Managerial Auditing Journal

Usage of Internal Auditing Standards and internal auditing activities in South Africa and
all respondents
Marinda Marais Priscilla A. Burnaby Susan Hass, Elmarie Sadler Houdini Fourie
Article information:
To cite this document:
Marinda Marais Priscilla A. Burnaby Susan Hass, Elmarie Sadler Houdini Fourie, (2009),"Usage of Internal
Auditing Standards and internal auditing activities in South Africa and all respondents", Managerial Auditing
Journal, Vol. 24 Iss 9 pp. 883 - 898
Permanent link to this document:
http://dx.doi.org/10.1108/02686900910994818
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

Downloaded on: 13 March 2016, At: 20:48 (PT)

References: this document contains references to 9 other documents.
To copy this document: permissions@emeraldinsight.com
The fulltext of this document has been downloaded 1869 times since 2009*
Users who downloaded this article also downloaded:
Philomena Leung, Barry J. Cooper, (2009),"Internal audit – an Asia-Pacific profile and the level of
compliance with Internal Auditing Standards", Managerial Auditing Journal, Vol. 24 Iss 9 pp. 861-882 http://
dx.doi.org/10.1108/02686900910994809
Faudziah Hanim Fadzil, Hasnah Haron, Muhamad Jantan, (2005),"Internal auditing practices
and internal control system", Managerial Auditing Journal, Vol. 20 Iss 8 pp. 844-866 http://
dx.doi.org/10.1108/02686900510619683
Lois Munro, Jenny Stewart, (2011),"External auditors' reliance on internal auditing: further evidence",
Managerial Auditing Journal, Vol. 26 Iss 6 pp. 464-481 http://dx.doi.org/10.1108/02686901111142530

Access to this document was granted through an Emerald subscription provided by emerald-srm:272736 []
For Authors
If you would like to write for this, or any other Emerald publication, then please use our Emerald for
Authors service information about how to choose which publication to write for and submission guidelines
are available for all. Please visit www.emeraldinsight.com/authors for more information.
About Emerald www.emeraldinsight.com
Emerald is a global publisher linking research and practice to the benefit of society. The company
manages a portfolio of more than 290 journals and over 2,350 books and book series volumes, as well as
providing an extensive range of online products and additional customer resources and services.
Emerald is both COUNTER 4 and TRANSFER compliant. The organization is a partner of the Committee
on Publication Ethics (COPE) and also works with Portico and the LOCKSS initiative for digital archive
preservation.

*Related content and download information correct at time of download.

 The current issue and full text archive of this journal is available at
www.emeraldinsight.com/0268-6902.htm

Usage of Internal
Usage of Internal Auditing Auditing
Standards and internal auditing Standards
activities in South Africa
883
and all respondents
Marinda Marais
University of South Africa, Pretoria, South Africa
Priscilla A. Burnaby
Bentley College, Waltham, Massachusetts, USA
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

Susan Hass
Simmons College, Boston, Massachusetts, USA, and
Elmarie Sadler and Houdini Fourie
University of South Africa, Pretoria, South Africa

Abstract
Purpose – The purpose of this paper is to compare the responses of South African respondents with
all Common Body of Knowledge (CBOK) 2006 respondents in the areas of compliance with the Institute
of Internal Auditors’ (IIA) International Standards for the Professional Practice of Internal Auditing
(Standards) and several areas of the internal audit activity’s (IAA) operations.
Design/methodology/approach – This paper summarises and discusses the survey results from
questionnaires sent to the IIA members as of September 2006. For selected topics, the CBOK 2006
database is compared for South African respondents and non-South African respondents.
Findings – The paper finds that South Africans have a higher level of compliance with the Standards
than those respondents residing in other parts of the world. Since the internal auditing profession is so
young in South Africa, compliance with the Standards gives structure and support to the new IAAs
and internal auditors.
Originality/value – This is the first study comparing the status of the South African internal
auditing profession with the global state of internal auditing, activities performed by internal auditors
and the perception of the IAAs in their organizations.
Keywords Auditing, Auditing standards, Internal auditing, South Africa
Paper type Research paper

