Managerial Auditing Journal - Business Solutions

Managerial Auditing Journal Emerald Article: Usage of Internal Auditing Standards by companies in the United States and select European countries Priscilla A. Burnaby, Mohammad Abdolmohammadi, Susan Hass, Gerrit Sarens, Marco Allegrini

Article information: To cite this document: Priscilla A. Burnaby, Mohammad Abdolmohammadi, Susan Hass, Gerrit Sarens, Marco Allegrini, (2009),"Usage of Internal Auditing Standards by companies in the United States and select European countries", Managerial Auditing Journal, Vol. 24 Iss: 9 pp. 835 - 860 Permanent link to this document: http://dx.doi.org/10.1108/02686900910994791 Downloaded on: 09-05-2012 References: This document contains references to 32 other documents To copy this document: [email protected] This document has been downloaded 1892 times.

Access to this document was granted through an Emerald subscription provided by UNIVERSITA DI PISA For Authors: If you would like to write for this, or any other Emerald publication, then please use our Emerald for Authors service. Information about how to choose which publication to write for and submission guidelines are available for all. Additional help for authors is available for Emerald subscribers. Please visit www.emeraldinsight.com/authors for more information. About Emerald www.emeraldinsight.com With over forty years' experience, Emerald Group Publishing is a leading independent publisher of global research with impact in business, society, public policy and education. In total, Emerald publishes over 275 journals and more than 130 book series, as well as an extensive range of online products and services. Emerald is both COUNTER 3 and TRANSFER compliant. The organization is a partner of the Committee on Publication Ethics (COPE) and also works with Portico and the LOCKSS initiative for digital archive preservation. *Related content and download information correct at time of download.

The current issue and full text archive of this journal is available at www.emeraldinsight.com/0268-6902.htm

Usage of Internal Auditing Standards by companies in the United States and select European countries

Usage of Internal Auditing Standards 835

Priscilla A. Burnaby and Mohammad Abdolmohammadi Bentley College, Waltham, Massachusetts, USA

Susan Hass Simmons College, Boston, Massachusetts, USA

Gerrit Sarens Louvain School of Management (IAG), Universite´ Catholique de Louvain, Louvain-la-Neuve, Belgium, and

Marco Allegrini Universita` di Pisa, Pisa, Italy Abstract Purpose – The purpose of this paper is to investigate differences in the degree of usage and compliance with the Institute of Internal Auditors (IIA) International Standards for the Professional Practices of Internal Auditing (Standards) by organizations’ internal audit activities (IAA) located in the USA and a sample of European countries which have affiliates with the IIA. This paper shows the differences among Belgium, Italy, The Netherlands, the UK and Ireland, and the USA with respect to the level of use of the Standards and compliance with the Standards by respondents’ IAAs. Design/methodology/approach – Survey results from questionnaires sent to IIA members in September 2006 about various topics relating to internal auditing are summarized in the Common Body of Knowledge 2006 database. These results are compared among Belgium, Italy, The Netherlands, the UK and Ireland, and the USA. Findings – This paper shows the differences among Belgium, Italy, The Netherlands, the UK and Ireland, and the USA with respect to the level of use of the Standards and compliance with the Standards by respondents’ IAAs. There are significant levels of variation in responses by country. For Standards 1300, Quality Assurance and Improvement Program, and 2600, Resolution of Management’s Acceptance of Risks, respondents indicate high levels of non-compliance. Originality/value – This study compares the status of the use of the IIA Standards in five countries to determine if there is any difference in application in different parts of the world. Keywords Auditing, Auditing standards, Internal auditing Paper type Research paper

Introduction The primary objective of this paper is to investigate the degree of usage and compliance with The Institute of Internal Auditors’ (IIA) internal International Standards for the Professional Practices of Internal Auditing (Standards) by organizations’ internal audit activities (IAA) located in Belgium, Italy, The Netherlands, the UK and Ireland, and the USA. Compliance with the Standards is mandated by the IIA for every individual who

Managerial Auditing Journal Vol. 24 No. 9, 2009 pp. 835-860 q Emerald Group Publishing Limited 0268-6902 DOI 10.1108/02686900910994791

MAJ 24,9

836

provides internal audit services. A strong IAA can be an important part of the corporate governance structures for organizations. The Standards state that chief audit executives should have a Quality Assurance and Improvement Program (QA&IP) to monitor the effectiveness of the IAA’s work. As the data show that many IAAs do not comply with the QA&IP Standard, an objective of this paper is to examine the usage of this Standard in more detail. Prior global studies of internal auditors were limited in size and scope and predominantly documented competencies and knowledge of relevant disciplines that were required of internal auditors and skills appropriate to perform internal auditing tasks (Albrecht et al., 1992). Birkett et al. (1999) performed a global study of internal auditors, but did not focus on compliance with Internal Auditing Standards. This study found a lack of uniform meaning for such basic terms as “internal control” and “compliance.” In Europe, studies have mainly focused on the role of the IAA. A literature review shows changes in the activities performed by internal auditors in part due to a more dynamic regulatory environment, but there are no in-depth studies of compliance with the Standards (Allegrini and D’Onza, 2003; Melville, 2003; Paape et al., 2003; Sarens and de Beelde, 2006a, b; Selim and Yiannakas, 2001; Selim et al., 2003). This paper compares the demographics of the respondents and levels of use of, and compliance with, the Standards in Belgium, Italy, The Netherlands, the UK and Ireland, and the USA, and the reasons for non-compliance. The paper first discusses the background literature leading to the study’s research questions. The next section reviews the research method followed by a discussion of the importance of the Standards. Data analysis is presented next, followed by a summary and implications of the current study. Background literature and research questions The Professional Practices Framework (PPF) of the IIA (2005) consists of, “the Definition of Internal Auditing, Code of Ethics, International Standards for the Professional Practices of Internal Auditing, and Practice Advisories.” Compliance with the IIA’s Code of Ethics and Standards is mandatory for those who provide internal auditing services. Guidance on how to apply the Standards is provided in the IIA’s Practice Advisories which are endorsed and strongly recommended by the IIA. In defining competency, the IIA’s Code of Ethics (IIA, 2005, p. xxxii) states that, “Internal Auditors shall perform internal auditing services in accordance with the International Standards for the Professional Practices of Internal Auditing.” The Standards have three purposes: educating applicable groups about the roles and responsibilities of internal auditing; providing a basis for measuring performance; and improving the practice of internal auditing. The IIA is always updating and improving the Standards. In 1999, the Vision for the Future task force (IIA, 1999) recommended that the new definition of internal auditing be expanded to include assurance and consulting engagements for governance, risk management, and internal control. Although the Standards were revised in July 2007, this study uses the Standards mandatory as of January 1, 2005. These standards were in effect in 2006 when the Common Body of Knowledge (CBOK) in Internal Auditing 2006 database was populated and are the authoritative source for this paper.

