The Position of Internal Auditing in different Corporate Governance-

Systems – An empirical analysis for the European Countries

Prof. Dr. Marc Eulerich, Dipl.-Kfm. Jochen Theis, Dr. Patrick Velte

1. Introduction

Today the role of internal auditing in the field of corporate governance, which implies

especially interactions with the board, the audit committee and the external auditor, has met

with enlarged courtesy in management research and business practice. This is also highlighted

from an international perspective by standard setters such as the EU Commission and the US

lawmaker. Not only since the financial crisis of 2008/09 lawmakers try to improve the quality

of corporate governance (i.e. green papers of the EU Commission “Corporate Governance in

Financial Institutions and Remuneration Policies”, “Further Approach in the Area of Annual

Auditing” and “European Corporate Governance Framework”) (EC, 2010a; EC, 2010b; EC,

2011).

In particular, these measures aimed at strengthening the supervision activities performed by

the individual corporate governance entities (external auditor, supervisory board or non-

managing members of the board of directors including the audit committee and the internal

auditing). The existing discussion on the further development of corporate governance has

also an influence especially on the issue of the internal auditor’s position within the company.

In view of this fact, the present study investigates the design of corporate governance

structures with a European versus a US perspective on an explanatory basis with a focus on

the position of internal auditing and its cooperation with the audit committee. The intention of

our empirical analysis is to draw conclusions on the relevance of the internal auditing within

the overall governance construct and in connection with the audit committee. Using a

structural equation model allows us to analyze the relationship and interactions of internal

auditing with other governance bodies and prove which influence the internal auditing has on

the design and achievement potential of corporate governance.

The remainder of this paper goes as follows: In chapter 2 we shortly outline the limited prior

research in the field of interest before we introduce our hypotheses. The research design is

described in chapter 3. While the results of the empirical approach are presented in chapter 4,

a qualitative analysis of the empirical findings will follow in chapter 5. We finally conclude

with noting some limitations of our study and with outlining several ideas for future research.

2. Theoretical background and hypothesis development

Current scientific knowledge on the structure of internal auditing within the corporate

governance system is scarce and mixed. One reason for this may be that scholars have mainly

devoted their attention to the relationship between internal and external auditing (see for

instance Brody et al., 1998; Grant et al., 2009; Desai et al., 2010; Mihmet and Admassu,

2011). Until now, few studies have similarly investigated the mechanism of internal auditing

and the audit committee. However, whilst the practical wisdom tells us that internal auditing

is an integral part of good corporate governance, few empirical studies document that.

Based on the economic justification for the implementation of an internal auditing in the one-

tier as well as in the two-tier system according to the principal-agent theory, the key

hypotheses of empirical research shall be derived in the following despite the present study’s

exploratory character. Since studies sharing the principal objectives of the present analysis are

still largely inexistent, the deduction shall take place in an iterative manner and on the basis of

previous scientific findings. For this purpose, the relationship between the internal auditing

and the audit committee is analyzed in a first step before the relationship with the governance

structure is established in another step. As a basic principle, two different explanations are

possible to determine the position of the internal auditing within the governance structure:

Firstly, internal auditing can support the control function of the (supervisory) board and audit

committee and therewith the whole governance (Turley and Zaman, 2004; Hahn et al., 2008),

i.e. the internal auditors play the role of a principal supporter for the (supervisory) board for

topics like fraud, safeguarding of assets and integrity of financial information. Secondly,

internal auditing is an integral part of the governance structure on its own. Both ideas underlie

several determinants, which have to be integrated in our model.

To act conductively, the internal auditing first of all needs to have an adequate organization.

Especially as far as interaction with the audit committee is concerned, organization options

are conceivable in this context, in which the audit committee exerts influence on the activities

of the internal auditing for instance via the reporting line, via the possibility to appoint the

head of internal auditing (one-tier system) or make this appointment subject to its approval

(two-tier system) or through an assessment of the internal auditing activity. In addition,

compliance with the four professional principles of the Institute of Internal Auditors (IIA)

(independence, integrity, impartiality and confidentiality) leads to better cooperation with the

audit committee, since it provides the internal auditing with an acknowledged position in the

governance structure (Abbott et al., 2010; Gramling and Hermanson, 2006). This leads to the

following hypothesis H1:

H1: The internal auditing cooperates closely with the audit committee through a

structural component (organization) and a practical component (compliance with

the professional standards).

