Who Ultimately Defines the Value of Internal Audit?
I have recently been reflecting on the added value of internal audit, particularly from the perspective of institutional investors. What initially sparked my interest was the thought that the role, significance and potential value of internal audit may differ considerably across industries. In some sectors, internal audit may play a particularly important role due to the nature of the organisation's activities, its risk environment and the responsibilities it carries.
Based on my reading of academic research, institutional investment organisations appear to represent one such environment. Their responsibility for managing substantial assets over long investment horizons, combined with complex investment activities, risk management requirements and governance expectations, creates a setting in which independent assurance can be especially important.
Research on sovereign wealth funds by Hammer, Kunzel and Petrova (2008), for example, highlights internal audit's role in assessing compliance with investment guidelines, risk management and internal controls. Similarly, a PwC professional article on pension fund internal audit emphasises risk awareness, board-level decision-making and transparency.
These perspectives suggest that internal audit has an established and potentially significant role within institutional investment organisations. But recognising its importance is not quite the same as understanding the value it actually creates.
Who ultimately defines the value of internal audit?
Perhaps the answer is not any single stakeholder. Internal audit provides assurance and insights to different groups, each with its own expectations. The board and audit committee may particularly value independent assurance and confidence in governance and risk management, while senior management may place greater emphasis on practical recommendations and organisational improvement. Investment professionals, in turn, may value insights that help strengthen investment processes, controls and risk awareness.
Botha and Wilkinson (2020) identify five dimensions for evaluating the perceived added value of internal audit: responsiveness, assurance, tangible outcomes, understanding stakeholder needs and reliability. Their research suggests that value is not simply determined by what internal audit delivers, but also by how its work is experienced and perceived by those who rely on it.
However, this raises another question: is perceived value necessarily the same as actual value?
Not always. A well-received audit may strengthen stakeholder confidence without necessarily producing measurable organisational improvements. Conversely, an audit that identifies uncomfortable weaknesses may create substantial long-term value, even if its findings are not particularly welcomed at the time. This distinction is important, particularly when considering internal audit's independence and its responsibility to challenge existing practices when necessary.
What, then, actually enables internal audit to create value?
Professional competence, independence, a risk-based approach and effective communication are clearly important. But I believe we should also look beyond the internal audit function itself.
Vadasi, Bekiaris and Koutoupis (2021) found that audit committee independence, meeting frequency and the evaluation of internal audit activities were positively associated with internal audit professionalisation. Although the study did not directly measure added value, its findings suggest that organisational governance structures can influence the conditions under which internal audit operates.
This leads to an interesting consideration: internal audit may be responsible for delivering high-quality assurance, but its ability to create value also depends on whether the organisation provides the independence, access, support and willingness to act on its findings.
How should value be measured?
Traditional performance indicators, such as audit plan completion rates or the implementation of recommendations, remain useful. However, they primarily tell us what has been accomplished rather than what has changed as a result.
A more meaningful assessment might combine several perspectives: the quality of assurance provided, stakeholder experiences, improvements in governance and risk management, and evidence of organisational changes resulting from audit findings. No single measure is likely to capture the full picture.
For institutional investors, measuring value may be particularly challenging. A significant contribution of internal audit may lie in strengthening investment governance, identifying weaknesses before they develop into significant risks, or improving the reliability of information available to decision-makers. These benefits are not always immediately visible or financially measurable.
Consider, for example, an internal audit that identifies weaknesses in investment risk monitoring before they result in financial losses. The organisation may strengthen its controls and avoid potential consequences. Yet how should the value of that audit be measured when the risk never materialises? The avoided loss cannot be established with certainty, even though the improvement in risk management may be substantial.
This illustrates why evaluating internal audit value requires more than measuring activities or financial outcomes. It also requires understanding the mechanisms through which internal audit contributes to better governance, stronger controls and more informed decision-making.
Previous research provides valuable insights into internal audit value and the governance structures of institutional investors. However, how value is created, developed, perceived and measured within institutional investment organisations themselves appears to warrant further investigation.
Understanding these relationships could help organisations identify which factors most strongly influence internal audit's contribution and how those factors might be strengthened. It could also support a more meaningful dialogue between internal audit, management and governing bodies about expectations, priorities and performance.
Ultimately, perhaps the most important question is not simply whether internal audit creates value, but whether organisations truly understand what that value consists of, what enables it, and how it can be developed further.
And perhaps defining that value should not be the responsibility of internal audit alone.
Cheers,
-Emmi
References
Botha, L. M. & Wilkinson, N. (2020). A framework for the evaluation of the perceived value added by internal auditing. Meditari Accountancy Research, 28(3), 413–434.
Vadasi, C., Bekiaris, M. & Koutoupis, A. G. (2021). The impact of audit committee characteristics on internal audit professionalization: empirical evidence from Greece. Accounting Research Journal, 34(5), 447–470.
Hammer, C., Kunzel, P. & Petrova, I. (2008). Sovereign Wealth Funds: Current Institutional and Operational Practices. IMF Working Paper.
PwC Ireland. Pension Fund Internal Audit and the Three Lines of Defence. Professional article.