Managerial Auditing JournalInternal auditing practices and internal control systemFaudziah Hanim Fadzil Hasnah Haron Muhamad Jantan

Article information:To cite this document:Faudziah Hanim Fadzil Hasnah Haron Muhamad Jantan, (2005),"Internal auditing practices and internalcontrol system", Managerial Auditing Journal, Vol. 20 Iss 8 pp. 844 - 866Permanent link to this document:http://dx.doi.org/10.1108/02686900510619683

Downloaded on: 07 September 2015, At: 19:30 (PT)References: this document contains references to 24 other documents.To copy this document: permissions@emeraldinsight.comThe fulltext of this document has been downloaded 13517 times since 2006*

Users who downloaded this article also downloaded:Michael B. Adams, (1994),"Agency Theory and the Internal Audit", Managerial Auditing Journal, Vol. 9 Iss 8pp. 8-12 http://dx.doi.org/10.1108/02686909410071133Dominic S.B. Soh, Nonna Martinov-Bennie, (2011),"The internal audit function: Perceptions of internalaudit roles, effectiveness and evaluation", Managerial Auditing Journal, Vol. 26 Iss 7 pp. 605-622 http://dx.doi.org/10.1108/02686901111151332Mort Dittenhofer, (2001),"Internal auditing effectiveness: an expansion of present methods", ManagerialAuditing Journal, Vol. 16 Iss 8 pp. 443-450 http://dx.doi.org/10.1108/EUM0000000006064

Access to this document was granted through an Emerald subscription provided by emerald-srm:394654 []

For AuthorsIf you would like to write for this, or any other Emerald publication, then please use our Emerald forAuthors service information about how to choose which publication to write for and submission guidelinesare available for all. Please visit www.emeraldinsight.com/authors for more information.

About Emerald www.emeraldinsight.comEmerald is a global publisher linking research and practice to the benefit of society. The companymanages a portfolio of more than 290 journals and over 2,350 books and book series volumes, as well asproviding an extensive range of online products and additional customer resources and services.

Emerald is both COUNTER 4 and TRANSFER compliant. The organization is a partner of the Committeeon Publication Ethics (COPE) and also works with Portico and the LOCKSS initiative for digital archivepreservation.

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

*Related content and download information correct at time of download.

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

Internal auditing practices andinternal control system

Faudziah Hanim FadzilFaculty of Accountancy, Universiti Utara Malaysia, Kedah, Malaysia

Hasnah HaronSchool of Management, Universiti Sains Malaysia, Penang, Malaysia, and

Muhamad JantanCentre for Policy Research, Universiti Sains Malaysia, Penang, Malaysia

Abstract

Purpose – Two main objectives and they are: to determine whether the internal audit department ofthe companies listed in the Bursa Malaysia complies with the Standards for the Professional Practiceof Internal Auditors IIA (2000); and, to determine whether compliance to SPPIA will affect the qualityof the internal control system of the company.

Design/methodology/approach – Two sets of questionnaires were used in the study. Internalauditing practices was measured by the items listed in the SPPIA and the internal control wasmeasured by means of the statement on internal control: guidance for directors of public listedcompanies. The population used in this study was all the companies listed in the Bursa Malaysia in2001. This study used both descriptive and inferential analyses.

Findings – It was found that management of internal audit department, professional proficiency,objectivity and review significantly influence the monitoring aspect of the internal control system.Scope of work and performance of audit work significantly influences the information andcommunication aspect of the internal control system while performance of audit work, professionalproficiency and objectivity significantly influence the control environment aspect of the internalcontrol system. The study also shows that management of internal audit department, performance ofaudit work, audit program and audit reporting significantly influences the risk assessment aspectof the internal control system. Lastly, performance of audit work and audit reporting significantlyinfluences the control activities aspect of the internal control system.

Research limitations/implications – The research has contributed to the agency theory withrespect to the bonding costs that management has to pay to the internal auditors for the best interest ofthe principals of the companies. Another important implication pertains to the extent of the internalauditing practices among internal auditors in Malaysian public listed companies. Research has alsoshown that the compliance with internal auditing practices partially influence certain aspects of thequality of the internal control system.

Originality/value – This is the first empirical study that has linked the compliance of the internalauditing function to the SPPIA and its effect on the internal control system.

Keywords Auditing, Auditing standards, Malaysia

Paper type Research paper

IntroductionInternal auditing has undergone dramatic changes that have expanded its scope in a waythat allows it to make greater contributions to the organization it serves. Internal auditingis also performed in diverse legal and cultural environments; within organizations thatvary in purpose, size, and structure; and also by persons within or outside theorganization. Furthermore, the internal auditing profession also walks a tightrope

The Emerald Research Register for this journal is available at The current issue and full text archive of this journal is available at

www.emeraldinsight.com/researchregister www.emeraldinsight.com/0268-6902.htm

MAJ20,8

844

Managerial Auditing JournalVol. 20 No. 8, 2005pp. 844-866q Emerald Group Publishing Limited0268-6902DOI 10.1108/02686900510619683

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

between serving as a management consultant and an independent professional. A surveydone by the Malaysian Institute of Corporate Governance (MICG), The Institute of InternalAuditors Malaysia (IIAM) and Ernst and Young concluded that internal auditors are bestplaced to understand and appreciate the business processes of a company and they act asmanagement consultant to reduce risks. Internal auditors also help run a company moreefficiently and effectively to increase shareholders’ value.

As this is the case, internal auditors need to be out in front, leading the businessunits with regards to the internal control system and also focusing on strategicbusiness objectives. The internal auditors also need to establish themselves as vitalcogs in their organizations, rather than as observers who watch from the periphery andwait for events to impact them (Sawyer and Vinten, 1996).

One issue that has emerged related to the internal auditing practices is; “what is aproper and sound measurement of the internal auditing practices?” Barrett (1986)notes, “effectiveness (of internal audit) can be described, but it is difficult to quantifyand in the final analysis, effectiveness is determined by the perception of auditees”.In the company environment, management is the most important auditee of theinternal audit department since effectiveness of the internal auditing practices can bedescribed through the expectations of management with regard to the internal auditingpractices. The management will expect the internal auditors to perform their internalauditing practices to a certain level that is complying with the Standards for theProfessional Practice of Internal Auditors (SPPIA) (now known as the ProfessionalPractice Framework (PPF)), since it can be easily described. Compliance with SPPIA istherefore an indication of the effectiveness of the Internal Audit Department.

The auditing profession, both internal and external, has come under increasingscrutiny since the highly publicised collapse of energy trader, Enron (Vinten, 2003) inthe USA last year. The uncovering of alleged irregularities at Technology ResourcesIndustries Berhad (TRI) has highlighted the need for greater corporate governance inMalaysia.

TRI had issued false invoices between 1998 and 1999, which amounts to MYR260million (USD 68 million). According to Dato’ Samad Alias, the President of theMalaysian Institute of Accountants (MIA), “This could be the largest accounting fraudin Malaysian history”. The false invoices was discovered by Telekom Malaysia, whotook control of the TRI in June 2002, after conducting several internal audits, whenArthur Andersen was TRI’s auditor. “We had to rely on the information prepared bythe company’s accountants”, said Dato’ Abdul Samad, who was then head of theAndersen’s Malaysian office. If TRI was to restate 1998 and 1999 accounts, its net bookvalue will reduce as much as MYR 198 million (Financial Times, 2002). The case hascertainly shed a light on the importance of the role of internal auditors, which was onlyrecognised and emphasised after irregularities were discovered.

