Internal auditing's role in preventing and detecting fraud: An empirical analysis

Bonrath, Annika; Eulerich, Marc Article — Published Version Internal auditing's role in preventing and detecting fraud: An empirical analysis International Journal of Auditing Provided in Cooperation with: John Wiley & Sons Suggested Citation: Bonrath, Annika; Eulerich, Marc (2024) : Internal auditing's role in preventing and detecting fraud: An empirical analysis, International Journal of Auditing, ISSN 1099-1123, Wiley, Hoboken, NJ, Vol. 28, Iss. 4, pp. 615-631, https://doi.org/10.1111/ijau.12342 This Version is available at: https://hdl.handle.net/10419/306209 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. http://creativecommons.org/licenses/by-nc-nd/4.0/ ORIGINAL ARTICLE Internal auditing's role in preventing and detecting fraud: An empirical analysis Annika Bonrath | Marc Eulerich University of Duisburg-Essen, Duisburg, Germany Correspondence Marc Eulerich, University of Duisburg-Essen, Chair of Internal Auditing, Lotharstrasse 65, 47057, Duisburg, Germany. Email: [email protected] Internal auditing plays a pivotal role in preventing and detecting fraudulent activities. However, the orientation and role of internal auditing in dealing with fraud risk can vary significantly across different companies. This study examines the relationship between the internal audit function (IAF) and fraud, providing new insights into the current practices of internal auditing. Using a survey dataset comprising responses from 275 Chief Audit Executives across Germany, Switzerland and Austria, we investigate factors that correlate with an increased propensity for IAFs to engage in fraud prevention and detection. Our findings suggest that a robust corporate governance environment significantly influences the extent to which the IAF is involved in preventing and detecting fraud. Shedding light on the positioning of internal auditing between management and the audit committee with respect to fraud, our results show that increased IAF involvement with management positively affects the level of activities to prevent and detect fraud, while increased IAF involvement with the audit committee has the opposite effect. Furthermore, we find that the propensity of IAFs to engage in fraud prevention and detection increases when the IAF applies technology-based auditing techniques for risk identification. Our results have implications for building appropriate protection against the steadily increasing risk of fraud within organizations, while holistically addressing the ambiguity regarding the responsibility for preventing and detecting fraud. KEYWORDS corporate governance, fraud, internal auditing 1|INTRODUCTION In today's increasingly complex and demanding organizational structures, fraud is becoming more prevalent. This rise underscores the importance of maintaining and developing robust protections against fraud risk. Uncertainty and disruption often lead to established processes and controls being circumvented, creating fertile ground for fraud (Karpoff, 2021). Experts, such as the president and CEO of the Association of Certified Fraud Examiners (ACFE), anticipate a significant increase in fraud in the coming years (Dorris, 2021), while large accounting firms emphasize the need for immediate responses to this heightened risk exposure through reports and white papers. The question of who is responsible for preventing and detecting fraud regularly comes up (e.g., Baker Tilly, 2013). The responsibility often falls on the IAF, the third line in the Three Lines Model (TLM) (e.g., Eulerich, 2021). The IAF provides assurance and insight on governance adequacy and risk management effectiveness (e.g. Eulerich & Lohmann, 2022). While tips from various parties, such as employees, Received: 21 February 2023 Revised: 10 October 2023 Accepted: 4 December 2023 DOI: 10.1111/ijau.12342 This is an open access article under the terms of the Creative Commons Attribution-NonCommercial-NoDerivs License, which permits use and distribution in any medium, provided the original work is properly cited, the use is non-commercial and no modifications or adaptations are made. © 2024 The Authors. International Journal of Auditing published by John Wiley & Sons Ltd. Int J Audit. 2024;28:615–631. wileyonlinelibrary.com/journal/ijau 615 vendors or customers, detect most fraud cases, the IAF is of utmost importance for organizations in dealing with the risk of fraud (ACFE, 2020). 