New Perspectives in Internal Audit Research: A Structured Literature Review^†

Oversight Governance Role

As Gramling et al.’s (2004) seminal literature review posited that the IAF acts as a governance mechanism, the first wave of research adopted this idea as a premise (Goodwin-Stewart and Kent, 2006a; Mat Zain and Subramaniam, 2007; Prawitt et al., 2009; Stewart and Subramaniam, 2010). Published on the heels of SOX, this group of studies is interested in the “fiduciary” aspect of governance (Labelle, Gargouri, and Francoeur, 2010). Internal audit is therefore considered an oversight governance mechanism that mitigates the agency problem, to shareholders' benefit, by providing assurance to the audit committee mainly, if not exclusively, on financial reporting. However, Sarens and Abdolmohammadi (2011) and Barua et al. (2010) argue that there is a substitution effect between the IAF and the audit committee, but more research is needed to confirm or discard this conclusion.

Few articles have investigated the IAF's impact on investors' judgments and decision making (Archambeault et al., 2008; Holt and DeZoort, 2009), on earnings management levels (Davidson et al., 2005), and external audit fees (Goodwin-Stewart and Kent, 2006b). Since the results of these studies are mixed, the IAF's impact on “external” stakeholders is still to be demonstrated.

The first group of studies shows that the IAF's usefulness as an oversight governance pillar resides mainly in its ability to (i) enhance the reliability of financial information (Davidson et al., 2005; Prawitt et al., 2009;), and (ii) to prevent, detect, and disclose both significant internal control weaknesses and financial fraud perpetrated within the organization (Arel et al., 2012; Asare et al., 2008; Coram et al., 2008; Lin et al., 2011; Norman et al., 2010). However, Norman et al. (2010) argue that the IAF's influence on fraud prevention, detection, and disclosure remains unproven since in some circumstances internal auditors tend to protect top management from negative repercussions stemming from the audit committee. Roussy (2013, 2015) echoes these ideas by questioning the IAF's governance oversight role as a premise (see following section). Additionally, Brender et al. (2015) recently argued that although the IAF should be considered a tool to oversee other governance mechanisms and processes, it is not actually used as such. More research is needed to delineate whether and how the IAF can provide assurance on the effectiveness of risk management and other governance bodies such as the board of directors. For instance, surveys and interviews with boards of directors and internal auditors could be fairly relevant methodologies to use in launching this exploration.

Last but not least, some studies that investigated the 2007 financial crisis (Chambers and Odar, 2015) or compared the role of internal audit with the actual tasks of internal auditors (Leung et al., 2011) argued that internal audit might have failed to play its governance oversight role properly. They assert that to provide the board with relevant assurance, this function needs to move to auditing corporate governance mechanisms and processes instead of concentrating its activities on operational processes. These two articles lead us to consider a second wave of research that documents additional roles for internal audit.

Other Documented Roles

This second group of studies argues that the roles of internal audit are complex and constantly evolving (Soh and Martinov-Bennie, 2011) and therefore cannot be confined to governance oversight. A host of contrasting viewpoints regarding the roles of internal audit is offered. For example, Lenz and Sarens (2012) maintain that there is no single or straightforward answer to the question regarding the role of internal audit and how it brings added value. They point out that the uncertainty surrounding its role is because of internal auditors having multiple customers to serve—managers, the board, the audit committee, and so on. Acknowledging the issue, Roussy (2013) found that internal auditors play two key roles, as “protectors” and “helpers” of the organization and its top managers. Sarens et al. (2009) view the IAF as an important source of “comfort” for audit committee members while Vinnari and Skaerbaek (2014) point out that the IAF plays a central role in risk management.

Roussy (2015) even questions the relevance of conceptualizing internal audit as a governance mechanism, arguing that the time has come to explore the proximity of the IAF and management control. Her point of view is shared by Mihret and Grant (2017), who adopted a Foucauldian perspective for their study and suggested that internal audit can be understood as a disciplinary mechanism within organizations, similar to management control. Finally, Mihret (2014) diverged from traditional agency theory arguments by suggesting that the role of internal audit should be understood through the lens of labor process theory. According to this particular conceptualization, the IAF could be seen as a control mechanism that helps to create value by providing advisory and assurance services that increase the rate of return on capital.