Introduction
Owing to the significant growth in The Institute of Internal Auditors (IIA) membership
around the world, the IIA’s Common Body of Knowledge (CBOK) 2006 research study was
commissioned by The Institute of Internal Auditors Research Foundation (IIA, 2006) to
understand how internal auditing is practised throughout the world and to populate a
database to capture a current view of the global state of the internal audit profession. This
database contains information from surveys distributed globally in the last quarter of Managerial Auditing Journal
Vol. 24 No. 9, 2009
2006 about compliance with the IIA’s International Standards for the Professional Practice pp. 883-898
of Internal Auditing (Standards), information about how internal audit activities (IAAs) q Emerald Group Publishing Limited
0268-6902
operate, internal auditor skills and competencies, and emerging roles of IAAs. DOI 10.1108/02686900910994818
 MAJ The objective of this paper is to compare the responses of the South African respondents
24,9 with all CBOK respondents with selected areas of the CBOK 2006 data base.
From June 2003 to September 2006, the IIA’s membership increased from 82,600 to
127,700 resulting in a 55 percent increase in three years (Burnaby et al., 2007). In
September 2006, the IIA had members in 165 countries and territories and 60,000
certified internal auditors (CIAs) around the world. The IIA South Africa membership
884 grew from 2,516 in June 2003 to 4,874 in September 2006, an increase of more than
90 percent (Erasmus, 2008). Some of this growth can be attributed to the new
legislation in South Africa requiring public organizations to have IAAs (King
Committee on Corporate Governance, 1994, 2002).
Based on the comparison of South African respondents to all respondents in the
CBOK 2006 study, the internal auditing profession in South Africa was found to be
growing and adapting to changing environments. This paper discusses the increased
scope of internal auditing and previous studies performed in South Africa about the
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

Standards and then compares South African respondents to all the CBOK 2006
respondents in the areas of demographics, compliance with the Standards, satisfaction
with the Standards guidance, several key operational areas of the IIA, types of audits
performed and the organization’s perception of the IAA.

Literature review
In 1999, to recognize the broadened needs of the organizations that internal auditing
serve, the IAA’s scope of work increased when the definition of internal auditing was
expanded to include additional activities. This caused a paradigm shift in the activities
performed by internal auditors from being primarily responsible for only assurance
services with regard to internal controls, to now include assurance in the areas of
governance and risk management. The expanded definition also allows internal
auditors to provide consulting services to organizations’ management, boards of
directors and audit committees. In 2002, the Standards were updated to include the
three scope areas of internal control, risk management and governance for both
assurance and consulting engagements.
Developments in public finance regulation and corporate governance are the most
significant factors that have contributed to the growth and development of the internal
audit profession in South Africa during the last ten years. The King Reports on
Corporate Governance (King Committee on Corporate Governance, 2002) were issued
recommending that organizations should have IAAs to improve corporate governance.
All listed companies in South Africa are obliged to adhere to the recommendations of
this report. This was supported by the promulgation of the Public Finance
Management Act (PFMA, 1999), which made it a legal requirement for all forms of
public organizations to have IAAs in accordance with the Standards.
In South Africa, Coetzee and du Bruyn (2001) investigated the limitations of the
previous Standards and compared them to the changes in the new IIA Standards. They
concluded that the changes to the Standards successfully address the challenges faced
by the internal audit profession in South Africa. Marais (2003) investigated the
importance of Standard AS1300, Quality Assurance and Improvement Program (QAIP),
within IAAs. This research also attempted to determine to what extent these Standards
and guidelines are adhered to in IAAs in South Africa. The study concluded that quality
control is not adequately applied within all IAAs in South Africa. Compliance with the
 Standards that were implemented during January 2002 should contribute to Usage of Internal
improvement with this situation. Marais further concluded that the IIA should take Auditing
action to motivate IAAs to exercise quality control according to the Standards.
Standards
Methodology
Questionnaires
Three questionnaires were developed to gather information from all respondents on the 885
current state of the internal audit profession. The length of the questionnaires and the
number of questions asked of the respondents was constrained by the targeted
45-minute time limit it would take respondents to complete the questionnaires. Not all
questions were asked of all the respondents. The three questionnaires were to:
(1) chief audit executives (CAEs);
(2) internal audit practitioners; and
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

(3) IIA affiliates.

Population
South Africa was one of the 91 countries that participated in the survey. Over 15,000
initial responses were received from the 127,735 IIA members as of September 30, 2006.
After the data were cleansed of responses that did not answer enough questions, 9,366
usable responses remained for a response rate of 7.3 percent. Discounting those
members who do not allow e-mails and those affiliates whose members did not
participate in the survey brought the response rate to 9.5 percent (Burnaby et al., 2007).
The South African response rate was also 9.5 percent with 464 replies from its 4,874
members as of September 30, 2006. In this paper, the responses of the South African
respondents are compared to the results of all the respondents in the CBOK 2006 study.

Discussion of results
The CBOK results will be discussed under the following captions:
.
demographics;
.
use of and compliance with the Standards;
.
use of the Practice Advisories; and
.
the IAA.

Demographics
Staff level
All staff levels were represented by the survey respondents. Table I shows the
respondents’ staff levels for all respondents and for South Africa.
A lower percentage of respondents in South Africa are CAEs (18.7 percent) than
global respondents (26.5 percent), while more respondents in South Africa are
audit managers (29.5 versus 22.8 percent). About 25 percent of all respondents and
South African respondents are audit seniors/supervisors.