As a result of the close cooperation described in H1, the audit committee becomes a more

efficient governance body within the overall system. The effect on the corporate governance

structure is thus increased in a verifiable way. For instance, this can be proved through the

resulting improved level of information of the audit committee. Moreover, an audit committee

receiving support from the internal auditing obtains a stronger position in the framework of

the three-lines-of-defense model. Insofar, the following hypothesis H2 can be derived:

H2: Through close cooperation between internal auditing and audit committee, the audit

committee is able to exert positive influence on the internal governance structure.

Compliance with the professional principles of the IIA determines the practical activity of the

internal auditing with respect to effectiveness and efficiency. Through this kind of orientation,

not only the company’s governance structure is to be enhanced, but also the functional

capability of the three-lines-of-defense model to be guaranteed. Furthermore, the professional

orientation of internal auditing activities provides added value to the company for instance

through the better revelation of inefficiencies, errors or fraud. Insofar, hypothesis H3 is as

follows:

H3: Through compliance with the professional principles, the internal auditing enhances

the governance structure and provides added value to the company.

The organization of the internal audit department exerts influence on the functional capability

of the internal auditing. Through a corresponding structural connection with the overall

organization, the internal auditing is able to act more effectively and therefore likewise

guarantees the functional capability of the three-lines-of-defense model and ensures

improvement of the governance structure. In addition, a productive internal audit organization

provides added value to the company, since the auditing processes are implemented more

efficiently (Arena and Azzone, 2009), as is expressed in hypothesis H4.

H4: A productive organization of the internal auditing enhances the governance

structure and provides an added value to the company.

Especially under the Sarbanes Oxley Act (SOA), the establishment of an internal auditing has

been made obligatory for the US one-tier board. In addition, the above-described theoretical

foundation in the one-tier board leads to improved cooperation with the audit committee. For

that reason, the integration of internal auditing into the governance structure is verifiably

greater in the US than in Europe, so that hypothesis H5 results. Figure 1 illustrates the overall

model including the individual hypotheses.

H5: Due to the increased regulatory density under the SOA, the findings gained for the

US deviate considerably from the findings for the EU, with the effect being more

extensive in the US than in the EU.

Figure 1: Overall model including all individual hypotheses

3. Research design

3.1 Data collection

The present study has drawn on data from the “Common Body of Knowledge (CBOK)” study,

which was conducted in 2010 on behalf of the Research Foundation of the IIA. In the

framework of the CBOK study, a data basis of 13,582 evaluable questionnaires from 107

countries was generated. As a basic principle, the CBOK study did not address itself explicitly

to a certain group of potential participants, but referred expressly to a wide group of target

persons with relations to the internal auditing sector. More than 30% of the survey

participants have passed the examination of “Certified Internal Auditor (CIA)”, and 22% of

the survey participants hold the position of “Chief Audit Executive (CAE)” in their

companies. In addition, more than 90% of the survey participants are members of the IIA.

For the present study, the available raw data were first grouped by countries. In this context,

the national association of the IIA, of which the survey participant was a member where

applicable, was not decisive for the allocation of a data set. Instead, the crucial point was the

country, in which the survey participant predominantly pursues his professional activity, since

the focus of the conducted country comparison was supposed to be on structural differences in

the company organization with regard to the internal audit division. Initially, it was possible

to identify 3,144 data sets (evaluable questionnaires) for the US. In contrast, data from a total

of 3,294 questionnaires were evaluated for the 26 EU member states. Due to the basic

configuration of the presented structural equation model and the questions included in the

modeling, the existence of an audit committee in the company is a necessary requirement for

a data set’s inclusion in the estimation of the structural equation model. In an international

comparison, there are different degrees of compulsion for the implementation of audit

committees in the one-tier and two-tier system. Following the elimination of all datasets,

where the respective company does not have an audit committee or where the questions

included in the structural equation model were answered only in an incomplete way, 254 and

306 evaluable data sets remain for the US and the EU respectively, which are included in the

estimation of the structural equation model. From the 304 evaluable data sets for the EU, 65

come from the United Kingdom, 41 from Germany and 40 from France.

3.2 Operational measures

All constructs in the presented model were specified reflectively. In this context, the

respective constructs are reflected by a number of indicators, which stand in an elsewhere

explained relationship with their constructs in terms of content and argumentation (see Table

1). The indicators of the constructs “Professional Ethics”, “Value Added”, “Governance” and

“Three Lines of Defense” are based on questions from the CBOK study, which had to be

answered in the questionnaire on a 5-point Likert scale. Whereas no adjustment to the data

material had to be made for the Likert-scaled indicators, recoding of the essentially

categorical data was required for the indicators of the constructs “Cooperation” and

“Organization”. As a rule, a dummy variable was established for each and every indicator, to

which the value 1 was assigned provided that the answer of the survey participant reflects the

intended relation with the audit committee. For the indicator “Appointment” of the construct

“Organization”, the dummy variable for instance assumes the value 1 if, when confronted

with the question “Who is involved in appointing the chief audit executive (CAE) or

equivalent?”, the survey participant has selected (among others) the predetermined answering

option “Audit committee/committee chairman”. All further interpretations of the initial data’s

recoding can be seen in Table 1. The validity of the constructs established in the present form

will be shown elsewhere through a discussion of the common validity figures (Cronbach's

Alpha, Composite Reliability, Average Variance Extracted).