The early 2000s witnessed huge business frauds and scandals in North America (e.g. Enron, an energy trading company and WorldCom, a communications company) and in Continental Europe (e.g. Parmalat, an Italian food supply company; and Royal Ahold, a Dutch supermarket giant). These well-publicized scandals have increased public demand for better corporate governance. Corporate management has responded by further recognizing its responsibilities in the areas of governance, development and maintenance of control structures, and risk management. This has resulted in an unprecedented increase in demand for internal auditors and the development of IAAs within organizations. In many countries, new legislation (Sarbanes-Oxley Act (SOX), 2002; PCAOB, 2004; King Committee of Corporate Governance, 2002) dictates the development of IAAs within organizations. In the USA, IAAs have become more involved with compliance due to the requirements of the SOX of 2002 and the PCAOB’s statements on internal controls in 2004. Non-compliance with SOX and other regulations is a high-level risk to an organization selling shares on the New York Stock Exchange (NYSE), regardless of an organization’s country of origin. Although there are no formal laws, worldwide stock exchanges have implemented governance and regulatory requirements impacting the scope of work performed by IAAs within listed companies (NYSE, 2004; Gray, 2004). Central banks and supervisory authorities published mandatory corporate governance guidance for financial companies (e.g. Basel Committee on Banking Supervision, 2004; Banca d’Italia, 1999; Banking, Finance and Insurance Commission, 1997) stressing the growing role of an IAA. Older laws in the UK require government agencies to have proper administration of financial affairs and to have internal audits. Section 151 of the Local Government Act 1972 (Parliament, 1972) states that: [. . .] every local authority shall make arrangements for the proper administration of their financial affairs and shall secure that one of their officers has responsibility for the administration of those affairs.

In addition, the Local Government Finance Act 1982 (Parliament, 1982) requires that “the responsible financial officer of a local authority maintains an adequate and effective internal audit of the accounts of the body.” This is further supplemented by the Accounts and Audit Regulations 1996 (Parliament, 1996). Although most European Corporate Governance Codes refer to the role of internal auditing in corporate governance, establishing an internal audit function for many of these countries still remains voluntary for non-financial companies. In general, the European Corporate Governance Codes apply the “comply or explain” principle as stated in the preamble of the UK’s Combined Code on Corporate Governance (Financial Reporting Council, 2006): While it is expected that listed companies will comply with the Code’s provisions most of the time, it is recognised that departure from the provisions of the Code may be justified in particular circumstances. Every company must review each provision carefully and give a considered explanation if it departs from the Code provisions.

At the European level, the recent EU Directive on Statutory Audits of Annual Accounts and Consolidated Accounts (the so-called 8th Directive; European Parliament and Council of the European Union, 2006) refers to internal audit in only a limited way.


MAJ 24,9

838

In the UK, an important recommendation for publicly traded companies having an internal audit function is included in the Combined Code on Corporate Governance (Financial Reporting Council, 2006): C.3.5. The audit committee should monitor and review the effectiveness of the internal audit activities. Where there is no internal audit function, the audit committee should consider annually whether there is a need for an internal audit function and make a recommendation to the board, and the reasons for the absence of such a function should be explained in the relevant section of the annual report.

In Italy, the Corporate Governance Code (Corporate Governance Committee, 2006), which follows the principle “comply or explain”, requires that: 8.C.7. The issuer shall establish an internal audit function. The person responsible for internal control shall usually coincide with the person responsible for the internal audit function. 8.C.8. The internal audit functions may be entrusted, as a whole or by business segments, to persons external to the issuer, provided, however, that they are endowed with adequate professionalism and independence; these persons may also be responsible for the internal control. The adoption of such organizational choices, with a satisfactory explanation of the relevant reasons, shall be disclosed to the shareholders and the market in the report on corporate governance.

Similar to Italy, the Belgian Corporate Governance Code (Corporate Governance Committee, 2004) recommends listed companies establish an IAA: 5.2/10. An independent internal audit function should be established, with resources and skills adapted to the company’s nature, size and complexity. If the company does not have an internal audit function, the need for one should be reviewed at least annually.

The Dutch Corporate Governance Code (Commission Tabaksblat, 2003) also refers to the role of the IAA: The internal auditor, who can play an important role in assessing and testing the internal risk management and control systems, shall operate under the responsibility of the management board.

Internal auditing has become increasingly important as a corporate governance mechanism in recent years. The IIA’s position paper, “Organizational governance: guidance for internal auditors” (IIA, 2006a), suggested two roles for internal auditors: (1) Auditors provide independent, objective assessments of the appropriateness of the organization’s governance structure and the operating effectiveness of specific governance activities. (2) Act as catalysts for change, advising, or advocating improvements to enhance the organization’s governance structure and practices. As a corporate governance mechanism, internal auditing aids management in monitoring progress in these areas by providing “independent, objective assurance and consulting services designed to add value and improve the organization’s operations.” (IIA, 2005). One response to this heightened need for internal auditing services has been a dramatic increase in the number of internal auditors. From June 2003 to September 2006, the IIA membership increased from approximately 82,600 to 127,700, resulting in

a 55 percent increase in three years (IIA, 2006b). In November 2007, the IIA web site indicated that the IIA membership is over 150,000. As internal auditing is performed in diverse economic and cultural environments within organizations that vary in purpose, size, and structure, this globally explosive growth could result in variations in the practice of internal auditing and in the usage and compliance with the Standards between countries. Compliance with standards world wide and the extent of differences in compliance by different IIA affiliates has not previously been studied. This study compares internal auditors’ responses from Belgium, Italy, The Netherlands, the UK and Ireland, and the USA to address the usage of and compliance with Internal Auditing Standards and several possible reasons for lack of compliance. The following research questions investigate differences between countries in use of and compliance with the Standards: RQ1. What is the level of usage of the Standards in Belgium, Italy, The Netherlands, the UK and Ireland, and the USA? RQ2. Do Belgium, Italy, The Netherlands, the UK and Ireland, and the USA differ in their compliance with the Standards? RQ3. Is guidance for usage of the Standards adequate? RQ4. What is the level of usage of the Practice Advisories in Belgium, Italy, The Netherlands, the UK and Ireland, and the USA? RQ5. What are the reasons for lack of compliance with the Standards? RQ6. Are there differences in internal quality and improvement programs in Belgium, Italy, The Netherlands, the UK and Ireland, and the USA? RQ7. Are there differences in external quality and improvement programs in Belgium, Italy, The Netherlands, the UK and Ireland, and the USA? Research method Data Data were selected from the CBOK 2006 database. This database was developed in 2006-2007 by the Institute of Internal Auditors Research Foundation (IIARF). Three research teams were engaged in this worldwide effort from Europe and Africa, Asia and the Pacific, and the Americas and the Caribbean. The research resulted in the development of the most comprehensive database ever to capture a current view of the global state of the internal auditing profession (Burnaby et al., 2007). Sample Table I presents the total number of internal auditor members in each country in the study as of September 30, 2006, the date the questionnaires were electronically distributed, and the number of usable responses from each country. The total number of usable responses is 4,080 for an overall response rate of 6.1 percent of the membership for the affiliates included in this paper. Tables II-VIII provide demographic background for the respondent groups. More than 5 percent of the IIA membership responded to the survey except for the UK and Ireland. For each group, more than 45 percent of the respondents were audit managers


MAJ 24,9

840

or chief audit executives (CAEs) and, with the exception of the USA (58.4 percent), more than 63 percent of all respondents were between 35 and 54 years old. Respondents have varied educational background, but those from Belgium and The Netherlands were the most highly educated. Most respondents have been members of the IIA for five years or less and possess an Internal Auditing Certification. In Belgium, The Netherlands, and the USA, more than half of all respondents represented companies that have been in existence for more than 50 years, but most IAAs for all represented countries were 15 years old or less.