Internal auditors are often described as both a business partner and a policemanbecause of his work as a business partner with client management and also because heacts as an independent reviewer of management. As a business partner, the internalauditor is expected to provide expertise to assist an organization in meeting itsobjectives while as a policeman; an internal auditor is often thought of as an adversarylooking for flaws. As such, the extent of the internal auditing practices plays animportant factor on these roles. This study will provide empirical evidence whethercompliance with internal auditing practices will lead to a better internal control system.

Internal auditingpractices and

control system

845

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

The development of SPPIASPPIA are the criteria by which the operations of an internal auditing department areevaluated and measured and intended to represent the internal auditing practices, as itshould be. It is also meant to serve the entire profession of internal auditing, in all typesof organisations where internal auditors are found. It was first developed in June 1978,at the Internal Auditors International Conference in San Francisco. The SPPIAcomprise of five general standards of:

(1) independence;

(2) professional proficiency;

(3) scope of work;

(4) performance of audit work; and

(5) management of the internal audit department.

This framework allowed the future expansion of the internal auditing practices untilthe new framework was released in January 2002.

A new framework, called PPF was released in January 2002[1] and it consisted ofthree sets of standards: attribute, performance, and implementation standards. Theattribute standards address the attributes of organisations and individuals performinginternal audit services while the performance standards describe the nature of internalaudit services and provide quality criteria against which performance of these servicescan be measured. The implementation standards on the other hand provide guidanceapplicable in specific types of engagements. However, this new framework is notutilised in this study because of the timing of its release.

Internal control system. The internal control system plays an important role in theinternal auditing practices since the internal auditors might be considered as beingspecialists in management control (Chambers et al., 1987). Internal auditing practicesappraise the effectiveness of internal control systems, which is a definition of internalauditing and which also includes an appraisal of the actions by management to correctsituations, which are at variance with planned outcomes. The definition of internalcontrol systems reveals that it is not fundamentally different from managementcontrol, which has an essential component of control such as planning, organising,staffing and directing (Chambers et al., 1987). Senior management and the auditcommittee normally expect that the CAE will perform sufficient audit work and gatherother available information during the year so as to form a judgement about theadequacy and effectiveness of the control processes. The CAE should thencommunicate that overall judgement about the organisation’s system of controls tothe senior management and the audit committee. This is necessary since internalauditors play an intermediary role and assist in the discharge of the oversight functionof audit committee. If the above internal audit function is not available, themanagement needs to apply other monitoring processes in order to assure itself and theboard that the system of internal control system is functioning as intended. In thesecircumstances, the board of the company will need to assess whether such processesprovide sufficient and objective assurance or regular review and appraisal of theadequacy and the integrity of the internal control systems in the company.

Bursa Listing Requirements has established industry taskforce which formulated the“Statement on Internal Control: Guidance For Directors of Public Listed Companies”

MAJ20,8

846

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

to fulfil the above circumstances. The aim of this guidance is to assist listed companies inmaking disclosures in their annual reports on the state of internal control, in compliancewith the Listing Requirements of the KLSE. Pursuant to the requirements of the Code inrelation to the Internal Audit Function, in May 2001, the Securities Commissionappointed the IIAM to establish a separate industry taskforce to formulate theseGuidelines to assist the board of public listed companies in effectively discharging theirresponsibilities in relation to establishing an Internal Audit Function. Risk assessment,control environment, control activities, information and communication and monitoringare five important characteristics in this guideline.

The roles of internal auditors. In the revised statement of responsibilities of internalauditing issued by the Institute of Internal Auditors (IIA) (2000) as part of thestandards framework, the section on objectives states:

The objective of internal auditing is to assist all members of management in the effectivedischarge of their responsibilities by furnishing them with analyses, appraisals,recommendations and pertinent comments concerning the activities reviewed. The internalauditor is concerned with any phase of business activity where he can be of service tomanagement. This involves going beyond accounting and financial records to obtain a fullunderstanding of the operations under review (p. 3).

Sawyer and Vinten (1996) noted four benefits managers have gained from internalauditing assistance. These benefits were providing managers with the bases forjudgement and action, helping managers by reporting weaknesses in control andperformance and in recommending improvements, providing counsel to managers andboards of directors on the solutions of business problems, and supplying informationthat is timely, reliable and useful to all levels of management.

Additionally, the statement sets forth the types of services that should be performedand the kinds of activities carried on by the internal audit function in attaining theoverall objective. Internal auditors should first review and appraise the soundness andadequacy of the accounting, financial, and other operating controls, and promoteeffective controls at reasonable cost. Secondly, the internal auditors should ascertainthe extent of compliance with established policies, plans, procedures, laws andregulations, which could have a significant impact on the company’s operations. Thenthe internal auditors review the means of safeguarding assets and when appropriate,verify the existence of such assets and appraise the economy and efficiency with whichresources are employed. Lastly, the internal auditors review operations or programs toascertain whether results are consistent with established objectives and goals andwhether the operations or programs are being carried out as planned.

Reviewing and evaluating the adequacy and effectiveness of an organisation’sinternal control system and the quality of performance in carrying out assignedresponsibilities is representative of several primary core activities of internal auditwork. The purpose of the review of the adequacy of the internal auditing is to ascertainwhether the established system provides reasonable assurance that the organisation’sobjectives and goals will be met efficiently and economically.

Adequate control is considered to be present if administrative management hasplanned and organised in a manner, which provides reasonable assurance that theorganisation’s objectives and goals will be achieved efficiently and economically.Reasonable assurance is provided when cost-effective actions are taken to restrictdeviations, such as improper or illegal acts, to a tolerable level.

Internal auditingpractices and

control system

847

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

The role of internal auditing in the review of effectiveness of the system of internalcontrol is to ascertain whether the system is functioning as intended. Effective controlis present when the administrative management directs the system in such as way asto provide reasonable assurance that the organisation’s objectives and goals will beachieved. The purpose of the review for quality of performance is to ascertain whetherthe organisation’s objectives and goals have been achieved.

The primary objectives of an organisation’s system of internal control are to provideadministrative management with reasonable assurance that financial information isaccurate and reliable; the organisation complies with policies, plans, procedures, laws,regulations and contracts; assets are safeguarded against loss and theft; resources areused economically and efficiently; and established objectives and goals for operationsor programs can be met. Internal auditing focuses on an evaluation of this system orframework of internal control.

A second type of audit work that internal auditors are guided to perform isreviewing the accuracy and reliability of financial and operating information and themeans used to identify, measure, classify and report such information. Informationsystems provide data for decision-making, control, and compliance with externalrequirement. Therefore, internal auditors should examine information systems anddetermine whether financial and operating records and reports contain accurate,reliable, timely, complete and useful information, and controls over record keeping andreporting are adequate and effective.

The performance of reviews of the systems established to ensure compliance withpolicies, plans, procedures, laws, regulations and contracts represents a third elementof audit activity described by the standards. Administrative management isresponsible for establishing the systems designed to ensure compliance with suchrequirements as laws, rules, regulations, policies and procedures. The internal auditorsrole is to determine whether the systems designed by management are adequate andeffective and whether the activities audited are complying with the appropriaterequirements.

Further, as described by the standards, the internal auditor’s role includes providingappraisals with recommendations regarding administration management establishedobjectives and goals for operations and programs.

Research framework and methodologyThe main source of data is annual reports of Malaysian public listed companies. Datacollected from the firm’s report were used to examine the existence of internal audit inthe firms and if any, the functions of the internal auditors. Corporate annual reportswere used because it is seen to be the main form of company communication (Zeghaland Ahmed, 1990; Unerman, 2000) and also they were widely available (Buhr, 1998;Gray et al., 1995; Unerman, 2000).

