1

Drivers to Internal Audit Adoption and Performance within the Belgian Public Sector

IIA BEL statistics and PhD findings

4 October 2011

Diane van Gils, PhD candidate

(diane.vangils@uclouvain.be)

(Supervisors: Prof. Christian de Visscher – Prof. Gerrit Sarens, UCL, Belgium)

2

1.1. IIA BEL 2010 Survey in the Belgian public sector

■ Online quantitative survey conducted jointly with Université de Louvain/ the Institute of Internal Auditors Belgium (IIABEL) and Ghent Universiteit (Jan. 2010 – July 2010)

■ Objectives: statistics, benchmarking activities between IIA members

■ Survey Scope : IA features and Maturity scales (simplification of the 2009 IA-CM, IIA Research Foundation)

■ Sample : 592 Belgian public entities (departments/agencies), at federal, regional and local level, IA Adopters – No IA Adopters

■ Respondents: Chief executives in internal control area or internal audit if relevant

■ Response rate: 21% (N=126);

■ + PhD Qualitative survey (Summer 2011), 20 public entities of the sample

3

2.1. IA adoption: Statistics 2010

None30%

IA projects17%

IA outsourced

8%

IA services45%

IA adoption rate: 53% legal IA mandate: 40%

IA age: from 1 to 20 years ; average 6,5 yearsTwo waves: 90’ and after 2000

4

2.2. IA adoption: rationale/drivers

■ IA “rationale” has an impact on its performance/profile

■ Various reasons/drivers:

Legal IA mandates : IA profile according to the legal requirements

Fraud risks : amalgam between inspection and internal audit

Restructuration context / quality assurance : “process oriented”

Mimetism after 2000 : IIA standards

5

3.1. IA maturity (statistics 2010) Internal Audit Capability Model (IA – CM) 2009, IIA Research Foundation

(2)Infrastructure

38%(1)

Initial54%

(5)Optimizing

4%(3)

Integrated4%

(4)Managed

0%

6

3.1. IA maturity (statistics 2010)“Professional practices” Capability Dimension

Examples of indicators, by decreasing order

• Audit plan (84%) ; Risk based audit plan (61%)

• Adherence to IIA standards (79%) ; 62% “partially” ; 45% “fully”

• IA manual (68%)

• Monitoring the implementation of recommendations (63%)

• Internal evaluation (53%)

• External evaluation (47%)

• Clients surveys (33%)

• Scope of IA work on governance, risk and control (34%)

Other statistics for information

• Operational audit (84%)

• Performance audit (61%)

• Compliance audit (56%)

• IT audit (38%)

• Financial audit (18%)

7

3.1. IA maturity (statistics 2010)“Governance” Capability Dimension

Examples of indicators, by decreasing order

• IA attached to the top (89%)

• IA charter (79%)

• Signature of official documents by top-level authority (68%)

• Presence AC (57%)

• Executive policies to support access to information and people (50%)

• Formal IA budget (52%)

• IA is a top issue in top-level meetings (47%)

• Internal communication on IA importance and benefits (45%)

• Exchange of audit reports/plans with external auditors (45%) ; Reliance of IA work by external auditor (18%)

• Coordination documented or procedures with IC services (21%)

Other statistics for information

• AC with an average of 3 to 5 members

• 60% of the audit committees have a legal mandate

• % of recommendations implemented: average: 62%

8

3.1. IA maturity (statistics 2010)“People Management” Capability Dimension

Examples of indicators, by decreasing order

• Training in IA field (84%)

• Presence of a CAE (82%)

• At least 40 hours of training per year (58%) ; average 45 hours

• Professional IA certifications or in related field (45%)

• Resource planification process (34%)

• CAE with senior experience (5<) (18%)

• Formal IA promotion system (11%)

• Rotation/internship programs (5%)

Other statistics for information• Size: from 1 to 20 ; 60% with maximum

3 internal auditors

• Recruitment : 45% internally (CAE, 56%)

9

3.1. IA maturity (statistics 2010)Average Per Capability Dimension

53%55%

41%

0%

10%

20%

30%

40%

50%

60%People Management

Professional PracticesGovernance

cs

10

3.2. IA maturity/performance (drivers)

• Clear IA added value should be perceived by the organization

Top management as a partner, not only as an auditee

Sometimes IA is used only as a label

Organizational maturity and IA maturity are interrelated, so IA added value

• High external control environment facilitates IA performance

• Strong HR managerial flexibility is crucial to ensure high professionalization

• Difficult to recruit senior professionals

• Gap between precarious contractual positions and high level expectations (credibility and independence) “IA paradox”

11

4. Conclusion

Is the very low global score in terms of IA maturity a deliberate wish or a constraint?

•Higher IA professional levels are very rare, but it is still a recent function

•Top management is not really demanding (political versus management risks)

•IA function is not fully adapted yet in official public HR policies/programs

•“Audit confusion” rather than “single audit”

•New form of public control and governance structure, not yet completed

No clear answer yet, it is still the beginning of the story