Usage of Internal Auditing Standards by Companies in the United States and Select European Countries Priscilla Burnaby Bentley College USA and Susan Hass.

Usage of Internal Auditing Standards by Companies

in the United States and Select European Countries

Priscilla Burnaby Bentley College USAand Susan Hass Simmons College USA

Priscilla A. Burnaby, CPA, PhDBentley College

Mohammad Abdolmohammadi, CPA, DBABentley College

Susan Hass, Professor, CPASimmons College

Gerrit Sarens, PhD, CIA, CCSA Université Catholique de Louvain

Marco Allegrini, PhDUniversità di Pisa

Authors

Topics

• Introduction• Research Method• Demographic Information• Use and Adequacy of the

Standards and Practice Advisories• Conclusions

Introduction

Objective

• To compare usage of the Standards and Practice Advisories in:–Belgium–Italy –The Netherlands–The United Kingdom and Ireland–The United States of America

Legislation Mandating the Internal Audit Activity

• Sarbanes Oxley Act of 2002 – All those that have stock on the NYSE• King, 2002 – South Africa

Other Regulations

• Stock Exchanges -NYSE, 2004

• Central Banks and Supervisory Authorities throughout Europe

-Basel Committee, 2004 – Many countries -Banca d’Italia, 1999 - Italy -CBFA, 1997 – Belgium

European Corporate Governance Codes

• United Kingdom - Combined Code on Corporate Governance

• Italy - Corporate Governance Code• Belgian - Corporate Governance Code• The Dutch Corporate Governance Code

Research Questions• RQ1: What is the level of usage of the Standards in Belgium,

Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

• RQ2: Do Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States differ in their compliance with the Standards?

• RQ3: Is guidance for usage of the Standards adequate?

• RQ4: What is the level of usage of the Practice Advisories in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

Research Questions, continued

• RQ5: What are the reasons for lack of compliance with the Standards?

• RQ6: Are there differences in internal quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

• RQ7: Are there differences in external quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

Research Methodology

• Data was selected from the CBOK (2006) database

• Due to missing data for some of the questions in the CBOK survey, usable responses may vary slightly for each question analyzed

• Chi-square test

IIA Membershipas of September 30, 2006

*Provided by The IIA.

Affiliate IIA Membership as of

9/30/2006*

Usable Responses

Percentage of Membership

Belgium 1,154 102 8.8

Italy 2,531 456 18.0

The Netherlands 1,741 112 6.4

UK and Ireland 7,185 271 3.8

United States 54,686 3,139 5.7

Total 67,297 4,080 6.1

Demographic Information

Staff Level Belgium Italy TheNetherlands

UK and Ireland

United States

CAE 20.7 28.5 23.2 25.1 24.3Audit Manager

29.7 21.4 26.8 27.8 22.6

Audit Seniors/Supervisor 21.8 17.2 26.8 30.0 28.2

Audit Staff22.8 25.8 15.2 13.0 17.2

Other 5.0 7.1 8.0 4.1 7.7Total 100.0 100.0 100.0 100.0 100.0Number of Respondents

101 453 112 270 3,127

χ2 =56.68, p<.001

Participants’ Staff Levels(In Percentages)

Age of Respondents(in Percentages)

Age Belgium Italy TheNetherlands

UK and Ireland

United States

25 years old or less

0.0 0.3 1.2 2.2 4.8

26 to 34 years old

25.0 26.5 20.2 19.3 23.8

35 to 44 years old

44.3 33.7 38.1 39.9 32.5

45 to 54 years old

22.7 31.1 25.0 32.3 25.9

55 to 64 years old

8.0 7.5 14.3 6.3 12.6

65 years or older

0.0 0.9 1.2 0.0 0.4

Total 100.0 100.0 100.0 100.0 100.0Number of Respondents

88 347 84 223 2529

χ2 =56.88, p<.001

Highest Level of Respondents’ Education (in Percentages)