Age of members
Table II summaries the age of survey respondents. The South African response
illustrates that the internal audit professionals that responded are represented by very
 MAJ
Percentage of all Percentage of South African
24,9 Staff level respondents respondents

CAEs 26.5 18.7

Audit managers 22.8 29.5
Audit seniors/supervisors 25.2 24.9
886 Audit staff 18.2 20.4
Othersa 7.3 6.5
Total number of respondents 8,935 464
Notes: a“Others” represents those with less traditional titles in organizations who are doing internal
Table I. audit work; many of those in the “Others” category have the same level of credentials as audit
Respondents’ staff levels managers
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

Age of respondents Percentage of all respondents Percentage of South African respondents

25 years old or less 3.5 10.6

26-34 years old 27.8 47.0
35-44 years old 34.8 26.8
45-54 years old 24.2 13.4
Table II. 55-64 years old 9.3 2.2
Age of respondents 65 years or older 0.4 None

young professionals with 84 percent of respondents under the age of 45, against
66 percent of all the respondents being younger than 45. It appears that, in South Africa,
more respondents at a young age (under 25 years) have decided on a career in internal
auditing than in other parts of the world. This may be attributable to the many formal
internal audit education programs being offered at various universities in South Africa,
as well as several membership programs (learnerships) which have been successfully
implemented by the IIA South Africa. In these learnerships, newly appointed internal
auditors are provided with structured theoretical and practical training in internal audit
environments. These actions in South Africa seem to be promoting internal auditing as a
career choice among young people entering the job market.

Age of internal audit activity

Table III shows the number of years that the IAA has existed within organizations.
About 49 percent of IAAs around the world and 58 percent of IAAs in South Africa are
ten years old or less. This could be the result of the laws and regulations requiring
IAAs within organizations, which have been promulgated in this period. This is a
positive development for the internal auditing profession and could reflect the
recognition by organizations, governments and governing boards of the value
provided by the IAA.

Credentials of respondents
With regard to the education level achieved by global survey respondents, the
results indicate that 52 percent of respondents have bachelors degrees (56 percent
 Usage of Internal
Number of Number of all Percentage of total Number of South Percentage of South
years responses respondents African respondents African respondents Auditing
0-5 2,194 28.4 124 30.2
Standards
6-10 1,628 21.0 114 27.8
11-15 914 11.8 51 12.4
16-20 847 10.9 34 8.3 887
21-25 529 6.8 18 4.4
26-30 566 7.3 30 7.3
31-35 181 2.4 5 1.2
36-40 255 3.3 7 1.7
41-45 48 0.6 2 0.5
46-50 257 3.3 11 2.7 Table III.
More than Number of years IAA has
50 years 328 4.2 14 3.4 existed in the
Total 7,747 100.0 410 100.0 organization
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

in South Africa) and 38 percent have masters degrees (31 percent in South Africa). Such
educational credentials illustrate that the internal auditing profession is attracting
highly educated individuals. Respondents were also asked to indicate all their
academic majors. Figure 1 shows the respondents’ five most frequently selected
majors. A substantially higher percentage of internal auditors in South Africa have
majors in accounting, auditing and internal auditing. This means that South African
internal auditors have an educational background that is more focused on
auditing/internal auditing than other respondents.
This may also be an indication that there are more programs and opportunities in
South Africa for students to major in internal auditing and auditing than in other parts
of the world.
Respondents were asked what other professional credentials they possess. Only 14
percent of South African respondents possess the chartered accountant (CA)
designation compared to 27 percent of global respondents holding the certified public
accountant or CA designation. In South Africa, 36 percent of respondents have the CIA
certification compared to 39 percent of all respondents.

Internal auditing 36.2%

12.7%

Auditing 56.2%
17.8%

Finance 32.8%
23.8% South Africa
All respondents
General business/management 26.5%
27.0%

Accounting 80.5%
55.8% Figure 1.
Academic majors
0% 10% 20% 30% 40% 50% 60% 70% 80% 90%
 MAJ Types of organizations and geographical area
24,9 Figure 2 shows the primary types of employer organizations for respondents. The
internal audit profession seems to be well diversified between employer organizations.
With mandated IAAs in government departments, the public sector in South Africa
has a relatively larger representation (30.2 percent) when compared to all respondents
(23.0 percent). Service providers or consulting firms also have a higher representation
888 in South Africa (18.0 percent) as compared to all respondents (10.5 percent). Publicly
listed and privately held firms comprise 44.3 percent of South African employer
organizations and 57.5 percent of employer organizations for all the respondents.
Figure 3 shows the geographical areas served by respondents’ employers. There
appears to be relative consistency among all respondents world wide concerning the
type of organizations represented. The highest number of all respondents (39.2 percent)
and South African respondents (41.9 percent) work for international/multinational
organizations.
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

Figure 4 shows the top six industries that employ survey respondents.
The banking/financial services industry is the largest employer for all respondents

3.9%
Non-for-profit organization
6.2%

Service provider or consulting firm 18.0%

10.5%

Public sector 30.2%

23.0% South Africa
All respondents
Privately held(non-listed) company 13.0%
19.5%

