1 Drivers to Internal Audit Adoption and Performance within the Belgian Public Sector IIA BEL statistics and PhD findings 4 October 2011 Diane van Gils, PhD candidate (Supervisors: Prof. Christian de Visscher – Prof. Gerrit Sarens, UCL, Belgium)

IIA BEL 2010 Survey in the Belgian public sector Online quantitative survey conducted jointly with Université de Louvain/ the Institute of Internal Auditors Belgium (IIABEL) and Ghent Universiteit (Jan – July 2010) Objectives: statistics, benchmarking activities between IIA members Survey Scope : IA features and Maturity scales (simplification of the 2009 IA- CM, IIA Research Foundation ) Sample : 592 Belgian public entities (departments/agencies), at federal, regional and local level, IA Adopters – No IA Adopters Respondents: Chief executives in internal control area or internal audit if relevant Response rate: 21% (N=126); + PhD Qualitative survey (Summer 2011), 20 public entities of the sample

IA adoption: Statistics 2010 IA adoption rate: 53% legal IA mandate: 40% IA age: from 1 to 20 years ; average 6,5 years Two waves: 90 and after 2000

IA adoption: rationale/drivers IA rationale has an impact on its performance/profile Various reasons/drivers: Legal IA mandates : IA profile according to the legal requirements Fraud risks : amalgam between inspection and internal audit Restructuration context / quality assurance : process oriented Mimetism after 2000 : IIA standards

IA maturity (statistics 2010) Internal Audit Capability Model (IA – CM) 2009, IIA Research Foundation

IA maturity (statistics 2010)Professional practices Capability Dimension Examples of indicators, by decreasing order Audit plan (84%) ; Risk based audit plan (61%) Adherence to IIA standards (79%) ; 62% partially ; 45% fully IA manual (68%) Monitoring the implementation of recommendations (63%) Internal evaluation (53%) External evaluation (47%) Clients surveys (33%) Scope of IA work on governance, risk and control (34%) Other statistics for information Operational audit (84%) Performance audit (61%) Compliance audit (56%) IT audit (38%) Financial audit (18%)

IA maturity (statistics 2010)Governance Capability Dimension Examples of indicators, by decreasing order IA attached to the top (89%) IA charter (79%) Signature of official documents by top-level authority (68%) Presence AC (57%) Executive policies to support access to information and people (50%) Formal IA budget (52%) IA is a top issue in top-level meetings (47%) Internal communication on IA importance and benefits (45%) Exchange of audit reports/plans with external auditors (45%) ; Reliance of IA work by external auditor (18%) Coordination documented or procedures with IC services (21%) Other statistics for information AC with an average of 3 to 5 members 60% of the audit committees have a legal mandate % of recommendations implemented: average: 62%

IA maturity (statistics 2010)People Management Capability Dimension Examples of indicators, by decreasing order Training in IA field (84%) Presence of a CAE (82%) At least 40 hours of training per year (58%) ; average 45 hours Professional IA certifications or in related field (45%) Resource planification process (34%) CAE with senior experience (5<) (18%) Formal IA promotion system (11%) Rotation/internship programs (5%) Other statistics for information Size: from 1 to 20 ; 60% with maximum 3 internal auditors Recruitment : 45% internally (CAE, 56%)

IA maturity (statistics 2010) Average Per Capability Dimension

IA maturity/performance (drivers) Clear IA added value should be perceived by the organization Top management as a partner, not only as an auditee Sometimes IA is used only as a label Organizational maturity and IA maturity are interrelated, so IA added value High external control environment facilitates IA performance Strong HR managerial flexibility is crucial to ensure high professionalization Difficult to recruit senior professionals Gap between precarious contractual positions and high level expectations (credibility and independence) IA paradox

11 4. Conclusion Is the very low global score in terms of IA maturity a deliberate wish or a constraint? Higher IA professional levels are very rare, but it is still a recent function Top management is not really demanding (political versus management risks) IA function is not fully adapted yet in official public HR policies/programs Audit confusion rather than single audit New form of public control and governance structure, not yet completed No clear answer yet, it is still the beginning of the story