Research frameworkThis study focuses on two variables: internal auditing practices and quality of theinternal control system. The theoretical framework is as follows:

Figure 1 model proposed is based on the postulate in the agency theory where theprincipal will incur the agency cost in order for them to observe the agent’s action.The relationship between principals and agents is that the principals will incur

MAJ20,8

848

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

monitoring expenditures while the agents incur bonding costs to ensure that the workof looking after the wealth of the principals is done (Adams, 1994). The cost of internalaudit is an example of this bonding costs. Sherer and Kent (1983) perceived internalauditing to be “a bonding cost borne by the senior manager to satisfy the demands foraccountability made by external participants especially shareholders”. Not internalaudit professionals argue that an effective audit function will correlate with anorganisation’s success in meeting management objectives and whether the internalcontrol system is functioning as intended.

Research hypothesesThe research hypotheses will examine the compliance of the internal auditing practicesto the quality of the internal control system. There are 45 sub-hypotheses relating theinternal auditing practices to internal control system.

H1. The better the compliance of internal audit department to the standards ofinternal auditing practices, the higher the quality of the internal controlsystem.

H1a. relates monitoring of the internal control quality with the nine components of theinternal auditing practices.

H1a1. The better the management of the internal audit department of the internalauditing practices, the higher the monitoring of the quality of the internalcontrol system.

H1a2. The greater the scope of work of the internal auditing practices, the higherthe monitoring of the quality of the internal control system.

H1a3. The higher the performance of audit work of the internal auditing practices,the higher the monitoring of the quality of the internal control system.

Figure 1.Theoretical framework

Internal auditingpractices and

control system

849

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

H1a4. The higher professional proficiency of the internal auditing practices, thehigher the monitoring of the quality of the internal control system.

H1a5. The higher the independence of the internal auditing practices, the higherthe monitoring of the quality of the internal control system.

H1a6. The higher the objectivity of the internal auditing practices, the higher themonitoring of the quality of the internal control system.

H1a7. The better the audit reviews of the internal auditing practices, the higherthe monitoring of the quality of the internal control system.

H1a8. The better the audit programs of the internal auditing practices, the higherthe monitoring of the quality of the internal control system.

H1a9. The better the audit reporting of the internal auditing practices, the higherthe monitoring of the quality of the internal control system.

H1b. relates information and communication of the internal control quality with thenine components of the internal auditing practices.

H1b1. The better the management of the internal audit department of the internalauditing practices, the better the information and communication of thequality of the internal control system.

H1b2. The greater the scope of work of the internal auditing practices, the betterthe information and communication of the quality of the internal controlsystem.

H1b3. The better the performance of audit work of the internal auditing practices,the better the information and communication of the quality of the internalcontrol system.

H1b4. The higher the professional proficiency of the internal auditing practices,the better the information and communication of the quality of the internalcontrol system.

H1b5. The higher the independence of the internal auditing practices, the betterthe information and communication of the quality of the internal controlsystem.

H1b6. The higher the objectivity of the internal auditing practices, the better theinformation and communication of the quality of the internal controlsystem.

H1b7. The better the audit reviews of the internal auditing practices, the better theinformation and communication of the quality of the internal controlsystem.

H1b8. The better the audit programs of the internal auditing practices, the better theinformation and communication of the quality of the internal control system.

H1b9. The better the audit reporting of the internal auditing practices, the better theinformation and communication of the quality of the internal control system.

MAJ20,8

850

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

H1c. relates control environment of the internal control quality with the ninecomponents of the internal auditing practices.

H1c1. The better the management of the internal audit department of the internalauditing practices, the higher the control environment of the quality of theinternal control system.

H1c2. The greater the scope of work of the internal auditing practices, the higherthe control environment of the quality of the internal control system.

H1c3. The higher the performance of audit work of the internal auditing practices,the higher the control environment of the quality of the internal controlsystem.

H1c4. The higher the professional proficiency of the internal auditing practices, thehigher the control environment of the quality of the internal control system.

H1c5. The higher the independence of the internal auditing practices, the higher thecontrol environment of the quality of the internal control system.

H1c6. The higher the objectivity of the internal auditing practices, the higher thecontrol environment of the quality of the internal control system.

H1c7. The better the audit reviews of the internal auditing practices, the higher thecontrol environment of the quality of the internal control system.

H1c8. The better the audit programs of the internal auditing practices, the higherthe control environment of the quality of the internal control system.

H1c9. The better the audit reporting of the internal auditing practices, the higherthe control environment of the quality of the internal control system.

H1d. relates risk assessment of the internal control quality with the nine components ofthe internal auditing practices.

H1d1. The better the management of the internal audit department of the internalauditing practices, the higher the risk assessment of the quality of theinternal control system.

H1d2. The greater the scope of work of the internal auditing practices, the higherthe risk assessment of the quality of the internal control system.

H1d3. The higher the performance of audit work of the internal auditing practices,the higher the risk assessment of the quality of the internal control system.

H1d4. The higher the professional proficiency of the internal auditingpractices, the higher the risk assessment of the quality of the internalcontrol system.

H1d5. The higher the independence of the internal auditing practices, the higherthe risk assessment of the quality of the internal control system.

H1d6. The higher the objectivity of the internal auditing practices, the higher therisk assessment of the quality of the internal control system.

Internal auditingpractices and

control system

851

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

H1d7. The better the audit reviews of the internal auditing practices, the higherthe risk assessment of the quality of the internal control system.

H1d8. The better the audit programs of the internal auditing practices, the higherthe risk assessment of the quality of the internal control system.

H1d9. The better the audit reporting of the internal auditing practices, the higherthe risk assessment of the quality of the internal control system.

H1e relates control activities of the internal control quality with the nine components ofthe internal auditing practices.

H1e1. The better the management of the internal audit department of the internalauditing practices, the higher the control activities of the quality of theinternal control system.

H1e2. The greater the scope of work of the internal auditing practices, the higherthe control activities of the quality of the internal control system.

H1e3. The higher the performance of audit work of the internal auditingpractices, the higher the control activities of the quality of the internalcontrol system.

H1e4. The higher the professional proficiency of the internal auditing practices,the higher the control activities of the quality of the internal control system.

H1e5. The higher the independence of the internal auditing practices, the higherthe control activities of the quality of the internal control system.

H1e6. The higher the objectivity of the internal auditing practices, the higher thecontrol activities of the quality of the internal control system.

H1e7. The better the audit reviews of the internal auditing practices, the higherthe control activities of the quality of the internal control system.

H1e8. The better the audit programs of the internal auditing practices, the higherthe control activities of the quality of the internal control system.

H1e9. The better the audit reporting of the internal auditing practices, the higherthe control activities of the quality of the internal control system.

Internal auditing practices and the quality of internal control systemIndependence and objectivity is seen as an important attribute to the quality of internalaudit function (IIA, 2000; Bethea, 1992; Traver, 1991; Farbo, 1985; Clark et al., 1980;Glazer and Jaenicke, 1980). If internal auditors are not independent and objective, theyare of little value to those who demand their service (Clark et al., 1980; Elliot andWillingham, 1980; Ward and Robertson, 1980; Williams, 1978). The internal auditdepartment must be granted the license to carry out its responsibilities freely andobjectively and also their judgements reached must be unbiased.

Most internal audit professionals argue that an effective internal audit functionunequivocally correlates with an organisation’s success in meeting managementobjectives and whether the internal control system is functioning as intended.

MAJ20,8

852

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

Research designThe basic research design utilised for this study was a survey design. The collection ofprimary data was accomplished through the use of a mail survey instrument(questionnaire). Data collected from the questionnaire is divided into two components:

(1) the measurement of the internal auditing practices was sent to the CAE/Head ofInternal Auditing Department; and

(2) questionnaire on the measurement of the quality of internal control system wassent to the audit committee.

