1. Usage of Internal Auditing Standards by Companies in the United States and Select European Countries Priscilla Burnaby Bentley College USA and Susan Hass Simmons College USA

2. Priscilla A. Burnaby, CPA, PhD Bentley College Mohammad Abdolmohammadi, CPA, DBA Bentley College Susan Hass, Professor, CPA Simmons College Gerrit Sarens, PhD, CIA, CCSA Université Catholique de Louvain Marco Allegrini, PhD Università di Pisa Authors

3. Topics Introduction Research Method Demographic Information Use and Adequacy of the Standards and Practice Advisories Conclusions

4. Introduction

5. Objective To compare usage of the Standards and Practice Advisories in: – Belgium – Italy – The Netherlands – The United Kingdom and Ireland – The United States of America

6. Legislation Mandating the Internal Audit Activity Sarbanes Oxley Act of 2002 – All those that have stock on the NYSE King, 2002 – South Africa

7. Other Regulations Stock Exchanges -NYSE, 2004 Central Banks and Supervisory Authorities throughout Europe -Basel Committee, 2004 – Many countries -Banca dItalia, 1999 - Italy -CBFA, 1997 – Belgium

8. European Corporate Governance Codes United Kingdom - Combined Code on Corporate Governance Italy - Corporate Governance Code Belgian - Corporate Governance Code The Dutch Corporate Governance Code

9. Research Questions RQ1: What is the level of usage of the Standards in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ2: Do Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States differ in their compliance with the Standards? RQ3: Is guidance for usage of the Standards adequate? RQ4: What is the level of usage of the Practice Advisories in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

10. Research Questions, continued RQ5: What are the reasons for lack of compliance with the Standards? RQ6: Are there differences in internal quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ7: Are there differences in external quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

11. Research Methodology Data was selected from the CBOK (2006) database Due to missing data for some of the questions in the CBOK survey, usable responses may vary slightly for each question analyzed Chi-square test

12. IIA Membership as of September 30, 2006 *Provided by The IIA. Affiliate IIA Membership as of 9/30/2006* Usable Responses Percentage of Membership Belgium1,1541028.8 Italy2,53145618.0 The Netherlands1,7411126.4 UK and Ireland7,1852713.8 United States54,6863,1395.7 Total67,2974,0806.1

13. Demographic Information

14. Staff LevelBelgiumItaly The Netherlands UK and Ireland United States CAE 20.728.523.225.124.3 Audit Manager 29.721.426.827.822.6 Audit Seniors/ Supervisor 21.817.226.830.028.2 Audit Staff 22.825.815.213.017.2 Other 5.07.18.04.17.7 Total 100.0 Number of Respondents 1014531122703,127 χ 2 =56.68, p<.001 Participants Staff Levels (In Percentages)

15. Age of Respondents (in Percentages) AgeBelgiumItaly The Netherlands UK and Ireland United States 25 years old or less 0.00.31.22.24.8 26 to 34 years old 25.026.520.219.323.8 35 to 44 years old 44.333.738.139.932.5 45 to 54 years old 22.731.125.032.325.9 55 to 64 years old 8.07.514.36.312.6 65 years or older 0.00.91.20.00.4 Total 100.0 Number of Respondents 88347842232529 χ 2 =56.88, p<.001

16. Highest Level of Respondents Education (in Percentages) Level of Education BelgiumItaly The Netherlands UK and Ireland United States Secondary / High School Education 0.020.60.823.41.3 Bachelors / Diploma in Business 8.942.85.419.649.9 Bachelors / Diploma in Fields Other than Business 4.017.54.520.711.9 Masters / Graduate Degree / Diploma in Business 57.413.756.320.030.1 Masters / Graduate Diploma in Fields Other than Business 26.73.820.512.25.5 Doctoral Degree 2.0.78.01.5.9 Other 1.0.94.52.6.4 Total 100.0 Number of Respondents 1014511122703129 χ 2 =967.89, p<.001

17. Number of Years as an IIA Member (in Percentages) Years BelgiumItaly The Netherlands UK and Ireland United States 5 or less68.374.464.042.556.1 6 to 1019.818.821.633.620.2 11 or more11.96.814.423.923.7 Total100.0 No. of Respondents 1014531112683121 χ 2 =119.26, p<.001

