The IIA defines IA as an “independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes” (IIA 2020). Furthermore, the IIA offers an additional explanation for the added value: “The internal audit activity adds value to the organization (and its stakeholders) when it provides objective and relevant assurance, and contributes to the effectiveness and efficiency of governance, risk management, and control processes” (IIA 2020). Finally, the mission statement of the IIA added a supplementary perspective: „To enhance and protect organizational value by providing risk-based and objective assurance, advice and insight” (IIA 2020).

Based on IIA’s definition, mission statement and additional explanation, the added value seems to be clear at the first sight. Nevertheless, since the potential areas where the IA can be used are so manifold, the value discussion is based on a) the concrete activities performed and results delivered by the IA and b) the specific stakeholder needs and roles IA has to fulfill.

Beside the definition from the professional regulator, the scientific literature offers a broad variety of possible positive effects of the IAF and thus also possible value definitions. E.g. Gramling et al. (2004) define IA as an effective tool to monitor and improve corporate governance and see the strongest value of IA in the improvement of the corporate governance framework. This perception of the added value of IA is substantiated by numerous subsequent papers (e.g. Goodwin-Stewart and Kent 2006; Archambeault et al. 2008). Sarens and Abdolmohammadi (2011) verify this finding by stating that IA performs a monitoring role in corporate governance, and furthermore show that IA reduces information asymmetries between the audit committee and management. However, recent studies argue that IA does not sufficiently fulfil its “governance oversight role” (Leung et al. 2011) and thus stakeholders’ expectation of the IA function are significantly lowered (Chambers and Odar 2015).

In sum, this stream of the literature focus on monitoring tasks of the IAF. Since the audit committee and the senior management is not able to audit and monitor all governance-related activities and processes, they rely on internal auditing as an independent and objective support function.

Al-Jaifi et al. (2017), in their analysis of the relationship between the strength of corporate governance and stock market liquidity in Malaysia, found that companies with strong corporate governance - and strong internal audit - have a positive effect on their stock market liquidity. Mihret (2014) departs from the traditional perspective of IA and considers it a control mechanism that creates added value by increasing the return on capital. Prawitt et al. (2009) find in their study that internal audit reduces the use of so-called earnings management (the use of accounting techniques to create financial statements that present an overly positive view of a company’s business activities and financial position) and thus, enhances the quality of financial reporting.

Jiang et al. (2016) find that IAF’s involvement in operations-related services has a significant positive association with operating performance. Furthermore, the authors separate the IAF activities into traditional areas (e.g., operational audit) and more business-oriented services (e.g., strategy consulting), and show that the assurance services in the traditional areas are prevalent in the IAFs whereas advisory and consulting services are less frequent. Carcello et al. (2017) find that IA improves risk management; while Lin et al. (2011) document in their study that IA helps to improve internal control systems. Oussii and Taktak (2018) show also a positive effect from IA on the quality of the internal control system. In this context, stricter environmental regulations and rising expectations for corporate sustainability have become a very recent subject for the internal control topic. Trotman and Trotman (2015) find that IA plays an important role in the disclosure and reporting of greenhouse emissions and energy consumption, however they state that this topic will get even more attention in the future.

Altogether, this stream of research tries to identify positive financial effects of internal auditing, since it is more than a “cost center” and creates value in different areas.

Furthermore, the work of the IA can also lead to a change in the costs of the external audit (Felix et al. 2001). Abbott et al. (2012) in particular substantiate this in the course of their study. They identify that the performance of IA increases the efficiency of the overall audit volume, which benefits both, the company and the external audit firms. But there is no consistent position in the literature on what this change looks like or whether it is exclusively positive or negative from an organizational perspective. On the one hand, it is argued that the effectiveness of IA leads to a reduction in the costs of the external audit, especially if IA covers areas of work relevant to the audit from an external perspective, such as accounting or fraud prevention and identification (Abbott et al. 2012; Ho and Hutchinson 2010). On the other hand, there have been studies which have concluded that this relationship is not correct, as organizations may view the work of internal auditors and external auditors as complementary rather than substitutes (Singh and Newby 2010). Accordingly, a strong internal audit function in an organization implies a high level of risk and audit awareness on the part of management and thus a greater willingness to pay for the external audit in order to strengthen the overall control environment (Alzeban and Sawan 2016; Singh and Newby 2010). Other papers focus on the collaboration of internal and external auditors and look for success factors (e.g. Al-Twaijry et al. 2004).

A huge body of research covers the effects of internal auditing on the external auditor. Internal auditing could influence external audit fees and the external audit quality. Other papers address the reliance decision of the external auditor and look for factors that could impair this reliance.