Sample and method of data analysisAll the companies (812 companies) listed in the Bursa Malaysia in year 2001 were usedas the population in this study. The year of 2001 was chosen due to the availability ofthe data and the current status of the data.

This study used both descriptive and inferential analyses. Descriptive analysis isused to determine if Bursa Malaysia listed companies comply with the standards intheir internal audit practices while the inferential analyses (multiple regressionanalyses) were used to test the hypotheses. The variables have met the assumptions ofmultiple regression analysis.

Factor analysis was run on the internal auditing practices variable and the internalcontrol system. As a result, the internal auditing practices variables have been brokenup into nine components instead of the present five[2]. The components of the internalcontrols system remains the same.

Analysis and findingsTable I shows information on sampling and return rates of the questionnaires sent tothe internal auditors and the audit committees of the Bursa Malaysia listed companies.Of the 812 questionnaires mailed, 654 subjects were contacted but only 250 responsesfrom both internal auditors and audit committees were received resulting in a responserate of 38.23 per cent.

Certain demographic information was gathered from each subject. While the datawas not collected to address a specific research question, it provides an insight into thesubjects and may assist in interpreting results of the analysis. The demographicvariables are: current position, qualification, professional accounting and/or auditingqualification, name of external auditors, establishment of the internal audit departmentand number of employees of the internal audit department.

Summaries of the demographic data collected from the internal auditors are shownin Table II and the audit committees in Table III.

Descriptive analysisThe extent of internal auditing practices. Table IV shows the mean results of the extentof the internal auditing practices items. From the results, independence is a highly rated

Questionnaires mailed 812Undelivered 158Subjects contacted 654No. of responses 250Responses rates (250/654) 38.23 (per cent)

Table I.Summary of response

rates

Internal auditingpractices and

control system

853

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

item of internal auditing practices from the perspective of the internal auditors with amean of 4.46 while the least rated items is professional proficiency with a mean of 3.88.

The analysis of the results also reveals that, of the 50 internal auditing practicesitems, there are 35 items having a score between 4.00 and 5.00 and 15 items between

Demographic Characteristics Frequency Percent

Current position Manager of the IAD 178 71.2Senior auditor 17 6.8Others 55 22.0

Qualification (excluding professional) First degree in 106 42.4Post graduate 88 35.2Diploma 22 8.8Certificate 5 2.0Others 29 11.6

Professional accounting/auditingqualification

Professional qualifications (CPA Aust.,CACA, ACCA, MICPA[2], CIMA) 174 69.6No professional qualifications 76 30.4

Type of business of the companyunder KLSE listing

TradingIndustrial products

4945

19.618.0

Consumer products 40 16.0Properties 37 14.8Finance 30 12.0Construction 20 8.0Plantation 12 4.8Technology 5 2.0Hotels 4 1.6Mining 3 1.2Trust 3 1.2Infrastructure 2 0.8

External auditor of the company “Big 4” audit firms 166 66.4Others 84 33.6

Existence of internal audit department Existence 231 92.4Non-existence 19 7.6

Number of employees of the internalaudit department

Five employeesSix to ten employees

14454

57.621.6

. 10 employees 42 16.8Outsourced 10 4.0

Table II.Summary ofdemographic data onrespondents from internalauditors

Demographic Characteristics Frequency Per cent

Current position Manager 88 35.2Director 59 23.6Audit committee 57 22.8Senior 6 2.4Others 40 16.0

Qualification First degree 82 32.8Post graduate 34 13.6Diploma 6 2.4Certificate 4 1.6Others 124 49.6

Table III.Summary ofdemographic data onrespondents from auditcommittees

MAJ20,8

854

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

3.00 and 4.00. Items having scores ranging from 4.00 to 5.00 are strongly compliantwith IIA (2000, 2001).

The extent of existence of the quality of the internal control system. Table V showsthe means of the components of the internal control system. From the results, the riskassessment component of internal control system is a highly rated item with a meanof 4.29 while information and communication is the least rated item with a meanof 4.12.

An analysis of the results also reveal that, of the 25 items stated, there are 23 itemshaving a score between 4.00 and 5.00. This suggests that the respondents considerthe 23 items identified earlier exist in their internal control systems. This is becauseitems having scores between 4.00 and 5.00 are perceived to be very important in thisstudy.

Hypotheses testing. Several methods of analyses were utilised to test these alternativehypotheses. The analyses used to test the hypotheses include descriptive and statisticalanalysis. The hypotheses sought to test for a significance difference of nine variables ofinternal auditing practices and five variables of internal control system.

Hypotheses.H1a. The better the management of the internal audit department of the internal

auditing practices, the greater the scope of work of the internal auditingpractices, the higher the performance of audit work of the internal auditingpractices, the higher professional proficiency of the internal auditing practices,the higher the independence of the internal auditing practices, the higher theobjectivity of the internal auditing practices, the better the audit reviews of theinternal auditing practices, the better the audit programs of the internalauditing practices, the better the audit reporting of the internal auditingpractices, the higher the monitoring of the quality of the internal control system.

Rank Item Mean Standard deviation

1 Risk assessment 4.29 0.512 Control activities 4.28 0.453 Monitoring 4.15 0.614 Control environment 4.14 0.595 Information and communication 4.12 0.46

Table V.Mean scores of the extent

of existence of theinternal control systems

Rank Item Mean Standard deviation

1 Independence 4.46 0.592 Scope of audit work 4.22 0.493 Audit reporting 4.17 0.544 Audit programs 4.12 0.575 Management of IAD 4.12 0.536 Performance of audit work 4.11 0.627 Audit reviews 4.11 0.688 Objectivity 4.04 0.609 Professional proficiency 3.88 0.57

Table IV.Means scores of the

extent of the internalauditing practices from

the internal auditor’sperspectives

Internal auditingpractices and

control system

855

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

Table VI shows, the model is significant ðF ¼ 2:502Þ (sig. F ¼ 0:009Þ: However, themodel only explained 8.6 per cent of the variation in monitoring. Internal auditingpractices of significant influence in their order of impact are management of internalaudit department ðbeta ¼ 0:327; p # 0:05Þ (sig. F ¼ 0:013Þ; professional proficiencyðbeta ¼ 20:197; p # 0:05Þ (sig. F ¼ 0:024Þ; objectivity ðbeta ¼ 20:146; p # 0:01Þ andaudit reviews ðBeta ¼ 20:174; p # 0:05Þ (sig. F ¼ 0:038Þ:

The following Table VI summarises the results.Thus, there is evidence to support that management of internal audit department of

the internal auditing practices positively influences the monitoring aspect of internalcontrol system while professional proficiency, objectivity and audit reviews of theinternal auditing practices negatively influence the monitoring aspect of internalcontrol system. Therefore, only H1a1 is accepted while H1a2 to H1a9 are rejected.

H1b. The better the management of the internal audit department of the internalauditing practices, the greater the scope of work of the internal auditingpractices, the higher the performance of audit work of the internalauditing practices, the higher professional proficiency of the internalauditing practices, the higher the independence of the internal auditingpractices, the higher the objectivity of the internal auditing practices, thebetter the audit reviews of the internal auditing practices, the better theaudit programs of the internal auditing practices, the better the auditreporting of the internal auditing practices, the better the information andcommunication of the quality of the internal control system.

