You are on page 1of 27

Accounting, Auditing & Accountability Journal

Internal audit quality: a polysemous notion?


Melanie Roussy, Marion Brivot,
Article information:
To cite this document:
Melanie Roussy, Marion Brivot, (2016) "Internal audit quality: a polysemous notion?", Accounting,
Auditing & Accountability Journal, Vol. 29 Issue: 5, pp.714-738, https://doi.org/10.1108/
AAAJ-10-2014-1843
Permanent link to this document:
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

https://doi.org/10.1108/AAAJ-10-2014-1843
Downloaded on: 12 January 2019, At: 03:55 (PT)
References: this document contains references to 90 other documents.
To copy this document: permissions@emeraldinsight.com
The fulltext of this document has been downloaded 2759 times since 2016*
Users who downloaded this article also downloaded:
(2016),"Internal auditor characteristics, internal audit effectiveness, and moderating effect of senior
management", Journal of Economic and Administrative Sciences, Vol. 32 Iss 2 pp. 160-176 <a
href="https://doi.org/10.1108/JEAS-07-2015-0023">https://doi.org/10.1108/JEAS-07-2015-0023</a>
(2015),"A new vision for internal audit", Managerial Auditing Journal, Vol. 30 Iss 1 pp. 34-55 <a
href="https://doi.org/10.1108/MAJ-08-2014-1073">https://doi.org/10.1108/MAJ-08-2014-1073</a>

Access to this document was granted through an Emerald subscription provided by emerald-
srm:216788 []
For Authors
If you would like to write for this, or any other Emerald publication, then please use our Emerald
for Authors service information about how to choose which publication to write for and submission
guidelines are available for all. Please visit www.emeraldinsight.com/authors for more information.
About Emerald www.emeraldinsight.com
Emerald is a global publisher linking research and practice to the benefit of society. The company
manages a portfolio of more than 290 journals and over 2,350 books and book series volumes, as
well as providing an extensive range of online products and additional customer resources and
services.
Emerald is both COUNTER 4 and TRANSFER compliant. The organization is a partner of the
Committee on Publication Ethics (COPE) and also works with Portico and the LOCKSS initiative for
digital archive preservation.

*Related content and download information correct at time of download.


The current issue and full text archive of this journal is available on Emerald Insight at:
www.emeraldinsight.com/0951-3574.htm

AAAJ
29,5
Internal audit quality:
a polysemous notion?
Melanie Roussy and Marion Brivot
714 School of Accounting, Université Laval, Québec, Canada

Abstract
Purpose – The purpose of this paper is to characterize how those who perform (internal auditors),
mandate (audit committee (AC) members), use (AC members and external auditors) and normalize
(the Institute of Internal Auditors (IIA)) internal audit work, respectively make sense of the notion of
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

“internal audit quality” (IAQ).


Design/methodology/approach – This study is predicated on the meta-analysis of extant literature
on IAQ, 56 interviews with internal auditors and AC members of public or para-public sector
organizations in Canada, and archival documents published by the IIA, analyzed in the light of
framing theory.
Findings – Four interpretative schemes (or frames) emerge from the analysis, called “manager,”
“éminence grise,” “professional” and “watchdog.” They respectively correspond to internal auditors’,
AC members’, the IIA’s and external auditors’ viewpoints and suggest radically different
perspectives on how IAQ should be defined and controlled (via input, throughput, output or
professional controls).
Research limitations/implications – Empirically, the authors focus on rare research data.
Theoretically, the authors delineate four previously undocumented competing frames of IAQ.
Practical implications – Practically, the various governance actors involved in assessing IAQ
can learn from the study that they should confront their views to better coordinate their quality
control efforts.
Originality/value – Highlighting the contrast between these frames is important because, so far,
extant literature has predominantly focussed on only one perspective on IAQ, that of external auditors.
The authors suggest that IAQ is more polysemous and complex than previously acknowledged, which
justifies the qualitative and interpretive approach.
Keywords Internal audit quality, Public sector, Framing theory, Quality controls
Paper type Research paper

1. Introduction
Despite a recent growing interest in internal audit (Pizzini et al., 2015; Trotman and
Trotman, 2015; Coetzee and Lubbe, 2014; Regoliosi and D’eri, 2014; Shabnam et al.,
2014), including in the public sector (Everett and Tremblay, 2014; Neu et al., 2013;
Roussy, 2013, 2015; Vinnari and Skaebaek, 2014), extant literature on this topic remains
scant and the definition of internal audit is very broad (Roussy, 2013), which invites a
variety of interpretations. Specifically, little is known about how internal audit quality
(IAQ) is understood and operationalized by different groups of governance actors. It
obviously matters to internal auditors (Christopher et al., 2009; Sarens et al., 2009;
Sarens, 2009; Allegrini et al., 2006) and audit committees (ACs) (Sarens et al., 2009), but
internal audit functions (IAFs) that seek to obtain “Quality Assurance and
Improvement Program” certification from the Institute of Internal Auditors (IIA)[1]
are also concerned with it. External auditors are directly interested in it as well: PCAOB
Accounting, Auditing &
Accountability Journal Auditing Standard No. 5 – which supersedes PCAOB Auditing Standard No. 2 – allows
Vol. 29 No. 5, 2016
pp. 714-738
external auditors to consider the IAF’s work in assessing internal control effectiveness
© Emerald Group Publishing Limited
0951-3574
over financial reporting. Last but not least, IAQ concerns the lay citizen, particularly
DOI 10.1108/AAAJ-10-2014-1843 when the audit process regards public organizations (Neu et al., 2013). Although IAQ
affects a large spectrum of social groups, so far extant literature has primarily Internal audit
documented how one specific category of actors – external auditors – defines this quality
notion. One plausible reason for this bias could be that external auditors are typically
responsible for assessing IAQ. They also use this quality assessment the most, since
internal audit reports constitute an important building block of their financial
statement audits (Gramling and Vandervelde, 2006). In contrast, our understanding of
how internal auditors, their professional association (the IIA) and AC members make 715
sense of IAQ is very limited. This lacuna provided the main motivation for our
research. We thus ask: how do those who perform (internal auditors), mandate (audit
committee members), use (audit committee members and external auditors) and
normalize (the IIA) internal audit work, respectively make sense of the notion of
“internal audit quality”?
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

We ask this question in the context of the public and para-public sector of the
Canadian province of Quebec, and view this as timely and pertinent for two reasons.
First, this province has been the recent target of large scale fraud investigations[2] in
which poor quality internal audit procedures have been denounced (Théoret et al.,
2012). Second, a New Public Management (NPM)/New Public Governance (NPG) reform
passed in 2000 for para-public organizations and in 2006 for public organizations,
directly inspired by the Sarbane-Oxley Act (US House of Representatives, 2002) and
Bill 198 (Government of Ontario, 2002). These emphasized the importance of the IAF,
together with the AC, in fighting public fund embezzlement by high ranking officials.
Following these reforms, public and para-public IAFs are required to comply with the
IIA’s standards and code of ethics; this also applies to IAFs of private sector
organizations. Among other IIA prescriptions, any IAF must be placed under the
“functional authority” of the AC[3] and report to the top manager (e.g. the deputy
minister in a public organization and the CEO in a para-public organization) only where
administrative issues are concerned. In view of these financial and political scandals,
the acknowledged aim of these reforms was to reassure Quebecers regarding the
government’s ability to manage public resources (Roussy, 2013 and 2012).
We rely on 56 interviews with internal auditors and AC members of selected public
organizations in Quebec, archival documents published by the IIA, and a meta-analysis
of extant literature on IAQ. We chose framing theory[4], which provides the analytical
tools to document interpretive schemes (or frames), as our theoretical lens. Four
frames emerge from our analysis: “manager,” “éminence grise,” “professional” and
“watchdog.” First, the internal auditors we interviewed view themselves as managers
whose main job is identifying how strategic organizational risks can be mitigated.
They define the quality of their work in relation to how the main output produced
(the internal audit report) proves useful to the top manager in improving the
organization’s performance. Second, AC members view internal auditors as private
counselors (hence the “éminence grise” title of their frame) who can help the
organization’s top manager make more informed decisions. In their opinion, quality
internal audits can be obtained only if internal auditors work closely with the top
manager and “are always there for him.” Third, based on the IIA documents we
analyzed, the institute views internal auditors as detached, independent professionals,
whose work is high quality only if internal audit standards are followed, and if internal
auditors demonstrate “due professional care” and abide by the IIA’s code of ethics.
Fourth, based on our literature review, which is a contribution in itself (Short, 2009)
since it allows us to suggest a frame for external auditors’ approach to IAQ, we argue
that external auditors regard internal auditors as “watchdogs” in charge of detecting
AAAJ important internal control weaknesses. They contend that quality work can be
29,5 obtained only if internal auditors’ profiles meet defined criteria (e.g. technical
competence) and certain organizational precautions are taken to protect their
independence vis-à-vis top managers.
These four frames suggest radically different perspectives on how the quality of
internal auditors’ work is signaled – by output criteria (e.g. perceived usefulness of the
716 audit report in helping top managers make informed decisions), by throughput criteria
(e.g. audit process compliance with professional standards and norms) or by input
criteria (e.g. careful selection of the “right” employee profiles and the right functional
arrangements to guarantee independence throughout the audit). Our contribution to
extant research is empirical, theoretical and practical. Empirically, we focus on rare
research data, including interviews with internal auditors and AC members, and IIA
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

documentation. Theoretically, we see our contributions as twofold. First, we contribute


to the literature on the quality of internal audit in general because the frames that we
have delineated for external auditors and for the IIA are not restricted to public sector
organizations. Second, we contribute to the literature on IAQ in the public sector by
theorizing the frame of meaning, respectively employed by internal auditors and AC
members from public and para-public sector organizations. Practically, this study
sheds new light on the reasons why the quality of IAF work is often questioned: the
very notion of IAQ is understood differently by different constituents. Thus, it should
come as no surprise that improving IAQ is a difficult task to achieve. It is not our aim to
argue that one frame is superior to the other three, but we are of the view that the
various governance actors who play an essential role in assessing IAQ need to increase
their awareness that competing frames exist. They should confront their views if they
wish to better coordinate their efforts and decide which quality controls mosaics are
most suitable (input, throughput, output and professional controls, as we shall develop
further in the discussion section). Lastly, as recently advocated by Malsch and
Salterio (2016), qualitative and interpretive research methods can aid in challenging
taken-for-granted assumptions found in experimental and empirical auditing research.
We contribute to this so far under-represented stream of research by enriching our
existing understanding of what IAQ means to different practitioners and thereby
address the call by Power and Gendron (2015) for more qualitative research in auditing.
This paper continues as follows: Section 2 presents our theoretical lens; Section 3
reviews extant literature on IAQ; Section 4 describes our methods; the results are
analyzed in Section 5 and Section 6 discusses and concludes the study.