Affiliate

Table I. Percentage of responses to total membership based on memberships as of September 30, 2006

IIA Membership as of September 30, 2006a

Usable responsesb

Percentage of membership

1,154 2,531 1,741 7,185 54,686 67,297

102 456 112 271 3,139 4,080

8.8 18.0 6.4 3.8 5.7 6.1

Belgium Italy The Netherlands UK and Ireland USA Total

Notes: aProvided by the IIA; bowing to missing data for some of the questions in the CBOK survey, usable responses may vary slightly for each question analyzed

Staff level

Table II. Participants’ staff levels

CAEs Audit managers Audit seniors/supervisors Audit staff Others Total Number of respondents

20.7 29.7 21.8 22.8 5.0 100.0 101

Percentage of respondents at each staff level Italy The Netherlands UK and Ireland 28.5 21.4 17.2 25.8 7.1 100.0 453

23.2 26.8 26.8 15.2 8.0 100.0 112

25.1 27.8 30.0 13.0 4.1 100.0 270

USA 24.3 22.6 28.2 17.2 7.7 100.0 3,127

Notes: x 2 ¼ 56.68; p , 0.001

Age of respondents

Table III. Age of respondents

Belgium

25 years old or less 26-34 years old 35-44 years old 45-54 years old 55-64 years old 65 years or older Total Number of respondents

Belgium 0.0 25.0 44.3 22.7 8.0 0.0 100.0 88

Notes: x 2 ¼ 56.88; p , 0.001

Percentage in each respondents’ age group Italy The Netherlands UK and Ireland 0.3 26.5 33.7 31.1 7.5 0.9 100.0 347

1.2 20.2 38.1 25.0 14.3 1.2 100.0 84

2.2 19.3 39.9 32.3 6.3 0.0 100.0 223

USA 4.8 23.8 32.5 25.9 12.6 0.4 100.0 2,529

Percentage of respondents at each level of education The UK and Belgium Italy Netherlands Ireland USA

Level of education Secondary/high school education Bachelors/diploma in business Bachelors/diploma in fields other than business Masters/graduate degree/diploma in business Masters/graduate diploma in fields other than business Doctoral degree Other Total Number of respondents

0.0 8.9

20.6 42.8

0.8 5.4

23.4 19.6

1.3 49.9

4.0 57.4

17.5 13.7

4.5 56.3

20.7 20.0

11.9 30.1

26.7 2.0 1.0 100.0 101

3.8 0.7 0.9 100.0 451

20.5 8.0 4.5 100.0 112

12.2 1.5 2.6 100.0 270

5.5 0.9 0.4 100.0 3,129

Notes: x 2 ¼ 967.89; p , 0.001

Number of years 5 or less 6 to 10 11 or more Total Number of respondents

Belgium

Italy

68.3 19.8 11.9 100.0 101

74.4 18.8 6.8 100.0 453

Respondents in percentages The Netherlands UK and Ireland 64.0 21.6 14.4 100.0 111

42.5 33.6 23.9 100.0 268


Table IV. Highest education level of respondents

USA 56.1 20.2 23.7 100.0 3,121

Notes: x 2 ¼ 119.26; p , 0.001

Results Demographic information Table II lists information about the professional rank of the respondents. The x 2 test of expected vs observed frequencies of professional ranks by country indicates significant differences (x 2 ¼ 56.68, p , 0.001) between the countries’ respondents. Noteworthy differences indicate that Italy’s respondents have the highest percentage of CAEs (28.5 percent) and Belgium the lowest percentage (20.7 percent). The order was reversed for the audit manager category, with Belgium having the highest percent (29.7 percent) and Italy the lowest (21.4 percent). The UK and Ireland have the lowest level of participation by the audit staff (13 percent) and the highest level for audit seniors/audit supervisors (30 percent). Table III presents summary data on respondents’ ages. The age categories are significantly different by country (x 2 ¼ 56.88, p , 0.001). No respondent from Belgium was 25 years or younger, while only 0.3 percent of the respondents from Italy were in this age category. In Italy, this is due to two factors. In the past, graduate students started working at 25 years of age or older and most internal auditors come from the external auditing profession. After the reform of the graduate degree in Italy in the early 2000s, students now obtain their bachelors degree in about three years.

Table V. Number of years as a member of the IIA

Table VI. Professional qualification(s) 31.1 3.9 2.0 12.3 12.3 0.7 4.6 2.0 1.8 0.7 0.4 22.1 456

55.9 9.8 0.0 8.8 10.8 2.9 2.0 8.8 2.9 1.0 1.0 12.7 102

Belgium

0.0 0.0 0.0 24.1 112

2.7 1.8 0.9

47.3

4.5 2.7

20.5

48.2

0.4 7.7 0.4 16.6 271

5.5 8.5 1.5

17.7

7.0 1.1

14.0

62.4

6.2 0.4 0.4 13.1 3,139

2.2 0.1 8.7

36.3

4.9 3.0

14.0

40.6

38.284 142.223 1.205 35.763

18.389 191.144 49.165

166.812

16.404 100.076

42.918

80.355

,0.001b ,0.001b 0.877b ,0.001

0.001b ,0.001b ,0.001b

,0.001

0.003b ,0.001b

,0.001

,0.001

p

Notes: aSince respondents could mark all that apply, percentages do not add up to 100; bwhen the number of observations is less than five in a cell, the x 2 results should be interpreted cautiously

Internal Auditing (such as CIA/MIIA/PIIA) Information Systems Auditing (such as CISA/QiCA/ CISM) Government Auditing/Finance (such as CIPFA/ CGAP/CGFM) Control Self-assessment (such as CCSA) Public Accounting/Chartered Accountancy (such as CA/CPA/ACCA/ACA) Management/General Accounting (such as CMA/ CIMA/CGA) Accounting – technician level (such as CAT/AAT) Fraud Examination (such as CFE) Financial Services Auditing (such as CFSA/CIDA/ CBA) Fellowship (such as FCA/FCCA/FCMA) Certified financial analyst (such as CFA) Other Number of respondents

Type of professional qualification

842 Percentage of respondents with each type of professional qualificationa Italy The Netherlands UK and Ireland USA x2

MAJ 24,9

Age categories (years)