Table VII summarises the results.Table VII suggests that the model is significant ðF ¼ 1:752Þ (sig. F ¼ 0:078;

p # 0:01Þ:However, the model only explained 6.2 per cent of the variation in informationand communication. Internal auditing practices of significant influence in their order ofimpact are scope of audit work ðbeta ¼ 20:212; p # 0:05Þ (sig. F ¼ 0:031Þ andperformance of audit work ðbeta ¼ 0:207; p # 0:05Þ (sig. F ¼ 0:021Þ:

The results suggested that scope of audit work of the internal auditing practicesnegatively influence the information and communication aspect of internal controlsystem while performance of audit work of the internal auditing practices positively

Internal auditing practices Beta t Sig.

Constant 10.672 0.000Management of IAD 0.327 2.515 0.013 * *

Scope of audit work 20.084 20.866 0.388Performance of audit work 0.126 1.433 0.153Professional proficiency 20.197 22.264 0.024 * *

Independence 20.009 20.122 0.903Objectivity 20.146 21.765 0.079 *

Audit reviews 20.174 22.092 0.038 * *

Audit programs 20.020 20.223 0.824Audit reporting 0.131 1.453 0.148

Notes: Dependent variable: monitoring; *at 0.01 significant level; * *at 0.05 significant level; R 2: 0.086;F: 2.502

Table VI.Results of H1a

MAJ20,8

856

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

influence the information and communication aspect of internal control system.Therefore, only H1b3 is accepted while the rest of the hypotheses are rejected.

H1c. The better the management of the internal audit department of the internalauditing practices, the greater the scope of work of the internal auditingpractices, the higher the performance of audit work of the internalauditing practices, the higher professional proficiency of the internalauditing practices, the higher the independence of the internal auditingpractices, the higher the objectivity of the internal auditing practices, thebetter the audit reviews of the internal auditing practices, the better theaudit programs of the internal auditing practices, the better the auditreporting of the internal auditing practices, the higher the controlenvironment of the quality of the internal control system.

Table VIII summarizes the result.Table VIII suggests that the model is significant ðF ¼ 3:470Þ (sig. F ¼ 0:000;

p # 0:05Þ: However, the model only explained 11.8 per cent of the variation in controlenvironment. Internal auditing practices of significant influence in their order of

Internal auditing practices Beta t Sig.

Constant 16.009 0.000Management of IAD 0.058 0.437 0.662Scope of audit work 20.212 22.175 0.031 * *

Performance of audit work 0.207 2.321 0.021 * *

Professional proficiency 20.065 20.738 0.461Independence 0.020 0.251 0.802Objectivity 0.015 0.184 0.854Audit reviews 20.118 21.399 0.163Audit programs 20.026 20.296 0.768Audit reporting 20.023 20.251 0.802

Notes:Dependent variable: information and communication; * * at 0.05 significant level;R 2: 0.062;F:1.752

Table VII.Results of H1b

Internal auditing practices Beta t Sig.

Constant 11.820 0.000Management of IAD 0.169 1.336 0.183Scope of audit work 0.015 0.162 0.871Performance of audit work 0.315 3.671 0.000 * *

Professional proficiency 20.266 23.087 0.002 * *

Independence 0.086 1.117 0.265Objectivity 20.249 23.093 0.002 * *

Audit reviews 0.058 0.699 0.485Audit programs 0.040 0.469 0.640Audit reporting 20.110 21.257 0.210

Notes: Dependent variable: control environment; * * at 0.05 significant level; R 2: 0.118; F: 3.470

Table VIII.Result of H1c

Internal auditingpractices and

control system

857

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

impact are performance of audit work ðbeta ¼ 0:315; p # 0:05Þ (sig. F ¼ 0:000Þ;professional proficiency ðbeta ¼ 20:266; p # 0:05Þ (sig.F ¼ 0:002Þ and objectivityðbeta ¼ 20:249; p # 0:05Þ (sig. F ¼ 0:002Þ:

Therefore, the results show that performance of audit work positively influences thecontrol environment aspect of internal control system while professional proficiencyand objectivity of the internal auditing practices negatively influence the controlenvironment aspect of internal control system and therefore the null hypothesis isaccepted. Therefore, H1c3 is accepted while H1c1 to H1c2 and H1c4 to H1c9 arerejected.

H1d. The better the management of the internal audit department of the internalauditing practices, the greater the scope of work of the internal auditingpractices, the higher the performance of audit work of the internalauditing practices, the higher professional proficiency of the internalauditing practices, the higher the independence of the internal auditingpractices, the higher the objectivity of the internal auditing practices, thebetter the audit reviews of the internal auditing practices, the better theaudit programs of the internal auditing practices, the better the auditreporting of the internal auditing practices, the higher the risk assessmentof the quality of the internal control system.

Table IX summarises the results.Table IX suggested that the model is significant ðF ¼ 2:983Þ (sig. F ¼ 0:002;

p # 0:05Þ: However, the model only explained 10.1 per cent of the variation in riskassessment. Internal auditing practices of significant influence in their order ofimpact are management of internal audit department ðbeta ¼ 20:254; p # 0:05Þ(sig. F ¼ 0:049Þ; performance of audit work ðbeta ¼ 0:193; p # 0:05Þ (sig.F ¼ 0:027Þ;audit program ðbeta ¼ 0:211; p # 0:05Þ (sig.F ¼ 0:016Þ and audit reportingðbeta ¼ 0:238; p # 0:05Þ (sig. F ¼ 0:008Þ:

Therefore, the results show that management of internal audit departmentnegatively influence the risk assessment aspect of internal control system whileperformance of audit work, audit program and audit reporting of the internal audit

Internal auditing practices Beta t Sig.

Constant 11.395 0.000Management of IAD 20.254 21.975 0.049 * *

Scope of audit work 20.157 21.640 0.102Performance of audit work 0.193 2.218 0.027 * *

Professional proficiency 20.121 21.411 0.160Independence 0.071 0.932 0.352Objectivity 0.045 0.554 0.580Audit reviews 0.015 0.184 0.855Audit programs 0.211 2.438 0.016 * *

Audit reports 0.238 2.655 0.008 * *

Notes: Dependent variable: risk assessment; * * at 0.05 significant level; R 2: 0.101; F: 2.983

Table IX.Result of H1d

MAJ20,8

858

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

practices positively influence the risk assessment aspect of internal control system.H1d3, H1d8 and H1d9 are accepted while the rest are rejected.

H1e. The better the management of the internal audit department of the internalauditing practices, the greater the scope of work of the internal auditingpractices, the higher the performance of audit work of the internal auditingpractices, the higher professional proficiency of the internal auditing practices,the higher the independence of the internal auditing practices, the higher theobjectivity of the internal auditing practices, the better the audit reviews of theinternal auditing practices, the better the audit programs of the internalauditing practices, the better the audit reporting of the internal auditingpractices, the higher the control activities of the quality of the internal controlsystem.

Table X suggested that the model is significant ðF ¼ 1:734Þ (sig. F ¼ 0:082; p # 0:01Þ:However, the model only explained 6.1 per cent of the variation in control activities.Internal auditing practices of significant influence in their order of impact areperformance of audit work ðbeta ¼ 0:176; p # 0:05Þ (sig. F ¼ 0:049Þ and auditreporting ðbeta ¼ 0:175; p # 0:01Þ (sig. F ¼ 0:057Þ:

The results support the hypothesis that both performance of audit work and auditreporting of the internal audit practices positively influence the control activities aspectof quality of the internal control system. Therefore, H1e3 and H1e9, which positivelyinfluence the control activities of the quality of the internal control systems areaccepted while the rest of the hypotheses are rejected.

Summary of results. The management of internal audit department of internalauditing practices positively influences the monitoring aspect of the quality of theinternal control system but it is negatively influenced by the professional proficiency,objectivity and audit review of the internal auditing practices.