2. Framing theory
Building on Goffman (1986) and Kaplan (2008) defined frames as “schemata of
interpretation,” made up of various building blocks, including those drawn from the
background of the individuals who support them (cognitive structures) and existing
institutional logics (social structures). These interpretation schemata are socially
constructed and collectively negotiated, but they appear obvious in retrospect. They
allow individuals to organize their understanding of the world around them. A frame
typically includes metaphors, symbols or cognitive cues that cast certain issues in a
particular light and suggest possible ways to respond to these issues (Campbell, 2005).
Frames need activists and networks of individuals galvanized around certain ways of
seeing the world, in order to exist, gain legitimacy and eventually gain the power to
change institutions (Hargrave and Van de Ven, 2006, p. 876). However, it should be
emphasized that frames are not just selling tools or influence techniques; they cannot
be instrumentally deployed at will. People have particular dispositions or Internal audit
preconceptions that incline them to support certain frames instead of others (Kaplan, quality
2008). In addition, frames are dynamic and fragile (Goffman, 1986); hence, change in the
dominance of one specific frame over other competing frames is always a possibility.
Frames are typically described as comprising three distinct parts – diagnosis,
prognosis and motivation (Benford and Snow, 2000; Snow and Benford, 1988). The
diagnosis concerns the way in which a specific “problem” is defined. In this research, we 717
used the diagnosis component of a frame to describe how various groups make sense of
the main tasks that the IAF is supposed to concentrate on. Although the IAF’s main
tasks do not constitute a “problem” per se, we claim that any IAQ issue that may arise
will be interpreted in light of those main tasks. Say a given group sees the IAF’s main job
to be ensuring that effective controls are in place to mitigate financial risks within the
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

organization. If an unforeseen event occurs and damages the organization’s reputation,


for instance, this event will not be interpreted as signaling an IAQ problem, because
controlling reputational risks was not believed to be the main job of the IAF. In contrast,
another group may view the IAF’s main task to be helping the top manager make
informed decisions on any business matter of potentially strategic importance. In this
case, failing to properly control reputational risks may be seen as signaling an IAQ
problem. The prognosis defines solutions to potential IAQ problems, and highlights
tactics or strategies that should be followed to address said problems (e.g. to do quality
work, internal auditors should avoid consultancy assignments for top management and
focus on assurance assignments for the AC). The motivation concerns a frame’s rationale.
This rationale is used by frame supporters to convince others to embrace their frame
instead of potentially competing frames (e.g. to do quality work, internal auditors have to
be able to detect risks of fraud, which requires independence vis-à-vis the organizations’
top management team. If internal auditors do consultancy assignments for the
organization’s top management team, they are not in the best position to resist potential
manipulation attempts by the latter. In contrast, doing assurance assignments for the AC
is the best way to protect internal auditors’ independence).

3. Literature review: how external auditors frame the notion of IAQ


Extant research on IAQ is limited, if not silent, where public sector organizations are
concerned. The only available literature on IAQ concerns external auditors’ perspective
in the context of private sector organizations. Although we focus on the public and
para-public sector, we do not view the above literature as off topic because, as briefly
explained in the introduction, the same internal audit professional standards apply to
both the private and public sectors. Documenting external auditors’ framing of IAQ is
thus relevant for our study. In the following section, we conduct a meta-analysis of
extant literature on IAQ as viewed by external auditors.
Two major criteria for assessing IAQ emerge from the literature: IAF independence
and internal auditor competence, as assessed by external auditors (Lesage and
Ben Saab, 2009; Prat Dit Hauret, 2003). A range of indicators have been developed to
measure these two variables and, so far, have been studied in isolation rather than in
combination (exceptions include Desai et al., 2010; Prawitt et al., 2009). We summarize
these indicators below.

Independence
The first measure concerns the type of assignment performed by the IAF. The assumption
is that the greater the emphasis on assurance in internal audit assignments, the higher
AAAJ IAF independence is (Lin et al., 2011; Gramling and Myers, 2006; Gramling et al., 2004;
29,5 Dezoort et al., 2001). Conversely, the greater the involvement of internal auditing in
operational activities, the lower the likelihood of IAF work being perceived as independent
and, accordingly, of high quality (Prawitt et al., 2009; Glover et al., 2008; Gramling and
Myers, 2006; Gramling et al., 2004). Consultancy assignments are situated between these
two extremes (Gramling and Myers, 2006).
718 The nature of IAF activity is also regarded as a good measure of independence
(Archambeault et al., 2008): specifically, IAF involvement in strategic activities is
considered to indicate that the IAF has enough freedom to intervene at the highest
levels of the organization, instead of concentrating on operational activities, where top
managers may control their work more closely.
According to Dezoort et al. (2001), the type of pay that internal auditors receive
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

matters to external auditors: a fixed salary is believed to be associated with greater


independence than a salary indexed on organizational results. Schneider’s (2010)
experiment, however, challenged this belief, which makes pay a controversial measure
of independence.
The IAF’s position within the organization and its relationships with management
and the AC have also been used as proxies of independence: the IAF is perceived by
external auditors to be more independent if it comes under the direct authority of the
AC (Stewart and Subramaniam, 2010; Christopher et al., 2009; Holt and DeZoort, 2009;
Prawitt et al., 2009; Archambeault et al., 2008; Gramling et al., 2004).
Another proxy for IAF independence is the outsourcing of internal audit activities
(Desai et al., 2011, 2010; Schneider, 2010; Stewart and Subramaniam, 2010; Glover et al.,
2008; Gramling and Vandervelde, 2006). Abbott et al. (2007) and Brandon (2010),
however, add some nuance to the argument that external consultants tend to be more
independent than in-house employees when conducting internal auditing assignments.
Among the threats to IAF independence identified by Christopher et al. (2009), one
relates to the tendency of some individuals to use their internal auditor role to climb the
organizational ladder more quickly. Another threat concerns internal audit budget
approval by top management – best practices recommend that the AC should perform
this role instead. Unsurprisingly, the authors also found that the greater top
management’s influence on internal audit work planning, the greater the threat to IAF
independence. Moreover, the lower the AC’s independence level is from top
management, the greater the threat to the IAF’s own independence becomes vis-à-vis
top management. Finally, when AC members lack the competence to properly focus
internal auditors’ attention on the most important financial risks, top management
likely has more latitude to influence internal auditors’ endeavors, which diminishes the
IAF’s independence (Christopher et al., 2009).

Competence
Messier and Schneider (1988) recognized the number of years of experience in the IAF as
a key factor in competence assessment by external auditors. In addition, Clark et al. (1980)
argued that internal auditors’ main skill is their detailed knowledge of the business
processes of the organization. This view is consistent with Munro and Stewart (2010), who
suggested that a detailed, internal knowledge of business processes by internal auditors
increases external auditors’ trust. However, Desai et al. (2011) claimed the opposite:
external auditors generally consider IAF competence to be greater if the IAF calls on
external consultants to perform part or all of the work. Brown (1983) also highlighted
the importance of internal auditors’ professional background: external auditors perceived
an accountancy qualification (CPA) as a guarantee of competence. Lastly, external Internal audit
auditors’ satisfaction level with previous work carried out by the IAF is another sign of quality
perceived competence (Brown and Karan, 1986).

External auditors’ interpretation of IAQ: the watchdog frame


In sum, extant academic research on IAQ has so far predominantly focussed on
external auditors’ point of view. Their frame (summarized in Table I) revolves around 719
the three core notions described in the theory section – diagnosis, prognosis and
motivation. First, external auditors’ consider that the IAF’s primary focus should be to
give an assurance that internal control procedures are effective, particularly where
financial risks are concerned, including the risk of fraud (diagnosis). Second, internal
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

auditors should not only be selected and trained appropriately, they should also,
collectively, be autonomous vis-à-vis the organization’s top management. These are
preconditions, in the eyes of external auditors, for internal auditors to do high quality
work (prognosis). Third, the above diagnosis and prognosis are justified by the fact
that external auditors wish to rely on internal audit work to reduce the scope of their
own investigations without decreasing their level of comfort regarding the
organization’s financial statements (motivation).

The watchdog frame

Diagnosis
What should the IAF The IAF should make sure that effective control procedures exist and are in
primarily focus on? use to mitigate important financial risks, including (but not limited to) the risk
of fraud, within the organization
Prognosis
What needs to be done The IAF should be independent from top management. This involves specific
to ensure quality organizational arrangements:
internal audit work? The IAF should focus on assurance assignments rather than consultancy
assignments
The auditing processes should be more strategic than operational
Internal auditors’ remuneration should be fixed pay
The IAF should be accountable to the audit committee and not top management
The IAF should come under the authority of the audit committee
Internal audit activities could be outsourced
Internal auditors should be competent. This can be ensured by selecting the
right internal auditor profile:
Extensive experience in internal auditing
In-depth knowledge of organizational activities
Professional designation in accountancy or qualification in internal audit
Track record of satisfactory past interactions with external auditors
Motivation
Why? If internal auditors are competent, they are technically able to identify
potential weaknesses in the organization’s internal control system. In addition,
if their attitude allows them to resist potential manipulation attempts by top
management, their opinion is likely objective. If these two conditions are met, Table I.
external auditors can rely on the internal audit report, which reduces the External auditors’
amount of work that they have to do in their external audit of the frame of internal
organization’s financial statements audit quality
AAAJ The above frame is obviously not centered on the quality of internal auditors’ work
29,5 output in and of itself. Instead, it is defined as resulting from the combination of
possessing the right competence and having the right attitude or frame of mind
(independence) toward the organization’s top management. Both factors concern the
profile of the person who should be selected to do the job and thus are work input criteria.

