Priscilla A. Burnaby, CPA, PhD Bentley College Mohammad Abdolmohammadi, CPA, DBA Bentley College Susan Hass, Professor, CPA Simmons College Gerrit Sarens, PhD, CIA, CCSA Université Catholique de Louvain Marco Allegrini, PhD Università di Pisa Usage of Internal Auditing Standards by Companies in the United States and Select European Countries

Objectives To compare usage of the IIAs Standards and Practice Advisories in: – Belgium – Italy – The Netherlands – The United Kingdom and Ireland – The United States of America

Regulations Requiring Internal Audit Activities Laws – Sarbanes Oxley Act of 2002 – All those that have stock on the NYSE – King, 2002 – South Africa Stock Exchanges – NYSE, 2004 Central Banks and Supervisory Authorities throughout Europe – Basel Committee, 2004 – Many countries – Banca dItalia, 1999 – Italy – CBFA, 1997 – Belgium European Corporate Governance Codes – United Kingdom - Combined Code on Corporate Governance – Italy - Corporate Governance Code – Belgian - Corporate Governance Code – The Dutch Corporate Governance Code

Research Questions RQ1: What is the level of usage of the Standards in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ2: Do Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States differ in their compliance with the Standards? RQ3: Is guidance for usage of the Standards adequate? RQ4: What is the level of usage of the Practice Advisories in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ5: What are the reasons for lack of compliance with the Standards? RQ6: Are there differences in internal quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States? RQ7: Are there differences in external quality and improvement programs in Belgium, Italy, The Netherlands, the United Kingdom and Ireland, and the United States?

Research Methodology Data was selected from the CBOK (2006) database Due to missing data for some of the questions in the CBOK survey, usable responses may vary slightly for each question analyzed Chi-square test

IIA Membership as of September 30, 2006 *Provided by The IIA. Affiliate IIA Membership as of 9/30/2006* Usable Responses Percentage of Membership Belgium1, Italy2, The Netherlands1, UK and Ireland7, United States54,6863, Total67,2974,0806.1

Staff LevelBelgiumItaly The Netherlands UK and Ireland United States CAE Audit Manager Audit Seniors/ Supervisor Audit Staff Other Total Number of Respondents ,127 χ 2 =56.68, p<.001 Participants Staff Levels (In Percentages)

Age of Respondents (in Percentages) AgeBelgiumItaly The Netherlands UK and Ireland United States 25 years old or less to 34 years old to 44 years old to 54 years old to 64 years old years or older Total Number of Respondents χ 2 =56.88, p<.001

Highest Level of Respondents Education (in Percentages) Level of Education BelgiumItaly The Netherlands UK and Ireland United States Secondary / High School Education Bachelors / Diploma in Business Bachelors / Diploma in Fields Other than Business Masters / Graduate Degree / Diploma in Business Masters / Graduate Diploma in Fields Other than Business Doctoral Degree Other Total Number of Respondents χ 2 =967.89, p<.001

Number of Years as an IIA Member (in Percentages) Years BelgiumItaly The Netherlands UK and Ireland United States 5 or less to or more Total100.0 No. of Respondents χ 2 =119.26, p<.001

Respondents Professional Qualifications Type of Professional Qualification BelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p Internal Auditing (such as CIA / MIIA / PIIA) <.001 Information Systems Auditing (such as CISA / QiCA / CISM) <.001 Government Auditing / Finance (such as CIPFA / CGAP / CGFM) ** Control Self-Assessment (such as CCSA) <.001** Public Accounting / Chartered Accountancy (such as CA / CPA / ACCA / ACA) <.001 Management / General Accounting (such as CMA / CIMA / CGA) ** Accounting - technician level (such as CAT / AAT) <.001** Fraud Examination (such as CFE) <.001** Financial Services Auditing (such as CFSA / CIDA / CBA) <.001** Fellowship (such as FCA / FCCA / FCMA) <.001** Certified Financial Analyst (such as CFA) ** Other <.001 Number of Respondents **When the number of observations is less than 5 in a cell, the Chi-square results should be interpreted cautiously.

