Internal audit practices and trends in Romania and worldwide

For a long time, internal audit has been seen mainly as an activity of providing assistance to external auditors, especially by checking up accounting procedures as part of the internal control evaluation process. At present, while this role of the internal auditor has not disappeared, the role of consultant manager has gained primary importance. In this context, it is increasingly obvious that the professional profile of the internal auditor will undergo changes generated not only by the changes in the role that he or she fulfils, but also by the challenges that the business world needs to deal with: risk management, increasingly sophisticated information technology, data mining etc. This study relies on the information provided by The Institute of Internal Auditors Research Foundation – IIARF which includes data extracted from The Global Internal Audit Common Body of Knowledge – CBOK database, and it aims to point out the practices and trends regarding internal audit in Romania and worldwide, and, respectively, the competencies traditionally required from internal auditors, their views on the skills they master and on the scope of their further skill development.


Introduction
Over the past years there have emerged multiple opportunities for internal auditors, but these opportunities can only be taken by auditors with more and more complex knowledge and skills.Some authors noticed the new responsibilities that internal auditors must manage and the new skills that they need.Thus, Ratliff and Reding (2002) claimed that "the auditors of the twenty-first century need to be prepared to 'audit' everythingoperations (including those particular to internal control), performance, information and information systems, compliance with the law, financial statements, fraud, environmental reports and performance and quality reports".Therefore, auditors need: • Analytical skills and critical thinking; • An efficient method to adequately understand any entity or activity to be audited: person, organization or system; • The new concepts, principles and techniques specific to internal control; • Awareness and understanding of risks and opportunities characteristic to auditors, as well as to those to be audited; • The ability to generate general and specific audit objectives for any audit assignment; • The ability to select, collect (using a large array of auditing procedures), evaluate and document auditing evidence, using statistic and non-statistic procedures; • The ability to report progress on the audit assignments, in varied forms and to various beneficiaries; • The ability to assess how recommendations are complied with; • High professional ethics; • The ability to use modern auditing techniques.Similarly, Moeller and Witt (1999) believe that a successful internal auditor masters the following personal skills, which complement technical and professional skills: fairness and integrity, loyalty to the organization's interests, modesty, professional calm, empathy, coherence, curiosity, critical attitude, vigilance, tenacity, energy, self-trust, courage and the ability to make value judgments.
Considering these skills as significant for a high-quality activity of internal auditors, in this article we aim to present comparative analyses regarding: a.The Romanian auditors' level of training and skills; b.The way in which they carry out their activity (relationship with organization management structures, reporting); c.Trends regarding various audit techniques and tools.

Literature review
Over time, numerous studies on the evolution of internal audit have been carried out internationally (Moeller and Witt, 1999;Anderson, 2003;Ramamoorti, 2003;Ratliff and Reding, 2002;Flemming Ruud, 2003;Moeller, 2005), and lately they have been carried out in Romania as well (Boţa-Avram and Popa, 2011; Precob and Rusu-Buruiană, 2015).Moeller and Witt (1999) and Moeller (2005) carried out the most encompassing studies on internal audit.The authors deal with internal audit in an exhaustive and detailed manner.They begin with the definition and evolution of internal audit and end with a discussion on the current trends in the field, takling subjects such as the way in which internal audit relates to the management structures of organizations, the way in which internal audit is managed as a profession (valid regulations), the impact of information systems on internal audit, techniques and instruments used in assurance and advisory assignments.
After presenting, from a historical perspective, the evolution of internal audit and its objectives, Ramamoorti (2003) describes contemporary internal audit practices.He mentions the influence that changes in the business environment have on internal audit, namely, the need to assume new roles and responsibilities.
Technological development and its impact on businesses were the object of Flemming Ruud's (2003) research.He too pointed out the evolution of internal audit, seeing that it evolved from providing assurance services to consulting, he discussed the new role internal auditors need to assume and the relationships they need to maintain and develop with company management structures.
In the context of recent financial scandals, Anderson (2003) formulated several questions on the plus value that internal audit brings its "clients", a category in which he includes: those who are the object of the internal audit asignments, managers, company management structures, external auditors, regulating bodies, customers and suppliers.He also describes the tensions existing between these beneficiaries, due to different and sometimes contradictory requirements that they make to internal auditors, and wonders how balance could be reached in the management of their relationships.
Ratliff and Reding (2002) mention the significant expansion of the area in which internal auditors activate.This impacts the level of knowledge and the abilities that internal auditors need to have and improve in order to meet companies' increased demands.
Boţa-Avram and Popa (2011) highlighted the atypical evolution of internal audit in Romania, namely its initial development in the public sector and only later in the private sector.This is at least partially explained by the cultural peculiarities of the Romanian economic environment.
An empirical and more recent study, carried out by Precob and Rusu-Buruiană (2015), describes the current characteristics of the internal auditing carried out by Romanian auditors, the internal auditors' opinions on their role in Romanian firms and the auditors' opinions on the subsequent evolution of internal audit.