Latent Variable Indicators Interpretation of Values

Professiona Ethics

x11 Credibility “Your internal audit activity is credible within your organization.” (1= strongly disagree, 5=strongly agree)

x12 Independence “Independence is a key factor for your internal audit activity to add value.” (1= strongly disagree, 5=strongly agree)

x13 Objectivity “Objectivity is a key factor for your internal audit activity to add value.” (1= strongly disagree, 5=strongly agree)

x13 Sufficiency “Your internal audit activity has sufficient status in the organization to be effective.” (1= strongly disagree, 5=strongly agree)

Organisation x21 Appointment 1=AC appoints CAE, 0=else

x22 Reporting Line 1=respondent reports to AC, 0=else

x23 Evaluation 1=AC evaluates respondent, 0=else

x24 Signature 1=AC chairman signs report on IC, 0=else

x25 Written Report 1=respondent prepares written report for AC, 0=else

Cooperation y11 Additional Private Sessions 1=respondent interacts with AC in addition to regular meetings, 0=else

y12 Appropriate Access 1=respondent has appropriate access to AC, 0=else

y13 Regular Private Sessions 1=respondent meets with the AC in private sessions during regular meetings, 0=else

y14 Regular Meetings Percentage of formal AC meetings attended by respondent

Value Added y21 Value Added “Your internal audit activity adds value.” (1= strongly disagree, 5=strongly agree)

Governance y31 Better Governance “One way your internal audit activity adds value to the governance process is through direct access to the audit committee (or equivalent).” (1= strongly disagree, 5=strongly agree)

y32 Integral Part of CG “Your internal audit activity is an integral part of the governance process by providing reliable information to management.” (1= strongly disagree, 5=strongly agree)

Three Lines

of Defense

y41 Governance Process “Your internal audit activity brings a systematic approach to evaluate the effectiveness of governance processes.” (1= strongly disagree, 5=strongly agree)

y42 Internal Control “Your internal audit activity brings a systematic approach to evaluate the effectiveness of internal controls.” (1= strongly disagree, 5=strongly agree)

y43 Risk Management “Your internal audit activity brings a systematic approach to evaluate the effectiveness of risk management.” (1= strongly disagree, 5=strongly agree)

Table 1: Indicators of the measurement model

3.3 Estimation

The present structural equation model consists of the six latent variables (constructs)

displayed in Figure 3. For estimation in the framework of the structural equation model, the

“Partial Least Squares (PLS)” method has been used. The need to apply the PLS method

largely results from the complex structure of the underlying data. Since, in addition, the

normal distribution assumption is rejected for the predominant number of variables included

in the structural equation model and, instead, unknown oblique frequency distributions have

to be assumed, the PLS method is preferable to other methods (such as the Maximum

Likelihood Method) within the described context (for a more far-reaching discussion, see for

instance Vilares et al., 2008 or Chin, 1998). All evaluations were conducted by using the

software SmartPLS (Ringle et al., 2007).

4. Results

4.1 Descriptive analysis

For the indicators based on 5-point Likert scalings, the arithmetic mean for the EU data set

ranges between 3.55 (y31 “Better Governance”) and 4.65 (x13 “Objectivity”) with a standard

deviation of at least 0.6 (x13) and no more than 1.16 (y31). Analogously, mean values in the

area between 3.76 (y31 “Better Governance”) and 4.61 (x13 “Objectivity”) and standard

deviations of at least 0.69 (x13) and no more than 0.89 (y31) result for the US (see Table 2).

For the indicators with binary recoding, it emerges for instance that in the EU area, the

chairman of the audit committees (among others) signs the “Report on Internal Controls” in

17% of the cases (in the US: 7%). For the EU, 85% of the survey participants said they had

adequate access to the audit committee; in the US, the corresponding share is 95%. On

average, survey participants in the EU are invited to 80% of the formal audit committees

meetings, whereas survey participants in the US receive invitations to even 95% of the

corresponding meetings.

Whereas the merely descriptive analysis of Likert-scaled indicators initially does not allow to

draw any obvious conclusions on region-specific differences in the participants’ answering

behavior, the indicators with binary recoding provide initial indications of a more direct

connection of the internal audit division to the audit committee in the US in comparison to the

EU. This deviation may be attributable in particular to the diverging regulatory frameworks

for internal audit divisions in the two groups of countries.

