I am always on the lookout for academic research or thought leadership that reflects different or contrarian points of view on the internal audit profession. So, I was immediately intrigued by a recent internal audit-related academic research paper. The report, which has generated some early media attention, concludes that companies are more likely to hire internal auditors after restatements and material weaknesses in internal controls over financial reporting (accounting failures) or compliance enforcement actions (operational failures). While the statistics are not dramatically higher, they do affirm that companies are more likely to appreciate an internal audit function after they get in trouble.

Professors Matthew Ege and Dechun Wang from Texas A&M University and Young Hoon Kim from George Mason University analyzed online internal audit job postings for almost 50,000 companies from 2010 to 2019. Their research, forthcoming in The Accounting Review, finds that companies “are about 10% more likely to post an internal auditor job after the revelation of accounting and operational failures.” The researchers surmise that companies increase “their demand for internal auditors because they have assessment skills that can help prevent future failures, helping restore corporate reputation.”

The research also concludes that “demand for internal auditors is stronger when a failure is more severe.” While research results don’t signal an overwhelming trend, all of this does paint a statistically valid peek inside the mindset of many companies after significant risk management or control failures occur.

Sadly, over the years I have seen first-hand the phenomenon described in the research report. In one instance, I had the opportunity to advise a large company on the redesign/upgrade of its internal audit function following a highly publicized compliance scandal that resulted in more than $1 billion in fines. The company’s executives and board were committed to a spare-no-expense strategy to upgrade the internal audit function. A new CAE was recruited, and a cadre of new internal audit leadership and staff were hired. I often wished I could bottle the company’s renewed appreciation for internal audit and serve it to other companies who were indifferent to the value that internal audit could bring.

As I read the new research report, I couldn’t help but wonder why so many companies fail to appreciate the value of internal audit until it is too late. It would be easy to simply blame the phenomenon on short-sighted executives or board members who either resist oversight or don’t want to invest in strong and effective internal audit functions. Yet, I have seen far too many internal audit functions that staved off corporate scandals or debacles by identifying risk management and control deficiencies in advance. I believe the reasons internal audit is not appreciated until it’s too late are complicated and often involve corporate culture. As I have observed before, ”companies often have the quality of internal audit function they want/deserve.”

The inference that some companies don’t hire enough internal auditors until after a debacle isn’t the only conclusion in the research that should concern the profession. The researchers also concluded that “more severe accounting and operational failure revelations are associated with an increased demand for the CPA and the CISA (i.e., Certified Information Systems Auditor) credentials. These results suggest that firms demand internal auditors who have accounting, information technology, and business systems knowledge in response to more severe failures.” The researchers make no reference to the Certified Internal Auditor (CIA) designation. Those of us who hold the CIA credential would quickly point out that we must have even greater expertise than CPAs or CISAs in executing our responsibilities. We are, admittedly, biased, but perhaps The IIA should consider this research as it undertakes future reviews of the CIA credential     .

There were a couple of additional insights in the report that stood out. First, the researchers noted that “it is also possible that firms will not increase demand for internal auditors in response to accounting and operational failures. They may instead focus on changing other areas of their management (e.g., CFO) and governance (e.g., board of directors or external auditors).” That is stating the obvious in my opinion. I would hope that accountability starts at the top after a corporate debacle. If the only thing a company does in the wake of accounting or compliance failures is to hire more internal auditors, I will show you a company that hasn’t learned its lesson.

The report also finds “evidence of internal audit demand spillovers through connected directors, which helps mitigate concerns that the primary results are due to replacing internal auditors that recently left or due to endogenous links between hiring internal auditors and failure revelations.” In other words, directors of companies where more internal auditors were hired in the wake of failures may well say: “This isn’t a bad idea. We need to hire more internal auditors in other companies where I am on the board!”

To be honest, I haven’t been a big fan of many research reports on internal audit to come out of university accounting departments over the years. I often find accounting researchers undertake such efforts under the false premise that internal audit is merely an extension of the accounting profession. While I believe this report hints at such research bias, I still find the results to be interesting and a valid assessment of a lack of appreciation in the corporate sector for the value of an internal audit function — until it is too late.      

What are your thoughts on the research results? Please share any comments via LinkedIn or Twitter, or drop me a note at blogs@richardchambers.com.