Priscilla A. Burnaby, CPA, PhD Bentley College Mohammad Abdolmohammadi, CPA, DBA Bentley College Susan Hass, Professor, CPA Simmons College Gerrit Sarens,

Priscilla A. Burnaby, CPA, PhDBentley College

Mohammad Abdolmohammadi, CPA, DBABentley College

Susan Hass, Professor, CPASimmons College

Gerrit Sarens, PhD, CIA, CCSA Université Catholique de Louvain

Marco Allegrini, PhDUniversità di Pisa

Usage of Internal Auditing Standards by Companies in the United States and Select

European Countries

Objectives

• To compare usage of the IIA’s Standards and Practice Advisories in:–Belgium–Italy –The Netherlands–The United Kingdom and Ireland–The United States of America

Regulations Requiring Internal Audit Activities• Laws

– Sarbanes Oxley Act of 2002 – All those that have stock on the NYSE– King, 2002 – South Africa

• Stock Exchanges – NYSE, 2004

• Central Banks and Supervisory Authorities throughout Europe– Basel Committee, 2004 – Many countries– Banca d’Italia, 1999 – Italy– CBFA, 1997 – Belgium

• European Corporate Governance Codes– United Kingdom - Combined Code on Corporate Governance– Italy - Corporate Governance Code– Belgian - Corporate Governance Code– The Dutch Corporate Governance Code

Research Questions• RQ1: What is the level of usage of the Standards in Belgium, Italy,

The Netherlands, the United Kingdom and Ireland, and the United States?

• RQ2: Do Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States differ in their compliance with the Standards?

• RQ3: Is guidance for usage of the Standards adequate?• RQ4: What is the level of usage of the Practice Advisories in

Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

• RQ5: What are the reasons for lack of compliance with the Standards?

• RQ6: Are there differences in internal quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

• RQ7: Are there differences in external quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

Research Methodology

• Data was selected from the CBOK (2006) database

• Due to missing data for some of the questions in the CBOK survey, usable responses may vary slightly for each question analyzed

• Chi-square test

IIA Membershipas of September 30, 2006

*Provided by The IIA.

Affiliate IIA Membership as of

9/30/2006*

Usable Responses

Percentage of Membership

Belgium 1,154 102 8.8

Italy 2,531 456 18.0

The Netherlands 1,741 112 6.4

UK and Ireland 7,185 271 3.8

United States 54,686 3,139 5.7

Total 67,297 4,080 6.1

Staff Level Belgium Italy TheNetherlands

UK and Ireland

United States

CAE 20.7 28.5 23.2 25.1 24.3Audit Manager

29.7 21.4 26.8 27.8 22.6

Audit Seniors/Supervisor 21.8 17.2 26.8 30.0 28.2

Audit Staff22.8 25.8 15.2 13.0 17.2

Other 5.0 7.1 8.0 4.1 7.7Total 100.0 100.0 100.0 100.0 100.0Number of Respondents

101 453 112 270 3,127

χ2 =56.68, p<.001

Participants’ Staff Levels(In Percentages)

Age of Respondents(in Percentages)

Age Belgium Italy TheNetherlands

UK and Ireland

United States

25 years old or less

0.0 0.3 1.2 2.2 4.8

26 to 34 years old

25.0 26.5 20.2 19.3 23.8

35 to 44 years old

44.3 33.7 38.1 39.9 32.5

45 to 54 years old

22.7 31.1 25.0 32.3 25.9

55 to 64 years old

8.0 7.5 14.3 6.3 12.6

65 years or older

0.0 0.9 1.2 0.0 0.4

Total 100.0 100.0 100.0 100.0 100.0Number of Respondents

88 347 84 223 2529

χ2 =56.88, p<.001

Highest Level of Respondents’ Education (in Percentages)

Level of Education Belgium Italy TheNetherlands

UK and Ireland

United States

Secondary / High School Education

0.0 20.6 0.8 23.4 1.3

Bachelors / Diploma in Business8.9 42.8 5.4 19.6 49.9

Bachelors / Diploma in Fields Other than Business 4.0 17.5 4.5 20.7 11.9

Masters / Graduate Degree / Diploma in Business 57.4 13.7 56.3 20.0 30.1

Masters / Graduate Diploma in Fields Other than Business 26.7 3.8 20.5 12.2 5.5

Doctoral Degree 2.0 .7 8.0 1.5 .9

Other 1.0 .9 4.5 2.6 .4Total 100.0 100.0 100.0 100.0 100.0Number of Respondents 101 451 112 270 3129

χ2 =967.89, p<.001

Number of Years as an IIA Member (in Percentages)