31.3%
Figure 2. Publicly traded(listed) company
38.0%
Primary types of employer
organizations
0% 5% 10% 15% 20% 25% 30% 35% 40%

4.2%
Regional
8.7%

11.8%
State/provincial 10.9%

Local 12.2%
12.1% South Africa
All respondents
National 29.9%
29.1%

Figure 3. 41.9%
International/multinational
Geographical area 39.2%
of organization
0% 5% 10% 15% 20% 25% 30% 35% 40% 45%
 10.0%
Usage of Internal
Communication/telecommunication
7.0% Auditing
8.5%
Standards
Insurance
9.3%

16.7%
Financial/accounting or business services
11.1% 889
South Africa
Manufacturing 10.8%
13.4% All participants

Other 17.1%
13.9%

22.8%
Banking/financial services/credit unions
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

24.5%
Figure 4.
0% 5% 10% 15% 20% 25% 30%
Top industries
represented
Note: Respondents were asked to mark all that apply

(24.5 percent) as well as the South African respondents (22.8 percent). The handling of
money and financial instruments has long been recognized as areas where controls and
risk must be managed and assessed.

Use of and compliance with the Standards

The roles, responsibilities and professional practice of internal auditing are defined and
guided by the IIA’s (2007) Professional Practices Framework (PPF). The PPF includes
the definition of internal auditing, the Code of Ethics, the Standards and Practice
Advisories. Guidance regarding how the Standards might be applied is included in the
Practice Advisories that are issued by the Professional Issues Committee of the IIA.
The Standards have been developed to serve the following purpose (IIA, 2007, p. 3):
.
to delineate basic principles that represent the practice of internal auditing as it
should be;
.
to provide a framework for performing and promoting a broad range of
value-added IAAs;
.
to establish the basis for the evaluation of internal audit performance; and
.
to foster improved organizational processes and operations.

Compliance with the Standards and the Code of Ethics is a mandatory requirement for
all members of the IIA that perform IAAs. The guidance contained in the Practice
Advisories is strongly recommended and endorsed by the IIA. The Standards consist
of Attribute Standards (AS) and Performance Standards (PS). AS address the
characteristics of organizations and parties performing IAAs, while PS describe the
nature of IAAs and provide quality criteria against which the performance of these
services may be evaluated (IIA, 2007, pp. 3-4).
While diverse legal and cultural environments within organizations and variations
in the purpose, size and structure of organizations may affect the practice of internal
auditing in each environment, the IIA regards compliance with the Standards as
 MAJ essential if the responsibilities of internal auditors are to be met (IIA, 2007, pp. 3-4).
24,9 Questions were included in the CBOK 2006 survey to determine:
.
the extent of use of the Standards around the world; and
.
the level of compliance with the Standards by IAAs.

Table IV shows that 81.9 percent of all respondents and 93.9 percent of the respondents
890 from South Africa indicate that they use the Standards in whole or in part. In both
groups, CAEs’ and audit managers’ percentages are the highest. These numbers are a
positive indication of global acceptance and implementation of the Standards. South
African respondents’ use of the Standards exceeds use by all participants for each staff
position by more than 10 percent.
Compliance with individual Standards is indicated in Table V. For most of the
individual Standards, a high level of compliance of more than 80 percent (full and
partial combined) was recorded. Only Standard AS1300, Quality Assessment and
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

Improvement Programs, and PS2600, Resolution of Management’s Acceptance of

Risks, have compliance concerns, where levels of compliance were recorded at lower
than 80 percent. In South Africa, this was only the case for AS1300.

Standard AS1300 Quality Assessment and Improvement Program

Standard AS1300, Quality Assessment and Improvement Program, addresses internal
and external assessments. CAEs are required to constantly monitor the quality of the

Position in the IAA Percentage of all respondents Percentage of South African respondents

CAE 85.1 95.3

Audit manager 84.3 97.8
Table IV. Audit senior/supervisor 79.7 91.3
Organization that use the Audit staff 81.0 93.5
Standards in whole or in Other 72.2 82.8
part Average of all respondents 81.9 93.9

Percentage of
Percentage of all South African
respondents respondents
Standard Full Partial Full Partial

