Corporate governance has received increased attention from both regulators and researchers in recent years resulting in highlighting the significance of the internal audit function (IAF). Another transformative force on the IAF has been the dissemination of enterprise resource planning (ERP) systems which have an impact on the legitimacy of the IAF if it is not suitably adapted. However, there is insufficient knowledge about the adaptations of the IAF which are required if it is to maintain its essential role in governance. This thesis extends our knowledge by exploring and theorising the adaptation of the IAF after ERP introduction. This thesis uses institutional theory as a lens through which to investigate how the IAF responds to the external governance pressures and the internal pressures of the control logic following the introduction of an ERP system. Data were gathered from two listed companies in the food and beverage sector and two large banks operating in Egypt, where one of each pair is an international company and the other is a national company. Interviews and focus groups were conducted with all stakeholders in addition to careful analysis of a number of internal and external documents related to the ERP and the IAF. The study finds that governance pressures related to the IAF determine the legitimisation criteria for the IAF. There is little coercive governance pressure on the IAF in Egypt. However, international companies with operations in Egypt have introduced normative governance pressures as a result of their compliance with stock exchange rules in other jurisdictions. Therefore, mimetic behaviour has helped in transferring the IAF response to ERP implementation. ERP systems carry new control logics based on some interlinked assumptions, which have affected the IAF. The ERP system’s control logic is aligned with the corporate governance goals and objectives, but further alignment is needed to make the best use of the ERP system in enhancing internal control. The introduction of an ERP system produces uncertainty about the IAF’s activities, which motivates it to adapt by changing its practice and structure. The changes in the IAF are dependent on the strategic response adopted by the auditors, which range from acquiescence to defiance. These responses were found to change over time. The differences in responses result in different outcomes for the IAF adaptation. In the international companies the implementation of an ERP system motivates the IAF to be integrated and have a comprehensive scope, whereas in the national companies change was resisted and the role of the IAF was significantly diminished. The IAF’s legitimacy maintaining strategies depend on the coercive and normative governance pressures, which give directions about how to maintain legitimacy. This study offers an explanation of how information systems contribute to the IAF’s professional stability or change and of how macro-governance pressures can bind micro-IAF practice within organisations.

This study examined the standing of the internal audit function in 30 of South Africa’s large listed companies as perceived by the chairs of their audit committees, their chief executive officers, chief financial officers, and chief operating officers, as well as the chief audit executives. The standing of the internal audit function in these 30 companies was based on the academic and professional qualifications profiles of the chief audit executives, the composition and qualifications of the internal audit staff complement, the independence of the function and the expectations that various stakeholders have of the function. The study reveals that the overall standing of the internal audit function in these 30 companies was perceived to be high. However, there are a number of concerning aspects that include the fact that most of the chief audit executives are qualified and registered South African Chartered Accountants (CA(SA)) and not holders of the Certified Internal Auditor (CIA) qualification. Additional concerns are that the chief audit executives’ reporting lines are not necessarily in line with currently perceived best practices; the stakeholders surveyed for this study held diverse views of the internal audit function; and in-house internal audit functions were viewed to be of a higher standing than those of outsourced functions. This study provides the internal audit profession with a scientifically researched benchmark of their status or standing in the eyes of their stakeholders and will enable them to measure changes to their status and effectiveness within their companies.

With the passage of Sarbanes-Oxley in 2002, external auditors face a new regulatory inspection process in addition to an increase in litigation (or engagement) pressure. It has been communicated that this new inspection process will place an increased emphasis on the efficiency of integrated audits while maintaining the same level of effectiveness. In an experiment, I explore how external auditors’ reliance decisions on the internal audit function will be affected by different inspection focuses, varying levels of engagement risk, and the level of risk associated with the audit test or procedure. While I expect that there will be significant main effects for inspection focus, engagement risk and the riskiness of the audit test, I explore the potential presence of a three-way interaction between these three factors. My findings suggest that the auditor reliance decisions are impacted by differing levels of engagement risk, the focus of the inspection process, and the riskiness of the audit tests. In general, as engagement risk increased, auditors’ reliance decreased. Also, as the riskiness of the audit test increased, auditors placed less reliance on the internal audit function. However, when the focus of the inspection changed, these factors interacted with one another. Specifically, when auditors faced a focus of both effectiveness and efficiency, their reliance decisions increased as engagement risk and riskiness of the test decreased, but when auditors faced a focus of effectiveness only, their reliance decisions were not impacted by the engagement risk when the riskiness of the test was high. Thus, the impact of engagement risk on auditors’ reliance decisions depends on the focus of the inspection process and the riskiness of the tests.

