خلاصه
1. معرفی
2. پیشینه و سوالات تحقیق
3. روش
4. نتایج
5. بحث و نتیجه گیری
اعلامیه منافع رقابتی
در دسترس بودن داده ها
سپاسگزاریها
پیوست اول
منابع
Abstract
1. Introduction
2. Background and research questions
3. Method
4. Results
5. Discussion and conclusion
Declaration of Competing Interest
Data availability
Acknowledgements
Appendix A
References
چکیده
هدف این مطالعه افزایش درک استفاده حسابرس داخلی از تحلیل علت ریشه ای (RCA) است. مشاوره عملی IIA 2320-2: تجزیه و تحلیل علت ریشه ای (IIA 2011) بیان می کند که RCA باید یک شایستگی اصلی برای حسابرسان داخلی برای ارائه بینش و ارزش افزوده در سازمان ها باشد. با این حال، اطلاعات کمی در مورد استفاده حسابرس داخلی از RCA در حرفه ای وجود دارد که در آن نظریه حل مسئله هنجاری و چارچوب های RCA به طور بالقوه با خواسته های حرفه ای برای استقلال و عینیت در تضاد است. ما مصاحبه های عمیقی را با 21 حسابرس داخلی سطح بالا با تجربه RCA انجام می دهیم تا استفاده در این حرفه را درک کنیم. نتایج چندین مضمون کلی را پیشنهاد میکند که برای سیاستگذاران، محققان و متخصصان پیامدهایی دارد. اول، ما متوجه شدیم که حسابرسان داخلی در عمل معتقدند که RCA ابزار بسیار مهمی در این حرفه است. دوم، اگرچه حسابرسان داخلی به طور کلی ادعا میکنند که RCA را درک میکنند، اما ما تفاوت قابلتوجهی را در روشهای رویکرد آنها به ساختار و اجرای فرآیندهای تجویز شده در عمل مییابیم. در نهایت، نتایج نشان میدهد که در حالی که استفاده از RCA به طور منطقی در بین حسابرسان داخلی رایج است، محدودیتهای دانش، محدودیتهای منابع، و نگرانی در مورد استقلال و عینیت، تنوع قابلتوجهی از نظر رویکرد RCA، دقت و کارایی در سازمان ایجاد میکند.
Abstract
The objective of this study is to increase understanding of internal auditor use of root cause analysis (RCA). The IIA’s Practice Advisory 2320–2: Root Cause Analysis (IIA 2011) states that RCA should be a core competency for internal auditors to provide insight and add value within organizations. However, little is known about internal auditor use of RCA in a profession where normative problem-solving theory and RCA frameworks potentially conflict with professional demands for independence and objectivity. We conduct in-depth interviews with 21 high-level internal auditors with RCA experience to understand use within the profession. The results suggest several overarching themes that have implications for policymakers, researchers, and practitioners. First, we find that internal auditors in practice believe that RCA is a very important tool within the profession. Second, although internal auditors generally claim to understand RCA, we find considerable variation in the ways they approach the construct and implement prescribed processes in practice. Finally, the results indicate that while RCA use is reasonably prevalent among internal auditors, knowledge constraints, resource limitations, and concern about independence and objectivity create considerable variation in terms of RCA approach, rigor, and efficacy within organizations.
Introduction
Internal auditors serve an evolving variety of assurance and consulting roles within organizations that require a diverse skillset to add value within organizations.1 Policymakers have established internal auditor performance of root cause analysis (RCA) as a key skill within the profession. Wilson, Dell, and Anderson (1993) define RCA in a problem-solving context as a process of identifying the most basic reason for an undesirable condition or problem that, if corrected or eliminated, would have prevented it from existing or occurring. The Institute of Internal Auditor’s (IIA) Practice Advisory 2320–2: Root Cause Analysis (IIA 2011) states that “a core competency necessary for delivering insights is the ability to identify the need for root cause analysis and, as appropriate, actually facilitate, review, and/or conduct a root cause(s) analysis” (para. 2). However, the literature provides evidence that internal auditors sometimes fail to fulfill expectations in the area. For example, Miller and Smith (2011) provide evidence of a gap between what is expected from internal auditors related to RCA use and what they actually provide. After an investigation of fraudulent sales practices at Wells Fargo, the board of directors concluded that internal auditors had access to information regarding sales practice problems, but “did not attempt to determine the root causes of unethical sales practices” (Wells Fargo 2017p. 91).
The objective of this study is to evaluate internal auditor use of RCA in the profession as called for by policymakers. This research is motivated in large part by the lack research on RCA use by internal auditors and the factors that affect their performance in the area given various and sometimes conflicting professional calls for independence, objectivity, professional skepticism, and due care. In an internal audit context, extant studies focus on internal audit quality (e.g., criteria and perceptions) and roles in organizational governance (Gramling et al., 2004, Roussy and Perron, 2018). For example, Barua, Rama, and Sharma (2010) discuss how internal auditors can assist audit committees by providing independent investigations and evaluation of accounting practices, processes, and controls. However, extant research provides little insight into internal audit practice. Roussy and Perron (2018) provide a structured literature review with 91 internal audit studies from 2005 to 2017 and find that “only 13 of these papers addressed internal audit practice and…scholars know very little about how internal auditors behave” (p. 373).
Discussion and conclusion
The IIA prioritizes RCA for internal auditors as a core competency that should help them add insight and value within organizations. Although policymakers prescribe the importance of RCA in the profession, the literature lacks evidence about internal auditor use of RCA in an environment with professional (e.g., independence, objectivity) and practical (e.g., time, expertise, access) constraints. We use in-depth interviews with highly experienced internal auditors to provide initial evidence about RCA use within the profession.
Table 2 provides a summary of key takeaways and specific questions for future research. Several primary themes deserve careful and continued consideration. First, we find strong agreement that RCA is an important tool for internal auditors working to solve problems and add value within their organizations. Reported keys to RCA success include obtaining a thorough understanding of business processes and having frequent group discussions to challenge findings and potential solutions. However, the interviewees also emphasize that internal auditors should carefully consider resource constraints and prioritize RCA efforts in high-risk areas where it can have the greatest impact. Second, although the interviewees generally claim to understand RCA, we find evidence of a substantial knowledge gap between what they think RCA is and what it actually is given prescriptive and practice guidance in the area. For example, some interviewees view RCA simply as a general mindset and lack awareness of professional guidance, training opportunities, and rigorous methods available to them and their colleagues. Finally, although internal auditor use of RCA appears to be reasonably prevalent, the knowledge gap, resource constraints, turnover issues, and professional concerns about independence create considerable variation RCA approach, rigor, and efficacy. Although some internal audit leaders clearly manage sophisticated RCA systems that triangulate methods and include rigorous data collection, analysis, and documentation procedures, others readily admit they lack the resources and expertise to perform RCA as called for by policymakers.