Internal audit function characteristics and external auditors' co‐sourcing in different institutional contexts

• Author: Fabrizio Di Meo,Annukka Jokipii
• Date: 01 July 2019
• Published date: 01 July 2019
• DOI: http://doi.org/10.1111/ijau.12162

ORIGINAL ARTICLE

Internal audit function characteristics and external auditors'

co‐sourcing in different institutional contexts

Annukka Jokipii

1

|Fabrizio Di Meo

2

1

Accounting and Finance, University of Vaasa,

Vaasa, Finland

2

Department of Economics and Business,

Universidad de Alcalá, Alcalá de Henares

(Madrid), Spain

Correspondence

Annukka Jokipii, University of Vaasa,

Accounting and Finance, P.O. Box 700, Vaasa,

65101, Finland.

Email: annukka.jokipii@uwasa.fi

We examine the association between several characteristics of an internal audit

function (IAF) and fees paid to external auditors to support internal audit activities

(co‐sourcing). We also analyze how this relation is influenced by the mandatory or

voluntary implementation of IAFs. By using data from the Common Body of Knowl-

edge (CBOK) study, which was conducted by the Institute of Internal Auditors

Research Foundation in 2015, we find that more consulting‐oriented IAFs and more

autonomous IAFs are likely to pay higher co‐sourcing fees, whereas IAFs with greater

expertise are likely to pay lower co‐sourcing fees. Although results related to consult-

ing activities hold regardless of the institutional context, the negative association

between IAF expertise and co‐sourcing fees paid to support internal audit activities

only holds in mandatory IAF environments, and the positive association between

IAF autonomy and co‐sourcing fees paid only holds where IAF is voluntary.

KEYWORDS

co‐sourcing, fees, IAF autonomy, IAF expertise, IAF focus, internal audit, internal audit function,

mandatory, voluntary

1|INTRODUCTION

The shift that internal audit functions (IAFs) have experienced from

assurance to consulting activities in many firms (Allegrini, D'Onza,

Melville, Sarens, & Selim, 2011; Soh & Martinov‐Bennie, 2015) has

increased the importance of internal audit in firms' organizations

(Speklé, van Elten, & Kruis, 2007), as more consulting‐oriented IAFs

are better able to enhance corporate governance through their rela-

tionships with the audit committee, the management, and the external

auditors (Gramling, Maletta, Schneider, & Church, 2004; Hazem &

Roberts, 2018). To respond to the increasing importance of IAFs in

firms' corporate governance, firms can choose to develop the required

internal audit skills and abilities inside an organization, or to adopt

the strategy of co‐sourcing internal audit activities (Selim, Woodward,

& Allegrini, 2009). In a typical co‐sourcing arrangement, responsibilities

for the IAF remain inside the organization. However, through co‐

sourcing, the IAF is likely to obtain, from the outside of the organiza-

tion, special expertise and skills that may be difficult to achieve inside

an organization due to limited resources available or limited employees'

skills. The most common services that are likely to be co‐sourced are

typically reviews of internal control activities, or testing processes

related to financial reporting, risk management, and regulatory compli-

ance (Carey, Subramaniam, & Wee Ching, 2006). Through co‐sourcing,

internal auditing can maximize internal audit activities without hiring

new employees, or without substantially increasing the corresponding

expenses (Dame, 2000). Accordingly, prior studies focusing on co‐

sourcing of internal auditing suggest that the primary reasons to co‐

source are to gain efficiency, to save costs (Abdolmohammadi, 2013),

and to further increase flexibility and expertise when needed the most

(Van Peursem & Jiang, 2008).

This study examines co‐sourcing between internal audit of an

organization and external audit firms. Previous empirical studies ana-

lyze variables that may lead a firm's organization to use co‐sourcing

to develop their internal audit activities. For example, characteristics

related to the size or the location of an organization (Abdolmohammadi,

2013; Widener & Selto, 1999), asset specificity and frequency (Speklé

et al., 2007; Widener & Selto, 1999), ownership (Díaz‐Mora &

Triguero‐Cano, 2012), and audit committee activities (Abbott, Parker,

Received: 27 June 2018 Revised: 10 April 2019 Accepted: 16 April 2019

DOI: 10.1111/ijau.12162

292 © 2019 John Wiley & Sons Ltd Int J Audit. 2019;23:292–307.wileyonlinelibrary.com/journal/ijau