<p>The Swedish Code for Corporate Governance was introduced on July 1, 2005. All companies then listed at OM Stockholmsbörsen A-list and those on the O-list with a market value of more than three billion SKr must implement the rules in the Code. The Code includes rules for corporate governance as a complement to the legislation. The Code is based on the principle comply or explain. This means that the companies are aloud to diverge from the rules if they explain why. The reason for this principle is that it enables a much higher level of ambition in the Code than if it would be legislated.</p><p>The Swedish Code for Corporate Governance has introduced much tougher rules on internal control than the existing legislation demands. The Code demands a good internal control without defining what it means. The idea is that the companies themselves are responsible for developing a standard for good internal control. It also includes that the board should sign an annual report about the companies internal control and establish a special internal audit function for evaluating the internal control system.</p><p>The main purpose with this paper is to study the implementation of the Code in Swedish companies concerning the rules on internal control of the financial reporting.</p><p>The paper is limited to the companies listed at OM Stockholmsbörsen former A-list which apply with the Code. Five companies are being interviewed on their work with internal control. All companies at the former A-list are included in the study of the existence of an internal audit function.</p><p>The paper is based on both secondary and primary data, mainly focused on the latter. The secondary data is collected from literature, journals, internet and annual reports from the companies included in the study. Primary data has been collected via e-mail and telephone contacts. One of the interviews was done via telephone and the others through meetings at the companies head offices.</p><p>The study shows that exactly half of the companies have an internal audit function and the existence of the function is strongly related to the ownership structure. Only companies with a wide spread in ownership and nationalized companies has the function.</p><p>There is a great uncertainty about what good internal control means. A suitable solution to apply with the rules in the Code is therefore to use COSO’s definition and recommendations on internal control. The framework also includes guidelines on how to evaluate and improve internal control.</p>

The Swedish Code for Corporate Governance was introduced on July 1, 2005. All companies then listed at OM Stockholmsbörsen A-list and those on the O-list with a market value of more than three billion SKr must implement the rules in the Code. The Code includes rules for corporate governance as a complement to the legislation. The Code is based on the principle comply or explain. This means that the companies are aloud to diverge from the rules if they explain why. The reason for this principle is that it enables a much higher level of ambition in the Code than if it would be legislated. The Swedish Code for Corporate Governance has introduced much tougher rules on internal control than the existing legislation demands. The Code demands a good internal control without defining what it means. The idea is that the companies themselves are responsible for developing a standard for good internal control. It also includes that the board should sign an annual report about the companies internal control and establish a special internal audit function for evaluating the internal control system. The main purpose with this paper is to study the implementation of the Code in Swedish companies concerning the rules on internal control of the financial reporting. The paper is limited to the companies listed at OM Stockholmsbörsen former A-list which apply with the Code. Five companies are being interviewed on their work with internal control. All companies at the former A-list are included in the study of the existence of an internal audit function. The paper is based on both secondary and primary data, mainly focused on the latter. The secondary data is collected from literature, journals, internet and annual reports from the companies included in the study. Primary data has been collected via e-mail and telephone contacts. One of the interviews was done via telephone and the others through meetings at the companies head offices. The study shows that exactly half of the companies have an internal audit function and the existence of the function is strongly related to the ownership structure. Only companies with a wide spread in ownership and nationalized companies has the function. There is a great uncertainty about what good internal control means. A suitable solution to apply with the rules in the Code is therefore to use COSO’s definition and recommendations on internal control. The framework also includes guidelines on how to evaluate and improve internal control.

