The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey

Onay, Ahmet Article The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey Istanbul Business Research (IBR) Provided in Cooperation with: Istanbul University, Business School Suggested Citation: Onay, Ahmet (2020) : The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey, Istanbul Business Research (IBR), ISSN 2630-5488, Istanbul University Press, Istanbul, Vol. 49, Iss. 2, pp. 177-200, https://doi.org/10.26650/ibr.2020.49.0032 This Version is available at: https://hdl.handle.net/10419/250240 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. https://creativecommons.org/licenses/by-nc/4.0/ RESEARCH ARTICLE Istanbul Business Research Istanbul Business Research, 49(2), 177-200 DOI: 10.26650/ibr.2020.49.0032 http://ibr.istanbul.edu.tr/ http://dergipark.gov.tr/ibr Submitted: 24.02.2020 Revision Requested: 23.06.2020 Last Revision Received: 29.06.2020 Accepted: 02.08.2020 Published Online: 27.04.2020 The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey Ahmet Onay1 Abstract Enterprise Risk Management (ERM) has emerged as a paradigm aimed at enabling organizations to respond to everchanging risk factors. Since the publication of the COSO Risk Management Framework and IIA report in 2004, internal audit functions have assumed a variety of roles in organizations' ERM operations. The main purpose of this study is to determine the extent to which internal auditors' activities have changed over time in relation to ERM activities and to what extent these tasks are undertaken in practice. In the first part, literature and new risk frameworks related to the role of internal audit in ERM are examined. In the study, data collected from 245 internal auditors working in organizations operating in Turkey were analyzed by t-test and analysis of variance (ANOVA). From the findings, it was determined that the opinions of internal auditors regarding ideal situations in terms of ERM tasks assumed under certain conditions differed from those in practice. The analyses showed that some of the internal auditors' opinions differed statistically according to demographic variables. It has been determined that the opinions of internal auditors differ according to age, professional experience and enterprise sector in which they worked. The results were compared with studies on different samples. Thus, internal auditors' opinions and the current situation in Turkey, can be compared to different regions. In our study, different results were obtained from the results of studies conducted in different countries. Keywords Internal Audit, Enterprise Risk Management, Role of Auditors, Turkey 1 Corresponding Author: Ahmet Onay (Ress. Asst.), Eskisehir Technical University, Vocational School of Transportation, Department of Management and Organization, Eskisehir, Turkey. E-mail: [email protected] ORCID: 0000-0003-1182-6003 To cite this article: Onay, A. (2020). Role of ınternal audit from new enterprise risk management frameworks perspective: a research in Turkey. Istanbul Business Research, 49(2), 177-200. http://doi.org/10.26650/ibr.2020.49.0032 This work is licensed under Creative Commons Attribution-NonCommercial 4.0 International License Introduction In recent years, the interest of employees, managers and internal auditors towards Enterprise Risk Management (ERM) has been increasing. Especially since recent financial crises, the fact that business stakeholders such as professional organizations, regulatory authorities and rating agencies have taken greater consideration of ERM than ever, explains this interest. Recent crises have highlighted weaknesses in risk management. Today, business executives face significant pressure to strengthen risk management systems and maintain stakeholder value. Regulatory agencies, professional organizations and other standard developers who put forward new risk management principles, rules and requirements increase this pressure. Istanbul Business Research 49/2 178 In an economic environment where institutional uncertainty is increasing, ERM has emerged as a new paradigm for risk management. ERM argues that instead of relying on a traditional, functional strategy where each unit of the organization manages its own risk, a broader perspective that integrates and coordinates risk management across functions should be adopted. The enterprise-wide approach is designed to increase and maintain stakeholder value. However, ERM aims to do more than merely integrate risk management. The ERM definition made by COSO in 2004 was the most accepted (COSO, 2004, p.4): “Enterprise risk management is a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.” The IIA is committed to implementing COSO guidelines and publications in risk management. The IIA definition made by IIA in 2004 is similar to and supports the definition of COSO (IIA, 2004, p.3): “A structured, consistent and continuous process across the whole organization for identifying, assessing, deciding on responses to and reporting on opportunities and threats that affect the achievement of its objectives.” In recent years, however, new needs have led to a metamorphosis in the mentality of ERM. COSO, which published the definition adopted by other professional organizations in 2004, did not remain indifferent to this metamorphosis and updated its ERM Framework and definition in 2017. One year after COSO, the International Organization for Standardization (ISO) updated the ISO 31000 guide, which are the most widely used guidelines in the field of ERM after COSO. In the current COSO guide, ERM is defined as (COSO, 2017, p.10): “The culture, capabilities, and practices, integrated with strategy-setting and its execution, that organizations rely on to manage risk in creating, preserving, and realizing value.” Along with the framework published in 2004, the change in the traditional risk management approach focusing on risk mitigation has enabled internal audit to assume significant roles in risk management. The paradigm of the new risk frameworks, which argues that risk should be linked to strategy and performance, and that integrated activities are a necessity instead of functional efforts, has undoubtedly influenced internal audit. As a result of the guidance of IIA, which has changed the scope of the profession to a great extent, internal audit has evolved from a traditional control-based approach to a focal