Construct EU USA

Indicators Mean SD Loading Mean SD Loading

Professional Ethics

x11

x12 x13

x14

4.33 4.55 4.65 4.06

0.71 0.72 0.60 0.96

***0.84 ***0.68 ***0.72 ***0.75

4.334.474.614.10

0.80 0.81 0.69 0.97

***0.87 ***0.80 ***0.85 ***0.83

Organisation

x21

x22

x23

x24

x25

0.29 0.22 0.36 0.17 0.71

0.46 0.42 0.48 0.37 0.45

***0.77 ***0.55 ***0.80 ***0.26 ***0.29

0.700.420.670.070.46

0.46 0.49 0.47 0.25 0.50

***0.87 ***0.18 ***0.87 ***0.06 **-0.07

Cooperation

y11

y12

y13

y14

0.61 0.85 0.45 0.80

0.49 0.35 0.50 0.34

***0.80 ***0.66 ***0.72 ***0.76

0.830.950.770.95

0.37 0.21 0.42 0.17

***0.63 ***0.76 ***0.73 ***0.52

Value Added y21 4.32 0.65 - 4.43 0.74 -

Governance y31

y32 3.55 4.00

1.16 0.89

***0.89 ***0.85

4.174.10

0.89 0.86

***0.91 ***0.86

Three Lines of Defense

y41

y42

y43

3.77 4.34 4.07

0.88 0.69 0.82

***0.81 ***0.80 ***0.84

3.764.444.02

0.86 0.74 0.85

0.80 0.88 0.83

***: significant at <0.01 level (two-tailed test)

**: significant at <0.05 level (two-tailed test)*: significant at <0.10 level (two-tailed test)

Table 2: Means, standard deviations and standardized loadings of manifest variables

4.2 Measurement reliability and validity

To assess the reliability and validity of the structural equation model, the internal consistency

reliability of the reflective measurement model is to be discussed in the first instance (see

Table 3). Both for the data set USA and the EU, the values for Cronbach’s Alpha and for

Composite Reliability exceed the value of 0.7, which is generally considered as critical, for

most of the latent variables (constructs) (Nunally, 1978 and Fornell and Larcker, 1981). Only

for the latent variable “Organization” are the corresponding values for both data sets far

below the critical value. All in all, the analysis indicates a high internal consistency of the

indicators that find their way into in the respective constructs; in a first step, construct

reliability can therefore be confirmed for both data sets. Through consideration of the

“Average Variance Extracted (AVE)”, it can furthermore be concluded in most of the cases

that the respective measurement models are distinguished by a high level of convergence

validity. Only for the construct “Organization” does the observed AVE value range far below

the critical value of 0.5 both in case of the US and of the EU data set (Fornell and Larcker,

1981). This leads us to the conclusion that, by and large, the variances recorded by the latent

variables are significantly higher than the ones caused by measurement errors. Moreover, the

reliability of the measurement models and the convergence validity are proved through an

analysis of the constructs’ standardized loadings and the associated bootstrap-t-statistics

(Anderson and Gerbing, 1988). The loadings of the indicators are largely higher than 0.7 and

essentially significant for both data sets. Only the loadings of the indicators x22, x24 and x29 of

the construct “Organization” are far below the critical value.

Latent Variables

EU USA

Cronbach’s Alpha

CompositeReliability

Average VarianceExtracted

Cronbach’s

Alpha Composite Reliability

Average VarianceExtracted

Professional Ethics

0.74 0.84 0.56 0.86 0.90 0.70

Organisation 0.46 0.68 0.34 0.19 0.51 0.31

Cooperation 0.71 0.82 0.54 0.58 0.76 0.44

Value Added - - - - - -

Governance 0.68 0.86 0.75 0.73 0.88 0.78

Three Lines of Defense

0.75 0.86 0.67 0.79 0.88 0.70

Table 3: Reliability and validity measures

Through consideration of the Fornell-Larcker criterion (Fornell and Larcker, 1981), the

discriminant validity of the reflective measurement models can finally be represented as well.

According to this approach, a latent variable is supposed to explain the variance of its own

indicators in a better way than the variance of all other latent variables. In Table 4, the square

root of the Average Variance Extracted for each and every construct is therefore compared to

the correlations between the latent variables. The discriminant validity can be confirmed for

both data sets, since the square root of the Average Variance Extracted for each and every

construct is higher than the correlation between the construct and all other constructs.

