1. Priscilla A. Burnaby, CPA, PhD Bentley College Mohammad Abdolmohammadi, CPA, DBA Bentley College Susan Hass, Professor, CPA Simmons College Gerrit Sarens, PhD, CIA, CCSA Université Catholique de Louvain Marco Allegrini, PhD Università di Pisa Usage of Internal Auditing Standards by Companies in the United States and Select European Countries

2. Objectives To compare usage of the IIAs Standards and Practice Advisories in: – Belgium – Italy – The Netherlands – The United Kingdom and Ireland – The United States of America

3. Regulations Requiring Internal Audit Activities Laws – Sarbanes Oxley Act of 2002 – All those that have stock on the NYSE – King, 2002 – South Africa Stock Exchanges – NYSE, 2004 Central Banks and Supervisory Authorities throughout Europe – Basel Committee, 2004 – Many countries – Banca dItalia, 1999 – Italy – CBFA, 1997 – Belgium European Corporate Governance Codes – United Kingdom - Combined Code on Corporate Governance – Italy - Corporate Governance Code – Belgian - Corporate Governance Code – The Dutch Corporate Governance Code

4. Research Questions RQ1: What is the level of usage of the Standards in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ2: Do Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States differ in their compliance with the Standards? RQ3: Is guidance for usage of the Standards adequate? RQ4: What is the level of usage of the Practice Advisories in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ5: What are the reasons for lack of compliance with the Standards? RQ6: Are there differences in internal quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ7: Are there differences in external quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

5. Research Methodology Data was selected from the CBOK (2006) database Due to missing data for some of the questions in the CBOK survey, usable responses may vary slightly for each question analyzed Chi-square test

6. IIA Membership as of September 30, 2006 *Provided by The IIA. Affiliate IIA Membership as of 9/30/2006* Usable Responses Percentage of Membership Belgium1,1541028.8 Italy2,53145618.0 The Netherlands1,7411126.4 UK and Ireland7,1852713.8 United States54,6863,1395.7 Total67,2974,0806.1

7. Staff LevelBelgiumItaly The Netherlands UK and Ireland United States CAE 20.728.523.225.124.3 Audit Manager 29.721.426.827.822.6 Audit Seniors/ Supervisor 21.817.226.830.028.2 Audit Staff 22.825.815.213.017.2 Other 5.07.18.04.17.7 Total 100.0 Number of Respondents 1014531122703,127 χ 2 =56.68, p<.001 Participants Staff Levels (In Percentages)

8. Age of Respondents (in Percentages) AgeBelgiumItaly The Netherlands UK and Ireland United States 25 years old or less 0.00.31.22.24.8 26 to 34 years old 25.026.520.219.323.8 35 to 44 years old 44.333.738.139.932.5 45 to 54 years old 22.731.125.032.325.9 55 to 64 years old 8.07.514.36.312.6 65 years or older 0.00.91.20.00.4 Total 100.0 Number of Respondents 88347842232529 χ 2 =56.88, p<.001

9. Highest Level of Respondents Education (in Percentages) Level of Education BelgiumItaly The Netherlands UK and Ireland United States Secondary / High School Education 0.020.60.823.41.3 Bachelors / Diploma in Business 8.942.85.419.649.9 Bachelors / Diploma in Fields Other than Business 4.017.54.520.711.9 Masters / Graduate Degree / Diploma in Business 57.413.756.320.030.1 Masters / Graduate Diploma in Fields Other than Business 26.73.820.512.25.5 Doctoral Degree 2.0.78.01.5.9 Other 1.0.94.52.6.4 Total 100.0 Number of Respondents 1014511122703129 χ 2 =967.89, p<.001

10. Number of Years as an IIA Member (in Percentages) Years BelgiumItaly The Netherlands UK and Ireland United States 5 or less68.374.464.042.556.1 6 to 1019.818.821.633.620.2 11 or more11.96.814.423.923.7 Total100.0 No. of Respondents 1014531112683121 χ 2 =119.26, p<.001

11. Respondents Professional Qualifications Type of Professional Qualification BelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p Internal Auditing (such as CIA / MIIA / PIIA) 55.931.148.262.440.680.355<.001 Information Systems Auditing (such as CISA / QiCA / CISM) 9.83.920.514.0 42.918<.001 Government Auditing / Finance (such as CIPFA / CGAP / CGFM).02.04.57.04.916.404.003** Control Self-Assessment (such as CCSA) 8.812.32.71.13.0100.076<.001** Public Accounting / Chartered Accountancy (such as CA / CPA / ACCA / ACA) 10.812.347.317.736.3166.812<.001 Management / General Accounting (such as CMA / CIMA / CGA) 2.9.72.75.52.218.389.001** Accounting - technician level (such as CAT / AAT) 2.04.61.88.5.1191.144<.001** Fraud Examination (such as CFE) 8.82.0.91.58.749.165<.001** Financial Services Auditing (such as CFSA / CIDA / CBA) 2.91.8.0.46.238.284<.001** Fellowship (such as FCA / FCCA / FCMA) 1.0.7.07.7.4142.223<.001** Certified Financial Analyst (such as CFA) 1.0.4.0.4 1.205.877** Other 12.722.124.116.613.135.763<.001 Number of Respondents 1024561122713139 **When the number of observations is less than 5 in a cell, the Chi-square results should be interpreted cautiously.