point of the profession to those who place risk management, corporate governance and value creation. Under the explicit guidance of the IIA for risk management, internal auditors make their profession an important part of risk management, and support their organizations in identifying and assessing risks. In Onay / The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey 179 recent years, the internal audit profession and risk management have changed in parallel. As a result, internal auditors theoretically made a significant contribution to ERM process locating them in a position which adds value to ERM practices. In the following sections of the study, the theoretical background shaped by the new ERM frameworks, literature aiming to determine role of internal audit in ERM, methodology of research, findings and results obtained within the scope of research limitations are given respectively. Theorical Background and Literature Review The transformation of the corporate risk management approach in recent years has necessitated the update of two important frameworks. COSO has updated its ERM framework that it published for first time in 2004, taking into account changing conditions of business world and new emerging requirements. In 2016, it published a draft of the new framework, and in 2017, it adopted the framework supported by feedback of its stakeholders under the name of Enterprise Risk Management - Integrating with Strategy and Performance (Anderson, 2017). The second most widely used risk management framework in the world after the COSO framework was first published by ISO in 2009. ISO re-published its framework in 2018 under the name of ISO31000:2018 Risk Management Guidelines, taking into account the new challenges and changes facing businesses (Fox, 2018). New COSO ERM Framework The new COSO ERM framework has been prepared from a business process perspective in order to facilitate the integration of ERM activities and to increase the level of acceptance of practitioners consisting of top managers, board of directors, risk employees and internal auditors. It argues that an organization must integrate risk management activities that are often carried out separately from operational management and not linked to business processes (Pierce et al., 2016). The new corporate risk management approach wanted to prevent risk management in enterprise from being perceived as a progressive activity carried out by individuals independent of business processes. Because of the lack of integration between employees, processes and technologies complicates activities and prevents creation of the value that ERM can provide by providing insights and recommendations on business activities. The new COSO ERM framework described a risk management model, which was previously composed of eight elements and described as cube, in a spiral of five interrelated elements (Prinsenberg & Sluis, 2017, p.14; COSO, 2017, p.6). Figure 1 shows elements of the new framework. Governance regulates the management style of an organization that identifies risks of an organization, strengthens the corporate risk management structure and develops oversight Istanbul Business Research 49/2 180 responsibilities (Prewett & Terry, 2018). Culture is about ethical values, desired behaviors and risk understanding in organizations. ERM works with strategic and objective setting activities in strategic planning processes. Risk appetite is determined and aligned with strategy. Business objectives are implemented through strategies while providing the basis for risk identification, assessment and development of appropriate responses. Achieving strategies and objectives is related to performance. Risks are prioritized according to their weight in terms of risk appetite. Organization then selects risk responses and creates a risk portfolio for the amount of risk it undertakes. The results of this process should be communicated to key risk stakeholders. An organization should review operating performance and how well the corporate risk management elements work due to significant changes over time, and which revisions are necessary, and revise as necessary. The ERM should establish communication channels that provide the necessary information from internal and external sources and share it when necessary. These channels should ensure continuous communication with both the top-down and bottom-up information sources and stakeholders that need to be communicated with outside the enterprise. Figure 1. COSO ERM Helicase (COSO, 2017) The new COSO Framework seeks to eliminate jargon risk and adopts a common business language to discuss concepts and practices. The framework argues that use of the same language will encourage the adoption of ERM by institutions. In traditional practice, although ERM refers to a business unit, team, or part of defense lines, a holistic view of the new framework provides a risk-based discussion of the culture, capabilities and activities used to manage risk in an enterprise. The five components in the updated framework are supported by a set of policies. These principles cover all processes from governance to monitoring. These are principles that can be applied in different ways depending on the size of the firm, regardless of type of enterprise or sector in which it operates. Adherence to these principles may provide the senior management and board with a reasonable expectation to understand and manage risks that affect strategy and objectives in the entity. The new framework consists of 20 principles. The principles are shown in Table 1. Onay / The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey 181 Table 1 Principles of COSO ERM Governance & Culture Strategy & ObjectiveSetting Performance Review & Revision Information, Communication, & Reporting 1.Exercises Board Risk Oversight 2.Establishes Operating Structures 3.Defines Desired Culture 4.Demonstrates Commitment to Core Values 5.Attracts, Develops, and Retains Capable Individuals 6. Analyzes Business Context 7.Defines Risk Appetite 8.Evaluates Alternative Strategies 9.Formulates Business Objectives 10.Identifies Risk 11.Assesses Severity of Risk 12.Prioritizes Risks 13.Implements Risk Responses 14.Develops Portfolio View 15.Assesses Substantial Change 16.Reviews Risk and Performance 17.Pursues Improvement in Enterprise Risk Management 18.Leverages Information and Technology 19.Communicates