EU USA

Pro

fess

iona

l E

thic

s

Org

anis

atio

n

Coo

pera

tion

Val

ue A

dded

Gov

erna

nce

Thr

ee L

ines

of

Def

ense

Pro

fess

iona

l E

thic

s

Org

anis

atio

n

Coo

pera

tion

Val

ue A

dded

Gov

erna

nce

Thr

ee L

ines

of

Def

ense

Professional Ethics

0.75 0.05 -0.05 0.44 0.44 0.53 0.84 0.19 0.25 0.56 0.68 0.61

Organisation 0.58 0.39 0.09 0.29 0.10 0.56 0.39 0.07 0.24 0.12

Cooperation 0.73 0.05 0.39 0.07 0.66 0.14 0.37 0.16

Value Added

- 0.38 0.51 - 0.55 0.61

Governance 0.87 0.44 0.88 0.62

Three Lines of Defense

0.82 0.84

Numbers shown in boldface denote the square root of the average variance extracted

Table 4: Correlations between latent variables

4.3 Model estimation results

To first of all assess the explanatory potential of the structural equation model, the R2 values

of the endogenous latent variables will be discussed in the following (see also Table 5). For

the construct “Cooperation”, the lowest R2 results both for the data set of the EU (0.16) and

the data set of the US (0.19). The explanatory potential of the constructs “Value Added”,

“Governance” and “Three Lines of Defense” results from an R2 value of 0.20 (US: 0.31), 0.38

(US: 0.50) and 0.29 (US: 0.38). It turns out that the explanatory potential of the structural

equation model is consistently higher when the estimation of the model is based on US data

than when the EU data set is used. A comparison with the R2 values found in other studies

also permits the overall conclusion that the explanatory potential of the presented structural

equation model is good and, consequently, supports the study’s validity (Mertenskötter, 2011,

p. 171).

EU USA

Criterion Predictors R² Path coefficient f² R² Path coefficient f²

Cooperation Professional Ethics 0.16 -0.07 0.19 **0.18 0.04

Organisation ***0.39 0.18 ***0.36 0.15

Value Professional Ethics 0.20 ***0.44 0.24 0.31 ***0.56 0.43

Added Organisation 0.04 -0.04

Cooperation 0.06 0.01

Governance Professional Ethics 0.38 ***0.45 0.24 0.50 ***0.62 0.67

Organisation **0.13 0.02 0.05

Cooperation ***0.37 0.17 ***0.19 0.06

Three Lines Professional Ethics 0.29 ***0.53 0.38 0.38 ***0.61 0.56

of Defense Organisation 0.04 -0.003

Cooperation 0.08 0.01

***: significant at <0.01 level (two-tailed test); **: significant at <0.05 level (two-tailed test) *: significant at <0.10 level (two-tailed test)

a Effect size measures the relevance of each predictor of a dependent latent variable and is based on the relationship of determination coefficients when including or excluding a particular predictor from the structural equation.

Table 5: Structural model results and effects sizesa (f2)

In the following, the estimated path coefficients of the model and the associated significances

are shown separately for the EU and the US data set (Table 5). In the event of the model’s

estimation by using the EU data set, a significantly positive, moderately strong (effect size f2

> 0.15; see Wilson et al., 2007) effect from the exogenous construct “Organization” on the

endogenous construct “Cooperation” emerges with a loading of 0.39. Moreover, a

significantly positive, moderately strong effect results from the exogenous construct

“Professional Ethics” to the endogenous construct “Value Added” with a loading of 0.20. The

constructs “Professional Ethics”, “Organization” and “Cooperation exert significantly positive

influence on the endogenous construct “Governance” in a moderately strong, weak (effect

size f2 > 0.02) and moderately strong way respectively through loadings of 0.45, 0.13 and

0.37 respectively. In case of the endogenous construct “Three Lines of Defense”, by contrast,

a significantly positive interdependence has emerged only with the exogenous construct

“Professional Ethics” [strong effect (effect size f2 > 0.35) with a loading of 0.53].

Where data from the US are used for the estimation of the model, significantly positive

influence on the endogenous construct “Cooperation” is exerted both by the exogenous

construct “Professional Ethics” and by the exogenous construct “Organization” (weak and

moderately strong effect with a loading of 0.18 and 0.36 respectively). For the endogenous

construct “Value Added”, a significantly positive impact is found by the exogenous construct

“Professional Ethics” (strong effect with a loading of 0.56). In the event of the US data, only

the constructs “Professional Ethics” and “Cooperation” exert significantly positive influence

on the endogenous construct “Governance” with loadings of 0.62 (strong effect) and 0.19

(weak effect) respectively. For the construct “Three Lines of Defense”, it has been found that

a strong, significantly positive effect with a loading of 0.61 is caused by the exogenous

construct “Professional Ethics”. As a rule, loadings can be confirmed in the event of both data

sets at a significance level of 1%, but at least at a significance level of 5%.