Years Belgium ItalyThe

Netherlands UK and Ireland

United States

5 or less 68.3 74.4 64.0 42.5 56.1

6 to 10 19.8 18.8 21.6 33.6 20.2

11 or more 11.9 6.8 14.4 23.9 23.7

Total 100.0 100.0 100.0 100.0 100.0

No. of Respondents

101 453 111 268 3121

χ2 =119.26, p<.001

Respondents’ Professional Qualifications Type of Professional Qualification Belgium Italy

TheNetherlands

UK and Ireland

United States

χ2 p

Internal Auditing (such as CIA / MIIA / PIIA) 55.9 31.1 48.2 62.4 40.6 80.355 <.001

Information Systems Auditing (such as CISA / QiCA / CISM) 9.8 3.9 20.5 14.0 14.0 42.918 <.001

Government Auditing / Finance (such as CIPFA / CGAP / CGFM) .0 2.0 4.5 7.0 4.9 16.404 .003**

Control Self-Assessment (such as CCSA) 8.8 12.3 2.7 1.1 3.0 100.076 <.001**

Public Accounting / Chartered Accountancy (such as CA / CPA / ACCA / ACA)

10.8 12.3 47.3 17.7 36.3 166.812 <.001

Management / General Accounting (such as CMA / CIMA / CGA) 2.9 .7 2.7 5.5 2.2 18.389 .001**

Accounting - technician level (such as CAT / AAT) 2.0 4.6 1.8 8.5 .1 191.144 <.001**

Fraud Examination (such as CFE) 8.8 2.0 .9 1.5 8.7 49.165 <.001**Financial Services Auditing (such as CFSA / CIDA / CBA) 2.9 1.8 .0 .4 6.2 38.284 <.001**

Fellowship (such as FCA / FCCA / FCMA) 1.0 .7 .0 7.7 .4 142.223 <.001**

Certified Financial Analyst (such as CFA) 1.0 .4 .0 .4 .4 1.205 .877**

Other 12.7 22.1 24.1 16.6 13.1 35.763 <.001Number of Respondents 102 456 112 271 3139

**When the number of observations is less than 5 in a cell, the Chi-square results should be interpreted cautiously.

Age of Respondents’ Organizations(in Percentages)

Age Belgium Italy TheNetherlands

UK and Ireland

United States

0 to 5 years 2.1 21.5 6.6 9.3 4.3

6 to 10 years 8.2 14.8 12.6 10.5 6.7

11 to 15 years 7.2 7.7 3.9 5.9 5.0

16 to 20 years 5.2 3.3 1.0 6.7 4.6

21 to 25 years 1.0 3.8 1.0 7.6 3.7

26 to 30 years 6.2 6.8 4.9 4.6 5.0

31 to 35 years 3.1 1.2 4.9 4.6 3.4

36 to 40 years 3.1 2.6 7.8 6.3 4.6

41 to 45 years 1.0 .7 1.0 .4 1.6

46 to 50 years 12.4 4.0 6.8 5.9 5.7

51 or more years 50.5 33.6 49.5 38.2 55.4

Total 100.0 100.0 100.0 100.0 100.0

Number of Respondents

97 426 103 238 2783

χ2 =307.46, p<.001

Number of Years IAA Has Existed (in Percentages)

Number of Years Belgium ItalyThe

Netherlands UK and Ireland United States

0-5 36.4 44.8 17.2 17.9 24.0

6-10 21.6 25.3 25.0 24.6 16.3

11-15 12.5 8.6 10.6 11.2 11.0

16-20 8.0 6.3 6.7 13.8 12.5

21-25 9.1 4.8 7.7 8.5 9.2

26-30 5.7 4.3 13.5 5.8 8.5

31-35 .0 1.8 5.8 5.4 2.9

36-40 1.1 1.0 1.9 2.2 4.7

41-45 .0 .3 2.9 .4 .7

46-50 1.1 .8 2.9 7.1 4.4

More than 50 years 4.5 2.0 5.8 3.1 5.8

Total 100.0 100.0 100.0 100.0 100.0Number of Respondents 88 396 104 224 2592

χ2 =202.86, p<.001

(RQ1) Organizations’ Use of The Standards In Whole or In Part

(in Percentages)