A further added value of the work of IA, especially through its assurance activities, is its impact on the issue of fraud. According to this, an effective IA has a positive influence on the prevention and identification of fraud from the company’s perspective. This influence increases the more responsibility the IA assumes in this area and the more training the internal auditors complete in this area (Drogalas et al. 2017). While the prevention and identification of fraud cases can be achieved through direct action by internal audit, the indirect influence of promoting the ethical culture in organizations is also part of this added value (Ma’ayan and Carmeli 2016). In this context, Asiedu and Deffor (2017) have highlighted the influence of IA on corruption in public city, municipal and district administrations in Ghana and found that IA reduces corruption. Coram et al. (2008) find a positive correlation between IA and the detection of fraud, which strengthens the internal control system.

Studies about internal auditing and fraud focus on the traditional understanding of an internal auditor. Someone who looks for irregularities in the organization made by a fraudster. Although this seems to be one of the origins of internal auditing, fraud detection and prevention is still a topic with relevance for organisations around the world.

Other papers discuss the value of the IA through the implementation of a so-called Management Training Ground (MTG) (Carcello et al. 2018). But the added value provided by an MTG setting is controversial in the literature. The fact that this concept is frequently used in practice can be interpreted as a positive added value from the management perspective (Rose et al. 2013). Carcello et al. (2018) found that one of the reasons for implementing an MTG approach is that confidence in the auditors’ recommendations is higher when the internal audit is used as an MTG, as the natural talent and organization-specific knowledge of the auditors is more pronounced in an MTG environment. In conclusion, increased confidence in the recommendations of the internal auditors can be seen as an increased willingness to implement them, which in turn strengthens the potential added value that can be achieved through internal auditing. Another reason for the increase in value added by Internal Audit as an MTG is the opportunity for auditors to deepen their knowledge of the organization in which they operate and to gain experience in leadership skills (Bond 2011; Rose et al. 2013). However, according to the literary discussion, this added value is also countered by the negative effects of using Internal Audit as an MTG environment, which could counteract the added value of Internal Audit in its role as an auditing body. These include the declining quality of financial reporting, which can only be offset by compensatory controls (Christ et al. 2012). It would also offset the potential effect described above that internal audit could reduce the cost of external audit, as organisations pay higher audit costs when their internal audit is used as an MTG (Messier et al. 2011). This may be related to the fact that in such a case, the confidence of auditors in the objectivity and independence of the auditors and their performance is lower (Rose et al. 2013). Most of prior MTG studies focus on the effects of MTG on the reliance decision of external auditors and often operationalize IA activities in the context of financial audits. Nevertheless, in most of the European countries, IAFs typically cover a much broader range of activities and do not necessarily focus on internal controls and financial audit. In sum, we find a dominant position of US research papers in the field of internal audit, which might lead to differences in the understanding and valuation of IA.

The research about MTG apply a common practice: Using the internal audit function as a perfect place to develop employees to future managers. Since an internal auditor has to understand internal controls, risk management and good governance in the organization, identify weaknesses and look for potential improvements, an internal auditor is trained to improve the governance and processes in a company.

Although there is a clear and precise definition of what IA is and should do, the actual role IA has within an organization is also important (see e.g. Roussy and Perron 2018). The role an organization assigns IA can either focus on advisory, meaning IA is expected to establish productive relationships both with the management of an organization as well as with other stakeholders (Arena and Azzone 2009; Van Peursem 2005), or IA’s role focuses on assurance for the audit committee and CEO/CFO. In this case, the IA has primarily the responsibility to audit the effectiveness of the internal control system, the risk management and the governance processes from an independent, and thus objective, position (Van Peursem 2005). While there are still negative stereotypes of internal auditors (e.g. Eulerich et al. 2019), especially the Global IIA promotes a more positive role model of IA. Richard Chambers, the president of the IIA, suggests the role of IA to be a “trusted advisor”. Nevertheless, depending on the specific stakeholder (CEO/CFO; Audit Committee; Auditee; External Auditor, Regulator; etc.) the expected role model of IA may vary significantly. Furthermore, IA’s self-perception and the stakeholders’ perception of IA’s role may differ.

Soh and Martinov-Bennie (2011) show that while heads of IA see the focus of their department’s activities on advisory, AC members emphasize IA’s assurance function. The authors also argue that the role of IA is complex and constantly evolving, and therefore cannot be limited to a mere governance oversight function. Comparable findings are offered by Lenz and Sarens (2012) as they state that there is not one single truth for IA’s role and value creation because of the numerous different stakeholders IA serves. Sarens et al. (2009) call IA a “comfort provider” of the AC, as the latter expects IA to be “guard of the corporate culture” and to act as a communication instance between the AC and the operational level. Roussy (2013) describes IA as “protector” and “helper” for the organization and the organization’s management. As a protector it guards the management regarding risks, fraud cases or inefficiencies, and as a helper it supports the management by giving recommendations to improve organizational performance.