Level of Education Belgium Italy TheNetherlands

UK and Ireland

United States

Secondary / High School Education

0.0 20.6 0.8 23.4 1.3

Bachelors / Diploma in Business8.9 42.8 5.4 19.6 49.9

Bachelors / Diploma in Fields Other than Business 4.0 17.5 4.5 20.7 11.9

Masters / Graduate Degree / Diploma in Business 57.4 13.7 56.3 20.0 30.1

Masters / Graduate Diploma in Fields Other than Business 26.7 3.8 20.5 12.2 5.5

Doctoral Degree 2.0 .7 8.0 1.5 .9

Other 1.0 .9 4.5 2.6 .4Total 100.0 100.0 100.0 100.0 100.0Number of Respondents 101 451 112 270 3129

χ2 =967.89, p<.001

Number of Years as an IIA Member (in Percentages)

Years Belgium ItalyThe

Netherlands UK and Ireland

United States

5 or less 68.3 74.4 64.0 42.5 56.1

6 to 10 19.8 18.8 21.6 33.6 20.2

11 or more 11.9 6.8 14.4 23.9 23.7

Total 100.0 100.0 100.0 100.0 100.0

No. of Respondents

101 453 111 268 3121

χ2 =119.26, p<.001

Respondents’ Professional Qualifications Type of Professional Qualification Belgium Italy

TheNetherlands

UK and Ireland

United States

χ2 p

Internal Auditing (such as CIA / MIIA / PIIA) 55.9 31.1 48.2 62.4 40.6 80.355 <.001

Information Systems Auditing (such as CISA / QiCA / CISM) 9.8 3.9 20.5 14.0 14.0 42.918 <.001

Government Auditing / Finance (such as CIPFA / CGAP / CGFM) .0 2.0 4.5 7.0 4.9 16.404 .003**

Control Self-Assessment (such as CCSA) 8.8 12.3 2.7 1.1 3.0 100.076 <.001**

Public Accounting / Chartered Accountancy (such as CA / CPA / ACCA / ACA)

10.8 12.3 47.3 17.7 36.3 166.812 <.001

Management / General Accounting (such as CMA / CIMA / CGA) 2.9 .7 2.7 5.5 2.2 18.389 .001**

Accounting - technician level (such as CAT / AAT) 2.0 4.6 1.8 8.5 .1 191.144 <.001**

Fraud Examination (such as CFE) 8.8 2.0 .9 1.5 8.7 49.165 <.001**Financial Services Auditing (such as CFSA / CIDA / CBA) 2.9 1.8 .0 .4 6.2 38.284 <.001**

Fellowship (such as FCA / FCCA / FCMA) 1.0 .7 .0 7.7 .4 142.223 <.001**

Certified Financial Analyst (such as CFA) 1.0 .4 .0 .4 .4 1.205 .877**

Other 12.7 22.1 24.1 16.6 13.1 35.763 <.001Number of Respondents 102 456 112 271 3139

**When the number of observations is less than 5 in a cell, the Chi-square results should be interpreted cautiously.

Age of Respondents’ Organizations(in Percentages)

Age Belgium Italy TheNetherlands

UK and Ireland

United States

0 to 5 years 2.1 21.5 6.6 9.3 4.3

6 to 10 years 8.2 14.8 12.6 10.5 6.7

11 to 15 years 7.2 7.7 3.9 5.9 5.0

16 to 20 years 5.2 3.3 1.0 6.7 4.6

21 to 25 years 1.0 3.8 1.0 7.6 3.7

26 to 30 years 6.2 6.8 4.9 4.6 5.0

31 to 35 years 3.1 1.2 4.9 4.6 3.4

36 to 40 years 3.1 2.6 7.8 6.3 4.6

41 to 45 years 1.0 .7 1.0 .4 1.6

46 to 50 years 12.4 4.0 6.8 5.9 5.7

51 or more years 50.5 33.6 49.5 38.2 55.4

Total 100.0 100.0 100.0 100.0 100.0

Number of Respondents

97 426 103 238 2783

χ2 =307.46, p<.001

Number of Years IAA Has Existed (in Percentages)