1 The presence of an IAF can reduce median losses from fraud by 33% (ACFE, 2022). The IAF serves as a central control mechanism to achieve compliance and prevent fraud (Friedberg, 1998; Ma’ayan & Carmeli, 2016). Most research on the antecedents and determinants of corporate fraud focuses on organizational-level factors (Mutschmann et al., 2021). Past studies have assessed several factors critical to the relevance of internal auditors in fraud prevention or detection (Kabuye et al., 2017; Khelil et al., 2016; Norman et al., 2010). The profession of internal auditing has emphasized the role of internal auditing through guidance aimed at improving its effectiveness (The IIA, 2019). However, existing research on the role of internal auditing in fraud risk management is limited for several reasons. Few studies present empirical evidence on factors associated with the role of internal auditing in managing fraud risk. Most studies use experimental methods (Asare et al., 2008; Norman et al., 2010) or have limited sample suitability (Drogalas et al., 2017; Kabuye et al., 2017; Khelil et al., 2016). Prior studies often overlook recent developments, such as the growing importance of innovative IT tools or new whistleblowing legislation. Most research focuses on specific industries or countries with unique characteristics, such as high corruption levels. Consequently, previous research does not offer generalizable results, and there is no consensus on the concept of the role of internal auditing in managing fraud risk and its determining factors. This lack of consensus is surprising, given that parts of the Institute of Internal Auditors' (IIA) global International Professional Practice Framework and anecdotal evidence directly link internal auditing to fraud prevention and detection. In response to Mutschmann et al.’s( 2021) call for further research, we aim to address this research gap by conducting a broader exploration of the potential driving factors that may influence the propensity of Internal Audit Functions (IAFs) to manage fraud risk. With the increasing importance of fraud risk management, the purpose of the study is twofold. Firstly, we examine the circumstances and regulations that shape the role of the IAF in managing such unethical practices. Secondly, we aim to deepen the understanding of the main drivers that shape the IAF's role in this context. We analyse potential drivers using ordered logistic regression models on a diverse survey data set, comprising responses from 281 chief audit executives across three European countries. Our findings suggest a strong governance environment and technology-based auditing techniques positively correlate with the IAF's role in fraud risk management. Interestingly, additional meetings with management strengthen the IAF's role in managing fraud risk, while more meetings with the audit committee show a negative association. Identifying these drivers can help organizations bolster fraud protection and highlight the importance of internal auditing. The paper is structured as follows: section 2reviews relevant literature and develops hypotheses. Section 3describes the research method and section 4presents the results. The final section discusses the results, connects them to existing research and theory and offers concluding remarks including implications for future research and potential limitations of the study. 2|LITERATURE REVIEW AND HYPOTHESES DEVELOPMENT 2.1 |The current landscape of fraud risk management As a result of ongoing corporate fraud scandals, the need for good corporate governance in terms of effective fraud risk management has become increasingly important. Prior scandals revealed unseen issues within businesses and the accounting profession, leading to significant damage to the reputation of the entire profession (Free, 2015). The effects were devastating as the public's confidence in the financial markets was destroyed. The consequence was the implementation of the Sarbanes-Oxley Act in 2002, which had the main objective to regain public confidence by creating a quasipublic institution for oversight, regulating auditing and involving auditors more in enforcing existing laws against theft and fraud by corporate officers (Coates & Srinivasan, 2014; Green, 2004; Ma’ayan & Carmeli, 2016). At the same time, penalties for fraudulent financial reporting have risen significantly to meet society's perception of fraudulent behaviour (Coram et al., 2008). The ongoing existence and reoccurrence of fraud cases, despite changes and adjustments in regulation, emphasize the importance for companies to strive for effective handling of fraud. The IIA (2019) defines fraud 2 as “any illegal act characterized by deceit, concealment, or violation of trust”(p.1). Fraud is not unique to specific types of organizations meaning that every organization can potentially become a victim of fraud. The Association of Chartered Certified Accountants (2021) highlights that fraud can potentially impact not only a firm's reputation but also its bottom line. Recent reports and publications emphasize the increasing prevalence and importance of fraud, which underscores the necessity to establish proactive responsibilities in relation to fraud (Holm et al., 2012). The role of internal auditing is generally described as a line of defence that has a pivotal responsibility in monitoring risks as well as preventing and detecting fraud. 