none

Je développe ici une nouvelle évaluation de la qualité de la fonction d'audit interne (FAI) basée sur des données d'entrée et j'examine les facteurs qui poussent les entreprises à mettre en place une FAI de haute qualité ainsi que les conséquences économiques d'une FAI de haute qualité. Afin de rendre opérationnelle mon analyse empirique, je crée un échantillon d'archivage de FAI international unique en associant une enquête d'auditeur interne menée au niveau international intitulée CBOK 2010 à des données publiques présentes dans la base de données Worldscope. En me basant sur les Normes Internationales pour la Pratique Professionnelle d'Audit Interne proposées par l'Institut des Auditeurs Internes, je mesure la qualité de la FAI en fonction des attributs et des pratiques de FAI souhaitables qui prennent en compte la compétence (1), l'indépendance (2), les pratiques de reporting et de planification (3), et les pratiques d'amélioration et de vérification de la qualité (4) de la FAI. En ce qui concerne les facteurs décisifs de la qualité de la FAI, je constate que la qualité de la FAI est affectée par les cadres opérationnels et les caractéristiques d'autres mécanismes de gouvernance des entreprises y compris les mesures incitatives de supervision du conseil d'administration, la diligence du comité d'audit et les pouvoirs du PDG. En outre, les mesures incitatives des entreprises destinées à une FAI de haute qualité sont renforcées par les exigences strictes et détaillées en matière de FAI présentes dans les codes de gouvernance d'entreprise des pays. Enfin, je documente le fait que d'autres mécanismes de gouvernance, en particulier les mesures incitatives de supervision des directeurs, jouent un plus grand rôle pour influencer la qualité de la FAI lorsque le cadre réglementaire dans son ensemble est fragile. En ce qui concerne les conséquences économiques d'une FAI de haute qualité, j'aborde le rôle que joue la FAI pour fournir des services de vérification en matière de reporting financier et je constate que la qualité de la FAI est associée de manière positive à la qualité des revenus. En prenant en compte l'implication croissante de la FAI dans la gestion du risque et les initiatives stratégiques, qui a pour conséquence le fait que la FAI joue un rôle accru pour fournir des services de consulting appropriés aux opérations des entreprises, je fournis en outre les preuves qu'une FAI de haute qualité est importante pour la performance opérationnelle des entreprises. Je documente de manière spécifique le fait que la vitesse de reprise de la performance opérationnelle suite à la crise financière récente est considérablement plus rapide pour les entreprises qui bénéficient d'une FAI de haute qualité que pour les entreprises dont la FAI est de mauvaise qualité, et que la qualité de la FAI est associée de manière positive à la bonne capacité d'investissement des entreprises au cours de la période post-crise financière. De plus, je constate que le degré d'implication de la FAI dans les activités de consulting stratégique a un effet positif incrémentiel sur la reprise de la performance, ce qui suggère que fournir des services de consulting est une façon importante pour la FAI de procurer de la valeur aux entreprises. Les bénéfices d'une telle expansion des activités de consulting ont cependant un coût pour les entreprises dont la FAI est de mauvaise qualité, car je constate que l'implication de la FAI dans le consulting stratégique peut nuire au rôle que joue la FAI pour fournir des services de vérification et par conséquent affecter de manière négative la qualité des revenus lorsque la qualité de la FAI est mauvaise mais non pas lorsque la qualité de la FAI est bonne. De manière générale, ces constatations suggèrent que si l'on s'attend à ce que la FAI procure de la valeur aux entreprises en fournissant à la fois des services de vérification et de consulting, il est alors essentiel de maintenir un niveau de qualité de FAI adéquat. / I develop a new input-based measure of internal audit function (IAF) quality and investigate the factors that incentivize firms to establish a high-quality IAF as well as the economic consequences of a high-quality IAF. To operationalize my empirical analysis, I construct a unique, international archival IAF sample by matching a proprietary global internal auditor survey named CBOK 2010 with public data in the Worldscope database. Based on the International Standards for the Professional Practice of Internal Auditing proposed by the Institute of Internal Auditors, I measure IAF quality by desirable IAF attributes and practices which encompass the IAF’s (1) competence, (2) independence, (3) planning and reporting practices, and (4) quality assurance and improvement practices. Regarding the determinants of IAF quality, I find that the IAF quality is affected by firms’ operating environments and features of other governance mechanisms including board monitoring incentives, audit committee diligence, and CEO power. Moreover, firms’ incentives for a high-quality IAF are bolstered by strict and detailed IAF requirements in countries’ corporate governance codes. Finally, I document that other governance mechanisms, especially the monitoring incentives of directors, play a greater role in influencing the IAF quality when the overall regulatory environment is weak. Regarding the economic consequences of a high-quality IAF, I first address the role of IAF in providing assurance services in financial reporting and find that IAF quality is positively associated with earnings quality. Considering the increasing involvement of IAF in risk management and strategic initiatives, which leads to an expanded role of IAF in providing consulting services relevant to firms’ operations, I further provide evidence supporting that a high-quality IAF matters for firms’ operating performance. Specifically, I document that the speed of operating performance recovery after the recent financial crisis is significantly quicker for firms with a high-quality IAF than for firms with a low-quality IAF, and that the IAF quality is positively associated with firms’ investment efficiency in the post-financial-crisis period. In addition, I find that the extent to which the IAF is involved in strategic consulting activities has an incremental positive effect on performance recovery, which suggests that providing consulting services is an important way for the IAF to deliver value to firms. However, the benefits from such an expansion of consulting activities comes at a cost in firms with a low-quality IAF, as I find that the IAF’s involvement in strategic consulting can impair the IAF’s role in providing assurance services and hence negatively affects earnings quality when the IAF quality is low but not when the IAF quality is high. Overall, the findings suggest that if the IAF is expected to deliver value to firms by providing both assurance and consulting services, maintaining an appropriate level of IAF quality is essential.