Further, several studies identified the IAF as an important organizational actor in key strategic activities such as organizational learning, training of prospective senior managers, IT governance, and sustainability. Ma'ayan and Carmeli (2016) suggested that the IAF facilitates learning by business units, while Anderson et al. (2012) found that organizations have two philosophies regarding internal audit staffing. The first sees internal auditing as a career in itself, whereas the second views it as a training ground for top managers, an aspect that could fall under the category of internal audit's other roles. Héroux and Fortin (2013), adopting a holistic approach to examining IT governance, found that the IAF focuses on risk assessment and evaluation of IT controls. Along those lines, D'Onza, Lamboglia, and Verona (2015) argued that managers want greater support from the IAF for IT governance. After investigating the role of internal auditors with respect to disclosures of greenhouse gas emissions and energy usage, Trotman and Trotman (2015) concluded that the IAF should play a role in this type of reporting because internal auditors view their function as having become part of the external reporting process. Despite the fact that sustainability issues are expected to increase in the coming years (Soh and Martinov-Bennie, 2015; Ridley et al., 2011), few papers advocate that internal audit should provide assurance concerning sustainability. Its issues remain unclearly defined and are considered less important than other governance issues (Soh and Martinov-Bennie, 2015; Ridley et al., 2011). Internal auditors are perceived to have far less expertise on environmental issues than on other topics (Soh and Martinov-Bennie, 2015).

General Observations and Research Avenues

In our perusal of the literature, we found no consensus regarding the roles internal audit should play or even of its actual role in organizations. Although most of the studies assume that the IAF is an oversight governance mechanism, others maintain that the roles of this function lie elsewhere. As a result, the literature seems to infer that the IAF has become a kind of “jack of all trades.” Having multiple roles is not necessarily problematic, but (i) it can create confusion about the IAF's main role, and (ii) stakeholders risk completing the expression “jack of all trades” with “master of none,” a perspective that may impair the function's perceived (or actual) added value.

The IIA has failed to offer a way out of this impasse, even compounding the problem by recently amending its standards to allow internal auditors to assume other responsibilities (in addition to assurance and consulting activities), according to the needs of the organization (Institute of Internal Auditors, 2017).While the IAF's roles may have been uncertain before this amendment, they are even more nebulous now. They must be more clearly defined or the confusion will ultimately affect (i) the practice of internal audit and (ii) IAF quality assessment by practitioners (and researchers) (Roussy and Brivot, 2016; Soh and Martinov-Bennie, 2011). Consequently, this important research avenue remains wide open. We particularly need to understand the extent to which the IAF's roles can be associated with the strategic aspect of governance duties (Labelle et al., 2010), given that its other roles (as we defined previously) fall under that category, adding to or complementing its “fiduciary” role (Labelle et al., 2010). Future research must consider the conflicting nature of the strategic and fiduciary aspects of governance if they are to coexist within the IAF, not least because this issue could raise independence and ethical concerns for internal auditors. Experimental research design seems an appropriate vehicle for such testing.

Additionally, the IAF's roles with respect to IT governance and other IT issues such as big data, cryptocurrency, and block chains require further understanding given the scant literature on this topic. As IT concerns are emergent in the IAF literature, interviews and/or surveys could be relevant for further investigation. For instance, interviews with ISACA officials or internal auditors who specialize in IT audit (i.e., internal auditors with the Certified Information Systems Auditors professional designation) could be an appropriate starting point for engaging the internal audit literature on this important future research avenue.

With the exceptions of Trotman and Trotman (2015) and Soh and Martinov-Bennie (2015), none of the reviewed articles examined a further relevant and underexplored issue: the social role of internal audit. In light of the IIA's assertion that internal auditors are professionals with their own professional designation (e.g., certified internal auditor (CIA)), standards, and code of ethics (Institute of Internal Auditors, 2017), it follows that internal auditors should be working for the public interest, an objective that may create a moral conflict with the governance and strategic imperatives of organizations. In sum, not only are internal audit's social roles undefined, but also the question remains as to whether it is actually a profession within the meaning of the fundamentals of sociology of the professions (e.g., Abbott, 1988; Freidson, 2001; Macdonald, 1995). Historical research on the professionalization of internal audit could shed light on its social roles, as could a study of the IIA's representation of internal audit, based on a content analysis of its website and publications, the CIA's exams, and the CBOK questionnaires.