Number of Years Belgium ItalyThe

Netherlands UK and Ireland United States

0-5 36.4 44.8 17.2 17.9 24.0

6-10 21.6 25.3 25.0 24.6 16.3

11-15 12.5 8.6 10.6 11.2 11.0

16-20 8.0 6.3 6.7 13.8 12.5

21-25 9.1 4.8 7.7 8.5 9.2

26-30 5.7 4.3 13.5 5.8 8.5

31-35 .0 1.8 5.8 5.4 2.9

36-40 1.1 1.0 1.9 2.2 4.7

41-45 .0 .3 2.9 .4 .7

46-50 1.1 .8 2.9 7.1 4.4

More than 50 years 4.5 2.0 5.8 3.1 5.8

Total 100.0 100.0 100.0 100.0 100.0Number of Respondents 88 396 104 224 2592

χ2 =202.86, p<.001

Use and Adequacy of the

Standards and Practice Advisories

(RQ1) Organizations’ Use of The Standards In Whole or In Part

(in Percentages)

Position in the IAA Belgium Italy The Netherlands

UK and Ireland United States

χ2 pNumber of

Respondents

% Number of

Respondents

% Number of Respond

ents

% Number of

Respondents

% Number of

Respondents

%

CAE 21 90.5 126 81.7 26 88.5 68 85.3 753 86.3 2.412 .660

Audit Manager

30 93.3 96 85.4 30 70.0 75 89.3 700 86.7 8.814 .066

Audit Senior/Supervi-sor

22 68.2 76 81.6 30 60.0 81 74.1 873 83.6 17.504 .002

Audit Staff

22 90.9 113 86.7 17 88.2 35 62.9 523 83.7 12.868 .012

Other 5 100.0 27 85.2 8 37.5 9 77.8 218 76.1 9.433 .051

Overall Average

100 87.1 438 84.0 111 72.1 268 79.9 3067 84.4

(RQ2) Full and Partial Compliance with the Standards (in Percentages)

StandardBelgium Italy

The NetherlandsUK and Ireland

United Statesχ2 p

Full Partial Full Partial Full Partial Full Partial Full Partial

1000- Purpose, Authority, and Responsibility

71.1 23.7 62.3 30.0 61.8 25.0 64.2 21.4 69.2 13.5 120.953 <.001

1100- and Objectivity76.6 19.5 68.7 25.5 70.1 19.4 64.0 22.3 70.8 13.4 86.370 <.001

1200- Proficiency and Due Professional Care

61.0 35.1 58.5 36.9 68.7 14.9 66.5 20.2 69.1 14.5 141.578 <.001

1300- Quality Assurance and Improvement Program

38.7 40.0 28.6 40.2 31.3 41.8 38.6 39.2 48.6 24.5 159.730 <.001

2000- Managing the Internal Audit Activity

53.2 40.3 54.9 37.2 54.4 30.9 57.4 26.6 64.1 18.2 126.440 <.001

2100- Nature of work58.4 35.1 61.0 32.7 58.5 29.2 52.7 29.0 64.6 16.4 107.028 <.001

2200- Engagement Planning63.6 32.5 59.0 33.6 56.1 28.8 58.2 25.3 63.7 17.8 101.961 <.001

2300-Performing the Engagement

63.6 32.5 61.4 33.4 49.2 36.9 56.7 28.1 67.5 15.4 126.152 <.001

2400- Communicating Results68.4 28.9 65.4 29.1 59.7 28.4 62.8 21.5 69.3 14.4 94.343 <.001

2500- Monitoring Progress63.6 29.9 46.6 45.6 47.8 37.3 51.2 30.0 60.8 20.3 135.978 <.001

2600- Resolution of Management’s Acceptance of Risks

48.7 36.8 34.9 36.6 47.0 30.3 49.1 31.0 59.2 18.3 152.405 <.001

Overall Average 60.6 32.2 54.7 34.6 55.0 29.4 56.5 26.8 64.3 17.0

Standard Belgium ItalyThe

Netherlands UK and Ireland

United States

χ2 p

1000- Purpose, Authority, and Responsibility97.4 94.9 76.5 80.3 81.1 70.531 <.001

1100- and Objectivity94.9 95.5 80.6 82.5 83.1 58.564 <.001

1200- Proficiency and Due Professional Care97.5 96.8 76.5 82.5 81.9 66.003 <.001

1300- Quality Assurance and Improvement Program 85.5 73.9 76.5 72.0 74.9 70.305 <.0012000- Managing the Internal Audit Activity

