Effectiveness of the internal audit function

In the last couple of years, next to her full time job at the internal audit department of ABN AMRO, Violeta Verbraak-Kolevska conducted a research about Internal Audit (IA) effectiveness at the Erasmus School of Accounting & Auditing in Rotterdam. In 2014, after presenting her research ideas at the Conference on Internal Audit and Corporate Governance in Oslo, Violeta started her PhD research at the Erasmus University Rotterdam under supervision of prof.dr. Harry Commandeur (promotor) and dr. Arno Nuijten (co-promotor).

What was your motivation for this research about Internal Audit effectiveness?

“My PhD journey started in January 2014, some months before I took on the responsibility for the Audit Professional Practices department. This turned out to be the perfect moment to start studying the IA effectiveness for three reasons.

• In my role I was responsible for delivering input to our performance report to senior management that includes various indicators on the effectiveness of our internal audit department. This provided me insight in Internal Audit effectiveness and offered an opportunity to think about additional indicators to improve our effectiveness.
• Internal auditor’s risk warnings are more and more taken into consideration by senior management when making important strategic decisions.
• The CEO at that time showed his support to the Internal Audit Function (IAF) by personally giving feedback on our reports and in addressing audit issues. This triggered me to focus on the effect of management support on Internal Audit effectiveness.

Being for almost 25 years in auditing, I wanted to give something back to the internal audit profession. A framework for auditors to further improve their practices and a contribution for additional academic research.”

Can you tell us more about the core of your research?

“Nowadays it has become increasingly important for the IAF to prove its effectiveness, especially after something has gone wrong. We all know examples highlighted in the media or in our own organizations, where the internal auditor issued risk warnings but management did not change its course of action leading to serious business failures. The question ‘where was the internal auditor’ will pop up and the effectiveness of the IAF will be challenged. I have investigated how internal auditors can prevent that their risk warnings fall on deaf ears. In academic research this phenomenon is known as the ‘deaf effect’.”

What is deaf effect on risk warnings?

“One anecdotal illustration of deaf effect is when driving a car at high speed and the person sitting next to you, warns to slow down, reminding you of risks on the road. You could ignore the warning or you could respond that you do not see the same risks or that you know the road very well. All being reasons to not slow down and to continue the ‘wrongdoing’. Now, try to make the analogy of this happening in your organisation, when you as an internal auditor issue risk warnings to the driver (management) and management turns a deaf ear to your risk warnings.

Whereas the IAF can be considered effective when management follows the internal auditor’s advice for improvement, the deaf effect can be viewed as a deficiency in the effectiveness of the IAF. In my study I applied different methods and techniques to investigate what factors may reduce this deaf effect and hence increase the effectiveness of the IAF.”

“We all know examples highlighted in the media or in our own organizations, where the internal auditor issued risk warnings but management did not change its course of action”

Auditors as collaborative partners or opponents?

“Indeed, the question was whether internal auditors acting as collaborative partners or opponents are more successful in reducing the deaf effect of management on their risk warnings when they are being less or more supported by top management. The results of the study showed that top management support is most useful and even necessary when the internal auditor acts as an opponent because in this condition management is more willing to listen to the risk warning of the internal auditor. Maybe surprisingly, management is at a certain point even less willing to listen to the risk warnings auditors who act as partners and receive much top management support. This indicates a counterproductive effect on the effectiveness of the internal auditor. Top management support can be helpful but does not guarantee high effectiveness of internal auditors who act as collaborative partners.”

Auditors who apply nudging may reduce this deaf effect?

“I found out about this in an experiment about applying nudging concepts by the internal auditor to overcome the deaf effect. Nudging stems from the idea that small changes in the way information about choices is presented can lead to better decisions without limiting the freedom to choose by the person being nudged. There are many examples of how are people being nudged to stimulate desired behaviour. E.g. a staircase that starts playing piano music to stimulate people to take the stairs, or signs that indicate the number of calories you can lose by taking the stairs.”