Belgium

Italy

0-5 6-10 11-15 16-20 21-25 26-30 31-35 36-40 41-45 46-50 51 or more Total Number of respondents

2.1 8.2 7.2 5.2 1.0 6.2 3.1 3.1 1.0 12.4 50.5 100.0 97

21.5 14.8 7.7 3.3 3.8 6.8 1.2 2.6 0.7 4.0 33.6 100.0 426

Percentage of respondents The Netherlands UK and Ireland 6.6 12.6 3.9 1.0 1.0 4.9 4.9 7.8 1.0 6.8 49.5 100.0 103

9.3 10.5 5.9 6.7 7.6 4.6 4.6 6.3 0.4 5.9 38.2 100.0 238

USA 4.3 6.7 5.0 4.6 3.7 5.0 3.4 4.6 1.6 5.7 55.4 100.0 2,783

2

Notes: x ¼ 307.46; p , 0.001

Number of years 0-5 6-10 11-15 16-20 21-25 26-30 31-35 36-40 41-45 46-50 More than 50 Total Number of respondents

Belgium

Italy

36.4 21.6 12.5 8.0 9.1 5.7 0.0 1.1 0.0 1.1 4.5 100.0 88

44.8 25.3 8.6 6.3 4.8 4.3 1.8 1.0 0.3 0.8 2.0 100.0 396

Percentage of respondents The Netherlands UK and Ireland 17.2 25.0 10.6 6.7 7.7 13.5 5.8 1.9 2.9 2.9 5.8 100.0 104

17.9 24.6 11.2 13.8 8.5 5.8 5.4 2.2 0.4 7.1 3.1 100.0 224


Table VII. Age of respondents’ organizations

USA 24.0 16.3 11.0 12.5 9.2 8.5 2.9 4.7 0.7 4.4 5.8 100.0 2,592

Notes: x 2 ¼ 202.86; p , 0.001

Before the reform, while the official length of time to complete a bachelor degree was four years, the average student took more than six years. It is still not common for young people to move into internal auditing right after the graduation. In Belgium, it is unusual for young people to move into internal auditing right after graduation at the age of 22 or 23. Most of those moving into internal auditing have a few years of prior work experience. In the past, the trend was for individuals to spend a couple of years in external auditing and then transition into internal auditing positions. This trend has changed because IAAs prefer to hire people internally, as they are looking for individuals who have relevant company and business experience. In the USA, 4.8 percent of the respondents were 25 years or younger. Many US companies, such as the Big 4 accounting firms and larger corporate organizations, are now hiring students for internal auditing positions directly from undergraduate

Table VIII. Number of years IAA has existed in the organization

MAJ 24,9

844

programs at the age of 21 or 22. This is a change in practice, as before SOX most entry level internal auditors in the USA were certified public accountants with three or more years of work experience. The most frequently selected age category for all countries is the 35-44 age group. Table IV provides data relating to the respondents’ highest level of education. The x 2 test shows significant differences by country (x 2 ¼ 967.89, p , 0.001). While 20.6 percent of Italian and 23.4 percent of the respondents from the UK and Ireland have a secondary/high school education, the USA (49.9 percent) and Italy (42.8 percent) have the highest number of respondents with a bachelors/diploma in business. Belgium (84.1 percent) and The Netherlands (76.8 percent) have the largest number of respondents with a masters degree. In Belgium and The Netherlands, a masters degree appears to be a minimum requirement to enter the profession. Italian respondents have the lowest number of respondents with a masters or doctoral degree and the highest number of auditors with a bachelors degree/high school education. This is probably due to the age of the internal auditing profession in Italy (Table V) and that recruitment for internal auditors has been carried out by accounting firms that, in some cases, did not have high standards for staff education. As mentioned above, another causal factor is the length of time it takes to earn a bachelor degree at Italian universities. Until the end of the 1990s, it was officially four years, but on average often took a student more than six years to complete. Currently in Italy, the frequency of younger practitioners with a masters degree is growing. Table V shows the number of years respondents have been members of the IIA. The membership period differs significantly by country (x 2 ¼ 119.26, p , 0.001). As expected by the significant growth of the IIA membership in recent years, the majority of the respondents have been members for five years or less. Italy has the largest number of respondents (74.4 percent) that have been members for five years or less followed by Belgium (68.3 percent), The Netherlands (64.0 percent), the USA (56.1 percent), and the UK and Ireland (42.5 percent). The proportion of the respondents from the UK and Ireland (23.9 percent) and the USA (23.7 percent) who have been members of the IIA for 11 or more years is more than those from The Netherlands (14.4 percent), Belgium (11.9 percent), or Italy (6.8 percent). This data for Italian, Belgian, and Dutch companies are not unexpected since before the issuance of a corporate governance code for listed companies during the past decade (Corporate Governance Committee (Comitato per la Corporate Governance delle societa` quotate), 1999; Commission Tabaksblat, 2003; Corporate Governance Committee, 2004) and some rules from the Central Bank and financial supervisory authorities (Basel Committee on Banking Supervision, 2004; Banca d’Italia, 1999), the internal auditing profession was unknown in most companies. IAAs were present predominantly in branches of multinational companies or in some large banks or conglomerates. The growth of membership in the IIA in Italy after 2000 has been very rapid. Participants were asked if they had professional certifications, such as the CIA, MIIA, or the PIIA. These certifications indicate that internal auditing professionals have an understanding of the Standards and possess the knowledge needed to perform internal audits. Table VI is a summary of various certifications respondents indicated they had earned. As shown in the last two columns of Table VI, with the exception of the certified financial analyst (not significant, p ¼ 0.877) and Government Auditing (0.003 significance), certifications for which very few selections were made, there are highly