Risk Information 20.Reports on Risk, Culture, and Performance Executive The new framework highlights inter-function integration in ERM. It argues that risk should be linked to strategy setting and daily business activities. Thus, it helps to use ERM principles to promote value creation and preservation. The framework has been prepared from the perspective of business processes (Steffee, 2016). Risk-related concepts are discussed in terms of creating value that allows an organization to gain real benefits from ERM (Anders, 2019, p.66). The framework highlights relationship between risk and performance. It shows a new way of identifying and evaluating the relationship between risk level and performance. It argues that culture should be emphasized more. It argues that all risks that the organization is responsible for can be managed through an ERM model that reflects the changing demands and expectations of today’s markets. To achieve this, the impact of business culture on values such as risk appetite and risk tolerance should be constantly considered. The strategy setting process is an important field of activity in which corporate risk management should be integrated. Strategic errors are the main reason for the vast majority of losses in share value compared to operational failures. Strategies shaped by mission, vision and core values are the driving force of governance and business performance. Integrating with business activities and processes, ERM provides the development of a much more consistent information architecture that enables better decision-making and performance improvement. ERM should ensure that risk information is acted upon throughout the firm’s value chain cycle. ERM should be integrated into business strategy development, performance management, goal setting and governance processes. A holistic perspective can make risk management activities easier at various levels of enterprise, and act with risk information (Richtermeyer, 2018, p.25). Integrating ERM into business processes eliminates barriers to better information and communication structures and higher performance that support decision-making. Decisions that affect performance with risk information should be optimized and how decisions made affect the entity’s risk profile (Sobel, 2018, p.16). Istanbul Business Research 49/2 182 The new framework argues that the evolving role of technology in ERM activities needs to be further taken into account and that technology has reached the potential to create more benefits in ERM. It enables discussion of how technology can affect an organization’s strategy, business processes, and risk management (Prinsenberg & Sluis, 2017, p.12). The new COSO Framework emphasizes that it is important for corporate risk management to follow technological developments. ERM operations and capabilities need to adapt pace of changes and emerging risks in the business world. The principles of information, communication and reporting indicate that integrated risk and performance reporting has become a necessity for businesses. In order to develop strong ERM, businesses should use next generation data analytics and technologies, such as Big Data and Artificial Intelligence. Technology infrastructure will ensure the accuracy, completeness and timeliness of data in ERM (Herron & Dholabhai, 2017, p.21). There is no doubt that businesses will continue to face a future full of changes, complexities and uncertainties. ERM will be an important part of how an enterprise will be managed and guided in such periods. All organizations need to be able to respond consistently to change, including the ability to adapt quickly to capacity, while maintaining a high level of trust in stakeholders through strong decision-making processes. By focusing on the right issues, ERM can give businesses confidence in their ability to predict the future (Farrell & Gallagher, 2015). The future needs to be adapted to achieve the predicted benefits of ERM. A future-oriented perspective reflects trends that need to be considered (COSO, 2017, p.7-8): • ERM needs to adapt new data analytics technologies where more and more data can be analyzed faster. More data can be collected from both inside and outside of the enterprise and processed by new methods. Enhanced data analytics and visualization tools will improve understanding of both positive and negative impacts of risks and will be very useful for ERM activities. • Today, many people think that we have entered an era of automatic processes and artificial intelligence. It is important to take into account the impact of automation, artificial intelligence, and future technologies to be discovered and the enhanced capabilities of ERM in operations and applications. With advanced technology tools, previously unrecognized relationships, trends and models can be revealed, providing a critical source of information for risk management. • One concern that is often expressed by many business executives is the cost of risk management, compliance activities and control processes compared to value gained. As corporate risk management practices evolve, it will be important to effectively coordinate activities involving risk management, compliance, control and governance to provide maximum benefits to the organization. This may represent one of the best Onay / The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey 183 opportunities for ERM to redefine its importance for organization. ERM can be at the center of a structure, which ensures that risk management, compliance, control and governance activities are carried out at a lower cost, in coordination and cooperation. New ISO31000 ERM Framework In February 2018, ISO published a new risk management framework highlighting similar changes to COSO. However, there has been no change in the objective of integrating risk management of previous framework into strategic and operational processes. The importance of top management leadership, governance of the organization and integration of risk management were emphasized in the 2018 version of the framework. More emphasis was placed on the continuous repetitive nature of risk management. It was emphasized that information obtained and new analyses should ensure that processes, actions and controls are constantly revised. The scope of ERM has been reorganized to maintain a model of systems that can respond quickly to needs (IRM, 2018, p.8). The new version of ISO 31000 is shorter than the previous version and provides a holistic overview of how risk management can be implemented. ISO 31000 defines principles and processes that characterize effective risk management. It is understood that the new ISO guidelines have the same risk management approach as the new COSO framework, places more emphasis on decision-making processes supported by risk knowledge, places value creation and protection at the center of its principles and advocates organizational and technological integration for effective risk management (IRM, 2018, p.9). Th new guidelines state that ERM principles should be applied by all employees responsible for creating and maintaining value in risk management, decision-making, goal setting and performance improvement activities. Principles can be applied in any type and size of firm. ERM principles advocate that risk management should support organizations in terms of strategy setting, achieving objectives, and informed decision-making. Risk management should be a part of governance and leadership, and should form the basis of how to manage all organizational levels of enterprise. Eight principles of the new guidelines are (IRM, 2018, p.10): 1. ERM framework and processes should be customized to suit the business. 2. Timely participation of appropriate stakeholders is required. 3. A structural and comprehensive approach is required. 4. Risk management should be an integral part of all organizational activities. 5. Risk management anticipates, identifies, recognizes and responds to changes. 6. Risk management explicitly considers any limitations caused by available information. Istanbul Business Research 49/2 184 7. Human and cultural factors affect all aspects of risk management. 8. Risk management is continuously improved through learning and experience. When the revisions made in both guidelines are examined, it is understood that the changes emphasize the need for further involvement of the senior management and board of directors in corporate risk management, that business objectives and strategies should be more associated with risk management and that the performance evaluation processes of the enterprise should be integrated with risk management. According to both guidelines, risk management has become an activity where business functions should work together. In summary, both guidelines emphasize the process of creating value through risk management and emphasize the need to place risk management decision-makers at the heart of risk management through organization of employees, processes and technology (Sobel, 2018; IRM, 2018). The Role of Internal Audit in ERM A professional information note issued by IIA in 1998 addressed the role of internal audit in risk management for the first time. The information note suggests that internal auditing should add value to an organization by closely linking with key concerns of senior executives and focusing on issues deemed important for success (Pickett, 2011, p. 84). International Standards on Internal Auditing address the role and responsibilities of internal auditors in risk management. Performance Standard 2100 specifies that the internal audit function should assist an organization by assisting in the development of risk management and control processes and by identifying and assessing risks exposed. Thus, effective internal audit can become an integral part of organizations risk management processes, including the creation of appropriate corporate risk management. According to standard 2100, internal auditors should assist both management and audit committee by examining, evaluating, reporting and developing remedial measures to assess the adequacy and effectiveness of risk processes implemented by management. However, it should be remembered that corporate management, the audit committee and board of directors are responsible for the risk management and control processes of an organization. Internal auditors who undertake consultancy tasks can provide assistance in identifying risks, assessing risks, implementing risk management methods, and taking and implementing risk-related control measures (IIA, 2010, p.167-168). Internal auditors are in a position to better understand the concept of risk management than other employees and provide valuable advice (Flanders, 2018, p.62). Therefore, chief audit executive should be more proactive when training managers and the audit committee on the value of effective risk management (Wright, 2018). Internal auditors can play an important role in increasing this value (Thabit, 2019). In many internal audit activities, a risk-based 191 Onay / The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey statements in their research. Utilizing the IIA reports within the scope of the research has provided a more accurate determination of responsibilities of internal audit for the purposes of our study, as well as comparing the results of research with studies in the literature. Descriptive statistics related to sampling were used in the research. In order to reveal the differences between views of sample on ideal situation and current situation, t tests were conducted. Analysis of variance (ANOVA) was used to test the effect of the descriptive characteristics of the research sample on opinions and to compare the results of our study with the results of other studies in the literature. SPSS 24.0 was used for descriptive and predictive analyses. Findings In this section, the demographic characteristics of the sample and statistical analyses are given. Before statistical analyses were performed, normality, which is the prerequisite for analyses, was tested. Since the data set consisted of ordinal variables based on significance or superiority, the distribution of data was examined by a graphical approach and kurtosis-skewness values instead of test statistics measuring normality. In the literature, there are studies advocating that kurtosis-skewness limit values should be between +1.5 and -1.5 (Tabachnik & Fidell, 2007) or +2 and -2 (George & Mallery, 2010). When graphs and kurtosis-skewness values were examined, it was concluded that the data set was distributed close to the normal distribution and that normality assumption was not violated. The second part of the questionnaire consists of “core roles”, “legitimate roles with safeguards” and “roles that