How can it be used bij internal auditors?

“To investigate whether nudging can be used by internal auditors, I included a descriptive social norm in the internal auditor’s risk warning message. Using such norms can produce desired behaviour without enforcing compliance, simply by informing people about what others do in a given situation. In hotels you have probably seen signs asking to reuse the towels for saving the environment. Academic researchers did a study about the effect of such signs on human behaviour and found an increase in the percentage of towels reused after reading such a descriptive social norm.”

“Similarly, by warning that a project entails serious risks thereby adding a social descriptive norm that most of the project managers in the organisation in such situation redirected or stopped the project may lead to a reduced deaf effect and hence increased IAF effectiveness. The results showed that nudging can especially be useful when the internal auditor acts as a collaborative partner. When the internal auditor acts an opponent, nudging does not work or is even counterproductive.”

Auditors who time their warnings well can prevent this deaf effect?

“The question was how timing of the internal auditor’s risk warnings (not too early and not too late) influence management to give attention to these messages. Sometimes the IAF needs to communicate risk warnings in an early stage, even before the audit is finalised. In other situations we need to consider waiting for the right moment. To explore which factors determine the right timing, I conducted five interviews with managers from large financial institution focussing on timing factors, each illustrated by quotes from auditors and auditees. Some examples are: ‘Only after the audit evidence has been completed’ or ‘Only when the factual accuracy has been ascertained’, ‘When issuing the audit report’, ‘Prior to important (strategic) decisions’, ‘Continuously during the audit’ or ‘Before the fact rather than after the fact’.”

And next?

“Thereafter I conducted 52 interviews with auditors and managers and asked them to rank these factors from most important to least important for the IAF effectiveness. This resulted in five shared viewpoints about the right timing. (1) Immediate communication of risk warnings by the internal auditor no matter other conditions; (2) Take into consideration a good relation with the auditee first; (3) The right timing is when corrections are still possible; (4) Collecting audit evidence first and finally (5) The internal auditor is independent of the timing preferences of others to determine the right timing.”

“Being aware of the existence of these viewpoints, can help the internal auditor to determine the timing for communicating risk warnings and so decrease the deaf effect. For example when management wants to hear risk warnings at an early stage no matter the completeness of audit evidence, an internal auditor who evidences everything in detail first, would probably not be very effective.”

“The IAF needs to think outside the traditional toolbox and experiment with new approaches to become more effective”

What are the implications for the internal auditors and the internal audit profession?

“Hopefully my PhD has important implications for academic research and internal auditing practice. While previous studies about IA effectiveness focussed on realization of the audit plan, audit reports and implementation of audit recommendations, this study made a first step towards investigating how other, behavioural factors may impact IA effectiveness. My study found evidence that factors like acting as opponent or as partner as well as nudging and timing are important for IA effectiveness. Furthermore my study can help IAFs in this as it provides important support that behavioural concepts, like e.g. nudging, although not having much to do with internal auditing methodology, can be used by the internal auditors to influence management’s behaviour. Also, this study provides IAF with more awareness about the effects of top management support and applying the collaborative partner and opponent role of the internal auditor and combining these in smart ways to be more effective. I believe that my thesis opens up challenging venues for further research and provides a valuable input to both internal auditors and management to help increase the effectiveness of our profession.”

“I encourage internal auditors to start experimenting with the new approaches resulting of my research to increase IAF effectiveness”

What would be your final message to the internal auditors?

“At times when organizations increasingly adopt intelligent technologies that introduce new risks which may threaten objectives of management, the IAF cannot stay behind and needs to think outside the traditional toolbox and experiment with new approaches to become more effective. I encourage internal auditors to start experimenting with the new approaches resulting of my research to increase IAF effectiveness. Thereby we should not forget the impact of these approaches on the audit skills and competencies, way of communication, relations with stakeholders or even the auditing standards.”