Information and communication aspect of the quality of the internal control system isnegatively influenced by scope of work of the internal auditing practices but is positivelyinfluenced by performance of audit work of the internal auditing practices.

Internal auditing practices Beta t Sig.

Constant 14.046 0.000Management of IAD 20.098 20.748 0.455Scope of audit work 20.136 21.399 0.163Performance of audit work 0.176 1.979 0.049 * *

Professional proficiency 20.049 20.560 0.576Independence 0.123 1.576 0.116Objectivity 20.063 20.751 0.453Audit reviews 0.043 0.507 0.613Audit programs 20.078 20.876 0.382Audit reporting 0.175 1.915 0.057 *

Notes: Dependent variable: control activities; *at 0.01 significant level; * *at 0.05 significant level;R 2: 0.061; F: 1.734

Table X.Result of H1e

Internal auditingpractices and

control system

859

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

The control environment aspect of the quality internal control system is positivelyinfluenced by performance of audit work of the internal auditing practices while it isnegatively influenced by professional proficiency and objectivity of the internalauditing practices.

The risk assessment aspect of the quality of the internal control system isnegatively influenced by management of internal audit department of the internalauditing practices but is positively influenced by performance of audit work, auditprogram and audit reporting of the internal auditing practices.

The control activities aspect of the quality of the internal control system ispositively influenced by performance of audit work and audit reporting of the internalauditing practices.

Discussion and conclusionThis study examined the extent of the internal auditing practices by the internal auditdepartment and the effects of the practices have on the quality of the internal controlsystem. Analyses were done from the Internal Audit Practice Scale and Internal ControlSystem Scale that were sent to all internal auditors and audit committees of theMalaysian Public Listed Companies for the year 2001.

The extent of the internal auditing practicesOne of the major findings in this study is the extent of internal auditing practices inMalaysian Public Listed Companies. The five variables were derived from the IIA(2000), which were: independence and objectivity, professional proficiency, scope ofwork, performance of audit work and management of the internal auditing department.However, this study suggest that the internal auditing practices should comprise ofnine functions instead of only five functions as suggested by the IIA (2000). Thefunctions suggested are as follows: management of internal audit department,performance of audit work, independence, audit reviews, audit reporting, scope of auditwork, professional proficiency, objectivity and audit programs. The four new functionsare objectivity (separated from independence), audit reviews, audit programs and auditreporting.

Comparison was also made between the variables of this study and IIA (2001).Under IIA (2001), the standards consists of ten variables: purpose, authority, andresponsibility; independence and objectivity; proficiency and due professional care;quality assurance and improvement program; managing the internal audit activity;nature of audit work; engagement planning; performing the engagement;communicating results; monitoring progress; and management’s acceptance of risks.The difference between this study’s variables and IIA (2001) is the additional of fivenew audit functions that is the monitoring progress; communicating results;engagement planning; purpose, authority and responsibility; and management’sacceptance of risks.

Comparison with the findings of this study and the IIA (2001) were also made.There are only two new functions of the internal auditing practices in the IIA (2001):purpose, authority and responsibility, and management’s acceptance of risks. Therests of the internal auditing practices functions in this study are consistent to the IIA(2000, 2001). Table XI shows the summary of comparisons of the extent of the internalauditing practices.

MAJ20,8

860

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

Internal auditing practices and the quality of the internal control systemThis study also examines the influence of internal auditing practices and the quality ofinternal control system. It is shown that only the monitoring aspect of the qualityof internal control system positively influenced by the management of the internal auditdepartment. However, it is negatively influenced by the professional proficiency,objectivity and audit review of the internal auditing practices. By managing thedepartment, the work performed by the internal audit department has been implementedin the past and the work schedules have taken into consideration the goal of the internalaudit department and also the general purposes of company management. Thereforethis will positively influence the monitoring of the internal control system since this willhave an effective impact on the monitoring process and also reports on illegal acts areproperly monitored. However, this study suggests that professional proficiency such asadequate knowledge, professional membership, certification, and training in electronicdata processing (EDP) system lead to lower monitoring of the quality of the internalcontrol system. This is because when the internal auditors have all the above-mentionedcriteria, it would imply that they are competent to do the work and therefore lowermonitoring of the quality of the internal control system is needed since the internalauditors have a clear understanding of the internal control system. This is also true forobjectivity and audit reviews of the internal auditing practices on the monitoring of thequality of the internal control system. Objectivity involves the unbiased attitude andavoidance of conflict of interest by the internal auditors while audit reviews areefficiently conducted in respect to the necessary audit operations. Therefore, internalauditors need lower monitoring of the quality of the internal control system since theentire necessary audit operations has been well conducted.

This study also suggests that scope of work of the internal auditing practicesnegatively influences the information and communication aspect of the quality of theinternal control system while the performance of audit work of the internal auditingpractices positively influences the information and communication aspect of thequality of the internal control system. Scope of work of the internal auditing practices

SPPIA (2000) This study (2001) PPF (2002)

Independence and objectivity Independence Independence and objectivityProfessional proficiency Objectivity Proficiency and due

professional careScope of work Professional proficiency Nature of audit workPerformance of audit work Scope of work Performing the engagementManagement of internal auditdepartment

Performance of audit work Managing the internal auditactivity

Management of internal auditdepartment

Monitoring progress

Audit reviews Communicating resultsAudit reporting Engagement planning

Audit programsPurpose, authority andresponsibilityManagement’s acceptance ofrisks

Table XI.Summary of comparisons

of the extent of theinternal auditing

practices

Internal auditingpractices and

control system

861

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

involves reviewing the system to ensure compliance with procedures, policies, lawsand regulation and planning of the work and there is also better coordination betweenexternal and internal auditors. This means that if there is better scope of work ofthe internal auditing practices, this will lead to lesser control procedures of computerinformation system and lesser assessment of information needed on the quality ofthe internal control system. The internal auditors follow all the necessary procedures indoing the audit work and therefore lesser information and communication of thequality of the internal control system is needed. However, the better the performance ofaudit work, the greater is the information and communication since in performing theaudit work, the internal auditors need to identify, analyse, evaluate and recordsufficient information to achieve the engagement objectives.

This study also perceived that the performance of audit work of the internalauditing practices positively influences the control environment aspect of the quality ofthe internal control system while professional proficiency and objectivity of theinternal auditing practices negatively influences the control environment aspect of thequality of the internal control system. Performance of audit work plays a great impacton the control environment of the quality of the internal control system. Therefore, thebetter the performance of the audit work, the greater is the control environment on thequality of the internal control system. In performing the audit work, the internalauditors have been trained and are competent to do the audit work. Consequently, theyare able to identify and analyse the necessary records to achieve the audit objective.This will have a positive impact on the control environment of the quality of theinternal control systems since the senior management will demonstrate a higherclimate of trust with better performance of the audit work.

This study also suggests that management of internal audit department of theinternal auditing practices negatively influences the risk assessment aspect of thequality of the internal control system. However, the performance of audit work, auditprogram and audit reporting of the internal auditing practices positively influences therisk assessment aspect of the quality of the internal control system. Since the workperformed by the internal audit department has been implemented in the past and thework schedules take into consideration the goals of internal audit department,therefore, this will lead to lower risk assessment of the quality of the internal controlsystem. This is because; the necessary proper procedures are already applied inmanaging the internal audit department. However, the better the performance of auditwork, audit program and audit reporting of the internal auditing practices lead tobetter risk assessment. In performing the audit work, the internal auditors will identifybetter risk management framework and risk management policy and also betterprocedures should be installed in monitoring the applications of policies andprocedures of the organisation. This is also true for audit programs and auditreporting. The better the audit program and audit reporting, the installation of theprocedures and application of policies in assessing the risk of the organisation willfurther improve.