significant differences in the types of professional certifications held by respondents between countries. The x 2 results should be interpreted cautiously when observations in a cell are less than five. The UK and Ireland (62.4 percent), Belgium (55.9 percent), and The Netherlands (48.2 percent) have the most respondents with Internal Auditing Certification. After Internal Auditing Certification, Public Accounting/Chartered Accountancy is the certificate held by most respondents, with The Netherlands (47.3 percent) and the USA (36.3 percent) having the highest percentages. It is also noteworthy that certifications in Information System Auditing, Control Self-assessment, and Fraud Examination are held by 8 percent or more of the respondent for several affiliates. For Italy, these data are consistent with the age of the auditing profession. Until a few years ago, most internal auditors had jobs as external auditors or in the accounting offices of an organization and are just now starting to think about CIA certification. Italy (12.3 percent) has the highest percentage of respondents with Certification in Control Self-assessment (CCSA) certification. The IIA affiliate in Italy promoted the CCSA as a fundamental certificate. In Belgium, certifications such as CIA are more often becoming a requirement to enter or at least to remain in the IAA. These certifications are also highly valued when internal auditors rotate to other functions, either inside or outside their current employer. Demographic information about respondents’ organizations To gain an understanding about the age of respondents’ organizations and when organizations first developed an IAA, respondents were asked about the number of years of existence for both. Table VII provides summary information about the age of their organization for which significant differences by country are observed (x 2 ¼ 307.46, p , 0.001). The USA has the highest percentage (55.4 percent) of respondents with organizations in existence for 51 or more years, followed by Belgium (50.5 percent) and The Netherlands (49.5 percent). Italy (21.5 percent) has the largest number of respondents with organizations in existence for five years or less. Table VIII shows the number of years that respondents’ organizations have had an IAA. Significant differences are observed between countries (x 2 ¼ 202.86, p , 0.001). While the IIA was founded in 1941 in the USA, the international IIA affiliates began operation in subsequent years. A majority of the respondents’ organizations have had IAAs for 15 or less years: Italy (78.7 percent), Belgium (70.5 percent), the UK and Ireland (53.7 percent), The Netherlands (52.8 percent), and the USA (51.3 percent). In Italy 44.8 percent and in Belgium 36.4 percent of the respondents indicate that their organizations have had IAAs for only five years or less. The relatively low maturity of the internal auditing profession in these two countries compared to the others in this study is consistent with the date each became affiliated with the IIA, which was founded in the US in 1941; UK and Ireland in 1948; Italy in 1972; Belgium in 1977; and The Netherlands in 1997. Although the Belgian affiliate was created in 1977, it has taken more than two decades to gain recognition and to significantly increase its membership. This is also consistent with Table V which indicates the number of years that respondents have been members of the IIA. Use of the Standards in whole or in part (RQ1) The IIA’s (2005, p. xxxii) Code of Ethics indicates that all internal auditors, “Shall perform internal auditing services in accordance with the International Standards for


MAJ 24,9

846

the Professional Practice of Internal Auditing.” Those that do not follow the Standards due to laws and regulations must state so in their reports (IIA, 2005, p. 3). In the last two columns of Table IX, the x 2 test results show that there are no variations by staff level between the countries’ respondents in the percentage that claim to use the Standards in whole or in part. CAE responses for the countries indicate a range of usage from a high of 90.5 percent in Belgium to a low of 81.7 percent in Italy. The respondents that believe their IAAs’ use the Standards the least are audit senior/supervisors in The Netherlands (60.0 percent) and the audit staff in the UK and Ireland (62.9 percent). Full or partial compliance by Standard (RQ2 ) Respondents whose IAAs use the Standards in whole or in part were also asked to indicate for each standard whether their IAAs were in full compliance, partial compliance, not in compliance, or they did not know. Table X shows the results for full and partial compliance. High variation by country is indicated by the x 2 results reported in the last two columns of the table. The respondents from the USA (overall average of 64.3 percent) consistently indicate the highest level of full compliance with the Standards. Belgium’s respondents (60.6 percent) indicate the second highest percentage of full conformance. The Standard for which the respondents consistently note as having the least full compliance is Standard 1300, QA&IP, with a high of 48.6 percent in the USA to a low of 28.6 percent in Italy. For Italy, low compliance may be caused by nearly half of Italian respondents’ organizations’ IAAs being in existence for less than five years. This could impact compliance with the requirement for external assessments since such assessments are only required once every five years. For Standard 2600, Resolution of Management’s Acceptance of Risks, respondents also indicate high levels of non-compliance. This Standard requires the IAA to report to the board a disagreement with management about the acceptable level of risk in the organization. Adequacy of guidance for the Standards (RQ3 ) The respondents were also asked about the adequacy of the guidance provided by the Standards. In the last columns in Table XI, the x 2 tests show highly significant results indicating high variation between countries. Adequacy of guidance for Standard 2600, Resolution of Management’s Acceptance of Risk, received the lowest rating by respondents from all five countries. This could be the consequence of this Standard’s requirement that CAEs initiate a discussion with senior management if management has accepted, “a level of residual risk that may be unacceptable to the organization [. . .]” (IIA, 2005, p. 23), which could require delicate negotiation with upper management. The second area where respondents note a low level of adequacy of guidance is with Standard 1300, QA&IP. For all of the Standards, the respondents from Belgium (92.3 percent) found the guidance to be the most adequate with Italy (90.6 percent) a close second. The respondents from the UK and Ireland (77.3 percent) find the guidance to be the least adequate. Adequacy of Practice Advisories (RQ4 ) Guidance on how to apply the Standards is provided in the IIA’s Practice Advisories, which are endorsed and strongly recommended by the IIA. Respondents who use the

CAE Audit manager Audit senior/ supervisor Audit staff Other Overall average

Position in the IAA 90.5 93.3

68.2 90.9 100.0 87.1

21

30

22 22 5

100

438

76 113 27

96

126

84.0

81.6 86.7 85.2

85.4

81.7

111

30 17 8

30

26

72.1

60.0 88.2 37.5

70.0

88.5

268

81 35 9

75

68

79.9

74.1 62.9 77.8

89.3

85.3

3,067

873 523 218

700

753

17.504 0.002 12.868 0.012 9.433 0.051

83.6 83.7 76.1 84.4

8.814 0.066

86.7

p

2.412 0.660

x2

86.3

Percentage of respondents Belgium Italy The Netherlands UK and Ireland USA Number of Number of Number of Number of Number of respondents Percentage respondents Percentage respondents Percentage respondents Percentage respondents Percentage


Table IX. Organizations’ use of the Standards in whole or in part

Table X. Full and partial compliance with the Standards

1000 – Purpose, Authority, and Responsibility 1100 – Independence and Objectivity 1200 – Proficiency and Due Professional Care 1300 – QA&IP 2000 – Managing the IAA 2100 – Nature of Work 2200 – Engagement Planning 2300 – Performing the Engagement 2400 – Communicating Results 2500 – Monitoring Progress 2600 – Resolution of Management’s Acceptance of Risks Overall average

23.7 19.5 35.1 40.0 40.3 35.1 32.5 32.5 28.9 29.9 36.8 32.2

71.1 76.6 61.0 38.7 53.2 58.4 63.6 63.6 68.4 63.6 48.7 60.6

Belgium Full Partial

34.9 54.7

62.3 68.7 58.5 28.6 54.9 61.0 59.0 61.4 65.4 46.6 36.6 34.6

30.0 25.5 36.9 40.2 37.2 32.7 33.6 33.4 29.1 45.6 47.0 55.0

61.8 70.1 68.7 31.3 54.4 58.5 56.1 49.2 59.7 47.8 30.3 29.4

25.0 19.4 14.9 41.8 30.9 29.2 28.8 36.9 28.4 37.3 49.1 56.5

64.2 64.0 66.5 38.6 57.4 52.7 58.2 56.7 62.8 51.2 31.0 26.8

21.4 22.3 20.2 39.2 26.6 29.0 25.3 28.1 21.5 30.0 59.2 64.3

69.2 70.8 69.1 48.6 64.1 64.6 63.7 67.5 69.3 60.8

Full

18.3 17.0

13.5 13.4 14.5 24.5 18.2 16.4 17.8 15.4 14.4 20.3

USA Partial

848

Standard

Percentages of respondents The UK and Italy Netherlands Ireland Full Partial Full Partial Full Partial