3 Still, whenever it comes to fraud cases, the focus shifts to a company's overall corporate governance. Given that fraud is one of the top risks organizations face, internal auditors, as a driver of effective risk management, are frequently expected to take responsibility for preventing, 4 deterring and detecting fraud. Internal auditing's role in fraud prevention and detection becomes clearer when considering the core principles as defined by the IIA. According to the IIA (2021), internal auditing is an independent function that provides objective assurance and consultation to improve an organization's operations. It applies a systematic, disciplined approach to evaluate and enhance the effectiveness of risk management, control and governance processes. This role positions internal auditing as a key player in adding value to an organization, particularly through its efforts in fraud prevention and detection. As such, internal auditing 616 BONRATH and EULERICH can significantly contribute to operational performance by increasing the effectiveness of fraud prevention and detection measures (Asare et al., 2008; Norman et al., 2010). Besides, internal auditing can indirectly create value by fostering an ethical culture thereby preventing fraud (Ma’ayan & Carmeli, 2016). 5 There are several Standards published by the IIA addressing the role of internal auditors in monitoring, preventing and detecting fraud risks and directing those risks in audits and investigations which are portrayed in Appendix A. These encompass, for example, the required knowledge for evaluating fraud risk, reporting about fraud and the consideration of fraud when developing engagement objectives. We refer to the framework by Murphy and Dacin (2011), which largely builds upon the fraud triangle, a model that predicts the likelihood of fraud within an organization by considering three factors: opportunity, rationalization and pressure. This framework serves as a theoretical foundation for illustrating the relevance of internal auditing activities. The preventive and detective work of internal auditors primarily addresses the opportunity component within this framework, as internal auditors are expected to reduce future opportunities for fraud by identifying ineffective controls. While most existing research has focused on organizational-level characteristics affecting the perceived opportunity to commit fraud, recent studies have started to explore the other two components of the fraud triangle, which are mostly related to individual characteristics (Mutschmann et al., 2021). The following steps within the respective pathways of the framework are related to awareness, and intuition coupled with rationalization and reasoning. Internal auditors are expected to promote an ethical culture, which may lead to increased awareness of what constitutes fraud and its related severity. In the long run, this is expected to clarify that fraud is undesirable within organizations so that employees are mindful that fraud is unacceptable and that its costs exceed its benefits. Given an individual's awareness of fraudulent behaviour, both intuition and reasoning may be altered through further anti-fraud means such as an anti-fraud guideline, specific training or effective whistleblowing channels. Overall, these pathways offer a demonstration of internal auditors' efforts toward preventing and detecting fraud (see Stevens et al., 2005 for insights into how ethics impacts decision-making under pressure). Internal auditing mainly addresses the three main decision points issues and thereby fighting fraud (Figure 1). While external auditors are often held responsible for managing fraud, their effectiveness is potentially hampered by their detachment from the firms they audit. Their main responsibility lies in detecting material misstatements in financial reports caused by fraudulent activities. However, this focus restricts their scope, potentially limiting their overall effectiveness in fraud management. 6 DeZoort and Harrison (2018) confirm the mentioned separation of duties by concluding that external auditors perceive their responsibility as predominantly linked to fraud in financial statements. Conversely, internal auditors believe they bear equal responsibility across all types of fraud. This gap between prescribed and perceived responsibilities underscores the complexity of delineating fraud detection and management roles. Considering these constraints, and the division of duties within an organization, a large part of fraud risk management falls under the purview of the IAF. 7 Yet, as Grossi et al. (2007) revealed, varying organizational structures can lead to different responsibilities. Although the expectation regarding the role of internal auditing in managing fraud appears to be clear-cut, the frequency of fraud occurrences and the varying relevance of fraud to the IAF suggest that there are specific conditions needed for the IAF to fulfil its role effectively in fraud risk management. As a result, the research question for our study is: RQ: What are the factors that influence the focus of internal auditors on fraud prevention and detection? 2.2 |Research hypotheses 2.2.1 | Governance environment Recent fraud scandals revealed profound weaknesses in corporate governance structures (Nasir et al., 2019). As the quality of corporate governance appears to be of crucial relevance when it comes to fraud, regulators have enacted rules intended to strengthen the quality of corporate governance (Bhagat & Bolton, 2019). Agency theory suggests that the likelihood of fraud depends on specific internal governance structures of organizations (Dalton et al., 2007). Accordingly, managerial misbehaviours are found to be prevented through effective corporate governance systems (Liu, 2016). One way that companies are responding to these new rules is by implementing governance frameworks such as theTLM. 