Performance of audit work and audit reporting of the internal auditing practicespositively influence the control activities aspect of the quality of the internal controlsystem. With trained and competent internal audit staff and better evaluation toachieve the engagement objectives, this will lead to better control activities of thequality of the internal control system. In this case, higher board of director’s approval

MAJ20,8

862

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

on the audit work performed is achieved and the internal auditors would diligentlyinvestigate the variances. There are also improved recommendations made bythe internal audit department through audit reporting.

Implications of the studyThe logical question at this juncture is: what do the results of this study imply? In otherwords, how does the research contribute to theory building, provide guidance to theinternal auditors and serve as input for the next SPPIA? These questions are addressedas follows:

Theoretical implicationsThe first theoretical implication is that this study has contributed to the agency theoryand internal audit paradigm where this study supported how the agency theoryprovide more meaningful research in the internal audit discipline based on the premisemonitoring expenditure incurred by the principal and the agent. This study alsoexplains the existence of agency theory postulated and its influence on the extent ofinternal auditing practices in Malaysian public listed companies and its effect on thefirm’s internal control system.

Practical implicationsAn important finding of this research pertains to the extent of the internal auditingpractices among internal auditors in Malaysian public listed companies. The firstpractical implications refer to changing of internal auditing practices functions fromfive to nine. The standard setter such as the IIA has the important role to revise thePPF or the SPPIA based on this study. The IIA (2000) basically described the criteriaby which the operations of an internal auditing department are evaluated andmeasured and they are intended to represent the practice of internal auditing, as itshould be. This includes independence and objectivity, professional proficiency, scopeof work, performance of audit work and management of internal audit department.The study implied that the IIA should include nine factors in building up the SPPIA,that is independence, scope of work, audit reporting, audit programs, management ofinternal audit department, performance of audit work, audit reviews, objectivity andprofessional proficiency since these factors revealed that CAEs placed muchimportance on above factors. The assistance of internal auditing practices benefitmanagers in providing bases for judgement and action, helping managers by reportingweaknesses in control and performance, providing counsel to managers and board ofdirectors on the solutions of business problems and supplying information that istimely, reliable and useful to all levels of management. Therefore, compliance to theSPPIA is very important to internal auditors in the extent of the internal auditingpractices and IIA must play its role in representing the practice of internal auditing, asit should be. Another implication is that all the variables in this study is consistentwith the IIA (2001).

The rationale behind the extent of the internal audit practices is that it providesopportunity for the Chief Audit Executives or internal auditors to get themanagement’s undivided attention to the extent of internal auditing practices on thequality of the internal control system. Reporting significant audit results andrecommendations give Chief Audit Executives an avenue for presenting their internal

Internal auditingpractices and

control system

863

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

audit practices to the president and other top management team members. Thereasonable and meaningful findings and recommendations contained in the auditreport are symbols of their contribution, which result in improvements to theorganisation as a whole.

Further, Chief Audit Executives might have perceived more importance to theability to provide independent reviews to the president or other top management teammembers. Again, in order to comply with the SPPIA, Chief Audit Executives believethat their departments should be independent, have bigger scope of audit work, bettermanagement of internal audit department, higher performance of audit work, betterapplication of auditing standards to audit work, professional and proficient in internalaudit practices.

The results show that the five functions of the quality of the internal control systemare as per Committee of Sponsoring Organizations (COSO) standard. Currently,Malaysian approved auditing standards have incorporated this and also adoptedthe statement on internal control: guidance for directors of public listed companies(MIA, 2001). Internal auditing department also should be seen to conduct their workeffectively and have trained staff.

Limitations of the studyThis study provides empirical evidence that the internal auditing practices of thepublic listed companies in Malaysia comply with the IIA (2000) and statisticallyinfluence the quality of the internal control systems. This may be due to the auditingstandards enforced by the IIA (Malaysia) and MIA.

This study, however, has its limitations. Of 250 public listed companies included inthis study, it is only representative of 38.23 per cent of public listed companies for theyear 2001. Consequently, the results may not be generalisable to the population ofinternal auditors as a whole. Furthermore, the extent of the internal auditing practicesis only limited to the IIA (2000).

Internal auditors typically work as a team in its normal internal audit practices.This study is limited as only individuals who are Chief Audit Executives wereexamined. The dynamics of group interaction were not considered. However, theChief Audit Executives represent the internal audit department suggesting thatthe study of this individual is the logical first step.

This study assumed that auditors are of the same calibre across firms for eachdesignation. However, this may not be a valid assumption since years of experience ofthe internal auditors are not included in the study.

ConclusionWhile the results in this study are by no means conclusive, it is hope that this study hascontributed to the research done in the extent of the internal auditing practices.This study has also provided some evidence on the extent of the internal auditingpractices and the influence it has on the internal control system.

Notes

1. Please refer to www.theiia.org/iia for detail explanation of IIA (2001).

2. MICPA – Malaysian Institute of Certified Public Accountants.

MAJ20,8

864

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

References

Adams, M.B. (1994), “Agency Theory and the international audit”, Managerial Auditing Journal,Vol. 9 No. 8 pp. 8-12.

Barrett, M.J. (1986), “Measuring internal auditing performance”, Internal Auditing, Vol. 2,pp. 30-5.

Bethea, P. Jr. (1992), A Descriptive Exploratory Examination of the Role and Responsibilities ofInternal Auditors, UMI Microform, Ann Arbor, MI.

Buhr, N. (1998), “Environmental performance, legislation and annual report disclosure: the caseof acid rain and Falconbridge”, Accounting, Auditing & Accountability Journal, Vol. 11No. 2, pp. 163-90.

Chambers, A.D., Selim, G.M. and Vinten, G. (1987), International Auditing, ELBS.

Clark, M., Gibbs, T.E. and Schroeder, R.B. (1980), “Evaluating internal audit departments underSAS No. 9”, The Women CPA, 8-11 and 22.

Elliot, R.K. and Willingham, J.J. (1980), Management Fraud: Detection and Prevention, PetrocelliBooks, Inc., New York, NY.

Farbo, J.L. (1985), A Comparison of the Perceived Effectiveness of the Internal Audit FunctionBetween Selected Private and Public Institutions in the Western United States, UMIMicroform, Ann Arbor, MI.

Financial Times (2002) Malaysian Mobile Operator Reports MYR260 Million Fraud,13 September, available at: www.thecorporatelibrary.com/Governance-Research/news/2002/09_11_02.html (accessed 25 January 2005).

Glazer, A.S. and Jaenicke, H.R. (1980), A Framework for Evaluating an Internal AuditFunction, The Institute of Internal Auditors Research Foundation, AltamonteSprings, FL.

Gray, R., Kouhy, R. and Lavers, S. (1995), “Corporate social environmental reporting. a review ofthe literature and a longitudinal study of UK disclosure”, Accounting, Auditing &Accountability Journal, Vol. 8 No. 2, pp. 47-77.

Institute of Internal Auditors (2000), The Standards for the Professional Practice ofInternal Auditing, The Institute of Internal Auditors Research Foundation, AltamonteSprings, FL.

Institute of Internal Auditors (2001), The Professional Pratices Framework, The Institute ofInternal Auditors Research Foundation, Altamonte Springs, FL.

Malaysian Institute of Accountants (2001), Statement on Internal Control: Guidance ForDirectors of Public Listed Companies, KLSE, Kuala Lumpur.

Sawyer, L.B. and Vinten, G. (1996), TheManager and the Internal Auditor, Wiley, New York, NY.

Sherer, M. and Kent, D. (1983), Auditing and Accountability, Pitman, London.