152.405

120.953 86.370 141.578 159.730 126.440 107.028 101.961 126.152 94.343 135.978

x2

, 0.001

, 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001

p

MAJ 24,9


Standard 97.4 94.9 97.5 85.5 96.2 92.2 92.2 94.9 94.8 90.9 79.2 92.3

Belgium 94.9 95.5 96.8 73.9 92.8 93.0 94.8 94.8 94.8 92.4 73.3 90.6

Italy 76.5 80.6 76.5 76.5 79.4 76.9 78.5 79.7 80.3 79.1 73.1 77.9

80.3 82.5 82.5 72.0 77.2 72.6 77.1 76.7 79.0 78.0 72.8 77.3

Percentages of respondents The Netherlands UK and Ireland 81.1 83.1 81.9 74.9 79.9 78.0 79.1 80.3 80.8 78.3 75.2 79.3

USA p , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001

x2 70.531 58.564 66.003 70.305 63.008 59.926 65.249 62.029 53.527 56.364 57.346


Table XI. Adequacy of guidance provided by each of the Standards

MAJ 24,9

850

Practice Advisories were asked if they believed that the guidance provided is adequate. As reported in the last two columns of Table XII, there are significant variations among the five countries respondents concerning the level of adequacy for each Practice Advisory. Respondents from Belgium, Italy, and the USA indicate that the Practice Advisories for Standard 1300, QA&IP, and Standard 2600, Resolution of Management’s Acceptance of Risks, is the least adequate. The respondents in The Netherlands believe that the guidance for seven of the Practice Advisories is less adequate than that for Standard 1300 and in the UK and Ireland three others are less adequate. The overall averages for respondents from Italy (87.2 percent) show the highest satisfaction with the Practice Advisories’ guidance, while the UK and Ireland (69.8 percent) and The Netherlands (70.8 percent) indicate the lowest. It is interesting to note that Belgian respondents reveal much less satisfaction with the adequacy of Practice Advisories than for Standards (overall 76.1 vs 92.3 percent), whereas the USA is the only country which reports a higher average of adequacy for Practice Advisories than for Standards (81.1 vs 79.3 percent). Reasons for lack of compliance (RQ5 ) To determine why companies do not use the Standards in whole or in part, participants were given a list of reasons and asked to select all that apply as causal factors for their lack of use of the Standards. The results are summarized in Table XIII. While the x 2 test shows a high variation by country, several reasons for not using the Standards seem to be shared by the respondents. The top five reasons why all respondents do not use the Standards in whole or in part are: (1) not perceived as adding value by management/board (11.5 percent); (2) inadequate staff in the IAA (11.3 percent); (3) too time consuming (10.0 percent); (4) compliance not supported by management/board (9.7 percent); and (5) not appropriate for small organizations (9.2 percent). If management and the board do not support the IAA’s use of the Standards, there are significant issues that need to be addressed by the organization. Age of the IAAs’ effect on the use of the Standards To determine if the number of years an organization has had an IAA has an effect on the percentage of the respondents that use the Standards in whole or in part, the responses to these two questions where cross-tabulated. In order for a respondent to be included in Table XIV, they had to have answered both questions. Table XIV contains the data on the relationship between the age of the IAA and the use of the Standards in whole or in part. The insignificance of the x 2 test within each country indicates that the length of time an organization has had an IAA does not affect the use of the Standards in whole or in part. The x 2 between countries is significant for those that have had an IIA for more than six years. Comparison of use of Standards with number of full-time audit staff To determine if the number of full-time staff (CAE, audit manager, audit senior/supervisor, and audit staff) had any influence on the use the Standards in


Practice Advisories 82.8 75.4 80.7 69.0 78.6 78.9 71.9 78.9 78.6 78.9 70.2 76.1

Belgium 91.7 90.3 91.7 71.3 89.4 89.8 91.1 91.9 90.2 87.9 73.7 87.2

Italy 73.6 75.0 71.2 73.1 71.2 71.2 65.4 67.3 74.5 69.2 67.3 70.8

72.2 73.6 73.4 68.8 69.8 68.3 66.7 68.3 71.0 69.6 66.1 69.8

Percentage of respondents The Netherlands UK and Ireland 82.9 83.2 82.5 78.0 81.6 80.7 81.3 81.6 82.1 80.3 78.0 81.1

USA p , 0.001 , 0.001 0.001 0.026 , 0.001 , 0.001 , 0.001 , 0.001 , 0.001 0.001 0.016

x2 27.968 31.417 27.781 17.370 34.533 28.523 61.466 40.508 28.623 26.334 18.715


Table XII. Adequacy of Practice Advisories in percentages

Table XIII. Reasons for not using the Standards in whole or in part 7.5 11.3 12.0 12.5 7.9 2.6 16.6 21.9 20.7 3.1 8.4 416

10.6 14.9 12.8 18.1 6.4 5.3 16.0 18.1 6.4 6.4 10.6 94

17.0 8.0 5.0 23.0 100

11.0

14.0 2.0

5.0 12.0 6.0 17.0

10.0 7.6 4.0 15.3 249

7.2

19.3 4.4

2.0 6.0 2.8 9.2

9.8 10.6 0.3 13.6 2,877

8.6

7.4 4.4

3.2 8.9 7.3 9.2

11.5 11.3 1.2 13.3 3,736

9.7

8.4 4.2

3.8 9.2 7.7 10.0

Overall average for all respondents p

59.815 ,0.001 44.628 ,0.001 82.260 ,0.001 18.408 0.001 ,0.001

32.591 ,0.001

46.667 ,0.001 4.375 0.358b

32.968 ,0.001 10.091 0.039 23.752 ,0.001 17.515 0.002

x2

Notes: aSince respondents could mark all that apply, percentages do not add up to 100; bwhen the number of observations is less than 5 in a cell the x 2 results should be interpreted cautiously

Standards or Practice Advisories are too complex Not appropriate for small organizations Too costly to comply Too time consuming Superseded by local/government regulations or standards Not appropriate for my industry Compliance not supported by management/ board Not perceived as adding value by management/board Inadequate internal audit staff Compliance not expected in my country Other Number of respondents

Belgium Italy

852

Reason

Percentage of respondentsa The UK and Netherlands Ireland USA

MAJ 24,9

0.775 0.379

83.9

56

88

90.6

32

391

217

174

1.439 0.230

87.1

82.8

104

86

18

1.573 0.210

68.6

83.3

Notes: ax 2 ¼ 1.607, p ¼ 0.807 between counties; bx 2 ¼ 20.731, p , 0.001 between countries

0-5 yearsa 6 or more yearsb Total respondents x2 p

Years having an IAA

224

184

40

0.094 0.760

82.1

80.0

1.623 0.203

85.7

1,954 2,569

83.6

615

Percentage of respondents Belgium Italy The Netherlands UK and Ireland USA Percentage Percentage Percentage Percentage Percentage use of use of Number of use of Number of use of Number of use of Number of Number of respondents Standards respondents Standards respondents Standards respondents Standards respondents Standards


