Usage of Internal Auditing Standards by Companies in the United States and Select European Countries Priscilla Burnaby Bentley College USA and Susan Hass Simmons College USA

Priscilla A. Burnaby, CPA, PhD Bentley College Mohammad Abdolmohammadi, CPA, DBA Bentley College Susan Hass, Professor, CPA Simmons College Gerrit Sarens, PhD, CIA, CCSA Université Catholique de Louvain Marco Allegrini, PhD Università di Pisa Authors

Topics Introduction Research Method Demographic Information Use and Adequacy of the Standards and Practice Advisories Conclusions

Introduction

Objective To compare usage of the Standards and Practice Advisories in: – Belgium – Italy – The Netherlands – The United Kingdom and Ireland – The United States of America

Legislation Mandating the Internal Audit Activity Sarbanes Oxley Act of 2002 – All those that have stock on the NYSE King, 2002 – South Africa

Other Regulations Stock Exchanges -NYSE, 2004 Central Banks and Supervisory Authorities throughout Europe -Basel Committee, 2004 – Many countries -Banca dItalia, Italy -CBFA, 1997 – Belgium

European Corporate Governance Codes United Kingdom - Combined Code on Corporate Governance Italy - Corporate Governance Code Belgian - Corporate Governance Code The Dutch Corporate Governance Code

Research Questions RQ1: What is the level of usage of the Standards in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ2: Do Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States differ in their compliance with the Standards? RQ3: Is guidance for usage of the Standards adequate? RQ4: What is the level of usage of the Practice Advisories in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

Research Questions, continued RQ5: What are the reasons for lack of compliance with the Standards? RQ6: Are there differences in internal quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ7: Are there differences in external quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

Research Methodology Data was selected from the CBOK (2006) database Due to missing data for some of the questions in the CBOK survey, usable responses may vary slightly for each question analyzed Chi-square test

IIA Membership as of September 30, 2006 *Provided by The IIA. Affiliate IIA Membership as of 9/30/2006* Usable Responses Percentage of Membership Belgium1, Italy2, The Netherlands1, UK and Ireland7, United States54,6863, Total67,2974,0806.1

Demographic Information

Staff LevelBelgiumItaly The Netherlands UK and Ireland United States CAE Audit Manager Audit Seniors/ Supervisor Audit Staff Other Total Number of Respondents ,127 χ 2 =56.68, p<.001 Participants Staff Levels (In Percentages)

Age of Respondents (in Percentages) AgeBelgiumItaly The Netherlands UK and Ireland United States 25 years old or less to 34 years old to 44 years old to 54 years old to 64 years old years or older Total Number of Respondents χ 2 =56.88, p<.001

Highest Level of Respondents Education (in Percentages) Level of Education BelgiumItaly The Netherlands UK and Ireland United States Secondary / High School Education Bachelors / Diploma in Business Bachelors / Diploma in Fields Other than Business Masters / Graduate Degree / Diploma in Business Masters / Graduate Diploma in Fields Other than Business Doctoral Degree Other Total Number of Respondents χ 2 =967.89, p<.001

Number of Years as an IIA Member (in Percentages) Years BelgiumItaly The Netherlands UK and Ireland United States 5 or less to or more Total100.0 No. of Respondents χ 2 =119.26, p<.001

Respondents Professional Qualifications Type of Professional Qualification BelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p Internal Auditing (such as CIA / MIIA / PIIA) <.001 Information Systems Auditing (such as CISA / QiCA / CISM) <.001 Government Auditing / Finance (such as CIPFA / CGAP / CGFM) ** Control Self-Assessment (such as CCSA) <.001** Public Accounting / Chartered Accountancy (such as CA / CPA / ACCA / ACA) <.001 Management / General Accounting (such as CMA / CIMA / CGA) ** Accounting - technician level (such as CAT / AAT) <.001** Fraud Examination (such as CFE) <.001** Financial Services Auditing (such as CFSA / CIDA / CBA) <.001** Fellowship (such as FCA / FCCA / FCMA) <.001** Certified Financial Analyst (such as CFA) ** Other <.001 Number of Respondents **When the number of observations is less than 5 in a cell, the Chi-square results should be interpreted cautiously.

Age of Respondents Organizations (in Percentages) AgeBelgiumItaly The Netherlands UK and Ireland United States 0 to 5 years to 10 years to 15 years to 20 years to 25 years to 30 years to 35 years to 40 years to 45 years to 50 years or more years Total Number of Respondents χ 2 =307.46, p<.001

Number of Years IAA Has Existed (in Percentages) Number of Years BelgiumItaly The Netherlands UK and IrelandUnited States More than 50 years Total100.0 Number of Respondents χ 2 =202.86, p<.001

Use and Adequacy of the Standards and Practice Advisories

(RQ1) Organizations Use of The Standards In Whole or In Part (in Percentages) Position in the IAA Belgium ItalyThe Netherlands UK and Ireland United States χ2χ2 p Number of Responde nts % % Number of Respond ents % Number of Responde nts % Number of Responde nts % CAE Audit Manager Audit Senior/ Supervi- sor Audit Staff Other Overall Average