Traver, R.O. (1991), A Comparison of Perceived Importance of Factors that have an Impact onAudit Effectiveness, UMI Microform, Ann Arbor, MI.

Unerman, J. (2000), “Reflection of quantification in corporate social reporting content analysis”,Accounting, Auditing & Accountability Journal, Vol. 13 No. 5, pp. 667-81.

Vinten, G. (2003), “Enronitus – dispelling the disease”, Managerial Auditing Journal, Vol. 18 No. 9,pp. 448-55.

Ward, D.D. and Robertson, J.C. (1980), “Reliance on internal auditors”, Journal of Accountancy,Vol. 150, pp. 62-73.

Williams, H.M. (1978), “The emerging responsibility of the internal auditor”, The InternalAuditor, Vol. 18, pp. 45-52.

Internal auditingpractices and

control system

865

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

Zeghal, D. and Ahmed, S.A. (1990), “Comparison of social responsibility information disclosuremedia used by Canadian firms”, Accounting, Auditing & Accountability Journal, Vol. 3No. 1, pp. 38-53.

Further reading

Hair, J.E., Anderson, R.E., Tatham, R.L. and Black, W.C. (2002), Multivariate Data Analysis,6th ed., Prentice-Hall, Englewood Cliffs, NJ.

Sawyer, L.B. and Dittenhofer, M.A. (1981), The Practice of Modern Internal Auditing,The Institute of Internal Auditors Research Foundation, Altamonte Springs, FL.

MAJ20,8

866

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

This article has been cited by:

1. Wen-Hsien Tsai, Hui-Chiao Chen, Jui-Chu Chang, Jun-Der Leu, Der Chao Chen, YuyunPurbokusumo. 2015. Performance of the internal audit department under ERP systems: empirical evidencefrom Taiwanese firms. Enterprise Information Systems 9, 725-742. [CrossRef]

2. Wahid Omar Abuazza, Dessalegn Getie Mihret, Kieran James, Peter Best. 2015. The perceived scopeof internal audit function in Libyan public enterprises. Managerial Auditing Journal 30:6/7, 560-581.[Abstract] [Full Text] [PDF]

3. Abdulaziz Alzeban. 2015. Influence of audit committees on internal audit conformance with internal auditstandards. Managerial Auditing Journal 30:6/7, 539-559. [Abstract] [Full Text] [PDF]

4. Abdulaziz Alzeban, Nedal Sawan. 2015. The impact of audit committee characteristics on theimplementation of internal audit recommendations. Journal of International Accounting, Auditing andTaxation 24, 61-71. [CrossRef]

5. Malcolm Gammisch, Signe Balina. 2014. The Effectiveness of Compliance Management Systems – AnExperimental Approach. Procedia - Social and Behavioral Sciences 156, 236-240. [CrossRef]

6. Abdulaziz Alzeban, King Abdulaziz University. 2014. Factors Affecting the Internal Audit Effectiveness: Asurvey of the Saudi Public Sector. Journal of International Accounting, Auditing and Taxation . [CrossRef]

7. Shireenjit K. Johl, Satirenjit Kaur Johl, Nava Subramaniam, Barry Cooper. 2013. Internal audit function,board quality and financial reporting quality: evidence from Malaysia. Managerial Auditing Journal 28:9,780-814. [Abstract] [Full Text] [PDF]

8. Cláudia V. Viegas, Alan Bond, José Luis Duarte Ribeiro, Paulo Maurício Selig. 2013. A review ofenvironmental monitoring and auditing in the context of  risk: unveiling the extent of a confusedrelationship. Journal of Cleaner Production 47, 165-173. [CrossRef]

9. Grant Richardson, Grantley Taylor, Roman Lanis. 2013. The impact of board of director oversightcharacteristics on corporate tax aggressiveness: An empirical analysis. Journal of Accounting and PublicPolicy 32, 68-88. [CrossRef]

10. Ester Gras‐Gil, Salvador Marin‐Hernandez, Domingo Garcia‐Perez de Lema. 2012. Internal auditand financial reporting in the Spanish banking industry. Managerial Auditing Journal 27:8, 728-753.[Abstract] [Full Text] [PDF]

11. Inya Egbe, Mathew Tsamenyi, Hadiza Sa’idA Study of the Operations of Formal and Informal Controlsin a Multinational Subsidiary in Nigeria 1-29. [Abstract] [Full Text] [PDF] [PDF]

12. Hasnah Kamardin, Hasnah Haron. 2011. Internal corporate governance and board performance inmonitoring roles. Journal of Financial Reporting and Accounting 9:2, 119-140. [Abstract] [Full Text][PDF]

13. Appah Ebimobowei, Emeh Yadirichuk. 2011. Information Technology and Internal Auditors' Actvities inNigeria. Asian Journal of Information Technology 10, 201-208. [CrossRef]

14. Annukka Jokipii. 2010. Determinants and consequences of internal control in firms: a contingency theorybased analysis. Journal of Management & Governance 14, 115-144. [CrossRef]

15. Hasnah Haron, Dato' Daing Nasir Ibrahim, K. Jeyaraman, Ong Hock Chye. 2010. Determinants ofinternal control characteristics influencing voluntary and mandatory disclosures. Managerial AuditingJournal 25:2, 140-159. [Abstract] [Full Text] [PDF]

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)

16. Sandra Ho, Marion Hutchinson. 2010. Internal audit department characteristics/activities and audit fees:Some evidence from Hong Kong firms. Journal of International Accounting, Auditing and Taxation 19,121-136. [CrossRef]

17. Zaini Ahmad, Dennis Taylor. 2009. Commitment to independence by internal auditors: the effects of roleambiguity and role conflict. Managerial Auditing Journal 24:9, 899-925. [Abstract] [Full Text] [PDF]

18. Marika Arena, Kim K. Jeppesen. 2009. The Jurisdiction of Internal Auditing and the Quest forProfessionalization: The Danish Case. International Journal of Auditing . [CrossRef]

19. Adebayo Agbejule, Annukka Jokipii. 2009. Strategy, control activities, monitoring and effectiveness.Managerial Auditing Journal 24:6, 500-522. [Abstract] [Full Text] [PDF]

20. Marika Arena, Giovanni Azzone. 2009. Identifying Organizational Drivers of Internal Audit Effectiveness.International Journal of Auditing 13:10.1111/ijau.2009.13.issue-1, 43-60. [CrossRef]

21. Karen Van Peursem, Lehan Jiang. 2008. Internal audit outsourcing practice and rationales: SME evidencefrom New Zealand. Asian Review of Accounting 16:3, 219-245. [Abstract] [Full Text] [PDF]

22. Ahmad A. Abu‐Musa. 2008. Information technology and its implications for internal auditing. ManagerialAuditing Journal 23:5, 438-466. [Abstract] [Full Text] [PDF]

23. Barry J. Cooper, Philomena Leung, Grace Wong. 2006. The Asia Pacific literature review on internalauditing. Managerial Auditing Journal 21:8, 822-834. [Abstract] [Full Text] [PDF]

24. Nikolaos A. Panayiotou, Stylianos Oikonomitsios, Christina Athanasiadou, Sotiris P. GayialisRiskAssessment in Virtual Enterprise Networks 290-312. [CrossRef]

25. Nikolaos A. Panayiotou, Stylianos Oikonomitsios, Christina Athanasiadou, Sotiris P. GayialisRiskAssessment in Virtual Enterprise Networks 888-910. [CrossRef]

Dow

nloa

ded

by U

nive

rsiti

Uta

ra M

alay

sia

At 1

9:30

07

Sept

embe

r 20

15 (

PT)