The Internal Audit Function’s Role in Risk Management: Does the Salience of the IAF Stakeholders Matter?

• In Event: Break with Research and Education Poster Forum

Abstract

The importance of risk management (RM) and the role of the internal audit function (IAF) in RM have grown in recent years. Despite the relevance of these topics, prior literature infers that the IAF has become the ‘jack of all trades’ of RM, but does not clearly capture its actual roles. This paper investigates through a fuzzy-set qualitative comparative analysis (fsQCA), how different levels of salience of the several IAF stakeholders can influence the role of the IAF regarding RM (assurance role vis-à-vis consulting role), and the focus of the IAF on different categories of risks. We ground our study on the theory of Stakeholders Identification and Salience (Mitchell et al., 1997) to identify who really counts for the chief audit executives (CAEs) in shaping the IAF’s role in RM. The results of our analysis, based on 16 interviews with CAEs, working for top public non-financial Italian companies, and on the analysis of relevant documents, indicate that a higher salience of the board and the control bodies, compared to senior management, leads the IAF to assume a more marked role on the assurance of the RM system, and a greater focus on compliance, reporting, fraud and reputational risks. When the board is perceived as the most salient stakeholder, the IAF focus primarily on strategic risks. Finally, when the senior management is perceived as the most salient stakeholder, the IAF’s role shifts toward a consulting approach for the improvement of RM, and with a greater attention to operational risks.

Authors

• Romina Rakipi, University of Pisa

• Giuseppe D'Onza, University of Pisa

• Marco Allegrini, University of Pisa