財務再保險係屬於新興的風險移轉方式之一，除了可以移轉傳統再保險之核保風險外，更可以將保險公司有很多無法以傳統再保險獲得分散的風險，如時間風險、投資風險等財務風險移轉出去。財務再保險可以增加保險公司的盈餘及提升經理人的績效，同時能減少潛在的危險暴露，避免準備金提存不足的問題，並且可以增加保險公司的承保能量，資助新契約的成長，兼具風險管理與財務規劃的新興工具。 相對的，財務再保險的實施，也延伸出相關的問題，如財務再保險係為融資借貸關係，而非實質危險轉移；因為準備金提存不足，無法支付未來重大的損失；為了掩飾盈虧，而誤導投資大眾。HIH與AIG集團涉及以財務再保險契約粉飾財務報表的行為，顯示財務再保險契約所造成的監理漏洞，另一方面，保險公司若不注重其企業本身營運的風險管理，而是以財務再保險契約尋求穩定公司收益的財務揭露，對於保險公司的長期經營並不是一件好事，同時對於投資人、監理機關的管理亦影響甚鉅。 除了監理機關對於財務再保險應加以規範外，保險公司內部之內部控制與內部稽核在企業中亦扮演重要角色。本研究就HIH與AIG集團兩個案之財務再保險問題，收集截至2005年HIH相關人員被澳洲保險監理機關起訴之起訴理由，與AIG被美國監理機關起訴人員的相關資料，分析這些被起訴原因之內部控制缺失，強調財務再保險內部控制與內部稽核的重要性，最後，針對保險公司實施財務再保險提出建議，同時對保險監理機關監管財務再保險也提出建議，希望對國內保險業者實施財務再保險有所助益，同時，也作為保險監理機關監管財務再保險的參考。 / Financial reinsurance is one of the alternative risk transfer arrangements. Unlike the traditional reinsurance arrangement where only the underwriting risk is transferred, other risks such as time risk and investment risk may also be transferred through such arrangement. Financial reinsurance increases an insurance company’s earning and the managers’ performance, and hence decreases the exposures of reserve inadequacy. Additionally, it is also a new tool for risk management and financial planning for its positive impact on new business growth through the enhancement on the company’s underwriting capability. On the other side, the use of financial reinsurance also leads to some problems. Specifically, when it is structured as a financial lease without any physical transfer of risks and used to window-dress poor financial performance in order to mislead the investors. Two international insurance companies, namely HIH (Health International Holdings) and AIG (American International Group), have tried to use the financial reinsurance arrangements to window-dress their financial statements in order to deceive the regulators. From a long term perspective, financial reinsurance arrangements used for stabilizing the financial results instead of enhancing risk management would certainly be detrimental to investors and insurance regulators. Besides the regulators who need to set up the regulations on financial reinsurance, the internal controls and internal auditing functions within insurance company also play an important role in terms of supervision. This thesis focused on two real life cases related to HIH and AIG by studying their problems with financial reinsurance and colleting the people being prosecuted by Australia regulator (APRA) and SEC as of the end of 2005, the internal control weaknesses caused by them and finally emphasizing the important of internal controls and internal audit function. Lastly, after studies these two cases, recommendations are made to insurance companies and local regulator on how to manage the use of financial reinsurance. Hopefully these suggestions would be helpful to them.

