The effectiveness and value of internal audit in financial institutionsevidence from qualitative research

Resumen

Effective and value generating internal audit activities have long been contested because they play a key part in the achievement of a financial institution’s objectives. Internal audit’s systematic risk‐orientated approach to evaluate and improve a financial institution’s risk management and governance processes pro‐ vides theoretical and methodological room for discussion. The Three Lines of Defense (3‐LoD) model is found in financial institutions. This calls for interaction and cooperation to enhance the overall risk management in order to create effective and value generating internal audit activities. An analysis is undertaken on the current state, the state of the art, and the future state of the internal audit discipline to determine how it can evolve to achieve the desired state of providing effective and value generating activities. By making use of grounded theory and conducting qualitative content analyses, key concepts and categories surrounding the internal audit discipline are extracted in a mixed‐method approach. Starting points for effective internal audit activities are derived from the literature and its value generation is investigated in an interview study. Scientific relevant questions are derived from the literature study which are investigated in semistructured in‐depth interviews. Evidence is collected on the role of internal audit and its fields of relevance. The exogenous interest groups are positioned outside the financial institution and do not maintain a relationship with actors inside the financial institution. The exogenous perception of the internal audit discipline is essentially shaped by the regulatory supervision body, external audit and, to a lesser extent, of other interest groups. The findings from the conducted qualitative content analysis conclude that beneficial effects of internal audit mainly arise from the interaction with the management body and the financial institution’s internal governance framework. The evolvement of effective activities depends on internal audit’s ability to serve these endogenous and exogenous interest groups. Three dimensions are used to categorize the generation of value: (1) profession and organization, (2) cooperation, and (3) output. (1) Regular and indepth assessments, advisory, project management support, and assurance are contributing internal audit activities that relate to quantitative and qualitative measurands. (2) Reporting, assurance, independence, taking on a sparring partner role, and advisory are the most valuable activities for the management body. (3) An appropriate set‐up of the 3‐LoD for internal audit to maintain its independence requires a level of cooperation, sharing commonalities with the first and second line of defense, intensifying the exchange with the second line to avoid redundancies, the establishment of sparring partner roles, and a meaningful reporting. Explanatory hypotheses are formulated that infer the generation of value. Internal audit maintains causal relationships with exogenous and endogenous interest groups that shape the perception of the discipline. The thesis concludes by discussing that value is generated from the concentration of internal audit’s activities on the first and second line, internal governance to prevent findings from the regulatory supervision body, and the management body. The evolvement of the internal audit discipline depends on the importance assigned to it by the management body. The research contributes to the literature by providing insights on how the internal audit discipline needs to evolve to be effective and generate value for the financial institution’s interest groups.