720 4. Method
According to Eisenhardt (1989), qualitative research is particularly well-adapted to
cases where the research object is examined from a theoretical perspective other than
the dominant view. This applies to our study, since framing theory has rarely, if ever,
been used to describe how various groups of agents each define the notion of IAQ.
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Data sources
We used three data sources. To document how AC members frame the notion of IAQ,
we relied on 14 interviews, conducted in 2010. On average, interviewees had 28 years of
professional experience, including six years as an AC member in Quebec para-public
and public administrations. Seven interviewees were members of several ACs (from
both private and public sectors) when we interviewed them. Approximately two-thirds
were chartered accountants and almost all interviewees were members of the “Collège
des administrateurs de sociétés” (an institution aimed at training and helping
administrators build a network of contacts). We assigned each interviewee a random
number from 1 to 14, preceded by the initials “ACM” (for AC member).
To document the ways in which internal auditors in Quebec public and para-public
organizations frame the notion of IAQ, we relied on recorded interviews conducted in
2010: we conducted 42 interviews, including 14 with chief audit executives and 28 with
internal auditors. Interviewees were drawn from four public organizations and nine
para-public organizations and had 10-15 years of experience in internal auditing and 20-25
years of professional experience in total. Although 100 percent of the interviewees were
members of the IIA, only 64 percent were professional accountants. We also had access to
the interviewees’ IAF charters, as well as certain confidential annual planning documents.
To protect the identity of interviewees and organizations, each chief audit executive was
assigned a random number from 1-14 preceded by the initials “CAE” while the internal
auditors were assigned a random number from 1-28 preceded by the initials “IA.”
To document the ways in which the IIA frames the notion of IAQ, we reviewed
selected documents published by the Institute for its members, including the Internal
Auditor’s Code of Ethics (The Institute of Internal Auditors, 2013b), the International
Standards for the Professional Practice of Internal Auditing (The IIA, 2013a), the
International Professional Practices Framework (The IIA, 2012), the Implementing the
International Practices Framework (The Institute of Internal Auditors, 2010a), the
Internal Auditing Guide for the New Auditor (The IIA, 2010b), a document entitled
Clarity-Impact-Speed: Delivering Audit Reports That Matter (The Institute of Internal
Auditors, 2011), and the Certified Internal Auditor Model Exam (The Institute of
Internal Auditors, 2009).

Data analysis
The interviews were recorded and transcribed. Transcripts of some 100 hours of
recorded interviews, totaling over 2,500 pages of complete interviews with internal
auditors and AC members, were coded inductively following the Strauss and Corbin
(1990) open and axial coding techniques, using Atlas TI[5]. Once this preliminary Internal audit
coding was completed, we counted the number of words in each code and the number of quality
interviewees whose quotes were cited in each code. During this first analytical step,
counting allowed us to distinguish between emerging, important and consensual
themes and trends versus less central themes and trends (Duhaime and Landry, 1995;
Silverman, 1993). According to Silverman (1993), this counting approach also increases
the robustness of the qualitative analysis. In addition, approaching data through 721
several analytical angles (e.g. counting code frequencies and analyzing the data in a
more qualitative manner) were considered by Langley (1999) and Miles and Huberman
(1994) to be a sound strategy to avoid oversimplifying the studied phenomenon.
Our second analytical step consisted in splitting the main themes and trends
identified in Step 1 into the “diagnosis” (D), “prognosis” (P) and “motivation” (M)
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

categories derived from framing theory. Each distinctive D, P and M triplet constituted
a frame, and three such frames emerged from our empirical data. A fourth one was
obtained through our meta-analysis of extant literature on IAQ. Together, these four
frames constituted the main basis for the narrative[6] presented in the paper.

5. Results
How AC members frame IAQ
In the private sector, AC importance increased dramatically in the aftermath of the
financial scandals of the last decade (Bédard and Gendron, 2010). The public sector
followed suit by adopting corporate governance and “NPM” reforms inspired largely
by practices in place in the private sector. The Public Administration Act (Government
of Quebec, 2000) and the Act Respecting the Governance of State-Owned Enterprises
(Government of Quebec, 2006), in particular, emphasized the importance of the IAF and
made ACs and boards of directors mandatory in Quebec’s public and para-public
organizations, with the notable exception of government departments where ACs may
or may not exist, depending on the decision of each department’s deputy minister.
Essentially, the board of directors and AC have the same responsibilities – a few
nuances aside – in the public and private sectors. For instance, ACs are required by the
regulations mentioned above to oversee the activities performed by IAFs. However,
since ACs are relatively new in the Quebec public administration, the way in which
their members make sense of the notion of IAQ is not well understood and remains a
virgin research territory (Roussy, 2012).
An important specificity of AC members in public organizations is that they have to
adapt to an environment where the board has less authority over the top manager than
in the private sector:
Normally, the AC supports the board of directors as part of its monitoring role. […] However,
since there is no board of directors, we don’t have this natural basis. I had a meeting with the
top manager and the other AC members and we agreed that the top manager is required to
perform the duties that are generally assigned to a board president. That’s the basis of our
work. This seems to be fairly common practice in the Quebec public administration. Our
committee is committed to providing support to the top manager and to making proposals for
new measures (ACM 1).
In this context, interviewed AC members indicated that they viewed themselves as
strategic advisors to the top manager:
In our organization, the AC performs a consulting role for the manager of the organization
(ACM 8).
AAAJ This might be explained by the fact that all AC members interviewed had a “high”
29,5 public administration background in Quebec and knew one another and the top
manager of their respective organizations. In some cases, it was the top manager who
appointed them because of a long standing intuitu personae relationship of trust.
The interviewed AC members viewed the IAF as another important resource
(in addition to their own strategic advisory services) whose goal was to help the top
722 manager fulfill his/her duties. They expected “the chief audit executive to be there for
the top manager” (ACM 6) and not for them, directly:
In the Quebec public administration, the duty of an audit committee is to ensure that the
necessary mechanisms are implemented to promote sound management and to ensure that
the mission of the organization as defined by law is fulfilled. […] The audit committee and the
IAF are tools for supporting the top manager in pursuing these objectives (ACM 4).
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

The way in which AC members frame IAQ derives directly from what it is they
consider the IAF should focus on; that is, helping the top manager make informed
decisions on strategic issues and risks:
The role of the IAF is to help carry out the mission of the organization. Therefore the IAF
needs to consider the risks affecting the organization and to contribute to an integrated risk
management plan. […] For this to work in the long term, the IAF needs to provide added
value […] The role of the IAF is therefore closely connected with risk management […] failing
this, the targets defined by the mission of the organization will not be reached (ACM 1).
There needs to be a close relation between the top manager and the chief audit executive.
He (the chief audit executive) needs to be aware of the top manager’s concerns (ACM 4).
Although quality internal audit work is not defined in and of itself, the main signal of
quality is described as the closeness of the relationship developed by internal auditors
with the top manager. This close relationship of trust should allow the top manager and
internal auditors to reach a consensus on what should be (or what is not worthy of
being) reported to the AC:
In practice, chief audit executives need to talk to their top manager. They need to liaise with
the top manager before coming to the AC. People come to an agreement (on reports and
planning) […] with the top manager before addressing the AC. Over the years they’ve
developed a relationship of trust (ACM 8).
These findings give additional reasons to appreciate why the Auditor General of
Quebec’s fall 2013 report denounced the failure of boards of directors of public
organization to properly fulfill their oversight responsibilities (Auditor General of
Quebec, 2013). As long as AC members are also board members, this criticism is
de facto also addressed to them. It is indeed obvious that close collaboration between
top managers and internal auditors could lead the latter to become complicit in the
cover-up of what Radcliffe (2011, 2008) called “public secrets,” instead of the detractors
of public secrets that the regulator wishes them to be.

AC members’ interpretation of IAQ: the éminence grise frame


In sum (see Table II), AC members consider that the IAF’s chief focus should be to
provide strategic advisory services to the top manager and help him/her achieve
organizational goals (diagnosis). To this end, AC members are of the view that internal
auditors should develop a relationship of trust with the top manager and closely
collaborate with him/her throughout the entire internal audit process until they reach a
The “éminence grise” frame
Internal audit
quality
Diagnosis
What should the IAF primarily The IAF should provide tailor-made strategic consulting
focus on? services to the top manager in order to help him/her make
informed decisions and fulfill the organization’s mission
Prognosis
What needs to be done to ensure Develop a solid relationship of trust with the top manager 723
quality internal audit work? Collaborate closely with the top manager in both internal audit
activity planning and drafting internal audit conclusions
Achieve consensus with the top manager on what needs to be
reported to the audit committee
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Motivation
Why? If well advised by the AC and its “armed wing,” the IAF, the Table II.
top manager will be better able to identify and control the main Audit committee
organizational risks and be better equipped to realize the members’ frame of
organization’s mission than if left alone internal audit quality

consensus about what matters deserve to be escalated to the AC level (prognosis). If,
due to the agency of internal auditors, the top manager is better able to identify and
control the organization’s main risks, s/he will be equipped to fulfill the organization’s
mission. AC members thus justify their framing of IAQ by a rhetoric of organizational
performance: the top manager will be more successful – for the good of everyone – if
well advised by the AC’s “armed wing” within the organization, the IAF (motivation).