18. Respondents Professional Qualifications Type of Professional Qualification BelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p Internal Auditing (such as CIA / MIIA / PIIA) 55.931.148.262.440.680.355<.001 Information Systems Auditing (such as CISA / QiCA / CISM) 9.83.920.514.0 42.918<.001 Government Auditing / Finance (such as CIPFA / CGAP / CGFM).02.04.57.04.916.404.003** Control Self-Assessment (such as CCSA) 8.812.32.71.13.0100.076<.001** Public Accounting / Chartered Accountancy (such as CA / CPA / ACCA / ACA) 10.812.347.317.736.3166.812<.001 Management / General Accounting (such as CMA / CIMA / CGA) 2.9.72.75.52.218.389.001** Accounting - technician level (such as CAT / AAT) 2.04.61.88.5.1191.144<.001** Fraud Examination (such as CFE) 8.82.0.91.58.749.165<.001** Financial Services Auditing (such as CFSA / CIDA / CBA) 2.91.8.0.46.238.284<.001** Fellowship (such as FCA / FCCA / FCMA) 1.0.7.07.7.4142.223<.001** Certified Financial Analyst (such as CFA) 1.0.4.0.4 1.205.877** Other 12.722.124.116.613.135.763<.001 Number of Respondents 1024561122713139 **When the number of observations is less than 5 in a cell, the Chi-square results should be interpreted cautiously.

19. Age of Respondents Organizations (in Percentages) AgeBelgiumItaly The Netherlands UK and Ireland United States 0 to 5 years 2.121.56.69.34.3 6 to 10 years 8.214.812.610.56.7 11 to 15 years 7.27.73.95.95.0 16 to 20 years 5.23.31.06.74.6 21 to 25 years 1.03.81.07.63.7 26 to 30 years 6.26.84.94.65.0 31 to 35 years 3.11.24.94.63.4 36 to 40 years 3.12.67.86.34.6 41 to 45 years 1.0.71.0.41.6 46 to 50 years 12.44.06.85.95.7 51 or more years 50.533.649.538.255.4 Total 100.0 Number of Respondents 974261032382783 χ 2 =307.46, p<.001

20. Number of Years IAA Has Existed (in Percentages) Number of Years BelgiumItaly The Netherlands UK and IrelandUnited States 0-536.444.817.217.924.0 6-1021.625.325.024.616.3 11-1512.58.610.611.211.0 16-208.06.36.713.812.5 21-259.14.87.78.59.2 26-305.74.313.55.88.5 31-35.01.85.85.42.9 36-401.11.01.92.24.7 41-45.0.32.9.4.7 46-501.1.82.97.14.4 More than 50 years4.52.05.83.15.8 Total100.0 Number of Respondents883961042242592 χ 2 =202.86, p<.001

21. Use and Adequacy of the Standards and Practice Advisories

22. (RQ1) Organizations Use of The Standards In Whole or In Part (in Percentages) Position in the IAA Belgium ItalyThe Netherlands UK and Ireland United States χ2χ2 p Number of Responde nts % % Number of Respond ents % Number of Responde nts % Number of Responde nts % CAE2190.512681.72688.56885.375386.32.412.660 Audit Manager 3093.39685.43070.07589.370086.78.814.066 Audit Senior/ Supervi- sor 2268.27681.63060.08174.187383.617.504.002 Audit Staff 2290.911386.71788.23562.952383.712.868.012 Other5100.02785.2837.5977.821876.19.433.051 Overall Average 10087.143884.011172.126879.9306784.4