AS1000 – Purpose and Authority 63.0 25.0 62.0 30.7

ASAS1100 – Independence and Objectivity 66.9 22.2 65.8 26.9
AS1200 – Due Professional Care 62.9 26.1 61.9 31.9
AS1300 – QAIP 40.0 35.7 41.2 37.6
PS2000 – Managing the IAA 57.6 28.9 57.4 31.3
PS2100 – Nature of Work 57.5 28.7 56.8 33.9
PS2200 – Engagement Planning 57.7 29.0 59.5 32.6
Table V. PS2300 – Engagement 59.7 28.2 64.1 30.2
Full and partial PS2400 – Communication of Results 64.1 24.6 70.7 24.1
compliance PS2500 – Monitoring 52.6 32.1 52.3 38.3
with the Standards PS2600 – Resolution of Risks 46.9 30.7 50.7 32.2
 IAA’s work and an external assessment by an independent party is required every five Usage of Internal
years. Low compliance with AS1300 could possibly be attributed to the cost involved Auditing
with having regular quality assessments and/or the lack of experience and skills to
perform both internal and external quality assessments. The low compliance rate for Standards
external assessments may be impacted by the number of years that IAAs have existed
in organizations. As shown in Table III, 28.4 percent of all respondents and 30.2 percent
of those in South Africa indicate that their IAA existed for less than five years at the 891
time of the survey. These IAA’s have to comply with the external quality assessment
requirement every five years of existence so that newer IAAs may comply by the end
of five years of existence.
As quality assessment of the work performed by professionals is a high priority of
the internal audit profession, the CBOK 2006 survey included additional questions
about AS1300. Only 32.8 percent of all respondents and 44.9 percent of the respondents
in South Africa are currently in full compliance with AS1300. Another 21.9 percent of
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

all respondents and 29.8 percent of those in South Africa indicate that they plan to
comply with AS1300 within the next 12 months, while 22.9 percent (11.8 percent in
South Africa) indicate that they do not comply and plan to comply within the next
12 months. Compliance with this Standard appears to be given higher priority in
South Africa than in other countries. This may be attributable to the wide recognition
of the recommendations of the King Committee on Corporate Governance (2002),
recommending IAA’s for organizations and the PFMA recognizing the Standards and
requiring compliance with them (PFMA, 1999).
Response to additional questions regarding compliance with AS1311: internal
assessment and AS1312: external assessment revealed that 35.3 percent of all
respondents and 26.4 percent in South Africa never experienced an internal review and
39.7 percent of all respondents and 33.9 percent in South Africa never had an external
assessment performed in their IAAs. The IIA should consider initiatives to promote
adherence with AS1300 as non-compliance with this Standard affects compliance with
the Standards as a whole and affects the image of the profession. Since 32 percent of
IAA’s in South Africa have existed for less than five years, South Africa should
specifically aim their promotion of quality assurance at the younger IAA’s.

Standard 2600 Resolution of Management’s Acceptance of Risks

Standard PS2600, Resolution of Management’s Acceptance of Risks, was newly
introduced in 2002 and requires of the CAE to bring to the board’s attention any risk
that is not adequately addressed by management. Owing to the complex nature of
this Standard, more guidance may be required to improve compliance with the
Standard.

Adequacy of guidance provided by the Standards

Table VI shows that respondents in general are satisfied with the guidance provided
by each of the Standards. In light of the level of compliance with the Standards
previously discussed, it is expected that the lowest satisfaction ratings are for AS1300
and PS2600 for all respondents and South African respondents. This suggests that
respondents may need more guidance with regard to the implementation of these
Standards. South African respondents are more satisfied with the adequacy of the
guidance provided by all the standards than all respondents. For all respondents, only
 MAJ
Percentage of all Percentage of South African
24,9 respondents respondents
Standard CAE Practitioner Average CAE Practitioner Average

AS1000 – Purpose, Authority and

Responsibility 93.3 83.2 86.2 100.0 90.0 92.1
892 ASAS1100 – Independence and
Objectivity 94.1 85.6 88.1 97.3 92.1 93.1
AS1200 – Proficiency and Due
Professional Care 92.9 84.5 87.0 95.9 90.0 91.2
AS1300 – QAIP 81.5 75.6 77.3 86.3 82.1 83.0
PS2000 – Managing the IAA 90.0 81.0 83.7 93.2 85.5 87.1
PS2100 – Nature of Work 88.0 79.8 82.2 90.5 84.1 85.5
PS2200 – Engagement Planning 89.4 81.2 83.6 88.9 88.7 88.7
PS2300 – Performing the Engagement 89.3 81.5 83.8 87.5 87.2 87.2
PS2400 – Communicating Results 91.3 82.6 85.2 91.7 90.9 91.0
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

Table VI. PS2500 – Monitoring Progress 88.4 79.1 81.8 86.3 86.1 86.2
Adequacy of guidance PS2600 – Resolution of Management’s
provided by each of IIA Acceptance of Risks 81.3 73.8 76.0 87.7 81.3 82.7
Standards Overall average 89.0 80.7 83.2 91.3 87.1 87.0

three Standards have practitioner responses above 82 percent and for PS2600,
a positive response were received from only 73.8 percent of the respondents. With
regard to South African practitioners, more than 80 percent of respondents regard the
guidance provided by the Standards as adequate.