12. Age of Respondents Organizations (in Percentages) AgeBelgiumItaly The Netherlands UK and Ireland United States 0 to 5 years 2.121.56.69.34.3 6 to 10 years 8.214.812.610.56.7 11 to 15 years 7.27.73.95.95.0 16 to 20 years 5.23.31.06.74.6 21 to 25 years 1.03.81.07.63.7 26 to 30 years 6.26.84.94.65.0 31 to 35 years 3.11.24.94.63.4 36 to 40 years 3.12.67.86.34.6 41 to 45 years 1.0.71.0.41.6 46 to 50 years 12.44.06.85.95.7 51 or more years 50.533.649.538.255.4 Total 100.0 Number of Respondents 974261032382783 χ 2 =307.46, p<.001

13. Number of Years IAA Has Existed (in Percentages) Number of Years BelgiumItaly The Netherlands UK and IrelandUnited States 0-536.444.817.217.924.0 6-1021.625.325.024.616.3 11-1512.58.610.611.211.0 16-208.06.36.713.812.5 21-259.14.87.78.59.2 26-305.74.313.55.88.5 31-35.01.85.85.42.9 36-401.11.01.92.24.7 41-45.0.32.9.4.7 46-501.1.82.97.14.4 More than 50 years4.52.05.83.15.8 Total100.0 Number of Respondents883961042242592 χ 2 =202.86, p<.001

14. (RQ1) Organizations Use of The Standards In Whole or In Part (in Percentages) Position in the IAA Belgium ItalyThe Netherlands UK and Ireland United States χ2χ2 p Number of Responde nts % % Number of Respond ents % Number of Responde nts % Number of Responde nts % CAE2190.512681.72688.56885.375386.32.412.660 Audit Manager 3093.39685.43070.07589.370086.78.814.066 Audit Senior/ Supervi- sor 2268.27681.63060.08174.187383.617.504.002 Audit Staff 2290.911386.71788.23562.952383.712.868.012 Other5100.02785.2837.5977.821876.19.433.051 Overall Average 10087.143884.011172.126879.9306784.4

15. (RQ2) Full and Partial Compliance with the Standards (in Percentages) Standard Belgium Italy The Netherlands UK and Ireland United States χ2χ2 p FullPartialFullPartialFullPartialFullPartialFullPartial 1000- Purpose, Authority, and Responsibility 71.123.762.330.061.825.064.221.469.213.5120.953<.001 1100- and Objectivity 76.619.568.725.570.119.464.022.370.813.486.370<.001 1200- Proficiency and Due Professional Care 61.035.158.536.968.714.966.520.269.114.5141.578<.001 1300- Quality Assurance and Improvement Program 38.740.028.640.231.341.838.639.248.624.5159.730<.001 2000- Managing the Internal Audit Activity 53.240.354.937.254.430.957.426.664.118.2126.440<.001 2100- Nature of work 58.435.161.032.758.529.252.729.064.616.4107.028<.001 2200- Engagement Planning 63.632.559.033.656.128.858.225.363.717.8101.961<.001 2300-Performing the Engagement 63.632.561.433.449.236.956.728.167.515.4126.152<.001 2400- Communicating Results 68.428.965.429.159.728.462.821.569.314.494.343<.001 2500- Monitoring Progress 63.629.946.645.647.837.351.230.060.820.3135.978<.001 2600- Resolution of Managements Acceptance of Risks 48.736.834.936.647.030.349.131.059.218.3152.405<.001 Overall Average 60.632.254.734.655.029.456.526.864.317.0

