors Research Foundation, 2001).
Walker, P.L., W.G. Shenkir, and T.L. Barton, Enterprise Risk Management: Pulling it All
Together (Altamonte Springs, FL: The Institute of Internal Auditors Research Foundation,
2002).

Acknowledgments: I would like to thank Andy Bailey, Audrey Gramling, Sri Ramamoorti,
and Larry Rittenberg for their review of and comments on the structure, scope, and presentation of this ROIA chapter. I am grateful to Betty McPhilimy, chapter discussant, for her
critical and helpful remarks presented at the ROIA Chicago Conference from May 22-23,
2002, and to Richard Traver for his review of an earlier version of this chapter. I would also
like to acknowledge Susan Liones assistance in providing necessary reference materials.

The Institute of Internal Auditors Research Foundation