Use of Practice Advisories

Guidance for the Standards is provided by the IIA in the Practice Advisories, which are
highly recommended but not mandatory for all internal auditors. Respondents were
asked about their usage of the Practice Advisories. Their responses are shown in
Table VII. With an average response of more than 90 percent for both CAEs and

Percentage of all Percentage of South African

Practice Advisories respondents respondents

AS1000 – Purpose, Authority and

Responsibility 87.3 95.8
ASAS1100 – Independence and
Objectivity 88.3 94.7
AS1200 – Proficiency and Due
Professional Care 87.7 94.8
AS1300 – QAIP 82.3 93.1
PS2000 – Managing the IAA 86.5 94.6
PS2100 – Nature of Work 85.9 94.9
PS2200 – Engagement Planning 86.5 94.3
PS2300 – Performing the Engagement 87.0 95.0
Table VII. PS2400 – Communicating Results 86.3 95.6
Respondents that use the PS2500 – Monitoring Progress 85.3 92.8
Practice Advisories in PS2600 – Resolution of Management’s
percentages Acceptance of Risks 80.9 91.6
 practitioners for use of Practice Advisories, respondents from South Africa Usage of Internal
(range 91.6-95.8 percent) use the Practice Advisories more than all the respondents Auditing
(range 80.9-88.3 percent). Overall, respondents appear to be using the Practice
Advisories. Standards

The IAA 893

Age of IAA
In 1999, the promulgation of PFMA (1999), requiring all South African public sector
departments to introduce IAAs, could be a contributory factor as to why more
respondents’ IAAs in South Africa (58.0 percent), as per Table III, have been in
existence for ten years or less compared to all the respondents (49.4 percent). Although
a younger department does not equate to a weak or unskilled one, especially if the
training and qualifications of its staff are good, younger IAAs may not be as developed
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

or possess the same level of experience or expertise as more mature IAAs. IAAs are in
place because of the contributions they make to their organization. More regulators,
managements, oversight boards and audit committees are recognizing the IAA’s
importance and value to the organization.

Support of the audit committee

Practice Advisory 2020-2, Relationship with the Audit Committee, gives guidance
regarding the IAA’s Relationship with the Audit Committee. Support from the audit
committee helps ensure the success of the IAA and input from the audit committee is
required in CAE appointment and evaluation. The influence of the King Reports and
the PFMA on corporate governance has had a positive influence on the implementation
of audit committees in South Africa.
While 72.6 percent of all respondents indicate that their organizations have audit
committees, 88.4 percent of the respondents in South Africa note they have an audit
committee. Of those organizations that have audit committees, 63.2 percent of all
respondents and 73.7 percent of South African respondents meet with the audit
committee chairperson outside the regular meetings. For all respondents, 91.3 percent
believe that the IAA has appropriate access to the audit committee. For South Africa,
88.2 percent of their respondents believe that the IAA has appropriate access to the
audit committee. These percentages indicate strong support for the interaction of the
audit committee structure in organizational oversight and IAAs.

Planning
Standard PS2010, Planning, states that CAEs should create an audit plan using a
risk-based technique to determine the priorities of the IAA and ensure that they are
consistent with the organization’s goals. Only CAEs were asked this question. Survey
respondents indicate the following with regard to the annual planning process
conducted by the IAA for all CAEs (South African CAEs):
.
Of all CAEs, 96.8 percent (96.5 percent of South African CAEs) create an annual
audit plan.
.
Of all CAEs, 86.7 percent (91.6 percent of South African CAEs) use a risk-based
methodology in creating the annual audit plan.
 MAJ .
Of all CAEs, 73.1 percent (67.5 percent of South African CAEs) consider
24,9 management requests in creating the annual audit plan.

This shows a universally strong support for the planning attribute Standard.
Consideration of senior management requests is specifically stated in the Standard.

894 Types of audits performed

Standard PS2100, Nature of Work, and the definition of internal auditing include three
broad areas of responsibility for IAAs, namely, to evaluate and contribute to the
improvement of risk management, control and governance processes. Table VIII indicates
the most common types of audits performed by IAAs. The audits performed most are
internal auditing, operational auditing and investigation of fraud and irregularities.
Other work frequently performed includes control framework monitoring,
compliance with corporate governance and regulatory code requirements,
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

information risk assessment and enterprise risk management. IAAs overall spend
the least time on social and sustainability audits and quality and ISO audits.

Value added
Organizations have IAAs because they are perceived to be independent, are designed
to add value and improve an organization’s operations. By bringing a systematic and
disciplined approach to the evaluation and assessment of the effectiveness of
organizational structure and procedure, IAAs help ensure the achievement of
organization goals and strategy. Positive external perceptions of IAAs and their value
added are vital to the IAA’s success and supports requests for funding. The measures
used to assess the value added to organizations may vary, but all are important
indicators to evaluate the success of IAAs. As shown in Table IX, respondents use the
following measures most often to assess the value added by the IAA to the
organization:
.
acceptance of recommendations (51.4 percent all respondents, 55.8 percent
South Africa);
.
customer surveys (34.6 percent all respondents, 55.8 percent South Africa);

Percentage of Percentage of
Type of audit all respondents South African respondents