8 The TLM aids in structuring the responsibilities of key players and providing organizations with effective structures as well as processes for achieving their objectives and supporting strong governance and risk management (The IIA, 2020). The model ensures alignment of all organizational activities and goals with the interests of various internal and external stakeholder groups. It also underscores the positioning of internal auditing and the increasing complexity of today's business world. It underscores the importance of regular communication and interaction among these entities to ensure the internal audit's work aligns with the organization's strategic and operational needs. Prior research finds that an inadequate positioning of the IAF can significantly change or even limit internal auditing's value-adding work (Caplan & Kirschenheitner, 2000). However, recent literature challenges the role of internal audit as a thriving governance tool, emphasizing the risk of overreliance and the complexity of ethical issues (Roussy & Rodrigue, 2018). While the TLM is targeted at overarching organizational structures, whistleblowing is a key governance mechanism at the micro level that is currently experiencing a major upswing, mainly driven by the change in the regulatory environment within the European Union (EU) and the United States (see Vandekerckhove (2021) for a discussion on the former). Whistleblowing channels in organizations have a dual impact. Firstly, they function as a critical tool for fraud detection, providing individuals with a means to report BONRATH and EULERICH 617 fraudulent activities (Dyck et al., 2010). Essentially, they offer a conduit for individuals to sound the alarm when they suspect or observe fraud. Secondly, these channels can also play a significant role in fraud prevention (Johansson & Carey, 2016). The presence of effective whistleblowing systems can signal the organization's stance against fraud, emphasizing the risks and consequences for potential fraudsters. It creates a perception of increased surveillance and heightened risk of exposure, thereby potentially deterring fraudulent behaviour. Moreover, the establishment of whistleblowing channels can enhance the organization's overall ethical climate. It encourages not only employees but also individuals external to the organization to report suspected fraud (Johansson & Carey, 2016; Keenan, 2000). Therefore, the inclusion of these channels can lead to a more transparent, vigilant and ethically inclined environment. Considering the escalated complexity of fraud cases and the necessity for defined structures and authority within organizations, we define a strong governance environment as one incorporating governance models like the TLM and robust whistleblowing mechanisms. Such an environment, besides assisting in fraud detection, significantly shapes the organization's overall ethical climate. This specific understanding guides us to the following hypothesis: FIGURE 1 The framework: psychological pathways to fraud (Murphy & Dacin, 2011). 618 BONRATH and EULERICH H1. A strong governance environment is associated with internal auditing taking a more distinct role in fraud prevention and detection. This expectation, however, is not without tension. A strong governance environment, characterized by structured governance models like TLM and robust whistleblowing mechanisms, guides internal auditing to take a more streamlined role in fraud prevention and detection. Conversely, in a weak governance environment, where these mechanisms are deficient or absent, internal auditing may be compelled to adopt a more proactive and distinct role in fraud prevention and detection due to potentially higher instances of fraud. 2.2.2 | Independence and objectivity The concept of objectivity is fundamental to effective internal audit services, where an unbiased mental attitude is crucial (Reding et al., 2013). This objectivity assumes heightened importance when the IAF serves as a governance mechanism, ensuring effectiveness and credibility (Messier et al., 2011). Even though objectivity is anchored in the definition of internal auditing, certain factors could potentially compromise the objectivity of IAFs. Among the most significant is the relationship IAF shares with different stakeholders within an organization. Prior research reveals that the relationship with different stakeholders is an important predictor of the output generated by the work of internal auditors (Eulerich et al., 2017). This output is also influenced by internal dynamics such as reporting lines (Rose et al., 2013), the utilization of the IAF as a management training ground (Hoos et al., 2018) and sourcing decisions (Ahlawat & Lowe, 2004). Critically, the objectivity of the IAF is questioned when senior management wields excessive influence over them (Messier et al., 2011; Rose et al., 2013). For instance, senior management's expectations can significantly influence internal auditing, potentially shifting the focus away from internal-control-based activities to more operationally focused audits and consulting-related services (Abbott