96.2 92.8 79.4 77.2 79.9 63.008 <.0012100- Nature of work

92.2 93.0 76.9 72.6 78.0 59.926 <.0012200- Engagement Planning

92.2 94.8 78.5 77.1 79.1 65.249 <.0012300-Performing the Engagement

94.9 94.8 79.7 76.7 80.3 62.029 <.0012400- Communicating Results

94.8 94.8 80.3 79.0 80.8 53.527 <.0012500- Monitoring Progress

90.9 92.4 79.1 78.0 78.3 56.364 <.0012600- Resolution of Management’s Acceptance of Risks 79.2 73.3 73.1 72.8 75.2 57.346 <.001Overall Average

92.3 90.6 77.9 77.3 79.3

(RQ3) Adequacy of Guidance Provided by Each of the Standards (in Percentages)

(RQ4) Adequacy of Practice Advisories (in Percentages)

Practice Advisories Belgium ItalyThe

Netherlands UK and Ireland

United States

χ2 p

1000- Purpose, Authority, and Responsibility 82.8 91.7 73.6 72.2 82.9 27.968 <.0011100- and Objectivity 75.4 90.3 75.0 73.6 83.2 31.417 <.0011200- Proficiency and Due Professional Care 80.7 91.7 71.2 73.4 82.5 27.781 .0011300- Quality Assurance and Improvement Program 69.0 71.3 73.1 68.8 78.0 17.370 .0262000- Managing the Internal Audit Activity 78.6 89.4 71.2 69.8 81.6 34.533 <.0012100- Nature of work 78.9 89.8 71.2 68.3 80.7 28.523 <.0012200- Engagement Planning 71.9 91.1 65.4 66.7 81.3 61.466 <.0012300-Performing the Engagement 78.9 91.9 67.3 68.3 81.6 40.508 <.0012400- Communicating Results

78.6 90.2 74.5 71.0 82.1 28.623 <.0012500- Monitoring Progress 78.9 87.9 69.2 69.6 80.3 26.334 .0012600- Resolution of Management’s Acceptance of Risks 70.2 73.7 67.3 66.1 78.0 18.715 .016Overall Average 76.1 87.2 70.8 69.8 81.1

(RQ5) Reasons for Not Using the Standards In Whole or In Part* (in Percentages)

Reason Belgium ItalyThe

Netherlands UK and Ireland

United States

Average For All Respondents

χ2 p

Standards or Practice Advisories are too complex

10.6 7.5 5.0 2.0 3.2 3.8 32.968 <.001

Not appropriate for small organizations

14.9 11.3 12.0 6.0 8.9 9.2 10.091 .039

Too costly to comply 12.8 12.0 6.0 2.8 7.3 7.7 23.752 <.001Too time consuming 18.1 12.5 17.0 9.2 9.2 10.0 17.515 .002Superseded by local/government regulations or standards

6.4 7.9 14.0 19.3 7.4 8.4 46.667 <.001

Not appropriate for my industry

5.3 2.6 2.0 4.4 4.4 4.2 4.375 .358**

Compliance not supported by management / board

16.0 16.6 11.0 7.2 8.6 9.7 32.591 <.001

Not perceived as adding value by management / board

18.1 21.9 17.0 10.0 9.8 11.5 59.815 <.001

Inadequate internal audit staff

6.4 20.7 8.0 7.6 10.6 11.3 44.628 <.001

Compliance not expected in my country

6.4 3.1 5.0 4.0 .3 1.2 82.260 <.001

Other 10.6 8.4 23.0 15.3 13.6 13.3 18.408 .001Number of Respondents 94 416 100 249 2877 3736 <.001

*Note: Since respondents could mark all that apply, percentages do not add up to 100.**When the number of observations is less than 5 in a cell the Chi-square results should be interpreted cautiously.

(RQ5) Top Five Reasons for Lack of Compliance

• Not perceived as adding value by management/board (11.5%)

• Inadequate staff in the IAA (11.3%)• Too time consuming (10.0%)• Compliance not supported by

management/board (9.7%)• Not appropriate for small organizations (9.2%).

Using of the Standards in Whole or in Part Compared to the Number of Years Organization Has Had an

IAA (in Percentages)

Years with IAA

Belgium

Italy The Netherlands UK and Ireland

United States

# of Responde

nts

% UseStds.

# of Responde

nts

% UseStds.