Internal auditing 85.6 88.4

Operational audits 79.1 83.3
Investigations of fraud and irregularities 56.3 61.0
Financial auditing 56.0 63.5
Management effectiveness review/audit 48.5 57.0
Ethics audits 47.1 50.4
Information technology department assessment 45.4 46.8
Social and sustainability audits 22.7 30.1
Quality/ISO audits 20.5 26.1
Table VIII. Note: Since respondents were asked to mark all that apply, total respondents may not be the same for
Types of audits each activity
 Usage of Internal
All respondents South African respondents
Number of 2,361 CAE Percentage Number of 68 CAE Percentage Auditing
respondents by of respondents by of Standards
Method of evaluation activity respondents activity respondents

Recommendations
accepted/implemented 1,214 51.4 48 55.8 895
Customer/auditee
surveys form audited
departments 816 34.6 48 55.8
Reliance by external
auditors on the internal
audit function 790 33.5 45 52.3
Cost savings and
improvements from
recommendations
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

implemented 688 29.1 22 25.6

Number of management
requests for internal
audit assurance or
consulting projects 632 26.8 37 43.0
Number of major audit
findings 509 21.6 15 17.4
Budget to actual audit
hours 405 17.2 22 25.6
Cycle time form entrance
conference to draft report 256 10.8 11 12.8
Other 256 10.8 10 11.6
Table IX.
No formal measurement
Methods used to measure
of value added 770 32.6 86 30.2
value added by the IAA
Note: The respondents were asked to mark all that apply so the total of percentages may be more by CAE respondents by
than 100 group in percentages

.
reliance by external auditors (33.5 percent all respondents, 52.3 percent South
Africa); and
.
number of management requests (26.8 percent all respondents, 43.0 percent
South Africa).

Of all respondents, 32.6 and 30.2 percent of respondents in South Africa have no formal
measurements of value added.

Perception of IAAs throughout the organization

Respondents were asked how the IAA is perceived throughout the organization. There
is remarkable consistency in results for almost all statements in Table X among
South African and all respondents. Organizations believe their IAAs are independent,
add value and effectively evaluate internal controls. There is less certainty about
perceptions of the effectiveness of the IIA’s approach to risk management and the
evaluation of the effectiveness of governance processes. Strong support for the IAA’s
independence, objectivity and credibility was indicated by the respondents.
 MAJ
Mean of
24,9 Mean of all South African
Statement respondents respondents

Your internal audit function is an independent objective

assurance and consulting activity 4.3 4.3
896 Your internal audit function adds value 4.3 4.2
Internal Audit brings a systematic approach to evaluate
the effectiveness of risk management 4.0 4.0
Your internal audit function brings a systematic
approach to evaluate the effectiveness of internal
controls 4.2 4.3
Your internal audit function brings a systematic
approach to evaluate the effectiveness of governance
processes 3.7 3.8
Your internal audit function proactively examines
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

important financial matters, risks and internal controls 4.0 4.0

Your internal audit function is an integral part of the
governance process by providing reliable information to
management 4.0 4.1
The way our internal audit function adds value to the
governance process is through direct access to the audit
committee 3.6 4.0
Your internal audit function has sufficient status in the
organization to be effective 3.9 3.9
Independence is a key factor for your internal audit
function to add value 4.4 4.3
Objectivity is a key factor for your internal audit
function to add value 4.4 4.4
Your internal audit function is credible within your
organization 4.1 4.0
Compliance with The IIA’s International Standards for
the Professional Practice of Internal Auditing is a key
factor for your internal audit function to add value to the
governance process 3.9 4.2
Compliance with the IIA’s Code of Ethics is a key factor
for your internal audit function to add value to the
governance process 4.0 4.3
Table X.
Perception of IAA within Notes: The mean is the average response to: 1 – strongly disagree; 2 – disagree; 3 – neutral;
the organization 4 – agree; 5 – strongly agree

Internal auditors in South Africa perceive the direct access to audit committee and their
compliance with the Standards and Code of Ethics to be key factors in adding value to
the governance process with means above four (0.3-0.4 above all respondents). This
supports earlier observations that the South African IAAs comply with the Standards
more than all the respondents and that South African IAAs have a higher utilization of
audit committees in their organizations.

Conclusions
As a profession, internal auditing is evolving, as substantiated by the 54 percent
increase in global membership in the IIA in the three years from 2003 to 2006 and
 a 94 percent increase in IIA membership in South Africa. Many IAAs are relatively Usage of Internal
new with 49.4 percent of all respondents’ IAAs being ten years old or less. In South Auditing
Africa, 58 percent of respondents’ IAAs are ten years old or less. Many of the
respondents (31.3 percent) are less than 35 years old. South Africa’s respondents had a Standards
much higher percentage, 57.6 percent, of IIAs that are less than 35 years old.
Legislation around the world has sparked the growth of the profession. The PFMA in
1999, requiring all public sector departments to introduce IAAs, could be part of the 897
reason why South Africa has more young respondents.
The internal auditing profession is vital to an organization’s health and well-being.
In order to live up to such expectations, internal auditors should remain current and
focus on areas which are regarded as important now and in the future. They should
ensure that they have or obtain the skills and competencies necessary to meet their
responsibilities as defined by the internal audit definition and IIA Standards. Almost
95 percent of the IAAs in South Africa indicated that they use the Standards in whole
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