How internal auditors frame IAQ


In contrast to external auditors’ point of view on IAQ, how internal auditors make sense
of the quality of their own work is under-documented in the literature. Exceptions
include Norman et al. (2010), Roussy (2013) and Sarens (2009). These relatively recent
studies indicate that independence and competence are also important for internal
auditors. In addition, we know from Burnaby and Hass (2009) that internal auditors
associate the notion of independence with the ability to guarantee confidentiality.
Competence is a matter of technical skill and organizational knowledge. A third
important quality criterion emerges from their work: compliance with the IIA Code of
Ethics. The review of our interview data suggests an emphasis on additional factors.
Most interviewees stated that a report is relevant if it provides a fair, accurate and
representative picture of the situation and, more importantly, if the recommendations
outlined in the report help managers improve organizational performance:
Well, the point is to provide the best picture of how people work on cases. The aim really is to
provide the best picture, and then if there are weaknesses, to highlight them and to make
recommendations to ensure that people improve their work methods. That really is the first
goal (IAF 14).
Based on this view, the IAF serves the organization and its managers. Since managers
are busy, they favor parsimonious reports that get straight to the point and highlight
only issues worthy of their attention; in other words, those that can “result in a major
change” (CAE 7). Interviewees made it clear that they only wished to present “the core
of the matter” (IA 8) in their reports and, in order to do so, they focussed only on
the organizational level “so what?” dimension of the various points that they
AAAJ raised: “reports should really only include what is really significant” (CAE 11); “when
29,5 we make an observation, it has to be really important because if it isn’t important, we’re
better off not raising it […]” (CAE 7).
Internal auditors are not just tailoring their reports to the needs of top managers for
the altruistic sake of assisting them in the best possible way; they are also motivated by
the construction of their own legitimacy, and managing their own career:
724 It’s a game you have to play. Up to what point? […] In any case, it gives me access to
everything. So, if I don’t want to be limited in my work, I’m better off staying close to the top
manager, since he opens doors (CAE 5).
To be useful to top managers, the internal audit report must be not only parsimonious,
but also target the main organizational risks. This observation resonates with
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Archambeault et al. (2008), Gramling and Myers (2006), Gramling et al. (2004) and
Dezoort et al. (2001): internal audit report recommendations are tailored to meet top
managers’ strategic preoccupations. To ensure that they understand the strategic risks
faced by the organization, chief audit executives mentioned that they systematically
consulted the top manager. They also admitted to discussing their annual work plan
with the latter before presenting it to the AC. In the words of an interviewee:
“Everything depends on the top manager. From one day to the next, you can have a
different top manager and, if he doesn’t believe in it, your department can sink” (CAE 9).
Internal auditors understand that without top manager support, it is extremely difficult
for the IAF to perform its duties. The top manager represents a vital source of
information; his/her support is also essential for securing managers’ cooperation during
the audit process. On this aspect, our study contrasts with Christopher et al. (2009), who
found that internal auditors see top management involvement in the annual planning
process as a threat to their independence.
Therefore, the relevance of internal audit reports is defined entirely from the
perspective of their usefulness to top managers. Interviewees made no reference to
external auditors’ or the Auditor General’s perception of the usefulness of their internal
audit report. This omission is surprising given the predominance of external auditors’
frame in extant academic literature on the quality of internal audit work. It is also
surprising because external audits are prevalent in Quebec public organizations through
Auditor General interventions and ongoing monitoring by the finance controller. In
addition, interviewees did not pay much attention to the type of assignment performed
(operational, consultancy or assurance assignments) in relation to the quality of the audit
report produced. Besides, the relevance of the audit report is not dependent on their
expressing an assurance opinion. This contrasts with the conclusions of Gramling and
Myers (2006), Gramling et al. (2004) and Dezoort et al. (2001).
Remarkably, interviewees did not mention that a good relationship with AC
members helped improve the quality of their work, which contrasts with prior studies,
including Mat Zain and Subramaniam (2007) and Davies (2009), and with the laws and
regulations that present the AC as the IAF’s main contact point. Instead, interviewees
explained that their true “boss” (CAE 12) was the top manager.
This finding resonates with Norman et al.’s (2010) claim that the functional
relationship with the AC combined with the administrative relationship with the top
manager creates a “conflict of interest” for internal auditors that makes them reluctant
to disclose cases of fraud or embezzlement to the AC.
Interviewees also systematically emphasized the importance of understanding
the organization’s context and operations intimately – in line with Burnaby and
Hass’ (2009) and Clark et al.’s (1980) findings – for producing relevant reports and Internal audit
obtaining the top manager’s trust. quality
Being familiar with the IIA standards was also believed to ensure rigor in the audit
process and enhance internal auditor credibility within the organization – this contrasts
with external auditors’ frame, where IIA standards are not even alluded to. Interviewees,
however, did not view compliance with the IIA standards as an imperative:
Every internal auditor needs to know them [i.e. IIA standards]. That’s for sure; it’s like a recipe 725
for doing your work well, it’s our interpretive guide. […] It [the IIA] is recognized, I would say,
at an international level […]. It also gives credibility (CAE 1).
Beyond the matter of knowledge, most interviewees mentioned that good interpersonal
and communication skills were vital to “surviving in internal auditing” (CAE 9).
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Internal auditors spend much of their time meeting people at all levels of the
hierarchical chain, from the telephone operator at reception to the manager of any given
department and the top manager. “It requires someone who’s comfortable meeting
people” (IA 16). To obtain the information that they require, internal auditors need to
adopt a “friendly and sympathetic” approach (CAE 8), a “human” attitude (IA 28) and a
“pedagogical” way of expressing their requirements.
One participant went so far as to claim that communication skills were one of the
most important factors in his screening of internal auditor job applications. Others, as
illustrated below, suggested that “being the best” internal auditor does not involve
being the most knowledgeable:
Professionals who are more curt, who are perhaps better at understanding risks, better at
understanding what a good audit is, better at understanding business – they might be the
best in those areas, but they won’t be good with the relationship side of things. They turn up
and they’re really annoying, and that’s intimidating for an auditee. He’ll feel really bad. In the
end, you’ll never win in such cases. […] The best internal auditors, the most competent
auditors, aren’t necessarily the best [technically] (CAE 8).
Since the audit report is the main visible output produced by the IAF, particular care
should be taken in its presentation and writing style. One chief audit executive gave the
following instructions to his team:
I want you to write it as if you’re writing for idiots. So it has to be very easy to understand,
very simple, and the connections have to be obvious. That’s how you make sure it goes down
well (CAE 13).
Internal auditors are required to assimilate a significant amount of information. If
internal auditors have good analytical and synthetic skills, the report will be more
likely to address strategic issues. Otherwise, the report will merely be a collection of
operational details of far less relevance and interest to top management.
One interviewee asked the members who were leaving his team why they had
voluntarily chosen to leave their job. They responded that boiling down a vast amount
of information to be able to “pinpoint the issue” (IA 6) was discouragingly difficult:
It makes no sense; we work so hard, but the rules of the job are a grey area. It’s difficult to be
clear about best practices; we don’t have enough experience in the [government and
organizational] system and we don’t know the regulatory framework, et cetera. You have to
try to search for information, you have to read a lot, and then make up your mind (CAE 9).
This competence criterion is absent from external auditors’ and the IIA’s frames
of IAQ.
AAAJ Moreover, whether interviewees spoke of “common sense” (CAE 1), “discernment”
29,5 (CAE 14, IA 2) or “professional judgment” (CAE 3), they agreed that a competent
internal auditor must rely on his or her own discretion to distinguish what requires
further attention from mundane issues:
[You need] to have discernment to be capable of making assessments, and that takes a lot of
judgment, I think it’s one of the main [quality] criteria of internal auditing, and you need to
726 have a lot of it (IA 2).
This is consistent with Francis (1994), who argued that it is imperative for the external
auditor to engage in a practical reasoning process and to show phronesis (i.e. practical
wisdom) in interpreting the most significant information identified in the course of
performing audit assignments.
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Lastly, internal audit assignments vary significantly; internal auditors often operate
in “grey areas” (CAE 9) and unknown territories but they “[aren’t] really allowed to
make any mistakes” (IA 24); a single irrelevant report may cause an internal auditor
to be “sidetracked” (IA 28). The first defense of internal auditors, is rigor. This goes
beyond compliance with IIA standards, because standards leave room for
interpretation, which increases the difficulty of planning and performing audit
assignments. Rigor is exemplified by a precise audit strategy and the provision of
documentary evidence at every stage of the audit process:
In auditing, there’s not much room for error […] We’re not really allowed to make
any mistakes as such. That requires really well prepared documents, really well
supported documents. Conclusive evidence is important. You need to know everything
there is to know about the environment linked to a specific issue, to analyze it, and then,
based on what you’re looking for, to find references to ensure there’s evidence to support your
claims […] (IA 24)
Another defense is what interviewees defined as an “objective” posture: they explained
that the IAF should paint an accurate picture of the organization because it has “the
responsibility of stating whether it’s going well or not” (CAE 6). Interestingly,
interviewees never associated objectivity with the notion of independence from top
management. On the contrary:
I work for the top manager. I can’t really refuse to carry out an assignment, I just can’t. […]
In my case, it’s objectivity at the level of how I conduct the assignments [that prevails]. […]
Therefore, I’d say that I keep my distance from people in the organization (CAE 5).
In their view, objectivity serves to maintain good relationships with people in the
organization, which ensures their cooperation in future audit assignments and
increases the likelihood that they will not resist implementing the recommendations
issued by the IAF.
The list of skills summarized above does not resonate with external auditors’
frame (Table I). Brown (1983) and Prawitt et al. (2009), for instance, argued that a
professional accounting qualification is the main guarantee of competence for
internal auditors. The discrepancy between internal and external auditors’ respective
frames on this aspect is understandable: external auditors concentrate on financial
risks, hence the importance of accounting expertise, whereas internal auditors – like
AC members (hence the similarities between theirs and internal auditors’ frame) –
focus on the various business risks that their organization is exposed to, which
requires a wider range of competencies.
Internal auditors’ interpretation of IAQ: the manager frame Internal audit
In sum (see Table III), internal auditors consider that the IAF should develop useful and quality
practical solutions to help mitigate organizational risks and contribute to improving
organizational performance (diagnosis). Attaining this objective requires building a
solid relationship of trust with the top manager; it also involves following the IIA’s
prescriptions in a flexible way, possessing in-depth contextual knowledge of the
organization, verbal and writing skills, precision and fairness, among other talents and 727
virtues (prognosis). This framing of IAQ is justified by internal auditors’ desire to add
value: writing pertinent reports requires a privileged access to strategic information,
hence the need for close ties with the top manager. It also requires specific competences,
hence the necessity to rigorously select and train the members of the IIA. Methodical
thinking is one such competence, hence the motivation to follow the IIA’s prescriptions,
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

wherever practicable (motivation).