et al., 2010; Sarens & De Beelde, 2006). This creates a conflict of interest and competing demands regarding the allocation of resources and the scope of IAF activities (Hermanson & Rittenberg, 2003). This tension is illustrated in Norman et al.'s (2010) finding that internal auditors feel more threatened by management when they report directly to the audit committee, subsequently decreasing the assessment of the risk of fraud. This hints at a potential ethical conflict inherent to the IAF (Khelil et al., 2016). Despite this challenge, the importance of the audit committee in proactively promoting IAF independence is emphasized (Jaggi, 2022). Objectivity is essential for an internal auditor's unbiased assessments, judgments and decisions, though (Hazami-Ammar, 2019). Taken together, these considerations reveal a nuanced relationship between the IAF's objectivity and independence and its ability to manage fraud effectively. The following hypothesis is not without tension. While one would naturally anticipate that when the IAF is permitted to maintain its independence and objectivity, it will take on a more defined role in fraud prevention and detection, previous findings (e.g., Norman et al., 2010) offer a different perspective. They highlight that the IAF might feel threatened by management, thereby decreasing the assessment of the risk of fraud. Taking into account these conflicting viewpoints, we put forward our hypothesis: H2. More objective and independent IAFs are positively associated with internal auditing taking a more distinct role in fraud prevention and detection. 2.2.3 | Technology Technological innovations not only enhance the efficiency of internal auditing (Bierstaker et al., 2014; Rakipi et al., 2021) but also amplify the effectiveness, especially in the context of fraud detection (Islam & Stafford, 2021; Li et al., 2018). Audit analytics and data mining approaches are essential tools for allocating resources effectively and reducing the risk of internal fraud in a company. The utility of technology is extensively explored in both academic literature and practitioner reports, highlighting the use of technological tools to uncover insights, increase fraud detection and optimize the use of physical resources (e.g., CaseWare, 2022; Chandrakala et al., 2020; Green & Choi, 1997; Sarno et al., 2015; The IIA, 2022). The use of data analysis techniques has been linked to increased efficiency, expanded audit coverage (van der Nest et al., 2018) and enhanced audit quality (Moffitt et al., 2018). The value of technology for IAFs is twofold. Firstly, technology enables a risk-based approach, enhancing the detection of anomalies and red flags. The advancement of technology has given rise to methodologies like continuous auditing, which can significantly improve the effectiveness of risk-based audit planning - a fundamental approach in modern internal auditing (Eulerich et al., 2020). A riskbased approach implies a focus on areas with higher risks or anomalies that have been identified through data analysis, which is only feasible with advanced technology. This approach allows auditors to systematically identify, assess and address risks, which may be particularly beneficial for fraud prevention and detection. Secondly, improved resource allocation facilitated by technology allows a wider range of internal audit tasks. The efficiency gains from using technology free up resources, which can then be allocated to more complex tasks or thorough investigations of anomalies, ultimately leading to higher audit quality. In light of these considerations, we propose our third hypothesis regarding the importance of technological advancements in IAFs: H3. A high level of technological development in IAFs is positively associated with internal auditing taking a more distinct role in fraud prevention and detection. 9 BONRATH and EULERICH 619 With the advancement of technology, the nature of fraud itself is also changing, becoming more sophisticated and complex. This means that even as technology enhances the IAF's fraud detection capabilities, new challenges continue to emerge. Thus, the interplay between technological development, human judgment and evolving fraud schemes creates a dynamic and tense landscape in which IAFs operate. This hypothesis is, therefore, not without tension and reflects a nuanced understanding of the complexities inherent in modern internal auditing. Our conceptual framework that illustrates the potential drivers of internal audit functions' focus on fraud is presented in Figure 2. 3|METHODOLOGY 3.1 |Participants and procedure Our study is based on data from a comprehensive survey of chief audit executives across Germany, Austria and Switzerland. It was jointly conducted by the respective chapter of the IIA. 10 The survey data was collected in early 2020. In total, 4,009 chief audit executives were invited to participate, regardless of their IIA membership status. The questionnaire comprises over a hundred questions, covering various areas of internal auditing. These areas include the arrangement of internal auditing, staffing, corporate governance and fraud, compensation and success factors for the IAF. 11 We received 505 responses, resulting in a response rate of 12.6%. This rate aligns with other studies in the field of internal auditing (e.g., Abbott et al., 2016; Carcello et al., 2005). We checked the dataset for outliers and removed any identified outliers within the selected variables for the empirical models. For our empirical approach, we only included observations that provided complete answers to all relevant variables. The size of the dataset is favourable for statistical power, given the large number of observations from a wide variety of companies in terms of size, complexity and industries. 