Internal Audit: Is the ‘Third Line of Defense’ Effective as a Form of Governance? An Exploratory Study of the Impression Management Techniques Chief Audit Executives Use in Their Annual Accountability to the Audit Committee

Abstract

Our exploratory study considers whether the internal audit function is an efficient “third line of defense” for risk management and control as proposed by The Institute of Internal Auditors. To that end, we interview chief audit executives (CAEs) and experienced internal auditors to examine whether (and how) CAEs manage the impressions of audit committee members in the annual accountability process. We also provide an illustration of impression management techniques through a documentary case that explores a unique and exclusive dataset consisting of the main guidance, framework, and accountability documents of one of these organizations. Our analysis highlights how several macro- and microimpression management techniques were used to burnish the image of internal auditors and, more importantly, the management team. Rather than monitoring managers, the CAEs team up with them. Our findings cast doubts on the conceptualization of internal audit as the independent third line of defense envisioned to be a keystone of the governance mosaic. This study supports other research that questions the effectiveness of internal auditing as a governance mechanism. It also contributes to the impression management literature by exposing impression management practices that occur through a private reporting channel—the internal audit function’s annual accountability to the audit committee. Last but not least, significant ethical concerns are raised in regard to internal audit, and research is urged in that area.

Appendices

Appendix 1: Glossary

CAE:

Chief Audit Executive

CEO:

Chief Executive Officer

IAF:

Internal Audit Function

IIA:

Institute of Internal Auditors

IPPF:

International Professional Practices Framework

NPG:

New Public Governance

NPM:

New Public Management

Appendix 2: The Accountability Documents Analyzed

Internal Audit Charter

The IAF charter we examined complied in every respect with the guidelines of the Secrétariat du Conseil du Trésor (Office of the Quebec Treasury Board) and its recommended charter template. It set forth the charter’s purpose, the IAF’s guidelines (organizational structure, values, compliance with the IIA’s IPPF standards and code of ethics, access to information, and annual accountability reporting), a mission statement aligned with the IIA’s IPPF internal audit definition, the IAF’s areas of activity within the organization, and internal stakeholders’ roles and responsibilities.

The audit committee members’ oversight of the IAF (i.e., the functional authority) is depicted as one of the charter’s key principles that ensures the internal audit’s credibility and independence. The charter repeatedly stresses the need for the IAF’s independence from the management team in the principles, the internal audit mission, and statements on the CAE’s role, among other charter items. The charter also stipulates that internal auditors must work objectively and impartially and avoid any apparent or genuine conflict of interest. The auditees are portrayed as IAF work facilitators and recommendation followers, without any reference to collaboration or partnership.

Annual Accountability Report

The annual accountability report contained an audit statement on the report content produced by the CAE, a summary of the IAF’s mission, its organization chart and physical and human resources, the year’s highlights, the annual plan and three-year guidelines, follow-up on annual plan implementation, a summary of engagements and other activities carried out during the year, and a comparative table (with the previous year) of performance measurement based on a range of indicators.

The engagement summaries presented in the report were generally no longer than one page and all included the engagement title, a reminder of the objectives pursued, the IAF’s main findings and recommendations, and the auditees’ action plan summary. The engagement summaries were short and presented only highlights since the audit committee had already received a detailed report for each engagement. We did not obtain access to these detailed audit reports because of their confidential nature.

IAF Process Descriptions

The IAF process descriptions outline the work planning process, the procedure for identifying potential audit engagements, and the main steps of the audit process for a specific engagement. They also define each IAF member’s responsibilities during the audit process and the client satisfaction survey, which the auditees complete at the end of each IAF engagement. The cumulative average of all the survey questions (related to engagement content (relevance and clarity), audit performance, audit team and report, overall appreciation score) constitutes one of the performance indicators in the IAF’s accountability report.