23. (RQ2) Full and Partial Compliance with the Standards (in Percentages) Standard Belgium Italy The Netherlands UK and Ireland United States χ2χ2 p FullPartialFullPartialFullPartialFullPartialFullPartial 1000- Purpose, Authority, and Responsibility 71.123.762.330.061.825.064.221.469.213.5120.953<.001 1100- and Objectivity 76.619.568.725.570.119.464.022.370.813.486.370<.001 1200- Proficiency and Due Professional Care 61.035.158.536.968.714.966.520.269.114.5141.578<.001 1300- Quality Assurance and Improvement Program 38.740.028.640.231.341.838.639.248.624.5159.730<.001 2000- Managing the Internal Audit Activity 53.240.354.937.254.430.957.426.664.118.2126.440<.001 2100- Nature of work 58.435.161.032.758.529.252.729.064.616.4107.028<.001 2200- Engagement Planning 63.632.559.033.656.128.858.225.363.717.8101.961<.001 2300-Performing the Engagement 63.632.561.433.449.236.956.728.167.515.4126.152<.001 2400- Communicating Results 68.428.965.429.159.728.462.821.569.314.494.343<.001 2500- Monitoring Progress 63.629.946.645.647.837.351.230.060.820.3135.978<.001 2600- Resolution of Managements Acceptance of Risks 48.736.834.936.647.030.349.131.059.218.3152.405<.001 Overall Average 60.632.254.734.655.029.456.526.864.317.0

24. Standard BelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p 1000- Purpose, Authority, and Responsibility 97.494.976.580.381.170.531<.001 1100- and Objectivity 94.995.580.682.583.158.564<.001 1200- Proficiency and Due Professional Care 97.596.876.582.581.966.003<.001 1300- Quality Assurance and Improvement Program 85.573.976.572.074.970.305<.001 2000- Managing the Internal Audit Activity 96.292.879.477.279.963.008<.001 2100- Nature of work 92.293.076.972.678.059.926<.001 2200- Engagement Planning 92.294.878.577.179.165.249<.001 2300-Performing the Engagement 94.994.879.776.780.362.029<.001 2400- Communicating Results 94.8 80.379.080.853.527<.001 2500- Monitoring Progress 90.992.479.178.078.356.364<.001 2600- Resolution of Managements Acceptance of Risks 79.273.373.172.875.257.346<.001 Overall Average 92.390.677.977.379.3 (RQ3) Adequacy of Guidance Provided by Each of the Standards (in Percentages)

25. (RQ4) Adequacy of Practice Advisories (in Percentages) Practice AdvisoriesBelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p 1000- Purpose, Authority, and Responsibility 82.891.773.672.282.927.968<.001 1100- and Objectivity 75.490.375.073.683.231.417<.001 1200- Proficiency and Due Professional Care 80.791.771.273.482.527.781.001 1300- Quality Assurance and Improvement Program 69.071.373.168.878.017.370.026 2000- Managing the Internal Audit Activity 78.689.471.269.881.634.533<.001 2100- Nature of work 78.989.871.268.380.728.523<.001 2200- Engagement Planning 71.991.165.466.781.361.466<.001 2300-Performing the Engagement 78.991.967.368.381.640.508<.001 2400- Communicating Results 78.690.274.571.082.128.623<.001 2500- Monitoring Progress 78.987.969.269.680.326.334.001 2600- Resolution of Managements Acceptance of Risks 70.273.767.366.178.018.715.016 Overall Average 76.187.270.869.881.1

26. (RQ5) Reasons for Not Using the Standards In Whole or In Part* (in Percentages) Reason BelgiumItaly The Netherlands UK and Ireland United States Average For All Respondents χ2χ2 p Standards or Practice Advisories are too complex 10.67.55.02.03.23.832.968<.001 Not appropriate for small organizations 14.911.312.06.08.99.210.091.039 Too costly to comply12.812.06.02.87.37.723.752<.001 Too time consuming18.112.517.09.2 10.017.515.002 Superseded by local/government regulations or standards 6.47.914.019.37.48.446.667<.001 Not appropriate for my industry 5.32.62.04.4 4.24.375.358** Compliance not supported by management / board 16.016.611.07.28.69.732.591<.001 Not perceived as adding value by management / board 18.121.917.010.09.811.559.815<.001 Inadequate internal audit staff 6.420.78.07.610.611.344.628<.001 Compliance not expected in my country 6.43.15.04.0.31.282.260<.001 Other10.68.423.015.313.613.318.408.001 Number of Respondents9441610024928773736<.001 *Note: Since respondents could mark all that apply, percentages do not add up to 100. **When the number of observations is less than 5 in a cell the Chi-square results should be interpreted cautiously.