Peters, & Rama, 2007; Abdolmohammadi, 2013) are expected to be

considered by the management of a firm in deciding whether to use

co‐sourcing for internal activities. Other studies (Ahlawat & Lowe,

2004; Gramling & Vandervelde, 2006) examine the results obtained

through co‐sourcing, rather than firms' characteristics that may lead

to co‐sourcing‐related decisions. For example, Dickins and O'Reilly

(2009) found a positive association between the percentage of co‐

sourced internal audit work and the frequency of material weaknesses

in internal control. They also found a negative relationship between the

likelihood of the internal auditor reporting to the audit committee and

the level of internal auditing co‐sourcing. However, previous studies

have analyzed the determinants of co‐sourcing by using internal audit

or firm characteristics that are observable from outside the firm,

without considering characteristics such as the focus of an IAF

(consulting vs. assurance activities), its expertise, or its autonomy from

the management. Also, these previous studies do not take into account

how the determinants of the co‐sourcing decision may depend on

whether the IAF is mandated by law and regulations. Although there

may not be significant differences in the IAF characteristics for firms

in countries with voluntary or mandatory IAF implementation, the

effect of IAF characteristics over co‐sourcing may differ in alternative

institutional contexts. In a context where IAF is mandatory, co‐sourcing

may be mainly motivated by receiving assistance to achieve require-

ments from laws and regulations. On the contrary, in a context where

IAF is voluntary, co‐sourcing may be due to the need of strengthening

corporate governance in a context of agency theory, where internal

audit may serve as a monitoring response to agency costs (Carey,

Simnett, & Tanewski, 2000).

In this study, we analyze how IAF characteristics that are observed

inside an organization may have an influence on the co‐sourcing

decision. In particular, we consider (1) IAFs that are more focused on

either consulting or assurance activities, (2) IAF expertise, which takes

into account the expertise of internal audit employees acquired both

outside and inside an organization, and (3) IAF autonomy, which

measures to what extent internal audit activities are constrained by

the management and by a limited number of sources to establish the

audit plan (the lower the constraints, the higher the autonomy). We

argue that, when the IAF is more focused on consulting activities,

rather than on assurance activities, the IAF needs more specialized

nonroutine co‐sourcing assistance. We also argue that IAF expertise

decreases the need for co‐sourcing, as more expert IAF employees

are less likely to ask for external auditors' assistance in internal audit

activities. Finally, we expect that more autonomous IAFs are likely to

increase support from external auditors for their activities, as more

autonomous IAFs are less subject to constraints from the management

or from other specific areas of the organization. Therefore, more

autonomous IAFs are likely to need further external assistance to

comply with unregulated activities to serve both management and

the audit committee (which IAFs normally refer to). Besides discussing

the association between IAF characteristics and co‐sourcing, we also

analyze the effect that the mandatory or voluntary implementation

of IAFs may have on the association between IAF characteristics and

co‐sourcing fees paid to support internal audit activities. Because, to

our knowledge, this issue has been unexplored in previous literature,

we adopt an exploratory approach in our hypotheses development,

supposing that there are no differences in the associations between

IAF characteristics and co‐sourcing fees to support internal audit

activities depending on different institutional contexts.

To test our hypotheses, we use the Common Body of Knowledge

(CBOK) 2015 study conducted by the Institute of Internal Auditors

Research Foundation in 2015. This database provides characteristics

of internal audit that are evaluated inside an organization and, more

specifically, by internal audit employees. Our sample includes 393

companies in eight different geographic areas, and our results confirm

our expectations. Specifically, we find a positive association between

IAFs focusing more on consulting activities and co‐sourcing, and

between IAF autonomy and co‐sourcing. Our results also indicate a

negative association between the level of IAF expertise and co‐

sourcing. With regard to the role of mandatory or voluntary IAF, we

find that IAFs focusing on consulting activities, rather than on assur-

ance activities, are likely to increase co‐sourcing to support internal

audit activities, regardless of whether internal audit is mandatory or

voluntary. IAF expertise is likely to decrease co‐sourcing fees to sup-

port internal audit activities only in firms where IAF is mandatory.

We interpret this result by observing that greater expertise of IAF

employees can help internal audit comply with specific requirements

of laws and regulations without the need for support from external

audit co‐sourcing. Finally, the positive association between IAF auton-

omy and co‐sourcing fees to support internal audit activities only

holds when internal audit is voluntary. This result can be explained

by arguing that the voluntary implementation of an IAF allows internal

audit employees to operate without legal requirements. In this con-

text, more autonomous IAFs, which already comply with their tasks

without pressures from managers or from limited sources to establish

an audit plan, are likely to operate with more unregulated activities

that are not defined by laws and regulations, thus further increasing

the need for support from co‐sourced external auditors.

Our results contribute to prior research in several ways. First, to

test our hypotheses, we use characteristics that are observed inside

an organization, and not by using measures of internal audit, such as

age of employees, internal audit certifications, or organizational char-

acteristics, that are normally observable outside the firm. The charac-

teristics we analyze are concerned with the audit plan and risk areas

(IAF focus), with employees' education and certifications related to

internal audit, IAF tenure, internal development of activities, and man-

agerial rotation in the IAF (IAF expertise), and with the sources used to

establish an internal audit plan and pressures to modify findings and

reports of the internal department (IAF autonomy). To test our expec-

tations, we also use a holistic approach, using measures of IAF focus,

IAF expertise, and IAF autonomy that are composite measures of indi-

vidual IAF characteristics. This approach, which is usual in corporate

governance literature, allows us to decrease the noise that individual

measures are likely to contain (Larcker, Richardson, & Tuna, 2007).

Second, we contribute to internal auditing and co‐sourcing literature

by providing evidence that the association between IAF characteristics

and co‐sourcing fees to support internal audit activities is different in

JOKIPII AND DI MEO 293