Concludingly, the total effects in the structural equation model are to be presented in Table 6.

The most significant total effects for both the EU and the US data set can be found for the

exogenous construct “Professional Ethics”. For the three constructs “Value Added”,

“Governance” and “Three Lines of Defense”, total effects of 0.44, 0.43 and 0.52 result in case

of the EU data. In this context, the total effects result from a combination of path coefficients

of the direct paths between the construct “Professional Ethics” and the respectively

considered construct, and from the indirect relationship via the construct “Cooperation” (see

Figure 3). In the event of the US, the corresponding total effects are comparatively higher and

amount to 0.56, 0.65 and 0.61. Furthermore, significant total effects result both in case of the

EU and the US data between the construct “Organization” and the construct “Governance”.

These total effects amount to 0.27 (EU) and 0.12 (US), with the total effect being composed

of a direct influence as well as of an indirect influence via the construct “Cooperation”.

As regards the hypotheses, the results described above can be summarized as follows:

Whereas H1 can be fully confirmed for the US, this is only partially possible for the

EU.

H2 is basically confirmed for the US and the EU. However, a comparison of effect

sizes shows that the effect of cooperation between the internal audit division and the

audit committee on the governance structure is stronger in the EU than in the US.

H3 can be assumed as fully applicable. A significantly positive effect of compliance

with the professional principles on the governance structure and on the creation of

added value is verifiable for the US as well as for the EU.

H4 is to be assumed only for the correlation with the governance structure in the US,

whereas a positive effect on the three-lines-of-defense model or the creation of added

value cannot be verified. In the EU, all respective relationships are insignificant.

The differences outlined in H5 for the US and the EU are likewise confirmed in

principle. Whereas compliance with the professional principles has a significantly

positive effect in both systems, the extent of effects is different. The same applies to

the organization of the internal audit division and to the cooperation with the audit

committee.

Whereas a purely statistical presentation of results from the estimation of the structural

equation model was given in the above section, the qualitative analysis and evaluation will be

realized in Chapter 5.

Predictor

Criterion

EU USA

Coo

pera

tion

Val

ue A

dded

Gov

erna

nce

Thr

ee L

ines

of

Def

ense

Coo

pera

tion

Val

ue A

dded

Gov

erna

nce

Thr

ee L

ines

of

Def

ense

Professional Ethics -0.07 0.44 0.43 0.52 0.18 0.56 0.65 0.61

Organisation 0.39 0.06 0.27 0.07 0.36 -0.04 0.12 0.00

Cooperation - 0.06 0.37 0.08 - 0.01 0.19 0.01

Table 6: Total effects

5. Summary of the Results

Point of departure of this research was the ambiguity in the current knowledge on the

organization of internal auditing within the internal corporate governance structure and the

cooperation of internal auditing and audit committee. This study distributes empirical support

for a direct and indirect effect of the internal auditing’s work on the internal governance

structure and the three-lines-of-defense model, thereby providing important implications for

internal auditing theory and practice.

According to the principal-agent theory, which underlies the present analysis, as well as to the

basic standards of empirical research, the activities of the internal auditing are of central

importance in the framework of corporate governance. This applies both to the one-tier

system (board of directors, for instance in the US) and to the two-tier system, which is

compulsory in a number of EU member states (executive and supervisory board, for instance

in Germany and Austria). On the question of which specific tasks are performed in detail by

the internal auditing und how the cooperation with other corporate governance entities (such

as the audit committee or the external auditor) is shaped, has not been subjected yet to a

comprehensive empirical analysis from a perspective that ranges across the different countries

and systems. The presented hypotheses illustrate which essential features and attributes can be

assigned to the internal auditing. Against this backdrop, the available results make an

empirical contribution focusing on the internal auditing’s position in the governance system

and the relationships between the individual core elements. In addition, the comparison of

country-specific results allows us to integrate the influence of changing regulatory

requirements into the analysis.

The fact that the work of the internal auditing exerts significant influence on the design of the

governance structure can be considered as positive. In this context, the presented system

illustrates the two key components of the internal audit function, i.e. the practical component

of compliance with the professional principles on the one hand and the structural component

of the internal auditing’s adequate organization in the company on the other. Furthermore, the

relationship between the internal auditing and the audit committee, which is analyzed in a

number of empirical studies, is another integral part of the internal governance structure, with

both the structural and the practical internal audit component being taken into consideration in

this context.