Internal Audit Quality Criteria

The first wave of research on IAQ assumed that internal audit is an oversight governance mechanism and that IAQ is important for benefitting shareholders of publicly listed firms (Gramling and Vandervelde, 2006). Relying on the premise that IAQ is based on external audit quality criteria, as described by De Angelo (1981),5 especially independence and competence, this wave of studies thus replicated the approached used to measure external audit quality.

Unsurprisingly, the two main IAQ indicators that emerge from the literature are (i) the degree to which the external auditor relies on the work of the internal audit6 (Abbott et al., 2012a, 2012b; Bhattacharjee et al., 2016; Chen et al., 2017; Davidson et al., 2013; Issa and Kogan, 2014; Malaescu and Sutton, 2015; Munro and Stewart, 2011; Pizzini et al., 2015; Prawitt et al., 2011; Singh et al., 2014), viewed as a proxy for the IAF's “work performance” (Desai et al., 2010; Trotman and Duncan, 2017), and (ii) the effectiveness of the audit committee (Abbott et al., 2007, 2010; Anderson et al., 2012; Carcello et al., 2005; Christ et al., 2015; Davies, 2009; D'Onza, Selim, Melville, and Allegrini, 2015; Mat Zain and Subramaniam, 2007; Regoliosi and d'Eri, 2014), considered as the main proxy for independence.7

The internal audit's influence on the following items has been considered IAQ indicators: judgment and decisions of shareholders (Holt and DeZoort, 2009); level of earnings management (Abbott et al., 2016; Gras-Gil et al., 2012; Prawitt et al., 2009; Sierra Garcia et al., 2012); fraud risk and probability of its prevention, detection, and disclosure by internal auditors (Asare et al., 2008; Coram et al., 2008; Ege, 2015); and internal controls deficiencies (Farkas and Hirsch, 2016; Mazza and Azzali, 2015).

The literature indicates positive or negative correlations to IAQ for the following independence indicators. Positively correlated are the proportion of assurance assignments (Gramling et al., 2004; Lin et al., 2011); the strategic character of audited business processes (Archambeault et al., 2008); the fixed remuneration of chief audit executives (Schneider, 2010); close relationships between the chief audit executives and the audit committee (Anderson et al., 2012; Archambeault et al., 2008; Boyle et al., 2015; Christopher et al., 2009; D'Onza, Selim, Merlville, and Allegrini, 2015; Gramling et al., 2004; Holt, 2012; Holt and DeZoort, 2009; Prawitt et al., 2009; Stewart and Subramaniam, 2010; Zaman and Sarens, 2013); the audit committee's independence and competence (Christopher et al., 2009); and the outsourcing of internal audit work to a professional accounting firm (Abbott et al., 2012a; Brandon, 2010; Desai et al., 2011; Desai et al., 2010; Glover et al., 2008; Gramling and Vandervelde, 2006; Stewart and Subramaniam, 2010; Pike et al., 2016; Prawitt et al., 2012). Negatively correlated are the proportion of operational assignments (i.e., assignments in which the internal auditor acts as a manager) or consulting assignments (De Zwaan et al., 2011; Glover et al., 2008; Gramling et al., 2004; Prawitt et al., 2009); variable remuneration (Omar and Stewart, 2015; Schneider, 2010); use of the IAF as a training ground for top managers (Christ et al., 2015; Christopher et al., 2009; Messier et al., 2011); top management's significant involvement in long-term internal audit planning (Christopher et al., 2009); and close relationships between internal auditors and top managers (Holt, 2012; Norman et al., 2010).