16. Standard BelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p 1000- Purpose, Authority, and Responsibility 97.494.976.580.381.170.531<.001 1100- and Objectivity 94.995.580.682.583.158.564<.001 1200- Proficiency and Due Professional Care 97.596.876.582.581.966.003<.001 1300- Quality Assurance and Improvement Program 85.573.976.572.074.970.305<.001 2000- Managing the Internal Audit Activity 96.292.879.477.279.963.008<.001 2100- Nature of work 92.293.076.972.678.059.926<.001 2200- Engagement Planning 92.294.878.577.179.165.249<.001 2300-Performing the Engagement 94.994.879.776.780.362.029<.001 2400- Communicating Results 94.8 80.379.080.853.527<.001 2500- Monitoring Progress 90.992.479.178.078.356.364<.001 2600- Resolution of Managements Acceptance of Risks 79.273.373.172.875.257.346<.001 Overall Average 92.390.677.977.379.3 (RQ3) Adequacy of Guidance Provided by Each of the Standards (in Percentages)

17. (RQ4) Adequacy of Practice Advisories (in Percentages) Practice AdvisoriesBelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p 1000- Purpose, Authority, and Responsibility 82.891.773.672.282.927.968<.001 1100- and Objectivity 75.490.375.073.683.231.417<.001 1200- Proficiency and Due Professional Care 80.791.771.273.482.527.781.001 1300- Quality Assurance and Improvement Program 69.071.373.168.878.017.370.026 2000- Managing the Internal Audit Activity 78.689.471.269.881.634.533<.001 2100- Nature of work 78.989.871.268.380.728.523<.001 2200- Engagement Planning 71.991.165.466.781.361.466<.001 2300-Performing the Engagement 78.991.967.368.381.640.508<.001 2400- Communicating Results 78.690.274.571.082.128.623<.001 2500- Monitoring Progress 78.987.969.269.680.326.334.001 2600- Resolution of Managements Acceptance of Risks 70.273.767.366.178.018.715.016 Overall Average 76.187.270.869.881.1

18. (RQ5) Top Five Reasons for Lack of Compliance Not perceived as adding value by management/board (11.5%) Inadequate staff in the IAA (11.3%) Too time consuming (10.0%) Compliance not supported by management/board (9.7%) Not appropriate for small organizations (9.2%).

19. Use of the Standards in Whole or in Part Compared to the Number of Full-Time Staff at Each Staff (in Percentages) BelgiumItalyThe NetherlandsUK and IrelandUnited States Number of Staff # of Responde nts % % % % # 0f Responde nts % 1-3 2588.09668.81752.93868.466577.3 4-6 1258.37487.81586.74979.653084.0 7-9 6100.03577.13*100.04178.036986.2 10-12 2*100.02185.74*100.01681.320581.0 13-15 560.01291.7966.71275.015689.1 16-18 1*100.01782.4875.0785.711089.1 19-21 785.77 3*66.7771.47194.4 22-24 2*100.05 1*.0771.46883.8 25 or more 3193.512792.94475.07390.470690.8 Total 91394 104 250 2880 Chi- square 13.54127.37410.5539.3361.104 p.095.001.228.315<.001

20. (RQ6) When IAA Was Last Subject to a Formal Internal Quality Assessment (in Percentages) TimingBelgiumItaly The Netherlands UK and Ireland United States # of Respo nd ents % % % % % Done in past 5 years or scheduled to be completed prior to January 1, 2007. 3950.612235.04555.612769.4119160.0 Never had one or not done in compliance with Standard 1311 3849.422765.03644.45630.679440.0 Total Number of Respondents 77100.0349100.081100.0183100.01985100.0 χ 2 = 89.275, p<.001

21. (RQ7) When IAA Was Last Subject to a Formal External Quality Assessment (in Percentages) TimingBelgiumItalyThe NetherlandsUK and IrelandUnited States # of Responde nts % % % % % Done in past 5 years or scheduled to be completed prior to January 1, 2007. 3547.97927.13543.812668.5112757.7 Never had one or not done in compliance with Standard 1312 3852.121372.94556.35831.582742.3 Total Number of Respondents 73100.0292100.080100.0184100.01954100.0 χ 2 =115.997, p<.001

22. Conclusions Growth of the profession has been hastened by national regulation Respondents age, education, time in the profession, and years of IIA membership vary by country Age of organizations and of IAAs vary by country

23. Conclusions, continued There is consistency within each country for the use of the Standards in whole or in part by staff level but variation by country Significant differences exist between countries In the level of satisfaction with the adequacy of the guidance for all Standards and Practice Advisories, with the exception of Standards 1300 and 2600 – UK and Ireland are least satisfied with the Standards and Practice Advisories – Belgium is most satisfied with Standards guidance – Italy is most satisfied with the Practice Advisories

24. Conclusions, continued Compliance with Standard 1300, Quality Assurance and Improvement Program and Standard 2600, Resolution of Managements Acceptance of Risks, is universally limited – US has highest full compliance – Italy has lowest full compliance Convincing management and the board of the value of the Standards is a significant challenge for many IAAs Size of the audit staff affects usage of the Standards in Italy and the US