Table XIV. Using of the Standards in whole or in part compared to the number of years organization has had an IAA

MAJ 24,9

854

whole or in part, a x 2 test cross-tabulating these two responses was performed within each country. As shown in Table XV, in the USA and Italy the number of full-time staff does appear to affect the use of the Standards in whole or in part. Quality Assurance and Improvement Program Standard 1300 (IIA, 2005, p. 11), QA&IP, states that, “The chief audit executive should develop and maintain a QA&IP that covers all aspects of the internal audit activity.” This program should include internal assessments and external assessments. As reported earlier, full compliance with this Standard is the lowest among all the Standards. This is a concern, as Standard 1300 addresses monitoring the quality of the work performed by IAAs. For this reason, the next two sections discuss issues related to internal and external assessment under Standards 1311 and 1312. Internal assessments for Standard 1311 (RQ6 ) Internal assessments include ongoing reviews of the work performed by IAAs and periodic reviews by individuals with knowledge of the Standards (IIA, 2005, p. 11). Table XVI presents the respondents’ answers to the question of whether and when their IAAs were subject to a formal internal assessment in accordance with Standard 1311, Internal Assessments. The x 2 tests (x 2 ¼ 89.275, p , 0.001) shows significant variation between countries. Italy (65.0 percent) had the largest percentage of respondents that note that their IAA has never had an internal assessment or that the assessment was not in compliance with 1311, while the UK and Ireland (30.6 percent) has the lowest percentage of never having had an internal assessment or one not in compliance with 1311. For Belgium, The Netherlands, the UK and Ireland, and the USA, 50 percent or more of the respondents indicate that their IAAs have had a formal internal quality assessment within the past five years or plan to have by January 1, 2007. External reviews for Standard 1312 (RQ7 ) Standard 1312, External Reviews, requires an external quality assurance review every five years. While there is significant variation between countries (x 2 ¼ 115.997, p , 0.001), many of the respondents indicate that their IAAs are not in compliance with the Standards. Table XVII shows that Italy has the highest percentage of respondents (72.9 percent), indicating that their IAA has never had an external assessment or had one that was not in compliance with 1312, while the UK and Ireland respondents (31.5 percent) note the lowest number of IAAs that have not had an external assessment or one done that was not in compliance with 1312. These results are consistent with the data on internal reviews. While in May 2007, the IIA (2007) revised Practice Advisories 1310-1, Quality Assessments, 1312-1, Quality Program Assessments, and 1312-2, External Assessments: Self-assessments with Independent Valuation, these revisions do not change the requirement for having an external examination every five years. Rather, they provide a better explanation for self-assessments. Summary and conclusions This paper compares responses from Belgium, Italy, The Netherlands, the UK and Ireland, and the USA, with respect to the level of use of the IIA’s Standards, compliance with these standards, adequacy of guidance, and compliance with internal/external

88.0 58.3 100.0 100.0 60.0 100.0 85.7 100.0 93.5

25 12 6 2a 5 1a 7 2a

31 91 13.541 0.095

127 394 27.374 0.001

96 74 35 21 12 17 7 5 92.9

68.8 87.8 77.1 85.7 91.7 82.4 85.7 100.0

Italy Number of respondents Percentage

44 104 10.553 0.228

17 15 3a 4a 9 8 3a 1a 75.0

52.9 86.7 100.0 100.0 66.7 75.0 66.7 0.0

Percentage of respondents The Netherlands Number of respondents Percentage

73 250 9.33 0.315

38 49 41 16 12 7 7 7 90.4

68.4 79.6 78.0 81.3 75.0 85.7 71.4 71.4

UK and Ireland Number of respondents Percentage

Note: When the number of observations is less than 5 in a cell the Chi-square results should be interpreted cautiously

1-3 4-6 7-9 10-12 13-15 16-18 19-21 22-24 25 or more Total x2 p

Number of staff

Belgium Number of respondents Percentage 77.3 84.0 86.2 81.0 89.1 89.1 94.4 83.8 90.8

665 530 369 205 156 110 71 68 706 2,880 61.104 , 0.001

USA Number of respondents Percentage


Table XV. Use of the Standards in whole or in part compared to the number of full-time staff at each staff

Table XVI. When IAA was last subject to a formal internal quality assessment 50.6

49.4 100.0

39

38

77

Notes: x ¼ 89.275; p , 0.001

2

Done in past five years or scheduled to be completed prior to January 1, 2007 Never had one or not done in compliance with Standard 1311 Total number of respondents

Timing

856

349

227

122

100.0

65.0

35.0

81

36

45

100.0

44.4

55.6

183

56

127

100.0

30.6

69.4

1,985

794

1,191

100.0

40.0

60.0

Percentage of respondents Belgium Italy The Netherlands UK and Ireland USA Number of Percentage Number of Percentage Number of Percentage Number of Percentage Number of Percentage respondents of total respondents of total respondents of total respondents of total respondents of total

MAJ 24,9

47.9

52.1 100.0

35

38

73

Notes: x ¼ 115.997; p , 0.001

2

Done in past five years or scheduled to be completed prior to January 1, 2007 Never had one or not done in compliance with Standard 1312 Total number of respondents

Timing

292

213

79

100.0

72.9

27.1

80

45

35

100.0

56.3

43.8

184

58

126

100.0

31.5

68.5

57.7

42.3 100.0

1,127

827 1,954

Percentage of respondents Belgium Italy The Netherlands UK and Ireland USA Number of Percentage Number of Percentage Number of Percentage Number of Percentage Number of Percentage respondents of total respondents of total respondents of total respondents of total respondents of total