We identified fewer studies on the competence criteria of IAQ. However, Abdolmohammadi (2012) argues that leadership skills are the CAEs' most important ones, while the technical skills are more important for their team (i.e., the internal auditors). Desai et al. (2011) and Bartlett et al. (2016) found that external auditors' positive perception of IAQ increases when the internal audit work is outsourced to a professional accounting firm. It would follow that external auditors consider themselves more independent and competent than internal auditors. Conversely, Munro and Stewart (2010) and Abdolmohammadi (2013) obtained opposite findings based on the fact that internal auditors are more familiar with business processes and risks. In addition, some recent studies show the difficulty of recruiting highly qualified candidates to the IAF given their negative perceptions of this function (Bartlett et al., 2016, 2017; Burton et al., 2015). However, Trotman and Duncan (2017) argue that the use of the IAF as a training ground for senior managers is perceived as a positive signal regarding internal auditor competence and that it informs the recruitment of good candidates.

Stakeholder Perceptions of Internal Audit Quality

The main weakness of the first group of articles on IAQ is that they focus almost exclusively on independence and competence criteria. Similarly to the literature on external audit quality, these studies overlook other important aspects of audit quality (Trotman and Duncan, 2017). In addition, the external auditor's viewpoint dominates the analyzed data, indicating that prior literature, despite using a variety of methodologies, has largely neglected the perspectives of other stakeholders.

Roussy and Brivot (2016) argue that various perceptions of IAQ exist where there are multiple stakeholders present, and that the time has come to give these actors a voice and step away from the single lens of the external auditor. They consider that there can be no single definition of IAQ because this concept is a matter of stakeholder perception. On this topic, Roussy and Brivot (2016), as well as Trotman and Duncan (2017), have drawn inspiration from Knechel et al.'s (2013) paper on external audit quality. Roussy and Brivot (2016) used a mixed-method design to explore the IAQ perceptions of the IIA, external auditors, audit committee members, and internal auditors. They conclude that each stakeholder has its own conception of IAQ, as well as a consistent way to evaluate it, which may lead to different ways to control IAF activities and processes. For their part, Trotman and Duncan (2017) comprehensively applied the Knechel et al. (2013) external audit quality framework (including input, process, outputs, and outcomes as well as contextual factors) to internal audit by interviewing audit committee members, senior managers (the auditees), and internal auditors in an effort to identify the main dimensions of the quality framework these actors use. As a result, they developed a multistakeholder IAQ framework that went beyond the IAQ criteria of independence and competence. This framework is consistent with Lenz et al. (2014), who investigated the different factors that can influence IAF effectiveness, grouping them into four dimensions: the organization, internal audit resources, internal audit processes, and internal audit relationships.

General Observations and Research Avenues

As the perspective of external auditors has largely dominated the IAQ literature, the next logical step within that literature was to treat IAQ like external audit quality and to search for similar indicators. As a result, independence and competence became the core of this literature, and several indicators pertaining to these aspects were widely documented.

However, we support the criticism that emerged in the literature regarding the dominance of the external auditor's perspective and the underrepresentation of organizational stakeholders such as audit committee members, the internal auditors themselves, and the audited managers. The literature is also silent about the perspective of other stakeholders such as shareholders, financial analysts, and regulators.

As we found only two articles that addressed this gap, we argue that more research is needed to clarify these stakeholders' conceptualization of IAQ and the way they manage and/or assess it. Indeed, these stakeholders can influence the practice of internal audit and, consequently, the roles actually played by this function.

For instance, future research could test the Trotman and Duncan (2017) and Lenz et al. (2014) IAQ frameworks by surveying stakeholders to identify the extent of their reliance on the documented indicators. As the literature generally tested only one indicator at a time (or a few indicators individually), future research should try to capture a comprehensive view of the way in which stakeholders assess the IAQ (e.g., how do they weigh the different quality indicators used? Which is most important, and under what conditions?). In addition, future research could build on the Roussy and Brivot (2016) IAQ paper and explore how the IAF is managed and controlled to determine whether this method is consistent with stakeholders' conception of a high-quality internal audit. Interviews with chief audit executives, audit committee chairs, and CEOs may be a relevant methodological approach for that particular purpose. Thereafter, a survey instrument could be constructed and sent to a larger sample of stakeholders to assess whether the results are generalizable.

