This thesis comprises of an initial summary of Study I which is my licentiate thesis in business administration. Study I is a literature study on internal control. Thereafter follows Study II which is a case study of Swedish insurance organization. The case study adopts a contingency perspective and attempts to find environmental and firm-level factors that influence the design, use and outcome of internal control. Study II is a longitudinal study that accounts for key internal-control developments that occurred between 2000-2010. This case study finds that there are two environmental influences that significantly affected internal-control design, use and outcome. They consist of environmental uncertainty and regulatory and supervisory forces. Their influences differ in nature but jointly they act to set boundaries and frame in-ternal-control design, use and outcome. There are two firm-level influences of governance structure and managerial attitudes that act jointly with strategy to affect the design, use and outcome of internal control. While environmental influences set boundaries and frame internal-control work, firm-level contingencies can effectively enable or disable internal-control effectiveness. These firm-level influences provide means and opportunities to internal-control work. My longitudinal research suggests that evolutionary steps have been taken regarding internal-control design and use. In sum these steps correspond to a shift in internal-control orientation and a transformation of practices where Folksam has been moving from a looser towards a tighter form of internal control, with greater transparency in operational risk management. Finally, based on the internal-control principles of the COSO framework I see that particular principles have been enhanced within the Folksam system of internal control. The components of these principles are the control environment, risk assessment and monitoring.

The advent of democracy in 1994 prompted the South African government to provide public goods to the entire population as opposed to providing services along racial lines, as was the case during the apartheid era. Consequently, government expenditure increased considerably. However, continuous service delivery protests in recent years indicate that government has not been operating optimally. The Department of Planning, Monitoring and Evaluation and National Treasury introduced Organisational Performance Management (OPM) to improve service delivery. Government also adopted internal auditing as a mechanism to improve OPM because of internal auditing’s mandate, role and body of knowledge. This study explored the implementation of OPM as a management tool to assist national departments in effectively delivering goods and services to the public economically and efficiently. The study also explored the adoption of internal auditing by national departments as a mechanism to improve OPM. The study followed a sequential mixed methods approach. The chief audit executives of eighteen national departments participated in the quantitative phase. Interviews were held with employees from four national departments as well as two monitoring departments. Departmental officials included five deputy directors-general, three chief directors, four directors, one deputy director and one senior internal auditor. Seven focus group discussions were held with twenty-two internal auditors from the four departments. Sixty-four documents were analysed. The study found that national departments have implemented systems of OPM and the reporting of quarterly performance information but are at different levels of maturity. However, governance and reporting fatigue and a reluctance to implement effective consequence management for poor performance may be undermining optimal performance. National departments may be also preparing strategic plans, annual performance plans and annual reports simply for compliance rather than for optimal performance. The study also found that internal auditors may not have a thorough understanding of the department’s performance environment and consequently undertake limited assessments of OPM, focusing mainly on quarterly performance information (PI) and documentation rather than on organisational strategy. However, management’s expectations from internal auditing go beyond assessing the quarterly PI and require advice and guidance on strategic imperatives. The appropriate skills, knowledge and training of internal auditors therefore require review. Management expects assurance of sustainable future performance of the department. Internal auditing currently stands positioned to make an evolutionary transformation into becoming the most important strategic partner to management. However, under-theorisation and a restricted internal auditing approach inhibit its natural evolution. / College of Accounting Sciences / D. Phil. (Accounting Sciences)

South Africa has institutionalised the application of combined assurance’s Three Lines of Defence Model (TLDM) through the 3rd and 4th editions of the King Code. Albeit, failure of the TLDM has been documented in recent corporate governance scandals in South Africa. These failures point to the inadequacy of the model in its theoretical underpinnings that place more emphasis on compliance than moral development (acts vs virtue ethics). In this research study, the adequacy of the TLDM was assessed, as well as its effectiveness in dealing with Agency. It was further sought to establish whether competitive advantage could be created through TLDM implementation in South African organisations and to quantify in relative terms, the scope for competitive advantage creation through TLDM application. A mixed research methodology (convergent design) was used to gather quantitative and qualitative insights from governance practitioners in South Africa (concurrently over a cross-sectional time frame). 204 survey respondents and 11 interviewees participated in the study. A statistically valid model for creation of competitive advantage was developed from the quantitative findings while a framework for competitive advantage was developed from the qualitative findings. The findings of the study confirm the inadequacy of the TLDM that it lies in poor implementation by South African organisations than in the model’s theoretical underpinnings. It was concluded that competitive advantage can be created though TLDM implementation in South African organisations, and the scope for creation of competitive advantage is relatively significant. The implementation of TLDM with compliance fixation mediates the creation for competitive advantage through TLDM, while moral development focus in TLDM implementation moderates the relationship between TLDM Adequacy in ethics underpinnings and competitive advantage creation. While the inadequacy of the TLDM was established through this study, the support for the TLDM was still overwhelming, although support for additional levels as contemplated in the Five Levels of Assurance Model (FLAM) was considerable. / Graduate School of Business Leadership / D.B.L. (Strategy and Governance)