Age of Respondents Organizations (in Percentages) AgeBelgiumItaly The Netherlands UK and Ireland United States 0 to 5 years to 10 years to 15 years to 20 years to 25 years to 30 years to 35 years to 40 years to 45 years to 50 years or more years Total Number of Respondents χ 2 =307.46, p<.001

Number of Years IAA Has Existed (in Percentages) Number of Years BelgiumItaly The Netherlands UK and IrelandUnited States More than 50 years Total100.0 Number of Respondents χ 2 =202.86, p<.001

(RQ1) Organizations Use of The Standards In Whole or In Part (in Percentages) Position in the IAA Belgium ItalyThe Netherlands UK and Ireland United States χ2χ2 p Number of Responde nts % % Number of Respond ents % Number of Responde nts % Number of Responde nts % CAE Audit Manager Audit Senior/ Supervi- sor Audit Staff Other Overall Average

(RQ2) Full and Partial Compliance with the Standards (in Percentages) Standard Belgium Italy The Netherlands UK and Ireland United States χ2χ2 p FullPartialFullPartialFullPartialFullPartialFullPartial Purpose, Authority, and Responsibility < and Objectivity < Proficiency and Due Professional Care < Quality Assurance and Improvement Program < Managing the Internal Audit Activity < Nature of work < Engagement Planning < Performing the Engagement < Communicating Results < Monitoring Progress < Resolution of Managements Acceptance of Risks <.001 Overall Average

Standard BelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p Purpose, Authority, and Responsibility < and Objectivity < Proficiency and Due Professional Care < Quality Assurance and Improvement Program < Managing the Internal Audit Activity < Nature of work < Engagement Planning < Performing the Engagement < Communicating Results < Monitoring Progress < Resolution of Managements Acceptance of Risks <.001 Overall Average (RQ3) Adequacy of Guidance Provided by Each of the Standards (in Percentages)

(RQ4) Adequacy of Practice Advisories (in Percentages) Practice AdvisoriesBelgiumItaly The Netherlands UK and Ireland United States χ2χ2 p Purpose, Authority, and Responsibility < and Objectivity < Proficiency and Due Professional Care Quality Assurance and Improvement Program Managing the Internal Audit Activity < Nature of work < Engagement Planning < Performing the Engagement < Communicating Results < Monitoring Progress Resolution of Managements Acceptance of Risks Overall Average

(RQ5) Top Five Reasons for Lack of Compliance Not perceived as adding value by management/board (11.5%) Inadequate staff in the IAA (11.3%) Too time consuming (10.0%) Compliance not supported by management/board (9.7%) Not appropriate for small organizations (9.2%).

Use of the Standards in Whole or in Part Compared to the Number of Full-Time Staff at Each Staff (in Percentages) BelgiumItalyThe NetherlandsUK and IrelandUnited States Number of Staff # of Responde nts % % % % # 0f Responde nts % * * * * * * * or more Total Chi- square p <.001

(RQ6) When IAA Was Last Subject to a Formal Internal Quality Assessment (in Percentages) TimingBelgiumItaly The Netherlands UK and Ireland United States # of Respo nd ents % % % % % Done in past 5 years or scheduled to be completed prior to January 1, Never had one or not done in compliance with Standard Total Number of Respondents χ 2 = , p<.001

(RQ7) When IAA Was Last Subject to a Formal External Quality Assessment (in Percentages) TimingBelgiumItalyThe NetherlandsUK and IrelandUnited States # of Responde nts % % % % % Done in past 5 years or scheduled to be completed prior to January 1, Never had one or not done in compliance with Standard Total Number of Respondents χ 2 = , p<.001

Conclusions Growth of the profession has been hastened by national regulation Respondents age, education, time in the profession, and years of IIA membership vary by country Age of organizations and of IAAs vary by country

Conclusions, continued There is consistency within each country for the use of the Standards in whole or in part by staff level but variation by country Significant differences exist between countries In the level of satisfaction with the adequacy of the guidance for all Standards and Practice Advisories, with the exception of Standards 1300 and 2600 – UK and Ireland are least satisfied with the Standards and Practice Advisories – Belgium is most satisfied with Standards guidance – Italy is most satisfied with the Practice Advisories

Conclusions, continued Compliance with Standard 1300, Quality Assurance and Improvement Program and Standard 2600, Resolution of Managements Acceptance of Risks, is universally limited – US has highest full compliance – Italy has lowest full compliance Convincing management and the board of the value of the Standards is a significant challenge for many IAAs Size of the audit staff affects usage of the Standards in Italy and the US