Position in the IAA Belgium Italy The Netherlands

UK and Ireland United States

χ2 pNumber of

Respondents

% Number of

Respondents

% Number of Respond

ents

% Number of

Respondents

% Number of

Respondents

%

CAE 21 90.5 126 81.7 26 88.5 68 85.3 753 86.3 2.412 .660

Audit Manager

30 93.3 96 85.4 30 70.0 75 89.3 700 86.7 8.814 .066

Audit Senior/Supervi-sor

22 68.2 76 81.6 30 60.0 81 74.1 873 83.6 17.504 .002

Audit Staff

22 90.9 113 86.7 17 88.2 35 62.9 523 83.7 12.868 .012

Other 5 100.0 27 85.2 8 37.5 9 77.8 218 76.1 9.433 .051

Overall Average

100 87.1 438 84.0 111 72.1 268 79.9 3067 84.4

(RQ2) Full and Partial Compliance with the Standards (in Percentages)

StandardBelgium Italy

The NetherlandsUK and Ireland

United Statesχ2 p

Full Partial Full Partial Full Partial Full Partial Full Partial

1000- Purpose, Authority, and Responsibility

71.1 23.7 62.3 30.0 61.8 25.0 64.2 21.4 69.2 13.5 120.953 <.001

1100- and Objectivity76.6 19.5 68.7 25.5 70.1 19.4 64.0 22.3 70.8 13.4 86.370 <.001

1200- Proficiency and Due Professional Care

61.0 35.1 58.5 36.9 68.7 14.9 66.5 20.2 69.1 14.5 141.578 <.001

1300- Quality Assurance and Improvement Program

38.7 40.0 28.6 40.2 31.3 41.8 38.6 39.2 48.6 24.5 159.730 <.001

2000- Managing the Internal Audit Activity

53.2 40.3 54.9 37.2 54.4 30.9 57.4 26.6 64.1 18.2 126.440 <.001

2100- Nature of work58.4 35.1 61.0 32.7 58.5 29.2 52.7 29.0 64.6 16.4 107.028 <.001

2200- Engagement Planning63.6 32.5 59.0 33.6 56.1 28.8 58.2 25.3 63.7 17.8 101.961 <.001

2300-Performing the Engagement

63.6 32.5 61.4 33.4 49.2 36.9 56.7 28.1 67.5 15.4 126.152 <.001

2400- Communicating Results68.4 28.9 65.4 29.1 59.7 28.4 62.8 21.5 69.3 14.4 94.343 <.001

2500- Monitoring Progress63.6 29.9 46.6 45.6 47.8 37.3 51.2 30.0 60.8 20.3 135.978 <.001

2600- Resolution of Management’s Acceptance of Risks

48.7 36.8 34.9 36.6 47.0 30.3 49.1 31.0 59.2 18.3 152.405 <.001

Overall Average 60.6 32.2 54.7 34.6 55.0 29.4 56.5 26.8 64.3 17.0

Standard Belgium ItalyThe

Netherlands UK and Ireland

United States

χ2 p

1000- Purpose, Authority, and Responsibility97.4 94.9 76.5 80.3 81.1 70.531 <.001

1100- and Objectivity94.9 95.5 80.6 82.5 83.1 58.564 <.001

1200- Proficiency and Due Professional Care97.5 96.8 76.5 82.5 81.9 66.003 <.001

1300- Quality Assurance and Improvement Program 85.5 73.9 76.5 72.0 74.9 70.305 <.0012000- Managing the Internal Audit Activity

96.2 92.8 79.4 77.2 79.9 63.008 <.0012100- Nature of work

92.2 93.0 76.9 72.6 78.0 59.926 <.0012200- Engagement Planning

92.2 94.8 78.5 77.1 79.1 65.249 <.0012300-Performing the Engagement

94.9 94.8 79.7 76.7 80.3 62.029 <.0012400- Communicating Results

94.8 94.8 80.3 79.0 80.8 53.527 <.0012500- Monitoring Progress

90.9 92.4 79.1 78.0 78.3 56.364 <.0012600- Resolution of Management’s Acceptance of Risks 79.2 73.3 73.1 72.8 75.2 57.346 <.001Overall Average

92.3 90.6 77.9 77.3 79.3

(RQ3) Adequacy of Guidance Provided by Each of the Standards (in Percentages)

(RQ4) Adequacy of Practice Advisories (in Percentages)

Practice Advisories Belgium ItalyThe

Netherlands UK and Ireland

United States

χ2 p

1000- Purpose, Authority, and Responsibility 82.8 91.7 73.6 72.2 82.9 27.968 <.0011100- and Objectivity 75.4 90.3 75.0 73.6 83.2 31.417 <.0011200- Proficiency and Due Professional Care 80.7 91.7 71.2 73.4 82.5 27.781 .0011300- Quality Assurance and Improvement Program 69.0 71.3 73.1 68.8 78.0 17.370 .0262000- Managing the Internal Audit Activity 78.6 89.4 71.2 69.8 81.6 34.533 <.0012100- Nature of work 78.9 89.8 71.2 68.3 80.7 28.523 <.0012200- Engagement Planning 71.9 91.1 65.4 66.7 81.3 61.466 <.0012300-Performing the Engagement 78.9 91.9 67.3 68.3 81.6 40.508 <.0012400- Communicating Results