should never be undertaken”. In order to determine internal consistency of the questionnaire, the Cronbach Alpha coefficient was calculated for each question group. Cronbach’s alpha coefficient was calculated as α = 0.947 for core tasks, α = 0.872 for tasks that could be undertaken under certain conditions and α = 0.849 for tasks that should never be undertaken. It was determined from the obtained values that internal consistency, which is an important indicator of the reliability of the questionnaire, was quite high. The demographic characteristics of the internal auditors participating in our research are presented in Table 6. Internal auditors are classified according to their gender, age and professional experience. The majority of internal auditors who participated in the survey were male (66%), older than 40 years (35%) and with over 7 years of professional experience (58%). Comparison of Opinions in Terms of Ideal Situation and Current Situation In order to compare participants’ views on the ideal situation and the current situation of internal auditors on ERM tasks, the paired sample t test, which is frequently used in statistical literature, was used to evaluate the responses of the same group to two different questions. Results of the test are presented in Table 7. Table 6 Demographic Characteristics of Sample Business Sector Total Private Public Gender Female 74 10 84 (34%) Male 128 33 161 (66%) Age Under 34 80 -80 (33%) Between 34-40 73 6 79 (32%) Over 40 49 37 86 (35%) Professional Experience Under 7 Years 69 3 72 (29%) Between 7-12 54 20 74 (30%) Over 12 Years 47 20 67 (28%) Not Reply 32 -32 (13%) 202 (82%) 43 (18%) 245 (100%) Table 7 Paired Samples t Test Results Business Sector Total Private Public Gender Female 74 10 84 (34%) Male 128 33 161 (66%) Age Under 34 80 -80 (33%) Between 34-40 73 6 79 (32%) Over 40 49 37 86 (35%) Professional Experience Under 7 Years 69 3 72 (29%) Between 7-12 54 20 74 (30%) Over 12 Years 47 20 67 (28%) Not Reply 32 -32 (13%) 202 (82%) 43 (18%) 245 (100%) *p < .01 (t>2.58) According to the test results, a statistically significant difference was found only between the opinions of participants regarding tasks undertaken under certain conditions. The difference is in favor of ideal situation. Comparison of Opinions in Terms of Demographic Characteristics Independent samples t test should be conducted to test the statistical significance of the difference between the means of the views of two unrelated participants. It was tested whether the opinions of participants changed according to gender and sector Istanbul Business Research 49/2 193 (Private / Public) in which the enterprise of the internal auditors operates. Results showed that the opinions did not change according to gender. On the other hand, the fact that the firm to which the internal auditors belonged to operates in the private or public sector affected their opinions. Equality of variance should be examined when evaluating the test results and appropriate values should be considered according to the Levene Test results. Results of theindependent sample t test conducted to determine whether opinions of internal auditors vary according to sector in which they operate are shown in Table 8. Table 8 Independent Samples t Test Results Ideal Situation Group n X ΔX SS SD tp Core Tasks Private 202 4.13 0.344 0.626 243 3.23* 0.001 Public 43 3.79 0.674 Legitimate tasks with safeguards Private 202 3.09 -0.355 0.540 243 -3.28* 0.002 Public 43 3.45 0.665 Tasks should not undertake Private 202 1.93 0.282 0.624 243 2.21 0.030 Public 43 1.65 0.783 Current Situation Group n X ΔX SS SD t p Core Tasks Private 202 4.25 0.576 0.449 243 5.97* 0.000 Public 43 3.67 0.596 Legitimate tasks with safeguards Private 202 2.76 -0.766 0.663 243 -10.19* 0.000 Public 43 3.52 0.386 Tasks should not undertake Private 202 1.89 0.105 0.421 243 1.50 0.133 Public 43 1.78 0.385 *p < .01 (t>2.58) When Table 8 is examined, it is determined that the opinions of participants regarding both the ideal situation and the current situation differ statistically at the level of p < .01 in terms of “core tasks” and “legitimate roles with safeguards” according to the sector in which the enterprise operates. While the opinions of private sector employees on “core tasks” are higher in terms of both ideal situation and current situation, the opinions of public sector employees on “legitimate tasks with safeguards” are higher in both the ideal situation and the current situation. One-way analysis of variance (ANOVA) was conducted to assess whether age and professional experience had an impact on opinions. As presented in the table of demographic characteristics of sample, age and professional experience variables were classified into three groups. One-way ANOVA test was used to determine whether there was a significant difference between the mean scores of the opinions for three groups. The Scheffe test was applied to determine the difference between the groups for means where significant differences were detected. Results of ANOVA test for age independent variable are presented in Table 9. Onay / The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey Table 9 ANOVA Test Results According to Age Variable Ideal Situation Group n X SS SD F P Core Tasks Under 34 80 4.15 0.622 242 4.10* 0.018 Between 34-40 79 4.16 0.651 Over 40 86 3.91 0.643 Legitimate tasks with safeguards Under 34 80 3.10 0.523 242 1.13 0.325 Between 34-40 79 3.13 0.502 Over 40 86 3.23 0.683 Tasks should not undertake Under 34 80 1.83 0.556 242 0.52 0.590 Between 34-40 79 1.94 0.612 Over 40 86 1.87 0.787 Current Situation Group n X SS SD F P Core Tasks Under 34 80 4.27 0.430 242 3.77* 0.024 Between 34-40 79 4.12 0.464 Over 40 86 4.05 0.631 Legitimate tasks with safeguards Under 34 80 2.73 0.715 242 10.10* 0.000 Between 34-40 79 2.78 0.643 Over 40 86 3.15 0.632 Tasks should not undertake Under 34 80 1.79 0.397 242 2.28 0.104 Between 34-40 79 1.93 0.398 Over 40 86 1.88 0.443 * There is a significant difference between groups. According to the results of the ANOVA test, it was determined that the opinions of participants about the ideal situation and the current situation differed statistically according to age variable in terms of core tasks. Post-hoc test results to determine which age groups differ in terms of core tasks showed that the difference was between the views of the 34-40 age group and the over 40 