Does the Internal Audit Function Have Alternatives?

Abstract

In Denmark, there is no legal requirement for non-financial organizations to establish an internal audit function, which has led to the low presence of internal audit functions among large non-financial companies. To understand why internal audit function is not common despite its value proposition, this thesis investigates internal audit function in comparison with its two possible alternatives: external assistance with internal audit provided by consulting companies and other in-house control functions in the second line of defense. The thesis aims to assess whether external assistance and other in-house control functions can be used as alternatives to internal audit from a theoretical point of view, and whether as well as why they are used as alternatives in practice among the large non-financial companies in Denmark. This has been done by conducting a literature review and by gathering, analyzing, and discussing qualitative interview data. We have interviewed 12 respondents regarding their experiences, consisting of Heads of Internal Audit, Chairpersons of Audit Committees, consultants providing internal audit services, Heads of in-house control functions, and an expert in the field.
This study has found that an internal audit function has the potential to add value to large Danish non-financial organizations, as the internal audit function has a broad work area, including assurance and consulting activities related to governance, risk management, and control processes in order to improve the achievement of strategic, reporting, operational, compliance and IT goals. We have observed that some internal audit functions are shifting their focus away from financial audits to other areas, but there is some lack of understanding among the Audit Committees about internal audit services. This leads to a misunderstanding that the internal audit function can alternatively be replaced by either external audit or other in-house control functions. The thesis suggests that the possible root causes for the misunderstanding are 1) lack of tradition for internal audit function in Denmark, 2) Audit Committee's role limitation to external financial reporting according to the Danish Auditor’s Act, and 3) negative experiences with the internal audit function as the ”police” in contrast to solution-oriented sparring partner, which is perceived as a value-adding factor by the majority of the interviewees.
Furthermore, The Three Lines model suggests that the control functions in the second line should not be treated as alternatives to the internal audit function due to their lack of independence, but we have observed that some Audit Committees treat the functions as alternatives due to their attitude towards independence as not a value-creating factor. However, we have observed contradictory opinions about the perceived value of independence and hereby suggest exploring the topic further.
On the contrary, the thesis finds that outsourced internal audit is not treated as an alternative to the internal audit function, mainly due to the general lack of tradition for the internal audit function, and because the disadvantages, especially lack of knowledge of the business, are perceived to outweigh the advantages such as technical knowledge. However, we have found that external consultants are widely used to supplement the existing internal audit functions as consultants or co-sourced employees, mainly in the IT technical areas.