How the IIA frames IAQ


The IIA was established in 1941 in the USA and has become a global organization with
more than 180,000 loosely federated members. It is also a member of the Committee of
Sponsoring Organizations of the Treadway Commission. The institute offers training,
webinars, conferences, certification programs, standards and guidance and publishes
research on internal auditing. Since the mid-1990s, it has actively promoted risk-based
approaches to internal audits (for a summary, see Colbert and Alderman, 1995; Power,
2007, p. 57) argued that “it consistently emphasized the significance of internal auditing
in the wake of criticisms of the external audit function.”
For the IIA, quality internal audit work involves complying with the conceptual
framework that the institute publishes, which includes “mandatory guidance”

The manager frame

Diagnosis
What should the IAF The IAF should develop useful and practical solutions to mitigate the
primarily focus on? most important organizational risks and thereby contribute to improving
the organization’s performance
Prognosis
What needs to be done The IAF should build and maintain a good working relationship with the
to ensure quality internal top manager
audit work? The IIA standards should be followed whenever pertinent
Internal auditors should possess in-depth contextual knowledge of the
organization, communication skills, rigor, objectivity, reliance on their
own judgment and good analytical and synthetic skills
Motivation
Why? Maintaining good relationships between the IAF and top managers
ensures that internal auditors understand the main risks that the
organization faces and that their audit report specifically addresses them
instead of insignificant issues, thereby adding value to the top manager
Internal auditing requires methodical activities. The IIA’s framework is
available and internationally recognized. Therefore, using it whenever Table III.
pertinent makes sense Internal auditors’
Selecting internal auditors with the specific qualities highlighted above frame of internal
increases the odds that their audit report will be pertinent audit quality
AAAJ (comprising a definition of the purpose, nature and scope of internal auditing; a code of
29,5 ethics; and internal auditing standards) and “strongly recommended guidance”
(containing position papers and practice advisories and guides).
The institute’s definition of internal audit suggests a hybrid perspective, with a dual
emphasis on independence, objectivity and assurance assignments (in line with
external auditors’ frame), and on value creation and consulting assignments (in line
728 with both internal auditors’ and AC members’ respective frames):
By definition, internal auditing is an independent, objective assurance and consulting activity
designed to add value and improve an organization’s operations. It helps an organization
accomplish its objectives by bringing a systematic, disciplined approach to evaluate and
improve the effectiveness of risk management, control and governance processes ((The
Institute of Internal Auditor (IIA) (2012), p. 2, emphasis added).
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

The purpose of the code of ethics is to “promote an ethical culture in the profession of
internal auditing” and describes the principles and rules that should guide
internal auditors’ behavior and self-discipline. The principles include integrity,
objectivity, confidentiality and competency. The common denominator is a claim to
professionalism: internal auditors (who are not formally organized as a self-regulated
profession) should have the same standards of ethical conduct as other, more
established professional groups. Notably, they should demonstrate high levels of
“professional objectivity”, “not be unduly influenced by their own interest” in forming
judgments, and should be technically competent to undertake the tasks at hand
(IPPF, 2012, pp. 5-7). These are classical professional leitmotifs, including detached
concern and dual competence (moral and technical) (Dubar and Tripier, 1998).
Underlying these principles and behavioral rules is the belief that IAQ can be
(partially at least) inferred from internal auditors’ irreproachable ethical conduct
during the audit process.
The perceived importance of rigor and objectivity by internal auditors (see Table III)
does not align perfectly with the principles set out in the IIA code of ethics, but there are
obvious similarities. The IIA states that integrity is critical, because it “establishes trust
and thus provides the basis for reliance on their [internal auditor’s] judgment” (IIA,
Code of Ethics, Principle 1). Although the term integrity was not used by interviewed
internal auditors, they did mention the importance of establishing trust. The trust that
they spontaneously referred to, however, was from top and operational managers and
not the AC or external auditors.
Interviewees did not evoke the IIA’s principle of confidentiality either. The reason
for their silence on the issue was probably not that confidentiality was unimportant to
them, but rather that they likely considered it as legally binding (a confidentiality rule
applies to the entire Quebec public and para-public sector) and thus so obvious that it
was not noteworthy.
The IIA’s competency principle primarily means that internal auditors must
perform only those assignments for which they are qualified (in terms of knowledge,
skills and experience). The importance that interviewees placed on the existence of
complementary skills in an internal audit team suggests that internal auditors do share
the IIA’s concern for the so-called competency principle.
In addition, internal auditing standards[7] concentrate on the means through which
internal auditors can “add value” to their employer organization. This focus on value
creation diverges from external auditors’ watchdog frame. It resonates, instead, with
internal auditors’ and AC members’ frames. The standards are divided between
unconditional requirements and areas where conformance is expected “unless applying Internal audit
professional judgment justifies deviation” (IPPF 2012, p. 12, emphasis added). They quality
describe the nature of internal audit assignments, but also quality criteria. “Due
professional care” is mentioned twice (in IIA standards 1200-1, 1220-1), “continuing
professional development” is cited in IIA standard 1230, and emphasis is given to the
importance of undergoing a “quality assurance and improvement program that
covers all aspects of the internal audit activity” (IIA standard 1300). These criteria 729
reinforce the Institute’s vision, outlined in the code of ethics, that internal audit should
be regarded as a profession, where quality work depends on internal auditors’
self-discipline, their application of professional rules, use of professional judgment
whenever necessary, and where quality can be formally assessed by a peer-review
processes orchestrated by the IIA. An IAF that wishes to write “conforms with the
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

International Standards for the Professional Practice of Internal Auditing” on its


reports must have successfully passed a quality certification process (IIA standard
1321), performed by an independent IIA-certified reviewer. This process has to be
repeated every five years. At the end of the process, the certified reviewer makes
recommendations to the chief audit executive on these six specific quality assessment
criteria (The IIA, 2009, Practice Advisory 1310-1):
• conformance with the definition of internal auditing, the code of ethics, and the
standards, including timely corrective actions to remedy any significant
instances of non-conformance;
• adequacy of the internal audit activity’s charter, goals, objectives, policies and
procedures;
• contribution to the organization’s governance, risk management and control
processes;
• compliance with applicable laws, regulations and government or industry standards;
• effectiveness of continuous improvement activities and adoption of best
practices; and
• the extent to which the internal audit activity adds value and improves the
organization’s operations.
Being certified is not an obligation in Canada. An IAF may well meet the six quality
assessment criteria set out in Practice Advisory 1310-1, but may decide to opt out of an
external assessment in order to save time and money, or because the AC does not
consider such certification necessary. The non-mandatory nature of the IIA’s
professional practice framework highlights that the Institute’s professionalization
efforts have not been entirely successful so far. Its framing of the notion of IAQ
(summarized in Table IV) is thus no more authoritative than that of external auditors,
AC members or internal auditors.

The IIA’s interpretation of IAQ: the professional frame


In sum (see Table IV), based on the IIA’s publications, the IAF should primarily
concentrate on improving risk management, control and governance practices within
the organization (diagnosis). To provide quality services, the IAF should observe the
norms and standards publicized by the IIA, espouse the IIA’s code of conduct and
adopt its best practice tools and methods (prognosis). The main incentive for the above
AAAJ The professional frame
29,5
Diagnosis
What should the IAF Internal auditing should focus on evaluating and improving the
primarily focus on? effectiveness of risk management, control and governance processes, and
add value to the organization
730 Prognosis
What needs to be done Comply with codified professional norms of conduct and professional
to ensure quality internal standards promulgated by the IIA
audit work? Use the tools, techniques, programs, step-by-step approaches and best
practice examples of deliverables provided by the IIA
Successfully pass an external assessment done by an independent
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

IIA-certified reviewer and renewed every five years and comply with
six specific quality assessment criteria
Motivation
Table IV. Why? Internal audit work is professional work; professions need to be regulated
IIA’s frame of by a professional association in order to guarantee a desired level of
internal audit quality quality. The IIA should play this role

diagnosis and prognosis is a professionalization project: internal auditors need to be


regulated by a professional association – the IIA offers to play this role – if a consistent
level of quality is expected of them (motivation).