Table XVII. When IAA was last subject to a formal external quality assessment

MAJ 24,9

858

quality assessments of IAAs. While internal auditing is a global profession and the IIA’s Standards and certifications are the same for all countries, the growth of the internal auditing profession has been influenced by new national legislation, stock exchange requirements, and corporate governance standards. There are high levels of variation by respondents from these countries for most of the research questions. Demographic country variations indicate significant differences by country for the number of years respondents have been a member of the IIA, their college degrees, their professional certifications, and their ages. In addition, significant differences between countries are observed for the age of organizations and the number of years that the IAAs have been in existence. Although no significant difference is observed by staff level within each country for the use of the Standards in whole or in part, there is a significant difference between countries. The percentage of respondents that indicate their IAAs use the Standards in whole or in part ranges from 72.1 percent in The Netherlands to 87.1 percent in Belgium. There is also a significant difference for full compliance with the Standards between countries, which ranges from 54.7 percent of the respondents in Italy to 64.3 percent in the USA. Significant differences exist between countries in the level of satisfaction with the adequacy of the guidance for all the Standards and with the Practice Advisories, with the exception of Standards 1300 and 2600. The respondents’ assessments of the adequacy of the guidance provided by the Standards ranges from 77.3 percent in the UK and Ireland, to 92.3 percent in Belgium. The level of satisfaction with the guidance provided by the Practice Advisories ranges from 69.8 percent in the UK and Ireland to 87.2 percent in Italy. The value contributed by the IAA to the organization’s success may be compromised or devalued if the Standards are not followed. A lack of compliance with any standard means that the IAAs are not in full compliance with the Standards, and they must inform their constituents in each audit report. Respondents indicate that the major reason for not using the Standards in whole or in part is that company management or the board does not perceive them as adding value. Other reasons selected by respondents for failure to comply with the Standards are that compliance is too time consuming and that the IAAs do not have adequate staffing. It appears that convincing management and the board of the usefulness of the Standards is a major challenge for many IAAs. While further analysis reveals that the use of the Standards is not correlated with the age of the IAA, the size of the audit staff does affect the usage of the Standards in the USA and Italy. Compliance with Standards 1300, QA&IP and 2600, Resolution of Management’s Acceptance of Risks, is universally limited. The USA has the highest full compliance with these standards (48.6 and 59.2 percent, respectively) while Italy has the lowest full compliance (28.6 and 34.9 percent, respectively). Standard 1300 requires formal internal and external quality assessments of the IAAs compliance with the IIA Standards. There is significant lack of compliance with these assessment standards in all countries. In Italy, 65.0 percent of respondents indicate they have never had a formal internal quality assessment, or it was not done in accordance with Standard 1311. In the UK and Ireland, this number is only 30.6 percent. For formal external quality assessments, a high of 72.4 percent of the respondents in Italy to a low of 31.5 percent in the UK and Ireland, indicate that their IIAs have never had an external review or it was not performed in compliance

with Standard 1312. These results indicate a need for IAAs in all countries to take action in establishing internal and external quality assessment reviews. In summary, significant differences were found between countries, indicating a need for development of country-specific responses to the deviations in compliance with the IIA Standards. In each country, such responses must take into account the differing causes for variation as discussed in this paper. The mandates by country regulations, stock exchanges, and corporate governance rules, as well as the perception of IAA’s strategic value added to the organization should lead to solutions to increase compliance and adherence to all the IIA’s Standards. References Albrecht, W.S., Stice, J.D. and Stocks, K.D. (1992), A Common Body of Knowledge for the Practice of Internal Auditing, The Institute of Internal Auditors Research Foundation, Altamonte Springs, FL. Allegrini, M. and D’Onza, G. (2003), “Internal auditing and risk assessment in large Italian companies: an empirical survey”, International Journal of Auditing, Vol. 7 No. 3, pp. 191-208. Banca d’Italia (1999), “Organizzazione e controlli interni”, Istruzioni di vigilanza, Aprile. Banking, Finance and Insurance Commission (1997), Circular on Internal Control and Internal Audit, Brussels. Basel Committee on Banking Supervision (2004), International Convergence of Capital Measurement and Capital Standards, Basel. Birkett, W.P., Barbera, M.R., Leithhead, B.S., Lower, M. and Roebuck, P.J. (1999), Internal Auditing: The Global Landscape, The Institute of Internal Auditors Research Foundation, Altamonte Springs, FL. Burnaby, P.A., Abdolmohammadi, M. and Hass, S. (2007), A Global Summary of the Common Body of Knowledge 2006 – Preview Edition, The Institute of Internal Auditors Research Foundation, Altamonte Springs, FL. Commission Tabaksblat (2003), Corporate Governance Code, The Hague. Corporate Governance Committee (Comitato per la Corporate Governance delle societa` quotate) (1999), Corporate Governance Code, Borsa Italiana S.p.A, Milan. Corporate Governance Committee (2004), Corporate Governance Code, Brussels. Corporate Governance Committee (2006), Corporate Governance Code, Borsa Italiana S.p.A, Milan. European Parliament and Council of the European Union (2006), Directive on Statutory Audits of Annual Accounts and Consolidated Accounts, Brussels, Luxembourg, and Strasbourg. Financial Reporting Council (2006), The Combined Code on Corporate Governance, London. Gray, G. (2004), Changing Internal Audit Practices in the New Paradigm: The Sarbanes-Oxley Environment, The Institute of Internal Auditors, Altamonte Springs, FL. IIA (1999), A Vision for the Future: Professional Practices Framework for Internal Auditing, The Institute of Internal Auditors, Altamonte Springs, FL. IIA (2005), The Professional Practices Framework, The Institute of Internal Auditors Research Foundation, Altamonte Springs, FL. IIA (2006a), Organizational Governance: Guidance for Internal Auditors, The Institute of Internal Auditors, Altamonte Springs, FL.


MAJ 24,9

860

IIA (2006b), “By the numbers”, IIA Insight, Vol. 1, pp. 8-9. IIA (2007), Practice Advisories, available at: www.theiia.org (accessed May 16, 2007). King Committee of Corporate Governance (2002), King Report on Corporate Governance for South Africa, Institute of Directors, Johannesburg. Melville, R. (2003), “The contribution internal auditors make to strategic management”, International Journal of Auditing, Vol. 7 No. 3, pp. 209-22. NYSE (2004), Corporate Governance Rules – Section 3303A, p. 14. Paape, L., Scheffe, J. and Snoep, P. (2003), “The relationship between the internal audit function and corporate governance in the EU – a survey”, International Journal of Auditing, Vol. 7 No. 3, pp. 247-62. Parliament (1972), Local Government Act 1972, London. Parliament (1982), Parliament Local Government Finance Act 1982, London. Parliament (1996), Accounts and Audit Regulations 1996, London. PCAOB (2004), Auditing Standard No. 2: An Audit of Internal Controls over Financial Reporting Performed in Conjunction with an Audit of Financial Statements, Public Company Accounting Oversight Board, Washington, DC. Sarbanes-Oxley Act (2002), One Hundred Seventh Congress of the United States of America, HR 3763, Washington, DC. Sarens, G. and de Beelde, I. (2006a), “Internal auditors’ perception about their role in risk management: a comparison between US and Belgian companies”, Managerial Auditing Journal, Vol. 21 No. 1, pp. 63-80. Sarens, G. and de Beelde, I. (2006b), “The relationship between internal audit and senior management: an analysis of expectations and perceptions”, International Journal of Auditing, Vol. 10 No. 3, pp. 219-41. Selim, G. and Yiannakas, A. (2001), “Outsourcing the internal audit function: a survey of the UK public and private sectors”, International Journal of Auditing, Vol. 5 No. 1, pp. 213-26. Selim, G., Sudarsanam, S. and Lavine, M. (2003), “The role of internal auditors in mergers, acquisitions and divestitures: an international study”, International Journal of Auditing, Vol. 7 No. 3, pp. 223-46. Corresponding author Priscilla A. Burnaby can be contacted at: [email protected]

To purchase reprints of this article please e-mail: [email protected] Or visit our web site for further details: www.emeraldinsight.com/reprints