3.2 |Model To assess the effects of potential drivers on fraud risk management, we applied an ordered logistic regression model. The regression equation is as follows: fraud_scope ¼β1corporate_governanceþβ2ACþβ3management þβ4technologyþCONTROLSþε The dependent variable, referred to as fraud_scope, represents the extent to which the IAF currently focuses on preventing and detecting fraud, measured on a scale from one to five, with five indicating a higher focus. The model includes four independent variables and a vector of control variables to analyse possible drivers and test the hypotheses. To capture the characteristics of the underlying corporate governance structures (H1), we constructed a composite measure using Principal Component Analysis (PCA). This approach aligns with the methodology articulated by Allee et al. (2022) and resonates with the application of PCA within the realm of internal audit research, as demonstrated by D'Onza et al. (2020). The KaiserMeyer-Olkin statistic of 53.27% aligns with previous research approaches (e.g., Carter et al., 2019; Mahama & Cheng, 2013). The analysis revealed that only the first component with an eigenvalue larger than one (eigenvalue of 1.31) could be extracted. This component, comprised of four corporate governance-related variables, explains 32.85% of the total variance. The factor loadings for this component range from 0.089 to 0.658, underscoring the diverse yet substantial contributions of each variable to the extracted component. To test the second hypothesis, we include two variables related to independence and objectivity represented by both key stakeholder groups, management and audit committee. We anticipate diverging interests, potentially placing internal auditors in a position where they face the serving-two-masters issue. Accordingly, we created two dummy variables, AC and management, denoting whether the IAF has additional personal meetings with the audit committee and management, respectively. 12 We expect the signs of the two variables to be opposite with a negative sign for AC. However, since the influence of management and AC is strongly context-specific (Jaggi, 2022), a prediction for the direction of the coefficient is not feasible. As per prior literature, we expect a positive sign of management as this may reduce the distress internal auditors feel when reporting fraud. With respect to the principal-agent theory, the occurrence of fraud can be understood as a failure of the agent (see Zardkoohi et al. (2017) for insights on opportunistic behaviour in principal-agent relationships). Therefore, it seems reasonable to assume that management, as an agent, attributes high priority to the prevention and detection of fraud. To investigate the relationship between technological advancement and fraud management, our model includes variable technology. FIGURE 2 Conceptual framework illustrating potential drivers. 620 BONRATH and EULERICH This variable assesses the extent to which a technology-based auditing approach aids in identifying new risks, rated on a scale from one to five. We posit that the identification of new risks through technology signifies an innovative approach to enhancing efficiency and effectiveness. Consequently, we anticipate a positive coefficient for the technology variable. The model also incorporates control variables to test and, ideally, statistically nullify their impact on the dependent variable. Prior research consistently demonstrates a significant association between a company's listing status and disclosure levels (e.g., Firth, 1979). Therefore, we include listing as a dummy variable in our empirical model to account for systematic differences between listed and nonlisted organizations. Similarly, we include the size of the IAF as a control variable, given its potential to fundamentally alter the nature of the IAF. Prior studies indicate an association between the size of the IAF, audit activities and other firm characteristics, such as affiliation with the financial sector (Alhajri, 2017). This is also related to the approach of Sarens and Abdolmohammadi (2011) who state that larger IAFs imply more staff in the company whose primary responsibility is to actively monitor the company. Accordingly, the control variable iaf_size is included in the model to control for organizational characteristics related to the IAF's size in terms of the number of employees within the IAF. Incorporating the organizational size, org_size, depicted by the number of employees, aligns with prior studies such as Carcello et al. (2005), who found a positive association between firm size and the IAF budget, and D'Onza et al. (2020). The variable