6. Discussion
The purpose of this paper was to complement the literature on IAQ – so far
predominantly based on external auditors’ point of view – by documenting how internal
auditors themselves define the quality of the work that they do, how AC members define
the quality of the work that they mandate and how the IIA approaches the quality of the
work that they attempt to normalize and professionalize. We relied on three distinct
sources of data to build these frames: we analyzed the abundant literature on IAQ to
produce the external auditors’ frame; we studied 42 semi-structured interviews with
experienced internal auditors in Quebec public organizations and 14 interviews with AC
members in similar organizational settings. We also relied on the analysis of relevant
documents, directly or indirectly related to IAQ, published by the IIA.
We found that external auditors do not frame IAQ based on a set of desired
characteristics of the outputs produced (including the internal audit report). Instead,
they concentrate on the conditions they view as necessary to guarantee quality outputs:
individual internal auditor competence and the IAF’s independence from the
organization’s management team. These quality criteria are input factors. They
concern the profile of the person who should do the job and the organizational
arrangement that should be in place before the work begins.
In contrast, the IIA primarily frames IAQ from the throughput process perspective:
quality internal audit work derives from a proven conformity with the norms and best
practices promoted by the Institute. If followed carefully, these rules and examples can
lead to a formal certification process by the Institute, meant to signal high quality
internal audit both to other organizational members and to the outside world. This
frame is directly inspired by the classic argument by more established professions that
the quality of professional work cannot be observed by non-professionals (Karpik,
1989) because too much discretion, experience and technical knowledge is involved in
every task: only a professional association (like the IIA) can define, assess and Internal audit
normalize IAQ. The IIA’s quality frame is also consistent with the well-documented quality
attempt by any occupational group that aspires to professional status to
simultaneously codify their knowledge base into a set of tools, rules, protocols and
norms, and assert that using this codified knowledge in “the right way” requires an
incompressible amount of discretion and experience.
Internal auditors and AC members frame IAQ based on how useful they perceive 731
the completed work (output produced) will be to the organization’s top manager. These
two output-oriented quality frames are indicative of their supporters’ pragmatic
attitude (as already emphasized by Radcliffe, 1999): internal auditors and AC members
are concretely anchored to their specific organizational setting. Their perspectives
diverge from that of external auditors, who emphasize independence from top
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

management as an essential (yet idealistic and possibly impractical) quality criterion.


They also differ from the IIA’s frame in that achieving perfect compliance with
professional standards matters less, in their view, than being of some practical and
tangible value to the organizations’ decision makers.
We argue that the nature of internal auditors’ frame, focussed on assisting the top
manager in mitigating the most important organizational risks, could encourage
internal auditors to protect what Radcliffe (2008, 2011) called “public secrets” instead of
bringing them into the public arena, particularly if protecting public secrets is deemed
the best way to control organizational risks in certain circumstances.
This scenario is all the more plausible as AC members’ frame indicates that the
latter view the IAF as an éminence grise, whose role is to advise – not control – top
managers in their strategic decision making. We also argue that both AC members’ and
internal auditors’ frames create a climate conducive to public secrets protection, which
is contrary to the spirit of transparency that typically lies at the center of today’s
governance discourses (Power, 2007, chapter 2), and to the spirit of the NPM/NPG
reforms of the early 2000s.
In the present post-NPM/NPG reform context, Quebec’s public organizations are
pressured to improve their public money management and expected to have ACs and
IAFs that work in tandem to increase transparency and accountability (Neu et al., 2013;
Roussy, 2013). However, our study indicates that the way that internal auditors and AC
members currently frame the notion of IAQ in the province is potentially misaligned with
the NPM/NPG reform objectives. It was not our aim in this study to fully investigate the
practical implications of the dissonance between the four frames we analyzed, nor to fully
examine their potential disconnect with the mainstream moral discourses surrounding
the notion of “good governance” (Power, 2007), but we argue that these avenues would be
worthy of future research and more academic attention.
Our study also has practical implications for IAQ control. The organizational control
literature on the professions (see Brivot, 2011 for a review) posits that, when work
requires a significant amount of discretion, it cannot be reduced to a procedure that
codifies the entire work process. Throughput (or procedural) quality controls are
insufficient at best and counterproductive at worst unless they emanate from other
professionals, because only they can (partially) produce the algorithms of their own
heuristics (Kuhlmann and Burau, 2008). Output controls are equally unsatisfactory for
professional work, because they can signal quality defaults only ex post, when an
important problem has emerged. Input quality controls, through the selection of
the brightest and best, are viewed as more efficient and easier to implement.
In addition, self-directed controls (through discipline, in reference to a code of
AAAJ professional conduct) and lateral controls by peers (through sanctions by the members
29,5 of a professional association) are more adapted to the nature of professional work than
administrative controls.
We argue that external auditors’ and the IIA’s frames are both consistent with the
view that professional quality controls should be used, including input controls
through selective recruitment based on the proven competence of candidates, regular
732 peer controls by the members of a professional association (recall that external auditors
consider it desirable for internal auditors to be fully accredited accountants and that the
IIA positions itself as a quasi-professional association) to ensure independence and
loyalty to the profession and the public rather than to the employer organization.
The IIA’s frame is also consistent with self-directed controls through standards of
ethical conduct compliance. Internal auditors’ and AC members’ frames, in contrast, are
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

consistent with the view that administrative controls should prevail, including output
controls by the top manager, who was described by interviewees as the only one who
could judge whether the internal audit report was of any value to the organization.
This tension suggests that the old debate (see for instance Wallace, 1995) surrounding
the problematical nature of performing professional work (which requires professional
controls) in a non-professional service organization (where administrative controls are
more effective) is still relevant today.
The framing literature has already documented that individuals adhere to certain
frames if the latter “resonate” and strike a responsive chord with their pre-existing
beliefs (Snow and Benford, 1992). Thus, future research could analyze whether a link
might exist between an individual’s preference for a given frame and his/her
background, his/her identification with the organization (e.g. internal auditors and AC
members) or with a profession (e.g. external auditors and the authors of the IIA
guidance materials that we have examined).
Framing theory is a powerful analytical tool to examine how distinct groups of
stakeholders engage in “meaning battles” and try to convince others to see a certain issue
through one specific frame. Although we have concentrated on the meaning battle
surrounding the notion of IAQ, we suggest that framing theory could also be used in the
context of external audit quality. Despite more than three decades of empirical,
experimental and sociological research on external audit quality, this notion remains
poorly understood (Knechel et al., 2013). Documenting how it is framed by different
stakeholder groups (including external auditors, the regulator, financial statements users,
managers of audited organizations, etc.) thus offers one fruitful avenue for future research.
This study has several limitations. First, each frame relies on a distinct data source
(interviews, documents, extant literature). Our findings might have been slightly
different if we had only relied on one consistent data source (interviews, for example).
Second, we have not exhausted the multivocality of the IAQ notion. Studying how
taxpayers and organizational top managers frame IAQ, in particular, would increase
our studying of the various ways in which this notion might be interpreted.
Importantly, the Auditor General’s perspective on IAQ is also missing from the
literature. Documenting other IAQ frames (or adding nuance to our existing frames)
would be all the more important as internal audit is now considered an indispensable
governance mechanism (Power, 2007) about which too little is known, especially in the
public sector. In this respect, we acknowledge that our findings might not be
“transferable” (Langley, 1999) to other internal audit contexts. Future research could
also assess whether the competing frames documented in this study will continue to
cohabit in the long run – a scenario which extant framing literature suggests is highly
unlikely – or whether the IIA’s professionalization attempt will lead to the successful Internal audit
diffusion of its frame to the detriment of all others. quality
In brief, as Edmondson and McManus (2007) suggest is justified for interpretive
qualitative study, our research has ventured into quasi-virgin territory. Even if
numerous important research avenues are still unexplored in the area of internal audit,
we have contributed to this nascent field of inquiry by delineating four previously
undocumented competing frames of IAQ, and by suggesting that IAQ is more 733
multilayered and intricate than previously acknowledged.

Notes
1. See standards 1300-1322 and Practice Advisory 1310-1.
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

2. For instance, in November 2011, the Government of Quebec launched the Commission
d’enquête sur l’octroi et le gestion des contrats publics dans l’industrie de la construction. This
public inquiry commission is chaired by the Honorable Judge France Charbonneau. Its
mandate specifically includes investigating the infiltration of organized crime into the public
administration and unveiling corruption and fraud in the allocation and management of
public contracts. The commission’s report is expected to be released in November 2015
(Government of Quebec, 2013). In addition to this ad hoc, temporary public commission, a
new, long-term anti-corruption police unit (Unité Permanente Anti-Corruption, UPAC) was
created in February 2011. Its mandate is to investigate and prevent criminal corruption
activities within Quebec’s public and para-public administrations.
3. According to IIA standard 1110-Organizational Independence (The Institute of Internal
Auditors, 2013a), this functional authority involves approving the IAF’s charter, its annual
audit plan, budget and resource plans, and annual activities report. It also involves receiving
and validating the internal audit report.
4. Framing theory was originally crafted for the study of social movements in society at large
(Benford and Snow, 2000; Snow and Benford, 1992, 1988) but has recently started being used
in the context of organizations (Markowitz et al., 2012; Bay, 2011; Kaplan, 2008; Davis et al.,
2005; Creed et al., 2002a, b). Our research uses the latter framing studies more than the
original social movement ones.
5. This software facilitates the coding and analysis of qualitative data. Among other things, it
allows users to see codes that co-occur across all or just some selected documents, and
provides an overview of code frequencies.
6. According to Langley (1999), narration is, in itself, an analytical method and is used in almost
all qualitative studies.
7. It should be noted that internal auditing standards are much less developed (in terms of both
volume and level of detail) than external auditing standards.