Lastly, we were unable to find any studies that investigated the influence on the IAQ of IIA requirements regarding the quality assurance and improvement program (Institute of Internal Auditors, 2017) and the extent to which stakeholders rely on the program to gain a degree of trust in the IAF. This could be a relevant research avenue because the IIA's international professional practices framework emphasizes the importance of compliance with such requirements. As a follow-up, it may be interesting to explore whether, and under what circumstances, IAFs certified under the Quality Assurance and Improvement Program (Institute of Internal Auditors, 2017) are actually of better quality than uncertified ones and whether stakeholders consider this certification in their assessment of IAQ. To that end, given the absence of archival data on this topic, a content analysis of quality assurance and improvement program evaluations could be carried out based on prior IAQ literature findings. This exercise could be followed by surveys or interviews with relevant stakeholders, namely certified assessors (external independent professionals authorized by the IIA to conduct external assessments of IAF quality). In this particular case, these methods appear to be more accurate and productive research methodologies.

General Observations and Research Avenues

In view of the scarcity of research on the practice of internal audit, our conclusion is unsurprising: we know too little about this practice, and the time has come to conduct more research on the matter. Every stage of the internal audit process is poorly documented and understood. We therefore urge academics to investigate this issue, regardless of their theoretical or methodological preferences. That said, archival studies are extremely difficult, if not impossible, to conduct in internal audit practice because archival data is virtually nonexistent. Researchers must therefore rely on other methodologies such as interviews, case studies, surveys, and experiments.

On the topic of the planning stage, the literature is almost silent, and seems to consist of only one indirect study. Yet it would be most interesting to document how audit objectives and performance criteria are selected by internal auditors, and to analyze the extent to which these factors are consistent with the organization's strategic objectives and risk analysis. Moreover, as previous research has observed that internal auditors negotiate with auditees during the conclusion stage in regard to the findings and recommendations that will appear in the report, it would be relevant to understand the interactions between internal auditors and audited managers to determine how intensely the objectives and audit criteria are negotiated at the beginning of the process in anticipation of the final negotiation exercise.

The execution stage is also poorly understood. Not only is there insufficient scientific insight into the IT tools that internal auditors use to perform their duties, the audit methodologies they implement, and how they collect evidence, but the very nature of internal auditors' teamwork and interactions with one another remains unexplored. It would be significant to understand this aspect of their function as this would shed light on how they collectively perform assignments and establish their professional judgment. In addition, although we found a paper that documented the negotiation process pertaining to the findings and recommendations presented in internal audit reports, it would be highly valuable to conduct a documentary analysis of a real audit report in light of IAQ output indicators (Trotman and Duncan, 2017) and other relevant quality criteria. Such research would have been almost impossible even a few years ago, but some organizations, including the Canadian government, now publish their internal audit reports, giving researchers access to highly valuable data. Furthermore, access to the field and to confidential internal audit reports or IAF accountability reports can be negotiated for academic purposes, as demonstrated in Roussy and Rodrigue (2018).

It would also be relevant to measure managers' compliance with internal audit recommendations and how they perceive how these recommendations have contributed to improving organizational processes. Such research could help to capture the usefulness of the IAF.

In addition, the ethical reasoning of internal auditors is an important component of their professional judgment. It requires not only objectivity, sound technical competencies, and a good understanding of the organization, but also strong ethical deliberation skills, including the ability to detect ethical dilemmas and resolve them competently. Because previous research has cast doubt on internal auditors' ethical behavior (e.g., Everett and Tremblay, 2014; Roussy, 2015), we suggest that their ethical reasoning is a promising research avenue. For instance, experimentation could be a relevant research design since it makes it possible to simulate real-life scenarios in which internal auditors are confronted with ethical dilemmas and must posit a judgment and act accordingly.

Given the scarcity of studies on the IAF accountability process to the audit committee, scholars lack an overall understanding of this issue. However, the conclusions of prior literature (Roussy and Rodrigue, 2018) are worrisome and need to be supplemented and challenged. Other IAF accountability reports should be documented and analyzed in different settings to improve our understanding of the IAF's actual roles and quality. Interviews with audit committee members who receive accountability reports would also provide needed information on how they evaluate IAQ.