Bakgrund: Under år 2001 bröt den så kallade Enron-skandalen som innebar bokföringsaktiviteter och insiderhandel. Den interna kontrollen samt övervakning av denna funktion blev efter skandalen mer uppmärksammad. Det anses viktigt att ha någon sort granskningsfunktion för att nå ett välfungerande arbete med den interna kontrollen, vilket är internrevisionsfunktion (Internal Audit Function, IAF). Syftet med IAF har under åren förändrats. Tidigare syftade funktionen till att granska redovisningsinformation, medan det idag mer handlar om granskning kring riskhanterings-, kontroll- och styrningsprocesser. Andra händelser som Sarbanes-Oxley Act (SOX) och finanskrisen som skedde under år 2002 samt under åren 2007-2008, medförde en ökad förståelse kring vikten av verksamhetsstyrning, riskhantering och bolagsstyrning. Syfte: Studien syftar till att förklara vilka faktorer som påverkar ett bolags val om att följa koden gällande IAF, samt dess informationsinnehåll i förklaringen till sitt val. Metod: Uppsatsen grundar sig på en kvantitativ tvärsnittsstudie med en deduktiv forskningsansats. Det är en dokumentstudie som har genomförts där det empiriska materialet inhämtats främst från årsrapporter, men även hemsidor som Holdings och Nasdaq. Urvalet utgår från large-cap listorna från åren 2016 till 2017. Slutsats: Utifrån studiens 34 hypoteser har det hittats totalt nio stycken signifikanta samband mellan de beroende och oberoende variablerna. Det har framkommit ett större antal samband till den beroende variabeln följer, jämfört med den andra beroende variabeln informationsinnehåll. Med variabeln följer har studien hittat sju stycken samband och två stycken samband med variabeln informationsinnehåll. / Context: In 2001, a scandal involving accounting and insider trading, called Enron scandal, occured. The internal control and monitoring of this function became more noticeable after the scandal. Now, it is considered important to have some sort of audit function in order to achieve a well-functioning internal control. This function is called Internal Audit Function, IAF. Over the years, the purpose of IAF has changed. Previously, the function of reviewing accounting information was targeted, while today it is more about reviewing risk management, control and control processes. Other occurrences such as the Sarbanes-Oxley Act (SOX) and the financial crisis that occurred in 2002, as well as in 2007-2008, led to an increased understanding of the importance of business management, risk management and corporate governance. Purpose: The aim of the study is to explaining what factors affect a company's choice to follow the code of IAF, as well as its information content in the explanation of its choice. Method: The essay is based on a quantitative cross-sectional study with a deductive research approach. It is a documentary study that has been conducted where the empirical material was obtained mainly from annual reports, but also websites such as Holdings and Nasdaq. The selection is based on the large-cap lists from 2016 to 2017. Conclusion: Based on the 34 hypotheses of the study, a total of nine significant relationships between the dependent and independent variables have been found. There has been a greater number of connections to the dependent variable following, compared to the second dependent variable information content. With the variable following, the study found seven links and two related to the variable information content.

This study was conducted to generate an in-depth understanding of key internal audit function (IAF) customers’ perceptions of the work performed by the Department of National Treasury’s IAF. This study was further intended to address the absence of any qualitative study of IAF customers’ experiences and expectations, and their perceptions of the challenges the IAF faces. The study had five research objectives, namely: to identify the role of the IAF in the public sector in relation to its customers; to discuss strategies to meet the expectations of IAF customers; to determine the experiences of the identified key IAF customers of the work performed by the IAF in the National Treasury; to determine the expectations of the identified key IAF customers of the IAF in the National Treasury, and to ascertain what the identified key IAF customers perceive to be challenges facing the IAF in the National Treasury. In order to achieve the research objectives, the study implemented a qualitative research design using the National Treasury as a case study. Data were collected through semi-structured interviews with participants selected from the key IAF customers’ categories (comprising the audit committee (AC), executive and senior managers, programme and operating managers, and external auditors). Three main themes emerged from the identified key customers’ views. These were (1) Experiences, which revealed that the participants were reasonably satisfied with the work of the IAF in the National Treasury. Participants from the AC, the executive and senior managers, and the Auditor General of South Africa (AGSA) felt that the IAF does add value, while the programme and operating managers participants indicated that the IAF does not demonstrate a holistic view when it conducts evaluations. (2) Expectations, the AC participants expected the AGSA to be able to rely on the work of the IAF, that the IAF should maintain a findings register, and that it should demonstrate IT skills. Executive and senior managers participants expected the IAF to add value to the strategic direction of the National Treasury. Programme and operating managers participants expected the IAF to be open and consultative, to set realistic audit plans, to provide regular feedback, and to demonstrate knowledge of the business. The AGSA participants called for the IAF to demonstrate technical competencies as well as independence and objectivity. (3) Challenges, participants perceived the IAF’s lack of knowledge of the business, the limited reliance placed on its work by the AGSA, the lack of audit action monitoring processes and the lack of management support for the IAF as its biggest challenges. This study could benefit the National Treasury’s IAF by helping it to understand the changing needs and expectations of its customers, and to identify areas for improvement. It may also benefit professional audit bodies and the newly-established National School of Government by providing them with insights into the training needs of internal auditors, and the necessity of providing continuing professional educational programmes. / Auditing / MCom (Auditing)