References
Abbott, L.J., Parker, S., Peters, G.F. and Rama, D.V. (2007), “Corporate governance, audit quality,
and the Sarbanes-Oxley Act: evidence from internal audit outsourcing”, The Accounting
Review, Vol. 82 No. 4, pp. 803-835.
Allegrini, M., D’Onza, G., Paape, L., Melville, R. and Sarens, G. (2006), “The European literature
review on internal auditing”, Managerial Auditing Journal, Vol. 21 No. 8, pp. 845-853.
Archambeault, D.S., DeZoort, F.T. and Holt, T.P. (2008), “The need for an internal auditor report
to external stakeholders to improve governance transparency”, Accounting Horizons,
Vol. 22 No. 4, pp. 375-389.
AAAJ Auditor General of Quebec (2013), “Report of the Auditor General of Québec to the National
Assembly for 2013-2014”, Value-for-Money Audit, Auditor General of Quebec Press,
29,5 Quebec City.
Bay, C. (2011), “Framing financial responsibility: an analysis of the limitations of accounting”,
Critical Perspectives on Accounting, Vol. 22 No. 6, pp. 593-607.
Bédard, J. and Gendron, Y. (2010), “Strengthening the financial reporting system: can audit
734 committees deliver?”, International Journal of Auditing, Vol. 14 No. 2, pp. 174-210.
Benford, R.D. and Snow, D.A. (2000), “Framing processes and social movements: an overview and
assessment”, Annual Review of Sociology, Vol. 26 No. 1, pp. 611-639.
Brandon, D. (2010), “External auditor evaluations of outsourced internal auditors”, Auditing: A
Journal of Practice and Theory, Vol. 29 No. 2, pp. 159-173.
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Brivot, M. (2011), “Controls of knowledge production, sharing and use in bureaucratized


professional service firms”, Organization Studies, Vol. 32 No. 4, pp. 489-508.
Brown, P.R. (1983), “Independent auditor judgment in the evaluation of internal audit functions”,
Journal of Accounting Research, Vol. 21 No. 2, pp. 444-455.
Brown, P.R. and Karan, V. (1986), “One approach for assessing the operational nature of auditing
standards: an analysis of SAS 9”, Auditing: A Journal of Practice & Theory, Vol. 6 No. 1,
pp. 134-147.
Burnaby, P. and Hass, S. (2009), “A summary of the global common body of knowledge 2006
(CBOK) study in internal auditing”, Managerial Auditing Journal, Vol. 24 No. 9, pp. 813-834.
Campbell, J. (2005), “Where do we stand? Common mechanisms in organizations and social
movements research”, in Davis, J., McAdam, D., Scott, W. and Zald, M. (Eds), Social
Movements and Organization Theory, Cambridge University Press, New York, NY, pp. 41-68.
Christopher, J., Sarens, G. and Leung, P. (2009), “A critical analysis of the independence of the
internal audit function: evidence from Australia”, Accounting, Auditing & Accountability
Journal, Vol. 22 No. 2, pp. 200-220.
Clark, M., Gibbs, T.E. and Schroeder, R.B. (1980), “Evaluating internal audit departments under
SAS No. 9”, The Woman CPA, Vol. 42 No. 3, pp. 8-11.
Coetzee, P. and Lubbe, D. (2014), “Improving the efficiency and effectiveness of risk-based
internal audit engagements”, International Journal of Auditing, Vol. 18 No. 2, pp. 115-125.
Colbert, J.L. and Alderman, C.W. (1995), “A risk-driven approach to the internal audit”,
Managerial Auditing Journal, Vol. 10 No. 2, pp. 38-44.
Creed, W.D., Langstraat, J.A. and Scully, M.A. (2002a), “A picture of the frame: frame analysis as
technique and as politics”, Organizational Research Methods, Vol. 5 No. 1, pp. 34-55.
Creed, W.D., Scully, M.A. and Austin, J.R. (2002b), “Clothes make the person? The tailoring of
legitimating accounts and the social construction of identity”, Organization Science, Vol. 13
No. 5, pp. 475-496.
Davies, M. (2009), “Effective working relationships between audit committees and internal audit:
the cornerstone of corporate governance in local authorities, a Welsh perspective”, Journal
of Management & Governance, Vol. 13 Nos 1-2, pp. 41-73.
Davis, J., McAdam, D., Scott, W. and Zald, M. (2005), Social Movements and Organization Theory,
Cambridge University Press, New York, NY.
Desai, N., Gerard, G. and Tripathy, A. (2011), “Internal audit sourcing arrangements and reliance
by external auditors”, Auditing: A Journal of Practice & Theory, Vol. 30 No. 1, pp. 149-171.
Desai, V., Roberts, R. and Srivastava, R. (2010), “An analytical model for external auditor
evaluation of the internal audit function using belief functions”, Contemporary Accounting
Research, Vol. 27 No. 2, pp. 537-575.
Dezoort, F.T., Houston, R.W. and Peters, M.F. (2001), “The impact of internal auditor Internal audit
compensation and role on external auditors’ planning judgments and decisions”,
Contemporary Accounting Research, Vol. 18 No. 2, pp. 257-281.
quality
Dubar, C. and Tripier, P. (1998), Sociologie des Professions, Armand Colin, Paris.
Duhaime, C.P. and Landry, S.S. (1995), “Quand les ciseaux font place à l’ordinateur”, Gestion:
revue internationale de gestion, Vol. 20 No. 4, pp. 54-62.
Edmondson, A.C. and McManus, S.E. (2007), “Methodological fit in management field research”, 735
The Academy of Management Review, Vol. 32 No. 4, pp. 1155-1179.
Eisenhardt, K.M. (1989), “Building theories from case study research”, The Academy of
Management Review, Vol. 14 No. 4, pp. 532-550.
Everett, J. and Tremblay, M.S. (2014), “Ethics and internal audit: moral will and moral skill in a
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

heteronomous field”, Critical Perspectives on Accounting, Vol. 25 No. 3, pp. 181-196.