age group in terms of ideal situation. In addition, the opinions of participants about practice differed significantly according to age variable in terms of tasks assumed under certain conditions. Posthoc tests show that the difference is between the views of the under-34 and over-40 groups. On the other hand, there is no significant difference in terms of tasks that should never be undertaken. One-way analysis of variance (ANOVA) was conducted to determine whether opinions of internal auditors changed according to their professional experience. Results of analysis are presented in Table 10. Results of ANOVA test conducted according to the professional experience variable showed that the opinions of participants differed only in terms of tasks assumed under certain conditions. Post-hoc test results in order to determine the differences between the groups showed that there was a difference between the opinions of participants who had less than 7 years of experience and those who had more than 12 years of experience. Istanbul Business Research 49/2 195 Onay / The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey Table 10 ANOVA Test Results According to Professional Experience Ideal Situation Group n X SS SD F P Core Tasks Under 7 Year 72 4.26 0.591 242 2.93 0.055 Between 7-12 Years 74 4.10 0.678 Over 12 Year 67 4.00 0.629 Legitimate tasks with safeguards Under 7 Year 72 3.12 0.520 242 1.33 0.264 Between 7-12 Years 74 3.23 0.570 Over 12 Year 67 3.27 0.660 Tasks should not undertake Under 7 Year 72 1.91 0.558 242 0.70 0.495 Between 7-12 Years 74 1.83 0.746 Over 12 Year 67 1.96 0.694 Current Situation Group n X SS SD F P Core Tasks Under 7 Year 72 4.22 0.419 242 2.05 0.130 Between 7-12 Years 74 4.05 0.547 Over 12 Year 67 4.11 0.541 Legitimate tasks with safeguards Under 7 Year 72 2.76 0.699 242 6.51* 0.002 Between 7-12 Years 74 2.93 0.718 Over 12 Year 67 3.17 0.581 Tasks should not undertake Under 7 Year 72 1.86 0.380 242 0.82 0.437 Between 7-12 Years 74 1.83 0.418 Over 12 Year 67 1.92 0.444 * There is a significant difference between groups. Comparison of Opinions on New ERM Paradigm In the questionnaire form of research, question items that are not included in the IIA Role of Internal Audit in Corporate Risk Management Report, which is the focus of our study, are also included. These are the potential tasks of internal audit, reflecting the new paradigm that is emphasized in the new ERM frameworks. The participants’ opinions about the ideal situation and the current situation were analyzed by the t test. In addition, participants were asked open-ended about the risk management model used in their businesses. Findings are presented in Table 11. Table 11 Comparison of Opinions on New ERM Paradigm Item Statement Measure n X ΔX ΔSS SD tp Internal audit contributes to use of a common language to discuss risk in enterprise. Ideal Situation 245 3.96 0.302 0.772 244 6.12 0.000 Current Situation 3.66 Internal audit has the knowledge of software to guide IT professionals as needed. Ideal Situation 245 4.41 0.318 0.771 244 6.46 0.000 Current Situation 4.09 Internal audit encourages use of technologies that provide continuous audit. Ideal Situation 245 4.43 0.355 0.665 244 8.35 0.000 Current Situation 4.07 *p < .01 (t>2.58) Istanbul Business Research 49/2 196 According to the results of the paired samples t test, a statistically significant difference was found between the opinions about the three question items. This difference is in favor of the ideal situation for all three question items. Answers given to the open-ended question in Table 12 showed that the most commonly used framework in risk management is COSO ERM. Table 12 Open Ended Questions Answers Given What is the most commonly used risk management model in your business? COSO ISO BDDK GRC Own Model COBIT No answer Frequency (n=245) 142 24 8 8 6 3 54 Comparison of Research Findings with Similar Studies Our findings obtained from TİDE member participants within the scope of our study, were compared with studies of Gramling & Myers (2006) and Zwaan et al. (2011). The means of opinions of our study and participants of these two studies about core tasks, legitimate tasks with safeguards and tasks that should not undertaken in IIA report are presented in Table 13. Table 13 Comparison of Present Research and Other Research Ideal Situation Current Situation Present Research G&M ZW Present Research G&M ZW Core Tasks (n=245) Giving assurance on risk management processes 4.27 3.80 4.05 4.32 3.10 3.71 Giving assurance that risks are correctly evaluated 4.02 3.60 3.63 4.04 3.00 3.18 Evaluating risk management processes 4.03 3.82 3.98 4.12 3.17 3.44 Evaluating the reporting of risks 4.04 3.70 3.77 4.08 3.09 3.05 Reviewing the management of key risks 4.02 3.76 3.95 4.17 3.19 3.39 Legitimate Tasks with Safeguards (n=245) Facilitating identification and evaluation of risks 3.26 3.50 2.96 2.95 3.38 2.84 Coaching management in responding to risks 3.18 3.11 2.81 2.86 2.84 2.66 Coordinating ERM activities 3.17 2.75 2.19 2.91 2.47 2.30 Consolidating the reporting on risks 3.11 3.10 2.32 2.92 2.87 2.39 Maintaining and developing the ERM framework 3.18 2.73 2.17 2.86 2.49 2.30 Championing establishment of ERM 3.05 3.27 2.96 2.87 2.88 2.94 Tasks should not undertake (n=245) Setting the risk appetite 1.84 1.89 1.63 1.93 1.81 1.62 Imposing risk management processes 1.73 2.30 1.83 1.79 2.19 1.97 Management assurance on risks 1.90 2.64 3.17 1.76 2.41 3.04 Taking decisions on risk responses 1.89 2.14 1.86 1.97 2.07 1.89 Implementing risk responses on management’s behalf 1.84 1.90 1.30 1.77 1.88 1.39 Accountability for risk management 2.09 2.26 1.68 2.00 2.17 1.81 Onay / The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey 197 Differences were found between the findings of our study and the findings of the other two studies. The opinion on core tasks and tasks assumed under certain conditions of internal auditors in Turkey is higher than in terms of both the ideal situation and the current situation. On the other hand, their views on tasks that should never be undertaken are lower. If Table 13 is analyzed, it is understood that the means of views increases in terms of basic tasks and tasks that should never be undertaken according to topicality of the research. Results and Recommendations The International Internal Auditing Standards place internal auditors in a proactive position that adds