Carcello et al. (2005) show that IA adjusts as organizational or environmental circumstances change. For instance, if actual and perceived risks increase, IA will most likely be assigned the function of a “risk management expert” (Vinnari and Skaerbaek 2014) because it is familiar with the internal control processes of an organization (Spira and Page 2003).

IA as a “comfort provider” also supports the AC by auditing and evaluating risk management, internal controls and governance processes (Soh and Martinov-Bennie 2011). As part of its audit and advisory activities, IA can monitor risks, identify weaknesses in the control systems, facilitate the implementation of enterprise risk management, and raise awareness of these issues among management at the same time (Arena and Azzone 2009). It thus has the ability to support management and the board in achieving their objectives (Goodwin and Yeo 2001). Through personal contact with employees, IA can also help to maintain, shape and improve the corporate culture (Sarens and De Beelde 2006).

In their study, D’Onza et al. (2015) identify four factors that are positively related to the creation of value by IA: IA’s independence and objectivity, compliance with the IIA’s Code of Conduct, IA’s contribution in assessing the effectiveness of internal controls, and IA’s contribution in assessing the effectiveness of the risk management system. The independence and objectivity of the IAF and its contribution to assessing and improving internal controls and the risk management system have a positive impact on the added value that IA generates for the organization. The authors confirm that the added value generated by IA depends on its active role in strengthening the effectiveness of internal controls and the risk management system. They also highlight the importance of complying with the IIA Code of Conduct in creating value. In this way, IA is able to demonstrate to its stakeholders that its work and its results are carried out at a professional level. Mihret and Woldeyohannis (2008) note that for companies facing strict regulatory requirements, IA adds more value by performing compliance audits instead of advisory activities. It is interesting to see, that some authors derive a potential role for the IA based on their empirical findings, while others develop a role model, based on theory or prior practical experience.

Based on the different areas where IA can be used, the described models show the variety of potential roles IA has to present. While some IAs focus on one specific role, others try to create their own role model merging two or more aspects.

In order to measure the value creation and the effectiveness of the IA department, a performance measurement system can be used. The system consists of a set of metrics, which quantify the effectiveness and the efficiency of IA’s actions and hence its value creation (Rupšys and Boguslauskas 2007). In this context, the corresponding literature discusses various key performance indicators (KPI) (Eulerich and Lenz 2020).

First, the number of completed IA actions, i.e. audits and audit reports, can be used to measure IA performance (Soh and Martinov-Bennie 2011; Ziegenfuss 2000). Besides completed IA actions, the implementation of recommendations from IA to senior management are also regarded as an indicator of IA performance (Dumitrescu et al. 2014; Soh and Martinov-Bennie 2011; Ziegenfuss 2000). Both indicators can be interpreted in absolute terms or as a ratio comparing planning and actual numbers for a defined observation period (Boţa-Avram and Palfi 2009; Savčuk 2007; Soh and Martinov-Bennie 2011).

Second, the qualification and skills of auditors in the department is regarded to have strong influence on the added value created by IA. Thereby, the qualification and skills of auditors could either be recorded simply by the number of existing certification (Boţa-Avram and Palfi 2009), or otherwise the average time spent on trainings serves a as measure (Rupšys and Boguslauskas 2007).

Third, value creation can also be linked to senior management’s demand for IA services, as this means additional activity for the IA department (Rupšys and Boguslauskas 2007). Vice versa also recommendations made by IA or IA’s proactive addressing of risks and process improvements should be considered as a possible figure giving information about value creation by the department (Roussy and Brivot 2016; Soh and Martinov-Bennie 2011).

Fourth, the quality of the IA department’s operational work can be measured by hours of actual field work (Rupšys and Boguslauskas 2007). Furthermore, a detailed report describes whether planned time slots for audits, administrative activities etc. are complied with (Boţa-Avram and Palfi 2009).

Finally, the effect of IA actions on a company’s standard KPIs, like e.g. EBITDA (Earnings before Interest, Depreciation and Amortization) or liquidity, can be used to measure value creation as well (Lenz and Hahn 2015).

For those determinants that are not collectable via metrics, a different approach is needed. In order to include qualitative determinants into the list of factors that impact the value creation of IA, techniques like e.g. interviews, post-engagement surveys, or 360 degree feedback are possible approaches to gain information.