or in part, compared to 85 percent of all respondents. Compliance with Standard

AS1300 is the lowest, although a much higher percentage of the South African IAAs
indicated that they are currently in full compliance with this Standard. Also
encouraging is the finding that over 90 percent of the IAAs in South Africa are using
the Practice Advisories, which is again higher than all respondents’ usage of the
Practice Advisories. Of the South African respondents, 88.4 percent noted that their
organizations have audit committees while the global response is only 72.6 percent.
It is important for the IIA to promote certification of its members and to continue to
provide suitable means of continuing professional development to increase the skills of
those in the profession and to meet the demand for internal auditors. IAAs are
generally understaffed in South Africa and together with the growth in the number of
IAAs there will be a demand for educated and skilled internal auditors around the
world. Internal auditors in South Africa generally have a more focused educational
background with more of the respondents having majors in accounting, auditing and
internal auditing when compared to all respondents. The IIA in South Africa should
take on the responsibility of promoting the value and prestige of internal auditors and
their organizations. Regardless, the internal audit profession in South Africa compares
favorably with the profession world wide.

References
Burnaby, P.A., Abdolmohammadi, M. and Hass, S. (2007), Global Summary of the Common Body
of Knowledge 2006, The Institute of Internal Auditors Research Foundation, Altamonte
Springs, FL.
Coetzee, G.P. and du Bruyn, R. (2001), “The relationship between the new IIA Standards and the
internal audit profession”, Meditari – Accountancy Research, Vol. 9, pp. 61-79.
Erasmus, S. (membership@iiasa.org.za) (2008), IIA (SA) membership growth, e-mail to:
Fourie, H., March 10, 2008.
IIA (2006), “By the numbers”, IIA Insight, Vol. 1, The Institute of Internal Auditors Research
Foundation, Altamonte Springs, FL, pp. 8-9.
IIA (2007), The Professional Practices Framework, The Institute of Internal Auditors Research
Foundation, Altamonte Springs, FL.
King Committee on Corporate Governance (1994), King Report on Corporate Governance for
South Africa, Institute of Directors, Johannesburg.
 MAJ King Committee on Corporate Governance (2002), King Report on Corporate Governance for
South Africa, Institute of Directors, Johannesburg.
24,9 Marais, M. (2003), “Quality control within internal audit functions and the application thereof in
South Africa”, MCom dissertation, University of South Africa, Pretoria.
PFMA (1999), The Public Finance Management Act, Act 1 of 1999, Government Printers,
Pretoria.
898
Corresponding author
Priscilla A. Burnaby can be contacted at: pburnaby@bentley.edu
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

To purchase reprints of this article please e-mail: reprints@emeraldinsight.com

Or visit our web site for further details: www.emeraldinsight.com/reprints
 This article has been cited by:

1. Philna Coetzee, Houdini Fourie, Pricilla A Burnaby. 2015. The growth of the internal audit profession
is more than just numbers. Managerial Auditing Journal 30:6/7, 514-538. [Abstract] [Full Text] [PDF]
2. Abdulaziz Alzeban. 2015. Influence of audit committees on internal audit conformance with internal audit
standards. Managerial Auditing Journal 30:6/7, 539-559. [Abstract] [Full Text] [PDF]
3. Modar Abdullatif, Shatha Kawuq. 2015. The role of internal auditing in risk management: evidence from
banks in Jordan. Journal of Economic and Administrative Sciences 31:1, 30-50. [Abstract] [Full Text] [PDF]
4. Charles W. Bame-Aldred, Duane M. Brandon, William F. Messier, Larry E. Rittenberg, Chad M.
Stefaniak. 2013. A Summary of Research on External Auditor Reliance on the Internal Audit Function.
AUDITING: A Journal of Practice & Theory 32, 251-286. [CrossRef]
5. Priscilla A. Burnaby, Susan Hass. 2011. Internal auditing in the Americas. Managerial Auditing Journal
26:8, 734-756. [Abstract] [Full Text] [PDF]
6. Gerrit Sarens, Mohammad J. Abdolmohammadi. 2011. Factors associated with convergence of internal
Downloaded by Flinders University At 20:48 13 March 2016 (PT)

auditing practices. Journal of Accounting in Emerging Economies 1:2, 104-122. [Abstract] [Full Text] [PDF]
7. B. Marx, T. Voogt. 2010. Audit committee responsibilities vis‐á‐vis internal audit: how well do Top 40
FTSE/JSElisted companies shape up?. Meditari Accountancy Research 18:1, 17-32. [Abstract] [PDF]