In conclusion, the presented components are distinguished by having a positive effect on the

governance structure. In addition, positive relationships can be proved with the value

component and the three-lines-of-defense model, reflected in the risk management, the

internal control system and the effectiveness of the governance process. These relationships

differ in terms of strength. All in all, the study reveals a strong empirical correlation capable

of proving the proposed hypotheses. Based on the agency-theoretical modeling, the results

show that internal auditing also exerts positive influence on the governance structure as a

separate corporate governance body. By contrast, the reinforcing effect of cooperation with

the audit committee can be proved only conditionally. A significant correlation between

cooperation with the audit committee and the quality of corporate governance can only be

proved for the construct “Governance”. A more profound analysis of the effect sizes shows

that these effects are higher in the EU than in the US.

The two constructs “Professional Principles” and “Organization” have different levels of

influence, with precisely the practical component of the professional principles having a

verifiably positive impact on the areas “Governance”, “Three-Lines-of-Defense” and “Value

Added”. In contrast, the organizational form of the internal auditing does not exert any

significant influence on these three constructs. However, a significant correlation is verifiable

for the cooperation with the audit committee. Cooperation between the internal auditing and

the audit committee has a significant impact only on the organization of the governance

structure with no significant influence being exerted on the other two constructs.

In international comparison, it emerges that charges in the model are higher for the US than

for the EU in a majority of the correlations. This is identifiable at least for the relevant

relationships. In particular, the impact of the professional principles is higher in all areas in

the US. This result is attributable to better institutionalization of the profession on the one

hand and to the fact on the other that regulatory requirements under the SOA are more case

law-based in comparison to those in the EU. The professional principles have a significant

impact especially as far as cooperation with the audit committee is concerned. Whereas a

significant correlation cannot be verified in the EU, the professional principles are a

significant part of this cooperation in the US. Against the backdrop of the SOA, it can be

referred to particularly to the codification of the internal control sections. Both for the EU and

for the US, neither the organization of the internal auditing nor the cooperation with the audit

committee have a verifiable positive effect in the area of the “value added” function. The

effects on the construct “Governance” are highly significant both for the EU and for the US.

Only the aspect of organization shows no significant correlation for the US.

In an overall view, it emerges that the internal auditing is a key element of the governance

structure and has a positive impact on the efficiency of corporate governance. In this context,

the three constructs “Governance”, “Three-Lines-of-Defense” and “Value Added” illustrate

the actually most important objectives of the internal auditing. The latter is supposed to be a

crucial actor with regard to the revelation of grievances and problems in the company in the

framework of the three-lines-of-defense model and hence to support the governance structure.

In addition, however, the internal auditing also acts as a key governance body and supporting

entity in performing the supervisory function towards the executive board and the supervisory

board (two-tier system) or the board of directors (one-tier system). Finally, the internal

auditing is also supposed to create “value added” for the company either within the meaning

of revealing problems and grievances or in the sense of precautionary protection. The results

provide evidence that, in particular, the practical component of the internal auditing unit,

represented through compliance with the professional principles, provides a significant

contribution to accomplishing the objectives. By contrast, the organization of the internal

auditing seems to achieve this goal only in individual cases. Whereas a significant effect is

verifiable in the EU, this is not the case for the US, with the aforementioned differences in

terms of regulation (such as the SOA) being capable of serving an explanation. The close

cooperation between the internal auditing and the audit committee, which is often emphasized

in the literature as a key element of corporate governance, can only be confirmed

conditionally within the context of this study. Although there is a positive effect or influence

of the internal auditing on the activities of the audit committee and, in addition, on the

governance structure, this effect is only of a low (for the US) to medium scale (for the EU).

By contrast, the direct impact without cooperation with the audit committee is to be

considered as high. The stronger position of the internal auditing in the US in terms of its

direct effects seems to produce a lower level of contribution as far as cooperation with the

audit committee is concerned in comparison to the EU, where the internal auditing still

achieves a less significant effect.

Summarizing the results against the backdrop of the different regulatory frameworks, a clear

picture emerges. Both in the US, which is subject to strict regulation under the SOA, and in

the EU, which is characterized by a lower density of regulation with regard to the internal

auditing, internal auditing acts as a key body of corporate governance. In its current green

papers on corporate governance and external auditing, however, the EU Commission plans

far-reaching reform measures to strengthen the quality of the governance bodies (internal

auditing, audit committee, external auditor). In this context, especially the contribution of the

internal auditing to protect the company within the meaning of the three-lines-of-defense

model and the creation of “value added” for the company is supposed to be increased.