78.6 90.2 74.5 71.0 82.1 28.623 <.0012500- Monitoring Progress 78.9 87.9 69.2 69.6 80.3 26.334 .0012600- Resolution of Management’s Acceptance of Risks 70.2 73.7 67.3 66.1 78.0 18.715 .016Overall Average 76.1 87.2 70.8 69.8 81.1

(RQ5) Top Five Reasons for Lack of Compliance

• Not perceived as adding value by management/board (11.5%)

• Inadequate staff in the IAA (11.3%)• Too time consuming (10.0%)• Compliance not supported by

management/board (9.7%)• Not appropriate for small organizations (9.2%).

Use of the Standards in Whole or in Part Compared to the Number of Full-Time Staff at Each Staff (in Percentages)

Belgium Italy The Netherlands UK and Ireland United States

Number of Staff

# of Responde

nts

% # of Responde

nts

% # of Responde

nts

% # of Responde

nts

% # 0f Responde

nts

%

1-3 25 88.0 96 68.8 17 52.9 38 68.4 665 77.34-6 12 58.3 74 87.8 15 86.7 49 79.6 530 84.07-9 6 100.0 35 77.1 3* 100.0 41 78.0 369 86.210-12 2* 100.0 21 85.7 4* 100.0 16 81.3 205 81.013-15 5 60.0 12 91.7 9 66.7 12 75.0 156 89.116-18 1* 100.0 17 82.4 8 75.0 7 85.7 110 89.119-21 7 85.7 7 85.7 3* 66.7 7 71.4 71 94.422-24 2* 100.0 5 100.0 1* .0 7 71.4 68 83.825 or more

31 93.5 127 92.9 44 75.0 73 90.4 706 90.8

Total 91 394 104 250 2880Chi-square

13.541 27.374 10.553 9.33 61.104

p .095 .001 .228 .315 <.001

(RQ6) When IAA Was Last Subject to a Formal Internal Quality Assessment (in Percentages)

Timing Belgium Italy The Netherlands

UK and Ireland

United States

# of Respo

nd ents

% # of Respo

nd ents

% # of Respo

nd ents

% # of Respond ents

% # of Respo

nd ents

%

Done in past 5 years or scheduled to be completed prior to January 1, 2007.

39 50.6 122 35.0 45 55.6 127 69.4 1191 60.0

Never had one or not done in compliance with Standard 1311

38 49.4 227 65.0 36 44.4 56 30.6 794 40.0

Total Number of Respondents

77 100.0 349 100.0 81 100.0 183 100.0 1985 100.0

χ2 = 89.275, p<.001

(RQ7) When IAA Was Last Subject to a Formal External Quality Assessment (in Percentages)

Timing Belgium Italy The Netherlands UK and Ireland United States

# of Responde

nts

% # of Responde

nts

% # of Responde

nts

% # of Respond

ents

% # of Responde

nts

%

Done in past 5 years or scheduled to be completed prior to January 1, 2007.

35 47.9 79 27.1 35 43.8 126 68.5 1127 57.7

Never had one or not done in compliance with Standard 1312

38 52.1 213 72.9 45 56.3 58 31.5 827 42.3

Total Number of Respondents

73 100.0 292 100.0 80 100.0 184 100.0 1954 100.0

χ2 =115.997, p<.001

Conclusions

• Growth of the profession has been hastened by national regulation

• Respondents age, education, time in the profession, and years of IIA membership vary by country

• Age of organizations and of IAAs vary by country

Conclusions, continued

• There is consistency within each country for the use of the Standards in whole or in part by staff level but variation by country

• Significant differences exist between countries In the level of satisfaction with the adequacy of the guidance for all Standards and Practice Advisories, with the exception of Standards 1300 and 2600– UK and Ireland are least satisfied with the Standards

and Practice Advisories– Belgium is most satisfied with Standards guidance– Italy is most satisfied with the Practice Advisories

Conclusions, continued

• Compliance with Standard 1300, Quality Assurance and Improvement Program and Standard 2600, Resolution of Management’s Acceptance of Risks, is universally limited– US has highest full compliance– Italy has lowest full compliance

• Convincing management and the board of the value of the Standards is a significant challenge for many IAAs

• Size of the audit staff affects usage of the Standards in Italy and the US