# of Responde

nts

% UseStds.

# of Responde

nts

% UseStds.

# of Responde

nts

% UseStds.

0-5* 32 90.6 174 82.8 18 83.3 40 80.0 615 83.6

6 or more

**56 83.9 217 87.1 86 68.6 184 82.1 1954 85.7

Total 88 391 104 224 2569

χ2.775 1.439 1.573 .094 1.623

p .379 .230 .210 .760 .203

*χ2 = 1.607, p = .807 between counties** χ2 = 20.731, p<.001 between countries

Use of the Standards in Whole or in Part Compared to the Number of Full-Time Staff at Each Staff (in Percentages)

Belgium Italy The Netherlands UK and Ireland United States

Number of Staff

# of Responde

nts

% # of Responde

nts

% # of Responde

nts

% # of Responde

nts

% # 0f Responde

nts

%

1-3 25 88.0 96 68.8 17 52.9 38 68.4 665 77.34-6 12 58.3 74 87.8 15 86.7 49 79.6 530 84.07-9 6 100.0 35 77.1 3* 100.0 41 78.0 369 86.210-12 2* 100.0 21 85.7 4* 100.0 16 81.3 205 81.013-15 5 60.0 12 91.7 9 66.7 12 75.0 156 89.116-18 1* 100.0 17 82.4 8 75.0 7 85.7 110 89.119-21 7 85.7 7 85.7 3* 66.7 7 71.4 71 94.422-24 2* 100.0 5 100.0 1* .0 7 71.4 68 83.825 or more

31 93.5 127 92.9 44 75.0 73 90.4 706 90.8

Total 91 394 104 250 2880Chi-square

13.541 27.374 10.553 9.33 61.104

p .095 .001 .228 .315 <.001

Quality Assurance and Improvement Program

(RQ6) When IAA Was Last Subject to a Formal Internal Quality Assessment (in Percentages)

Timing Belgium Italy The Netherlands

UK and Ireland

United States

# of Respo

nd ents

% # of Respo

nd ents

% # of Respo

nd ents

% # of Respond ents

% # of Respo

nd ents

%

Done in past 5 years or scheduled to be completed prior to January 1, 2007.

39 50.6 122 35.0 45 55.6 127 69.4 1191 60.0

Never had one or not done in compliance with Standard 1311

38 49.4 227 65.0 36 44.4 56 30.6 794 40.0

Total Number of Respondents

77 100.0 349 100.0 81 100.0 183 100.0 1985 100.0

χ2 = 89.275, p<.001

(RQ7) When IAA Was Last Subject to a Formal External Quality Assessment (in Percentages)

Timing Belgium Italy The Netherlands UK and Ireland United States

# of Responde

nts

% # of Responde

nts

% # of Responde

nts

% # of Respond

ents

% # of Responde

nts

%

Done in past 5 years or scheduled to be completed prior to January 1, 2007.

35 47.9 79 27.1 35 43.8 126 68.5 1127 57.7

Never had one or not done in compliance with Standard 1312

38 52.1 213 72.9 45 56.3 58 31.5 827 42.3

Total Number of Respondents

73 100.0 292 100.0 80 100.0 184 100.0 1954 100.0

χ2 =115.997, p<.001

Conclusions

Conclusions

• Growth of the profession has been hastened by national regulation

• Respondents age, education, time in the profession, and years of IIA membership vary by country

• Age of organizations and of IAAs vary by country• There is consistency within each country for the use

of the Standards in whole or in part by staff level but variation by country

Conclusions, continued

• Significant differences exist between countries In the level of satisfaction with the adequacy of the guidance for all Standards and Practice Advisories, with the exception of Standards 1300 and 2600– UK and Ireland are least satisfied with the Standards and

Practice Advisories– Belgium is most satisfied with Standards guidance– Italy is most satisfied with the Practice Advisories

Conclusions, continued

• Compliance with Standard 1300, Quality Assurance and Improvement Program and Standard 2600, Resolution of Management’s Acceptance of Risks, is universally limited– US has highest full compliance– Italy has lowest full compliance

Conclusions, continued

• Convincing management and the board of the value of the Standards is a significant challenge for many IAAs

• Size of the audit staff affects usage of the Standards in Italy and the US

Thank You

Questions