value to the risk management activities of their organizations. The new risk factors that challenge businesses provide an opportunity to add value to their organizations for the internal audit profession. Internal auditors for this purpose must expand the scope of their activities in the direction of ERM. Adoption of a holistic risk approach advocated by the new risk frameworks depends on the extent to which internal audit, which is the strategic co-partner of the organization, extends the scope of risk management activities to the highest possible level, taking into account certain conditions. As a result of the tests conducted to reveal the differences between the limits of the risk responsibilities of internal audit and the current situation, which is the main purpose of our research, it was found that there is no difference between the opinions in terms of core tasks and never-to-undertake tasks of internal audit. The opinions obtained emphasize that internal audit does not adequately undertake tasks undertaken in certain circumstances. The reason for the difference lies in the fact that internal audit cannot provide conditions that allow it to undertake such tasks, a lack of management support required to meet requirements, or that internal audit functions do not have the level of professional knowledge and experience to undertake tasks. Internal audit functions should strive to provide the conditions that allow them to undertake these tasks to develop the holistic risk approach advocated by the new frameworks. As a result of our research, the opinions of 245 internal auditors were obtained. Analyses showed that the opinions of internal auditors working in the private sector on main duties were significantly higher than those of public sector employees. On the other hand, the opinions of public sector employees on tasks assumed under certain conditions are significantly higher than those of private sector employees. The findings indicate that internal audit in the private sector is expected to undertake more tasks in risk management and that the conditions affecting internal audit in the public sector have been fulfilled or that necessary top management support is provided. The opinions were analyzed in terms of demographic variables. It was found that gender did not affect the opinions. The mean of the opinions of internal auditors over the age of 40 on core tasks is significantly lower than the mean of young participants and mean of opinions about tasks assumed under certain conditions is significantly higher. On the other hand, it was Istanbul Business Research 49/2 198 determined that the mean of the opinions of auditors with a high level of professional experience (over 12 years) regarding tasks assumed under certain conditions was significantly higher than the mean of inexperienced (under 7 years). The new ERM frameworks emphasize that the use of the new technologies referred to as Industry 4.0 elements in risk management can play a key role. Development of an organization’s ERM capabilities depends on the use of advanced technologies such as automation, artificial intelligence, and machine learning in risk management activities. In particular, the benefits of big data and analytics to the audit profession will facilitate the development and internal audit of risk management activities. Advanced data analytics and visualization tools will provide a better understanding of both the positive and negative effects of risks. On the other hand, the paradigm advocated in the new ERM frameworks argues that the jargon problem in enterprises can be solved through a common framework, common processes and an integrated model. Development of a common risk jargon adopted by all functions of the business allows for easier discussion of culture, capabilities and activities involved in risk management processes. The findings of our study showed that the role of internal audit should be undertaken by use of new technologies that enable continuous auditing, adoption of a common risk jargon in the enterprise, and at least some level of technology knowledge to guide IT professionals. On the other hand, the participants believe that these new tasks are not adequately undertaken by internal audit in practice. Internal audit functions should update themselves in order to have the knowledge and skills necessary to adapt to the new ERM paradigm and to respond to the new expectations of a changing world. The study provided descriptive information on the role of internal auditors in ERM in the ideal situation and the current situation. The results of our study were compared with results of a similar study in the literature. Our findings showed that the perceptions of participants about internal auditors’ ERM duties increased over the years. The findings of our study showed that the mean of the opinions about core tasks was significantly higher than the mean obtained in the other two studies. On the other hand, there was a consensus among views on tasks that should never be undertaken. This finding can be explained by the fact that independence and objectivity are the red line of the internal audit profession. Our findings show that internal auditors are more aware of core tasks they should undertake in ERM. Regulations made by IIA and the new ERM frameworks are the most important drivers of awareness raising. Today, ERM has become an important area of responsibility for internal auditors. Some limitations should be considered when interpreting the results presented in our study. One of them is the potential to threaten internal validity of the research due to the loss of control caused by online delivery of the questionnaire, since it is almost impossible to reach potential participants in the same place. On the other hand, research was conducted on internal auditors of TİDE members. This increases the likelihood of the participants having a higher level of knowledge and objectivity than the total internal audit universe. While this may seem to be an advan- Onay / The Role of Internal Audit from New Enterprise Risk Management Frameworks Perspective: Research in Turkey 199 tage, it may also create doubts about generalizability of findings. In addition, due to economic conditions, participation is limited to Turkey. Thus, our findings were compared with other limited samples. This election, however, prevented achievement of general global