finance is included as a dummy variable referring to the company's industry. Prior literature suggests that the nature of the industry leads to different arrangements of IAFs (Carcello et al., 2005; Sarens & Abdolmohammadi, 2011) as well as a more pronounced risk for fraud (Baucus & Near, 1991). The financial industry, in particular, is known for its unique characteristics and high regulation, often leading to larger IAF budgets. Geographical differences in fraud and attitudes towards its prevention and detection necessitate the inclusion of country-related control variables. Generally, the exposure to fraud risk cannot be abstracted from the cultural context of fraud. Mihret (2014) points out that national culture can provide a useful analytical lens to analyse fraud risk against the cultural context, which is why we include both Germany and Austria as control variables. In addition, we have included diversity, measured by the presence of foreign nationalities in the IAF, as a control variable. Prior research in internal auditing controls for the IAF's age, as different levels of IAF maturity are linked to varying tasks. This inclusion allows us to account for these characteristics in our model. 13 4|RESULTS 4.1 |Descriptive statistics Descriptive statistics on the model variables are presented in Table 1. It gives initial insights regarding the data characteristics for the respondents and thereby helps to identify important characteristics of the respondents' internal audit departments as a foundation for the empirical model. The dependent variable, fraud_scope, has a mean value of 3.89 and a standard deviation of 0.95. Regarding the relationship with the audit committee, 40% of respondents reported additional meetings. Meanwhile, a significant 89% indicated increased interactions with management, suggesting a higher frequency of supplemental meetings with management than with the audit committee. The respondents appear moderate in terms of their technology usage for risk identification given a mean of 3.09 for the variable technology with a standard deviation of 1.02. The average value for the variable listed is 0.41, which translates to 41% of the respondents' organizations being listed. The number of full-time equivalents within the internal audit department as a control variable, after log transformation, ranges from 0.00 to 5.99 and has a mean of 1.68. The size of the entire organization, log-transformed, averages at 7.65. Moreover, within the internal audit departments, our data reveals that around 32% of the teams include members of foreign nationalities, as indicated by a mean of 0.31. The organizations of 36% of respondents operate in the financial industry. Meanwhile, our sample includes 65% of respondents from Germany and 19% from Austria. The mean age in the sample is 25.8. Table A3 shows the correlation matrix for the presented empirical analysis. The Pearson correlation matrix shows no high levels of correlation between any of the independent variables of the model. This is supported by tolerance and variance inflation factors values which are illustrated in Table A4. The results show that the VIF values corresponding to the explanatory variables have a mean of 1.66. Similarly, the tolerances are low, with a mean of 0.60. This signifies minimal multicollinearity, affirming the validity of the proposed model. 4.2 |Regression results Table 2presents the results of the ordered logistic regression model used to test our hypotheses. The overall model is statistically significant (p < 0.001). Our analysis reveals that a robust corporate governance environment is significantly positively associated with the dependent variable (p-value < 0.01), confirming our first hypothesis. The results for the variables representing personal meetings with the audit committee and management align with our expectations and support our second hypothesis. Specifically, additional private meetings with the audit committee are negatively associated with the dependent variable (pvalue < 0.01), while additional private meetings with management are positively associated (p-value < 0.05). These findings echo those of Norman et al. (2010) and highlight the potential conflicts of interest arising from the dual-reporting structure of internal audit functions (Abbott et al., 2010). As hypothesized, the use of technology for risk identification is another significant driver of the dependent variable (p-value < 0.01), supporting our third hypothesis. Among the control variables, iaf_size is statistically significant (p-value < 0.10) with a negative coefficient, while Austria,age and BONRATH and EULERICH 621 org_size are statistically significant (p-value < 0.05, p-value < 0.10, p-value < 0.05, respectively) with positive coefficients. 