Risk-based internal audit: factors related to its implementation

• DOI: https://doi.org/10.1108/CG-08-2020-0316
• Published date: 08 February 2021
• Date: 08 February 2021
• Pages: 645-662
• Subject Matter: Strategy,Corporate governance
• Author: Petros Lois,George Drogalas,Michail Nerantzidis,Ifigenia Georgiou,Eleni Gkampeta

Risk-based internal audit: factors

related to its implementation

Petros Lois, George Drogalas, Michail Nerantzidis, Ifigenia Georgiou and Eleni Gkampeta

Abstract

Purpose –This study aims to investigate the factors associated with the implementation of risk-based

internalaudit (RBIA).

Design/methodology/approach –As a first step, a literature review of the relevant liter ature is

performed and five potential factors related to the impl ementation of RBIA are identified. Based on

that, this paper constructs a questionnaire survey sent out to185 internal auditors, executives and

accountants in Greece to receive90 responses during the period of November 2019–January 2020.

Multiple regression analysis is conducted to identify the factors related to the implementation of

RBIA.

Findings –This paper shows that there is a statistically significant positive relationship between the

implementation of RBIA and: the provision of risk management training, an active audit committee role

and the establishmentof a formalized risk management system.

Practical implications –The results have important implications for internal auditors, chief executive

officers and accountantswho wish to enhance internal audit effectiveness and the accuracy and quality

of financialinformation.

Originality/value –Empiricalstudies on the factors related to the implementationof RBIA are rare. This is

the first study to create empirical variables based on a thorough review of the relevant literature to

empirically investigate the factors that are related to the implementation of RBIA in an emerging

economy. By focusing on the Greek context, this study also sheds light to other countries with similar

corporate governance systems, thus providing insights to settings where the Type II agency problem

exists(La Porta et al., 1999).

Keywords Risk-based internal audit, Internal audit, Greece, Risk management, Auditing

Paper type Research paper

1. Introduction

Corporate bankruptcies highlighted deficiencies in corporate governance, financial

reporting and timely detection of threats to business strategies (Drogalas et al.,2020a, b;

Grant and Visconti, 2006;KPMG, 2007). On that basis, there is growing evidence with

regard to the effects of internal auditon corporate governance (AlQadasi and Abidin, 2018;

Myers and Ziegenfuss, 2006;Ridley et al., 2011;Vadasi et al., 2020). Part of this evidence

illustrates that internal audit function may contribute to corporate governance and the

quality of the financial reporting process (Abdeljawad et al.,2020;Ebaid,2011a, 2011b;

Koutoupis et al.,2018).

In the same vein, there was a shift in internal audit focus from processes to business risk,

turning the latter into a cornerstone of corporate governance (Benli and Celayir, 2014;

Carcello et al., 2005;Dinc¸er and Hasi

glu, 2017;Hafizah, 2017;IIA, 2009;McNamee and

McNamee, 1995). At the same time, changes in regulatory frameworks and the

introduction of new standards of internal audit, risk management and corporate

governance required the interdependence of internal audit and risk management through

the use of a systematic and structured audit methodology, i.e. risk-based internal audit

Petros Lois is based at the

Department of Accounting,

University of Nicosia,

Nicosia, Cyprus.

George Drogalas is based

at the Department of

Business Administration,

University of Macedonia,

Thessaloniki, Greece.

Michail Nerantzidis is

based at the Department of

Accounting and Finance,

University of Thessaly –

Larisa, Larisa, Greece.

Ifigenia Georgiou is based

at the Department of

Accounting, University of

Nicosia, Nicosia, Cyprus.

Eleni Gkampeta is based at

Hellenic Open University,

Patra, Greece.

Received 6 August 2020

Revised 15 November 2020

Accepted 8 December 2020

DOI 10.1108/CG-08-2020-0316 VOL. 21 NO. 4 2021, pp. 645-662, ©Emerald Publishing Limited, ISSN 1472-0701 jCORPORATE GOVERNANCE jPAGE 645

(RBIA) (Chapman and Anderson, 2002;Jankensga

˚rd, 2019;Van Peursem, 2004;

Wilkinson and Coetzee, 2015).