views. Finally, the IIA limited internal auditors’ ERM duties to three categories. Our research is based on the task categories determined by the IIA. Important issues, such as impact of internal auditors’ characteristics on ERM activities, level of implementation of ERM of organizations, or the relationship between the audit committee, board of directors, and senior management with ERM are excluded from the scope of our research. Eliminating any limitations is a new research opportunity. Peer-review: Externally peer-reviewed. Conflict of Interest: The author has no conflict of interest to declare. Grant Support: The author declared that this study has received no financial support. References Anders, S. B. (2019). COSO’s Newest ERM Guidance. The CPA Journal, 89(3), 66-67. Anderson, Doug. (2017). COSO ERM: Getting risk management right: Strategy and organizational performance are the heart of the updated framework. Internal Auditor, 74(5), 38-43. Beasley, M. S., Clune, R., & Hermanson, D. R. (2005). ERM: A status report. Internal Auditors, February, 62(1), 67-73. Beasley, M. S., Clune, R., & Hermanson, D. (2006). The impact of enterprise risk management on the internal audit function. Kennesaw, GA: Kennesaw State University Press. Beasley, M. S., Clune, R., & Hermanson, D. (2005). Enterprise risk management: An empirical analysis of factors associated with the extent of implementation. Journal of Accounting and Public Policy, 24(6), 521-531. Castanheira, N., Rodrigues, L. L. and Craig, R. (2010). Factors associated with the adoption of risk‐based internal auditing. Managerial Auditing Journal, 25(1), 79‐98. Cohen, J., Krishnamoorthy, G., & Wright, A. (2017). Enterprise risk management and the financial reporting process: The experiences of audit committee members, CFO s, and external auditors. Contemporary Accounting Research, 34(2), 1178-1209. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2004). Enterprise Risk Management Framework (Draft), Amerika: COSO. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management Aligning with Strategy and Performance. Amerika: COSO. Farrell, M., & Gallagher, R. (2015). The valuation implications of enter-prise risk management maturity. Journal of Risk and Insurance, 82(3), 625–657. Flanders, K. (2018). An Appetite for Risk: Internal audit departments may need to recalibrate to accept more risk. Internal Auditor, 75(2), 60-66. Fox, C. (2018). Understanding the New ISO and COSO Updates. Risk Management, 65(6), 4-7. Fraser, I., & Henry, W. (2007). Embedding risk management: Structures and approaches. Managerial Auditing Journal, 22(4), 392-409. George, D., & Mallery, P. (1995). SPSS/PC+ step by step: A simple guide and reference. Belmont, CA: Wadsworth Publishing Company. Gramling, A. & Myers, P. (2006). Internal Auditing’s Role in ERM. Internal Auditor, April, 52-58. Istanbul Business Research 49/2 200 Herron, A. & Dholabhai, M. (2017). COSO Enterprise Risk Management FrameworkIntegrating Strategy and Performance. New York: PwC Governance Insights Center. Institute of Internal Auditors (IIA). (2004). The Role of Internal Auditing in Enterprisewide Risk Management. London: The Institute of Internal Auditors UK and Ireland. Institute of Risk Management (IRM). (2018). A Risk Practitioners Guide to ISO 31000: 2018. United Kingdom, London: The Institute of Risk Management UK. Institute of Internal Auditors (IIA). (2010). Uluslararası Mesleki Uygulama Çerçevesi (UMUÇ) Uluslararası İç Denetim Standartları. Çeviri: Türkiye İç Denetim Enstitüsü (TİDE). İstanbul: Lebib Yalkın Yayımları. Paape, L., & Speklè, R. F. (2012). The adoption and design of enterprise risk management practices: An empirical study. European Accounting Review, 21(3), 533-564. Pierce, E. M., Goldstein, J., & Pierce, E. (2016). Moving From Enterprise Risk Management to Strategic Risk Management: Examining the Revised COSO ERM Framework. In 14th Global Conference on Busness and Economics, (October). Pickett, K. H. S. (2011). The Essential Guide to Internal Auditing. West Sussex: John Wiley & Sons. Prewett, K., & Terry, A. (2018). COSO’s updated enterprise risk management framework - a quest for depth and clarity. Journal of Corporate Accounting & Finance, 29(3), 16-23. Prinsenberg, M., & Sluis, R. V. D. (2017). COSO Enterprise Risk Management Framework-Integrating Strategy and Performance. Netherlands, Den Bosch: PricewaterhouseCoopers. Reding, F. K. Sobel, P. J. Anderson, L. U., Head, M. J. Ramamoorti, S. Salamasick, M., & Riddle, C. (2013). Internal Auditing: Assurance&Consulting Services. Altomonte Springs: The IIA Research Foundation. Richtermeyer, S. B. (2018). Enterprise Risk Management Integrating with Strategy and Performance. USA, Massachusetts: COSO. Sarens, G., & De Beelde, I. (2006). Internal auditors’ perception about their role in risk management: A comparison between US and Belgian companies. Managerial Auditing Journal, 21(1), 63-80. Shortreed, J., Fraser, J., Purdy, G., & Schanfield, A. (2012). The Future Role of Internal Audit in (Enterprise) Risk Management. The Journal of Finance, 1-13. Sobel, P. J. (2018). COSO ERM: Integrating with Strategy and Performance. The Institute of Internal Auditors International Conferance, UAE, Dubai, 6-9 Mayıs 2018. Steffee, S. (2016). COSO drafts ERM framework: long-awaited revision addresses changes in business environment and risk. Internal Auditor, 73(4), 13-15. Thabit, T. (2019). Determining the Effectiveness of Internal Controls in Enterprise Risk Management based on COSO Recommendations. In International Conference on Accounting, Business Economics and Politics, April. Tabachnik, B. G., & Fidell, S. L. (2013). Multicollinearity and singularity. Using multivariate statistics. Boston: Pearson Education Inc, 2(013), 88-91. Tillinghast, P. T. (2004). Adding value through risk and capital management. New York: Tillinghast-Towers Perrin. Walker, P. L., Shenkir, W. G., & Barton, T. L. (2002). Enterprise risk management: pulling it all together. Altamonte Springs, FL: Institute of Internal Auditors Research Foundation. Wright, C. (2018). The CAE-CRO relationship: Chief audit executives and chief risk officers can collaborate in many ways to ensure the organization manages risks effectively. Internal Auditor, 75(1), 31-36. Zwaan, L. D., Stewart, J. ve Subramaniam, N. (2011). Internal audit involvement in enterprise risk management. Managerial Auditing Journal, 26(7), 586–604.