6. Limitations and Further Research

Some limitations of our research are worth noting. The research has been conducted for two

regions (USA and EU). Although our results are very consistent within the two regions, the

empirical model should be tested in other regions and countries, too. We might expect that the

relative importance of internal auditing and the audit committee is different in other countries.

The relative importance of the internal auditing determinants may depend on the level of

regulation of the governance body, the board-model and a range of possibilities in the legal

regulations. Therefore, the place of internal auditing in the governance structure may be

greater or smaller than in other countries. Also the importance of the moderating effects may

vary across countries.

Moreover, it needs to be noted that a study initiated by the IIA may be characterized by

deficits in terms of objectivity. Due to the high sample size, however, this restriction is to be

considered as only limited. In addition, it has to be pointed out that the questions of the

CBOK study were not developed originally to reflect the indicators used in the structural

equation model.

Future research should also test these models for other regions. In addition, a differentiated

consideration of industries or company sizes may be able to produce more far-reaching

insight. Finally, while we do provide an answer on the question whether internal auditing is

an integral part of corporate governance or not, we leave the question unanswered what other

“players” determine the governance.

Literature

Abbott, L.J., Parker, S., Peters, G.F., 2010. Serving two masters. The association between

audit committee internal audit oversight and internal audit activities. Accounting

Horizons 24 (1), 1-24.

Anderson, J.C., Gerbing, D.W., 1988. Structural Equation Modeling in Practice: a Review

and Recommended Two-Step Approach. Psychological Bulletin, 103 (3), 411-23.

Arena, M., Azzone, G., 2009. Identifying Organizational Drivers of Internal Audit

Effectiveness. International Journal of Auditing 13 (1), 43-60.

Brody, R.G., Golen, S.P., Reckers, P.M., 1998. An empirical investigation of the interface

between internal and external auditor. Accounting and Business Research 28 (3), 160-

172.

Chin, W.W., 1998. The Partial Least Squares Approach to Structural Equation Modeling. In:

Marcoulides, G. A. (Ed.), Modern Methods for Business Research, chapter 10, NJ

Lawrence Erlbaum Associates.

Desai, V., Roberts, R.W., Srivastava, R. 2010. An analytical model for external auditor

evaluation of the internal audit function using belief functions. Contemporary

Accounting Research 27 (2), 537-575.

EC, 2010a. Grünbuch. Weiteres Vorgehen im Bereich der Abschlussprüfung. Lehren aus der

Krise. KOM(2010) 561 endgültig, abrufbar unter: http://eur-

lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2010:0561: FIN:DE:PDF

EC, 2010b. Grünbuch. Corporate Governance in Finanzinstituten und Vergütungspolitik.

KOM(2010) 284 endgültig, abrufbar unter: http://ec.europa.eu/internal_market/company/

docs/modern/com2010_284_de.pdf

EC, 2011. Grünbuch. Europäischer Corporate Governance-Rahmen. KOM(2011) 164/3,

abrufbar unter: http://ec.europa.eu/internal_market/company/docs/modern/com2011-

164_de.pdf

Fornell, C., Larcker, D.F., 1981. Evaluating Structural Equation Models with Unobservable

Variables and Measurement Error. Journal of Marketing Research, 18 (1), 39-50.

Gramling, A., Hermanson, D., 2006. What role is your internal audit function playing in

corporate governance? Internal Auditing 2010 (6), 37-39.

Grant, C.T., Park, N., Wheeler, S. W., 2009. Non audit, external audit, and internal audit

services in a post-SOX world Internal Auditing 24 (1), 28-35.

Hahn, U., Quick, R., Mandre, S., 2008. Corporate Governance-Frameworks und Interne

Revision. Schweizer Treuhänder 82 (9), 695-706.

Mertenskötter, M., 2011. Qualität, Vertrauen und Akzeptanz im Kontext der Internen

Revision. Josef Eul Verlag, Köln.

Mihret, D.G., Admassu, M.A., 2011. Reliance of External Auditors on Internal Audit Work.

International Business Research 4 (2), 67-79.

Nunnally, J. C., 1978. Psychometric Theory (2nd Ed.). McGraw-Hill, New York.

Ringle, C.M., Wende, S., Will, A., 2007. SmartPLS 2.0 M3, University of Hamburg.

Turley, S., Zaman, M., 2004. The corporate governance effects of Audit Committees. Journal

of Management and Control 8 (3), 305-332.

Vilares, M.J., Almeida, M.H., Coelho, P.S., 2010. Comparison of Maximum Likelihood and

PLS estimators for structural equation modeling. A simulation with customer satisfaction

data. In: Vinzi, V., Chin, W., Henseler, J., Wang, H. (Eds.). Handbook of Computational

Statistics - PLS and Marketing, Springer, Heidelberg/New York.