Blurred lines: exploring internal auditor involvement in the local authority risk management function

ABSTRACT

The internal audit remit includes assessing budgetary compliance by departments, investigating fraud and error, appraising systems of control and undertaking consulting, the last including risk management even though internal auditors generally lack risk training and expertise. Surveying internal auditors in Scottish local authorities, this paper investigates discrepancies between professional guidance and current practice regarding the risk management remit of internal audit. Lines of responsibility were found to be blurred, so there were insufficient safeguards to ensure compliance and the roles and responsibilities of internal audit involvement in risk management assurance did not fully comply with professional guidance.

IMPACT

This paper has important policy implications for clearly defining the risk and control culture within organizations. The research findings prove that internal auditors often stray into areas of risk management outside their remit, and thus support the need to understand the clear boundaries of separation between the two roles. The paper identifies the challenge that both of these functions face and provides guidance as to how both professions can work more effectively to strengthen governance frameworks. Internal auditors are encouraged to go beyond local government focused guidance, to address the disconnect between ‘institutionalized’ sector specific guidance and wider professional guidance.

KEYWORDS:

• Critical friend
• ERM fan
• internal audit
• local government
• risk management

Disclosure statement

No potential conflict of interest was reported by the author.