27. (RQ5) Top Five Reasons for Lack of Compliance Not perceived as adding value by management/board (11.5%) Inadequate staff in the IAA (11.3%) Too time consuming (10.0%) Compliance not supported by management/board (9.7%) Not appropriate for small organizations (9.2%).

28. Using of the Standards in Whole or in Part Compared to the Number of Years Organization Has Had an IAA (in Percentages) Years with IAA Belgium ItalyThe Netherlands UK and Ireland United States # of Responde nts % Use Stds. # of Responde nts % Use Stds. # of Responde nts % Use Stds. # of Responde nts % Use Stds. # of Responde nts % Use Stds. 0-5* 3290.617482.81883.34080.061583.6 6 or more ** 5683.921787.18668.618482.1195485.7 Total883911042242569 χ2χ2.7751.4391.573.0941.623 p.379.230.210.760.203 *χ 2 = 1.607, p =.807 between counties ** χ 2 = 20.731, p<.001 between countries

29. Use of the Standards in Whole or in Part Compared to the Number of Full-Time Staff at Each Staff (in Percentages) BelgiumItalyThe NetherlandsUK and IrelandUnited States Number of Staff # of Responde nts % % % % # 0f Responde nts % 1-3 2588.09668.81752.93868.466577.3 4-6 1258.37487.81586.74979.653084.0 7-9 6100.03577.13*100.04178.036986.2 10-12 2*100.02185.74*100.01681.320581.0 13-15 560.01291.7966.71275.015689.1 16-18 1*100.01782.4875.0785.711089.1 19-21 785.77 3*66.7771.47194.4 22-24 2*100.05 1*.0771.46883.8 25 or more 3193.512792.94475.07390.470690.8 Total 91394 104 250 2880 Chi- square 13.54127.37410.5539.3361.104 p.095.001.228.315<.001

30. Quality Assurance and Improvement Program

31. (RQ6) When IAA Was Last Subject to a Formal Internal Quality Assessment (in Percentages) TimingBelgiumItaly The Netherlands UK and Ireland United States # of Respo nd ents % % % % % Done in past 5 years or scheduled to be completed prior to January 1, 2007. 3950.612235.04555.612769.4119160.0 Never had one or not done in compliance with Standard 1311 3849.422765.03644.45630.679440.0 Total Number of Respondents 77100.0349100.081100.0183100.01985100.0 χ 2 = 89.275, p<.001

32. (RQ7) When IAA Was Last Subject to a Formal External Quality Assessment (in Percentages) TimingBelgiumItalyThe NetherlandsUK and IrelandUnited States # of Responde nts % % % % % Done in past 5 years or scheduled to be completed prior to January 1, 2007. 3547.97927.13543.812668.5112757.7 Never had one or not done in compliance with Standard 1312 3852.121372.94556.35831.582742.3 Total Number of Respondents 73100.0292100.080100.0184100.01954100.0 χ 2 =115.997, p<.001

33. Conclusions

34. Growth of the profession has been hastened by national regulation Respondents age, education, time in the profession, and years of IIA membership vary by country Age of organizations and of IAAs vary by country There is consistency within each country for the use of the Standards in whole or in part by staff level but variation by country

35. Conclusions, continued Significant differences exist between countries In the level of satisfaction with the adequacy of the guidance for all Standards and Practice Advisories, with the exception of Standards 1300 and 2600 – UK and Ireland are least satisfied with the Standards and Practice Advisories – Belgium is most satisfied with Standards guidance – Italy is most satisfied with the Practice Advisories

36. Conclusions, continued Compliance with Standard 1300, Quality Assurance and Improvement Program and Standard 2600, Resolution of Managements Acceptance of Risks, is universally limited – US has highest full compliance – Italy has lowest full compliance

37. Conclusions, continued Convincing management and the board of the value of the Standards is a significant challenge for many IAAs Size of the audit staff affects usage of the Standards in Italy and the US

38. Thank You Questions