Holistic Risk Management: An Expanded Role for Internal Auditors

EVOLUTION OF THE INTERNAL AUDIT FUNCTION The internal audit function was introduced after World War II in a few large companies as a way to reduce the fees charged by their independent, external auditors by having some of the auditing work completed by staff of the auditee under the supervision and to the specifications provided by the independent auditor (McNamee and McNamee, 1995). Most of these internal audit departments were small and focused on testing controls and preparing workpapers to be used by the independent auditors. The independent auditors could thereby reduce the number of billable hours they worked and thus reduce the audit fee charged (Flesher, 1991). The role of internal auditors expanded dramatically with the enactment of the Foreign Corrupt Practices Act (FCPA, 1977). That legislation provided, among other things, severe penalties for executive officers of companies found to have insufficient systems of internal control in place. The prospect of substantial fines and even prison motivated top managers to increase funding for their internal audit functions so they could be confident that their internal control systems were sufficient to defend against prosecution under the FCPA (Flesher, 1991). Controls and Compliance In response to the expanded role of internal auditors, the Institute of Internal Auditors (IIA), the professional organization that sets standards for the work of internal auditors, underwent its own evolution. Operating as the generally recognized international governing body for internal auditors, the IIA continues to establish guidelines and create training materials based on research that it funds through its foundation (Flesher, 1991). In the decade following the enactment of the FCPA, the role of internal auditors became well established as the review of controls and the assurance of compliance with internal organization policies and legal regulation emanating from the environment in which the organization operated. Albrecht, Stice, and Stocks (1992, 1) described the role of internal auditors to be consultants to managers to ensure that controls are effective and efficient, operations are effective, assets are safeguarded, and organizational policies and appropriate laws are followed. As the importance of internal audit departments grew, many organizations identified the benefits of having them act more independently. Increasingly, fewer internal audit departments were reporting to chief financial officers and more were reporting to the board of directors or the audit committee of the board of directors (Moeller, 2009). Audit Risk vs. Business Risk Internal auditors have always been concerned with managing audit risk, which is the risk that the auditor will fail to provide effective, timely, and efficient assurance and consulting support to company management and its board of directors (Albrecht, Stice, and Stocks, 1992). Audit risk (for actions undertaken by the internal audit department) is the responsibility of internal audit, not management. In contrast, business risk is a cost incurred by the company if it does not achieve its strategic plans and is the responsibility of management (Moeller, 2009). Expanded Role for Internal Auditors In the past decade, further developments such as the enactment of Sarbanes-Oxley (2002) and the creation of the Public Companies Accounting Oversight Board (PCAOB) have caused internal audit departments to expand their activities to include more structured approaches to business risk assessment and to integrate those approaches with their organizations' strategies for managing business risk (Hass and Burnaby, 2010; Tabuena, 2010). Today, internal audit departments provide assurance and consulting services to management regarding the achievement of business risk goals as often as they engage in their traditional roles as testers of internal controls and assessors of compliance with organizational policies and external regulations (Moeller, 2009). …

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.