RBIA involves assessing an organization’s overall risk management framework to

investigate the extent to which the board of directors and management determine, assess,

manage and monitor risks (IIARF, 2013;Spira and Page, 2003), establish a control

environment, assess risk exposure level (Lindow and Race, 2002), create a risk-based

control plan, with the aim of meeting the needs of the organization (Coetzee and Lubbe,

2014;Selim and McNamee,1999a, 1999b) and conducting annual and periodic audits to

finally communicate audit results to the audit committee (AC), the board and the

management in a timely manner (Andersonand Dahle, 2006;Jackson, 2005).

Understanding business objectives and strategies and aligning them with business

objectives and activities (Coetzee and Lubbe, 2014;Selim and McNamee, 1999b), as well

as assessing business risks on an annual basis and in individual audit assignments

(Allegrini and D’Onza, 2003;Koutoupis and Tsamis, 2009)–that is, identifying, measuring

and prioritizing the negative effects for the entity –contributes to an effective risk

management that follows a holistic approach at the lowest possible cost (Bowling and

Rieger, 2005;Banham, 2005;Busman and Zuiden, 1998;Goodwin, 2003;Griffiths, 2006;

Gupta, 2011;Lois et al.,2020;McCord, 2002;Verschoor, 2002). Therefore, the focus of

internal auditors is shifted to the future (Crawford and Stein, 2002;Petridis et al., 2019)and

to “high-risk” areas that must be considered as a priority when preparing the internal audit

plan (Grıffıths, 2006;Hafizah, 2017;Koutoupis and Tsamis, 2009;Sarens et al.,2012). To

achieve the above, internal auditors, who now play a strategic role in organizations (IIARF,

2013;Krogstad et al.,1999), are required to possess specialized knowledge in matters of

control and risk management (Deloitte, 2012;Mayur and Saravanan, 2017;Zain et al.,

2006).

It becomes clear that the implementation of RBIA goes beyond the limitations of compliance

audits, operational effectiveness and the reliability of financial statements (Colbert and

Alderman, 1995). This is because it relies on the assessment of organizational objectives,

risks and audits (Rivenbark, 2000) and allows the provision of assurance regarding the

effectiveness and efficiency of risk management and internal control operations

(Castanheira et al., 2010; COSO, 2004; Spira and Page, 2003) leading to a more efficient

allocation of audit resources (Spadaccini, 2010) and continuously increasing the added

value of the internal audit function (Bou-Raad, 2000;Griffiths, 2006;Sheehan, 2010)by

upgrading the quality of audit work, improving operational performance and contributing to

the sustainability and long-term development of organizations (Danescu and Sandru, 2010;

Hermanson and Rittenberg, 2003;Sarens et al., 2009;Sheehan, 2010;Staciokas and

Rupsys, 2005).

Although a number of international studies have been conducted on the broader role of

internal audit at the organizational level (Abdolmohammadi, 2009;Khongmalai et al., 2010;

Melville, 2003;Selim et al.,2003,2009) and its relationship to business risk management

(De Zwaan et al., 2011;Drogalas and Siopi, 2017;Gramling and Myers, 2006;Karagiorgos

et al.,2010

), there is a paucity of literature on factors related to the implementation of RBIA.

Previous studies had focusedprimarily on risk assessment processes during audit planning

(Allegrini and D’Onza, 2003;Castanheira et al., 2010;Koutoupis and Tsamis, 2009). In

addition, some studies provide theoretical models for implementing RBIA (Coetzee and

Lubbe, 2014) while few of them associate the application of RBIA with organizational

performance (Kirogo et al.,2014) and with specific organizational factors (Hafizah, 2017).

Our paper makes several novel contributions to the corpus of literature on RBIA. First, new

empirical evidence regarding an emerging economy is provided. This contributes toward a

better understanding of the factors that are related to the implementation of RBIA. In

addition, by focusing on the Greek context this study sheds light to other countries with

PAGE 646 jCORPORATE GOVERNANCE jVOL. 21 NO. 4 2021