(RQ2) Full and Partial Compliance with the Standards (in Percentages) Standard Belgium Italy The Netherlands UK and Ireland United States χ2χ2 p FullPartialFullPartialFullPartialFullPartialFullPartial Purpose, Authority, and Responsibility < and Objectivity < Proficiency and Due Professional Care < Quality Assurance and Improvement Program < Managing the Internal Audit Activity < Nature of work < Engagement Planning < Performing the Engagement < Communicating Results < Monitoring Progress < Resolution of Managements Acceptance of Risks <.001 Overall Average

Standard BelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p Purpose, Authority, and Responsibility < and Objectivity < Proficiency and Due Professional Care < Quality Assurance and Improvement Program < Managing the Internal Audit Activity < Nature of work < Engagement Planning < Performing the Engagement < Communicating Results < Monitoring Progress < Resolution of Managements Acceptance of Risks <.001 Overall Average (RQ3) Adequacy of Guidance Provided by Each of the Standards (in Percentages)

(RQ4) Adequacy of Practice Advisories (in Percentages) Practice AdvisoriesBelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p Purpose, Authority, and Responsibility < and Objectivity < Proficiency and Due Professional Care Quality Assurance and Improvement Program Managing the Internal Audit Activity < Nature of work < Engagement Planning < Performing the Engagement < Communicating Results < Monitoring Progress Resolution of Managements Acceptance of Risks Overall Average

(RQ5) Reasons for Not Using the Standards In Whole or In Part* (in Percentages) Reason BelgiumItaly The Netherlands UK and Ireland United States Average For All Respondents χ2χ2 p Standards or Practice Advisories are too complex <.001 Not appropriate for small organizations Too costly to comply <.001 Too time consuming Superseded by local/government regulations or standards <.001 Not appropriate for my industry ** Compliance not supported by management / board <.001 Not perceived as adding value by management / board <.001 Inadequate internal audit staff <.001 Compliance not expected in my country <.001 Other Number of Respondents <.001 *Note: Since respondents could mark all that apply, percentages do not add up to 100. **When the number of observations is less than 5 in a cell the Chi-square results should be interpreted cautiously.

(RQ5) Top Five Reasons for Lack of Compliance Not perceived as adding value by management/board (11.5%) Inadequate staff in the IAA (11.3%) Too time consuming (10.0%) Compliance not supported by management/board (9.7%) Not appropriate for small organizations (9.2%).

Using of the Standards in Whole or in Part Compared to the Number of Years Organization Has Had an IAA (in Percentages) Years with IAA Belgium ItalyThe Netherlands UK and Ireland United States # of Responde nts % Use Stds. # of Responde nts % Use Stds. # of Responde nts % Use Stds. # of Responde nts % Use Stds. # of Responde nts % Use Stds. 0-5* or more ** Total χ2χ p *χ 2 = 1.607, p =.807 between counties ** χ 2 = , p<.001 between countries

Use of the Standards in Whole or in Part Compared to the Number of Full-Time Staff at Each Staff (in Percentages) BelgiumItalyThe NetherlandsUK and IrelandUnited States Number of Staff # of Responde nts % % % % # 0f Responde nts % * * * * * * * or more Total Chi- square p <.001

Quality Assurance and Improvement Program

(RQ6) When IAA Was Last Subject to a Formal Internal Quality Assessment (in Percentages) TimingBelgiumItaly The Netherlands UK and Ireland United States # of Respo nd ents % % % % % Done in past 5 years or scheduled to be completed prior to January 1, Never had one or not done in compliance with Standard Total Number of Respondents χ 2 = , p<.001

(RQ7) When IAA Was Last Subject to a Formal External Quality Assessment (in Percentages) TimingBelgiumItalyThe NetherlandsUK and IrelandUnited States # of Responde nts % % % % % Done in past 5 years or scheduled to be completed prior to January 1, Never had one or not done in compliance with Standard Total Number of Respondents χ 2 = , p<.001

Conclusions

Growth of the profession has been hastened by national regulation Respondents age, education, time in the profession, and years of IIA membership vary by country Age of organizations and of IAAs vary by country There is consistency within each country for the use of the Standards in whole or in part by staff level but variation by country

Conclusions, continued Significant differences exist between countries In the level of satisfaction with the adequacy of the guidance for all Standards and Practice Advisories, with the exception of Standards 1300 and 2600 – UK and Ireland are least satisfied with the Standards and Practice Advisories – Belgium is most satisfied with Standards guidance – Italy is most satisfied with the Practice Advisories

Conclusions, continued Compliance with Standard 1300, Quality Assurance and Improvement Program and Standard 2600, Resolution of Managements Acceptance of Risks, is universally limited – US has highest full compliance – Italy has lowest full compliance

Conclusions, continued Convincing management and the board of the value of the Standards is a significant challenge for many IAAs Size of the audit staff affects usage of the Standards in Italy and the US

Thank You Questions