Soh and Martinov-Bennie (2011) consider the relationship of IA with the audit committee (AC) and the senior management as crucial for creating added value. In particular, they refer to appropriately designed reporting lines and to the support offered to IA as being decisive for IA’s performance. Thereby, the AC could support IA by reviewing and approving audit planning, audit budget, audit objectives or the use of external resources, thus ensuring that the IA department is adequately equipped. Furthermore, the AC’s support to the Chief Audit Executive (CAE) is assumed to positively influence the performance of the whole IA department, whereas Soh and Martinov-Bennie (2011) especially emphasize the otherwise isolated role of CAEs.

Erasmus and Coetzee (2018) empirically analyze the AC’s and the senior management’s perception of the IA department and factors that influence IA’s performance. From the senior management’s point of view, the key ingredient for IA’s success is that IA work is not restricted. Only if IA can access human and other resources as well as every area and process within a company that is of interest within the scope of IA activity, IA will be able to fulfil its assigned role and to potentially uncover fraudulent behavior. Moreover, the auditors’ competence level together with a professional attitude is considered an important factor for IA’s performance (Erasmus and Coetzee 2018). From the AC’s point of view the positioning of IA within the organization as well as the roles assigned to IA are crucial for the IA department’s success. An optimal positioning of IA ensures that the department is a respected part of the organization, which is of great importance since it facilitates collaboration with other departments. An elaborate design of the IA department’s roles, guarantees that the range of IA’s activities is best suited to the organization’s needs (Erasmus and Coetzee 2018).

Furthermore, Soh and Martinov-Bennie (2011) show that the individual expertise of auditors is an important factor. Especially competencies in the field of accounting and IT positively influence the IA department’s performance. Regarding the CAE, his ability to cooperate with stakeholders is an important asset (Van Staden and Steyn 2009).

One approach to combine quantitative and qualitative determinants that effect IA’s value creation is using a balanced scorecard (Rupšys and Boguslauskas 2007). In line with the balanced scorecard for corporate management (see the whole work of Kaplan and Norton), Frigo (2002) together with The IIA Research Foundation has developed a balanced scorecard which is applicable for IA. His approach considers quantitative as well as qualitative determinants in the following four dimensions: the AC’s view of IA, the processes within the function, innovation and capacity, and the auditees’ view. Frigo (2002) introduces an instrument, which is flexible and easy to apply, and which incorporates different perspectives into one framework (Boţa-Avram and Palfi 2009; Rupšys and Boguslauskas 2007). Another approach which combines quantitative and qualitative determinants is the input-process-output scheme, which helps to categorize IA’s work according to three different phases: input (e.g. experience, knowledge, skills), process (e.g. audit planning, field work, reports), and output (e.g. satisfaction, inquiries) (Rupšys and Boguslauskas 2007). The IIA published an additional IPPF Practice Guide “Measuring Internal Audit Effectiveness and Efficiency” in December 2010, that updates the original scorecard approach and discusses the benefits and challenges of the implementation. Furthermore, the IIA Netherlands (2016) offer in their report “Measuring the effectiveness of the internal audit function” a toolkit for practitioners that can help to transfer the IIA scorecard approach to their companies.

In order to meet the needs of various stakeholders, a working group from the IIA Netherlands developed the Internal Audit Ambition Model (IA AM). The model is an excellent tool for self-reflection, internal validation of compliance, and definition of the level of ambition of the IA department. It also helps to communicate with the Board of Directors, and in particular the AC, since it measures both, the achieved level as well as the ambition. Furthermore, if CAEs are willing to share the data, it can also be used as a benchmarking tool. Six topics are included in the IA AM: “Services and role of IA”, “Professional processes”, “Performance measurement and accountability”, “Personnel Management”, “Organization and relations”, and “Governance structures”. “Performance measurement and accountability” thereby refers to all information needed to manage, conduct, and control IA’s activities and thus to eventually determine its performance. This includes the objectives of the IA department, budget for the audit plan, and alignment of the plan with the organization’s strategy.

As already mentioned, there is a multitude of expectations placed on the IA department. Satisfying different stakeholders’ needs and acting as a modern, standard-compliant IA function can be a major challenge. The International Professional Practice Framework (IPPF) of the IIA (IIA 2020) therefore considers this issue in Standards 1300 to 1312, and offers both internal (self-) assessments and external quality assessments as a solution. Moreover, each audit has to follow a formal and structured process to ensure its quality. This process should be carefully designed, using competencies and professional diligence, and should ideally be continuously refined. The concept of quality starts with the organizational design of the IA department, i.e. the inherent processes, (IT-)systems, and the recruitment of qualified staff. Furthermore, the alignment process of the audit charter, policies, and procedures should be a quality feature to be controlled as well as IA’s contribution to the improvement of governance, risk management, and internal controls. All of these aspects are covered in the so-called Quality Assurance and Improvement Program (IIA 2012).