4.3 |Sensitivity analysis We conduct additional analyses to validate our core regression coefficient estimates. When replacing the corporate governance measure with each of the four underlying variables (corporate governance guideline, whistleblowing tips, ethics guideline, resources), we find positive and significant results, supporting the validity of our main inferences (corporate governance =0.514**, whistleblowing = 0.524***, ethics =0.851***, resources =0.494***). Given that fraud risk management might depend on the industry, we add industry-fixed effects to the initial model. We control for those industries that are sufficiently represented in the sample, namely public, manufacturing and service. The results (untabulated) remain similar for this variation, offering further support for our main inferences. We also run regression models using the same independent variables but varying the dependent variables, as shown in Table A5. One model uses a dependent variable that refers to the use of internal audit results for fraud prevention. This choice stems from the idea that a greater use of internal audit results for fraud prevention indicates an increased focus or relevance of fraud within the scope of internal auditing activities. The question uses the same five-point Likert scale as the replaced one. In another model, we use a dependent variable that refers to whether the detection and investigation of fraud are considered a success factor for the IAF. This variable mainly relates to the attitude of those who use the audit results, thus broadening the scope of the initial model. This variable also uses a five-point Likert scale. TABLE 1 Descriptive statistics. Variable Mean Std. dev. Min p25 Median p75 Max Dependent variable fraud_scope 3.89 0.95 1.00 3.00 4.00 5.00 5.00 Independent variables corporate_governance 0.08 1.10 2.79 0.68 0.01 1.07 1.81 AC 0.40 0.49 0.00 0.00 0.00 1.00 1.00 Management 0.90 0.31 0.00 1.00 1.00 1.00 1.00 Technology 3.10 1.02 1.00 3.00 3.00 4.00 5.00 Control variables Listed 0.41 0.49 0.00 0.00 0.00 1.00 1.00 iaf_size 1.68 1.13 0.00 0.69 1.61 2.48 5.99 Finance 0.36 0.48 0.00 0.00 0.00 1.00 1.00 Germany 0.66 0.48 0.00 0.00 1.00 1.00 1.00 Austria 0.19 0.40 0.00 0.00 0.00 0.00 1.00 Age 25.62 20.58 0.50 11.00 20.00 30.00 100.00 Diversity 0.32 0.47 0 0 0 1 1 org_size 7.66 1.91 0.40 6.33 7.65 8.85 11.96 TABLE 2 Estimated results for the regression model. Variable Coefficient corporate_governance 0.608*** (0.127) AC 0.800*** (0.286) Management 0.932** (0.405) Technology 0.321*** (0.108) Listed 0.142 (0.291) IAF_size 0.260* (0.147) Finance 0.487 (0.338) Germany 0.536 (0.348) Austria 0.977** (0.402) Age 0.011* (0.006) Diversity 0.099 (0.296) org_size 0.213** (0.088) Nagelkerke R2 0.246 Number of observations 275 Note: *, **, *** indicate statistical significance at the p ≤0.10, 0.05 and 0.01 levels, respectively. Standard errors are in parentheses. 622 BONRATH and EULERICH TABLE A3 Correlation matrix. No Variable 1 2 3 4 5 6 7 8 9 10 11 12 13 1fraud_scope 1.000 2corporate_governance 0.255*** 1.000 3AC 0.065 0.281*** 1.000 4Management 0.177*** 0.165* 0.098* 1.000 5Technology 0.174** 0.132** 0.080 0.071 1.000 6Listed 0.044 0.266*** 0.364*** 0.152** 0.037 1.000 7iaf_size 0.006 0.229*** 0.295*** 0.036 0.011 0.290*** 1.000 8Finance 0.071 0.218*** 0.210*** 0.101** 0.133** 0.214*** 0.214*** 1.000 9Germany 0.001 0.226*** 0.262*** 0.037*** 0.005 0.130** 0.063 0.120** 1.000 10 Austria 0.099* 0.094* 0.025 0.135*** 0.005 0.108** 0.100* 0.028 0.691*** 1.000 11 Age 0.075 0.097* 0.172*** 0.087* 0.035 0.161*** 0.437*** 0.313*** 0.082 0.053 1.000 12 Diversity 0.091* 0.157*** 0.157 0.067 0.050 0.229*** 0.470*** 0.065 0.080 0.035 0.033 1.000 13 org_size 0.205*** 0.167*** 0.136*** 0.156*** 0.011 0.213*** 0.458*** 0.316*** 0.004 0.114** 0.153*** 0.252*** 1.000 BONRATH and EULERICH 629 TABLE A4 Collinearity statistics. Tolerance VIF corporate_governance 0.77 1.30 AC 0.68 1.46 Management 0.91 1.10 Technology 0.94 1.06 Listed 0.74 1.35 iaf_size 0.45 2.23 Finance 0.53 1.22 Germany 0.43 2.31 Austria 0.46 2.18 Age 0.73 1.37 Diversity 0.64 1.56 org_size 0.47 2.11 Mean 0.60 1.66 TABLE A5 Additional fraud-related models. Variable Fraud prevention Success factor Fraud risk corporate_governance 0.393*** 0.403*** 0.567*** (0.125) (0.119) (0.111) AC 0.257 0.417 0.017 (0.277) (0.262) (0.267) Management 0.141 0.484 0.130 (0.397) (0.397) (0.362) Technology 0.218* 0.310** 0.277** (0.115) (0.123) (0.129) Listed 0.020 0.049 0.257 (0.275) (0.253) (0.263) IAF_size 0.096 0.122 0.209 (0.148) (0.159) (0.137) Finance 0.916*** 0.946*** 0.329 (0.326) (0.356) (0.307) Germany 0.862** 0.033 0.512 (0.337) (0.357) (0.373) Austria 0.488 0.538 0.702* (0.399) (0.438) (0.420) Age 0.013** 0.007 0.011* (0.006) (0.005) (0.006) Diversity 0.363 (0.322) 0.494* (0.299) 0.171 (0.319) org_size (0.072) 1.219 0.083 (0.110) 0.236*** (0.068) Nagelkerke R2 0.158 0.145 0.210 Number of observations 272 269 270 Note: *, **, *** indicate statistical significance at the p ≤0.10, 0.05 and 0.01 levels, respectively. Standard errors are in parentheses. 630 BONRATH and EULERICH TABLE A6 Additional analyses - ethics. Estimated results for the regression model about ethics Variable Coefficient asset_protection 0.327*** (0.114) org_improvement 0.179 (0.164) opportunities_mgmt 0.234** (0.113) Leadership 0.309*** (0.114) Compliance 0.870*** (0.148) Consulting 0.144 (0.118) Auditing 0.235* (0.141) Finance 0.437* (0.235) Female 0.006 (0.004) code_of_ethics 0.918*** (0.288) Nagelkerke R2 0.322 Number of observations 291 Note: *, **, *** indicate statistical significance at the p ≤0.10, 0.05 and 0.01 levels, respectively. Standard errors are in parentheses. BONRATH and EULERICH 631