Francis, J.R. (1994), “Auditing, hermeneutics, and subjectivity”, Accounting, Organizations and
Society, Vol. 19 No. 3, pp. 235-269.
Glover, S.M., Prawitt, D.F. and Wood, D.A. (2008), “Internal audit sourcing arrangement and the
external auditor’s reliance decision”, Contemporary Accounting Research, Vol. 25 No. 1,
pp. 193-213.
Goffman, E. (1986), Frame Analysis: An Essay on the Organization of Experience, 2nd ed.,
Northeastern University Press, Boston, MA.
Government of Ontario (2002), “Ontario’s laws – keeping the promise for a strong economy Act”,
Part XXII (Bill 198), Toronto.
Government of Quebec (2000), “Revised statutes and regulations of Quebec”, Chapter A-6.01: Act
of Public Administration, Quebec City.
Government of Quebec (2006), “Revised statutes and regulations of Quebec”, Chapter G-1.02: Act
Respecting the Governance of State-Owned Enterprises, Quebec City.
Government of Quebec (2013), “Commission d’enquête sur l’octroi et la gestion des contrats
publics dans l’industrie de la construction”, available at: www.ceic.gouv.qc.ca/la-
commission/mandat.html (accessed February 22, 2015).
Gramling, A.A. and Myers, P.M. (2006), “Internal auditing’s role in ERM”, The Internal Auditor,
Vol. 63 No. 2, pp. 52, 56-58.
Gramling, A.A. and Vandervelde, S.D. (2006), “Assessing internal audit quality”, Internal
Auditing, Vol. 21 No. 3, pp. 26-30, 32-33.
Gramling, A.A., Maletta, M.J., Schneider, A. and Church, B.K. (2004), “The role of the internal
audit function in corporate governance: a synthesis of the extant internal auditing
literature and directions for future research”, Journal of Accounting Literature, Vol. 23,
pp. 194-244.
Hargrave, T. and Van de Ven, A. (2006), “A collective action model of institutional innovation”,
The Academy of Management Review, Vol. 31 No. 4, pp. 864-888.
Holt, T.P. and DeZoort, T. (2009), “The effects of internal audit report disclosure on investor
confidence and investment decisions”, International Journal of Auditing, Vol. 13 No. 1,
pp. 61-77.
Kaplan, S. (2008), “Framing contests: strategy making under uncertainty”, Organization Science,
Vol. 19 No. 5, pp. 729-752.
Karpik, L. (1989), “L’économie de la qualité”, Revue Française de Sociologie, Vol. 30 No. 2, pp. 187-210.
Knechel, W.R., Krishnan, G.V., Pevzner, M., Shefchik, L.B. and Velury, V. (2013), “Audit quality:
insights from the academic literature”, Auditing: A Journal of Practice & Theory, Vol. 32
No. S1, pp. 385-421.
AAAJ Kuhlmann, E. and Burau, V. (2008), “The healthcare state in transition”, European Societies,
Vol. 10 No. 4, pp. 619-633.
29,5
Langley, A. (1999), “Strategies for theorizing from process data”, The Academy of Management
Review, Vol. 24 No. 4, pp. 691-710.
Lesage, C. and Ben Saab, E. (2009), “Indépendance de l’auditeur”, in Colasse, B. (Ed.), Dans
Encyclopédie de comptabilité, contrôle de gestion et audit, 2nd éd., Économica, Paris.
736 Lin, S., Pizzini, M., Vargus, M. and Bardhan, I. (2011), “The role of the internal audit function
in the disclosure of material weaknesses”, The Accounting Review, Vol. 86 No. 1,
pp. 287-323.
Malsch, B. and Salterio, S. (2016), “Doing good field research: assessing the quality of audit field
research”, Auditing: A Journal of Practice and Theory, Vol. 35 No. 1, pp. 1-22.
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Markowitz, L., Cobb, D. and Hedley, M. (2012), “Framing ambiguity: insider/outsiders and the
successful legitimation project of the socially responsible mutual fund industry”,
Organization, Vol. 19 No. 1, pp. 3-23.
Mat Zain, M. and Subramaniam, N. (2007), “Internal auditor perceptions on audit committee
interactions: a qualitative study in Malaysian public corporations”, Corporate Governance:
An International Review, Vol. 15 No. 5, pp. 894-908.
Messier, W.F. and Schneider, A. (1988), “A hierarchical approach to the external auditor’s
evaluation of the internal auditing function”, Contemporary Accounting Research, Vol. 4
No. XX, pp. 337-353.
Miles, M.B. and Huberman, A.M. (1994), Qualitative Data Analysis: An Expanded Sourcebook,
2nd ed., Sage, Thousand Oaks, CA.
Munro, L. and Stewart, J. (2010), “External auditors’ reliance on internal audit: the impact of
sourcing arrangements and consulting activities”, Accounting and Finance, Vol. 50 No. 2,
pp. 371-387.
Neu, D., Everett, J. and Rahaman, A.S. (2013), “Internal auditing and corruption within
government: the case of the Canadian sponsorship program”, Contemporary Accounting
Research, Vol. 30 No. 3, pp. 1223-1250.
Norman, C., Rose, A. and Rose, J. (2010), “Internal audit reporting lines, fraud risk decomposition,
and assessments of fraud risk”, Accounting, Organizations and Society, Vol. 35 No. 5,
pp. 546-557.
Pizzini, M., Lin, S. and Ziegenfuss, D. (2015), “The impact of internal audit function quality
and contribution on audit delay”, Auditing: A Journal of Practice & Theory, Vol. 34 No. 1,
pp. 25-58.
Power, M. (2007), Organized Uncertainty. Designing a World of Risk Management, Oxford
University Press, Oxford.
Power, M. and Gendron, Y. (2015), “Qualitative research in auditing: a methodological roadmap”,
Auditing: A Journal of Practice & Theory, Vol. 34 No. 2, pp. 147-165.
Prat Dit Hauret, C. (2003), “L’indépendance du commissaire aux comptes: Une analyse empirique
fondée sur trois composantes psychologiques du comportement”, Comptabilité Contrôle
Audit, Vol. 9 No. 2, pp. 31-58.
Prawitt, D., Smith, J. and Wood, D. (2009), “Internal audit quality and earnings management”,
The Accounting Review, Vol. 84 No. 4, pp. 1255-1280.
Radcliffe, V.S. (1999), “Knowing efficiency: the enactment of efficiency in efficiency auditing”,
Accounting, Organizations and Society, Vol. 24 No. 4, pp. 333-362.
Radcliffe, V.S. (2008), “Public secrecy in auditing: what government auditors cannot know”,
Critical Prespectives on Accounting, Vol. 19 No. 1, pp. 99-126.
Radcliffe, V.S. (2011), “Public secrecy in government auditing revisited”, Critical Perspectives on Internal audit
Accounting, Vol. 22 No. 7, pp. 722-732.
quality
Regoliosi, C. and D’eri, A. (2014), “ ‘Good’ corporate governance and the quality of internal audit
departments in Italian listed firms. An exploratory investigation in Italian listed firms”,
Journal of Management and Governance, Vol. 18 No. 3, pp. 891-920.
Roussy, M. (2012), “Comment apprécier la compétence d’un auditeur interne? L’opinion des
membres du comité d’audit”, Télescope, Vol. 18 No. 3, pp. 33-51. 737
Roussy, M. (2013), “Internal auditors’ roles: from watchdogs to helpers and protectors of the top
manager”, Critical Perspectives on Accounting, Vol. 24 Nos 7-8, pp. 550-571.
Roussy, M. (2015), “Welcome to the day-to-day of internal auditors: how do they cope with
conflicts?”, Auditing: A Journal of Practice & Theory, Vol. 34 No. 2, pp. 237-264.
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Sarens, G. (2009), “Internal auditing research: where are we going? Editorial”, International
Journal of Auditing, Vol. 13 No. 1, pp. 1-7.
Sarens, G., De Beelde, I. and Everaert, P. (2009), “Internal audit: a comfort provider to the audit
committee”, The British Accounting Review, Vol. 41 No. 2, pp. 90-106.
Schneider, A. (2010), “Determining whether there are any effects of incentive compensation and
stock ownership on internal audit procedures”, International Journal of Auditing, Vol. 14
No. 1, pp. 101-110.
Shabnam, F.A., Zakiah, M.M. and Azlina, A. (2014), “The effects of personal and organizational
factors on role ambiguity amongst internal auditors”, International Journal of Auditing,
Vol. 18 No. 2, pp. 105-114.
Short, J. (2009), “The art of writing a review article”, Journal of Management, Vol. 35 No. 6,
pp. 1312-1317.
Silverman, D. (1993), Interpreting Qualitative Data, Sage Publications, London.
Snow, D.A. and Benford, R.D. (1988), “Ideology, frame resonance, and participant mobilization”,
International Social Movement Research, Vol. 1 No. 1, pp. 197-217.
Snow, D.A. and Benford, R.D. (1992), “Master frames and cycles of protest”, in Morris, A.D. and
Mueller, C.M. (Eds), In Frontiers in Social Movement Theory, Yale University Press,
New Haven, CT, pp. 133-155.
Strauss, A. and Corbin, J. (1990), Basics of Qualitative Research, Sage, Newbury Park.
Stewart, J. and Subramaniam, N. (2010), “Internal audit independence and objectivity:
emerging research opportunities”, Managerial Auditing Journal, Vol. 25 No. 4,
pp. 328-360.
The Institute of Internal Auditor (IIA) (2009), Certified Internal Auditor Model Exam Questions,
The IIA Research Foundation, Altamonte Springs, FL.
The Institute of Internal Auditor (IIA) (2010a), Implementing the International Professional
Practices Framework, 3rd ed., The IIA Research Foundation, Altamonte Springs, FL.
The Institute of Internal Auditor (IIA) (2010b), Internal Auditing: A Guide for the New Auditor,
3rd ed., The IIA Research Foundation, Altamonte Springs, FL.
The Institute of Internal Auditor (IIA) (2011), Clarity-Impact-Speed: Delivering Audit Reports that
Matter, The IIA Research Foundation, Altamonte Springs, FL.
The Institute of Internal Auditor (IIA) (2012), International Professional Practices Framework
(IPPF), The IIA Research Foundation, Altamonte Springs, FL.
The Institute of Internal Auditor (IIA) (2013a), “International standards for the professional
practice of internal auditing (standards)”, available at: www.theiia.org/guidance/standards-
and-guidance/ippf/standards/ (accessed February 22, 2015).
AAAJ The Institute of Internal Auditor (IIA) (2013b), “Code of ethics”, available at: https://na.theiia.org/
standards-guidance/mandatory-guidance/Pages/Code-of-Ethics.aspx (accessed February
29,5 22, 2015).
Théoret, P., Rivard, G. and Nadeau, Y. (2012), “What can internal audit do?”, CA Magazine,
August, pp. 44-46
Trotman, A.J. and Trotman, K.T. (2015), “Internal audit’s role in GHG emissions and energy
738 reporting. Evidence from audit committees, senior accountants and internal auditors”,
Auditing: A Journal of Practice & Theory, Vol. 34 No. 1, pp. 199-230.
US House of Representatives (2002), The Sarbanes-Oxley Act of 2002”, Public Law 107-204
(HR 3763). Government Printing Office, Washington, DC.
Vinnari, E. and Skaebaek, P. (2014), “The uncertainties of risk management: a field study on risk
management internal audit practices in a Finnish municipality”, Accounting, Auditing &
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Accountability Journal, Vol. 27 No. 3, pp. 489-726.


Wallace, J. (1995), “Organisational and professional commitment in professional and
nonprofessional organisations”, Administrative Science Quarterly, Vol. 40 No. 2, pp. 228-255.

Corresponding author
Melanie Roussy can be contacted at: melanie.roussy@fsa.ulaval.ca

For instructions on how to order reprints of this article, please visit our website:
www.emeraldgrouppublishing.com/licensing/reprints.htm
Or contact us for further details: permissions@emeraldinsight.com
This article has been cited by:

1. AL-QadasiAdel Ali, Adel Ali AL-Qadasi, AbidinShamharir, Shamharir Abidin, Al-JaifiHamdan


Amer, Hamdan Amer Al-Jaifi. The puzzle of internal audit function budget toward specialist
auditor choice and audit fees. Managerial Auditing Journal, ahead of print. [Abstract] [Full Text]
[PDF]
2. Daniela Argento, Timurs Umans, Patricia Håkansson, Annika Johansson. 2018. Reliance on the
internal auditors’ work: experiences of Swedish external auditors. Journal of Management Control
31. . [Crossref]
3. Anna Thomasson. 2018. Politicisation of the audit process: The case of politically affiliated auditors
in Swedish local governments. Financial Accountability & Management 34:4, 380-391. [Crossref]
4. Andrew J. Trotman, Keith R. Duncan. 2018. Internal Audit Quality: Insights from Audit
Downloaded by University of Sri Jayewardenepura At 03:55 12 January 2019 (PT)

Committee Members, Senior Management, and Internal Auditors. AUDITING: A Journal of


Practice & Theory 37:4, 235-259. [Crossref]
5. Mélanie Roussy, Michelle Rodrigue. 2018. Internal Audit: Is the ‘Third Line of Defense’ Effective
as a Form of Governance? An Exploratory Study of the Impression Management Techniques Chief
Audit Executives Use in Their Annual Accountability to the Audit Committee. Journal of Business
Ethics 151:3, 853-869. [Crossref]
6. Mélanie Roussy, Alexandre Perron. 2018. New Perspectives in Internal Audit Research: A
Structured Literature Review. Accounting Perspectives 17:3, 345-385. [Crossref]
7. Vikash Kumar Sinha, Marika Arena. 2018. Manifold Conceptions of the Internal Auditing of Risk
Culture in the Financial Sector. Journal of Business Ethics 62. . [Crossref]
8. OussiiAhmed Atef, Ahmed Atef Oussii, Boulila TaktakNeila, Neila Boulila Taktak. 2018. The
impact of internal audit function characteristics on internal control quality. Managerial Auditing
Journal 33:5, 450-469. [Abstract] [Full Text] [PDF]
9. BananukaJuma, Juma Bananuka, NkundabanyangaStephen Korutaro, Stephen Korutaro
Nkundabanyanga, NalukengeIrene, Irene Nalukenge, KaawaaseTwaha, Twaha Kaawaase. 2018.
Internal audit function, audit committee effectiveness and accountability in the Ugandan statutory
corporations. Journal of Financial Reporting and Accounting 16:1, 138-157. [Abstract] [Full Text]
[PDF]
10. EulerichMarc, Marc Eulerich, HenselerJörg, Jörg Henseler, KöhlerAnnette G., Annette G. Köhler.
2017. The internal audit dilemma – the impact of executive directors versus audit committees on
internal auditing work. Managerial Auditing Journal 32:9, 854-878. [Abstract] [Full Text] [PDF]
11. KabuyeFrank, Frank Kabuye, NkundabanyangaStephen Korutaro, Stephen Korutaro
Nkundabanyanga, OpisoJulius, Julius Opiso, NakabuyeZulaika, Zulaika Nakabuye. 2017. Internal
audit organisational status, competencies, activities and fraud management in the financial services
sector. Managerial Auditing Journal 32:9, 924-944. [Abstract] [Full Text] [PDF]

You might also like