The purpose of the research and the methodology used
The paper relies on the specialized audit literature and on the database provided by the Institute of Internal Auditors Research Foundation -IIARF, which contains data taken from the Global Internal Audit Common Body of Knowledge -CBOK.Also, for the comparative analyses mentioned in the Introduction section and for the formulation of conclusions, we used the information obtained, after working with the same database, by: Bailey (2010), Iyer (2016), Rose (2015) and Rose (2016), Seago (2015), Rittenberg (2016), Tsintzas (2016), Barr-Pulliam (2016), Harrington and Piper (2015).All these studies have been carried out using data provided by CBOK, while the analyses from these studies were concerned with the internal auditors' activities and features at a global level.
Our study aims to compare results obtained globally, in Europe and Romania, after the CBOK study carried out in 2010, on the level of education and the skills of internal auditors, the entities that they work for, the trends in using various techniques and tools for auditing assignments, the certifications and the experience that they have.
To process the data, we used the above mentioned database, and used the Q Reader computer application to visualize the data and to select relevant data for our study.Then we used the Microsoft Office-Excel facilities.For this purpose, we extracted information from the CBOK database on the global, European and Romanian results, concerning: • the internal auditors' education; • the university degree that they hold; and • the type of organization that they currently work for.
These elements were the foundation for the description of the representative group.We then proceeded to the proper data comparison and explanation of results.

Description of the sample
Although various studies have been conducted throughout the years, the most exhaustive one, whose results have been synthesized in a report, is the 2010 CBOK study.It was carried out based on answers received from 13,582 persons from 107 countries (22 languages), with varied answer rates per question.Meanwhile, in 2015, a more elaborate study was carried out, but its final results have not yet been published in full.Therefore, we will use the data provided by the 2015 study in a future research.After presenting the information which has been processed based on CBOK data, we will present the content of the question as it appeared in CBOK.
From Romania, in the 2010 study, 104 internal auditors answered the CBOK questionnaire, with the following distribution regarding their education, compared to the global and European situation.Personal skills (communication, persuasion and collaboration, critical thinking) are important in providing a reasonable certainty that the information, observations and recommendations have the expected impact on the organization.
The carrying out of any audit assignment requires objectivity, strategic and operational planning skills, as well as a good management of resources.Finally, improvement and innovation prepare the organization for the necessary changes ensuring a smooth transition to its sustainable growth.
The attributes in the above mentioned conceptual framework were formulated based on the fundamental Principles for professional internal auditing, published in 2015 by the Institute for Internal Auditors (IIA), which states that the activity of the internal auditors must be characterized by the following: • Integrity; • Professional competence and scrupulosity; • Objectivity and self-reliance; • Is in line with the stategies, objectives and risks of the organiation; • Appropriate position within the organization and possession of adequate resources; • Delivers high quality, and is under continuous improvement; • Efficient communication; • Provision of assurance based on risk; • Possession of detailed knowledge of the organization, pro-active and future oriented attitude; • Promotion of improved activity in the organization.The analysis of the answers of participants in the 2010 Global Internal Audit Common Body of Knowledge-CBOK showed that internal auditors at all levels thought that the most important three competence areas were: • Communication skills; • Competence in problem identification and problem solving; • Knowledge of legislative changes, changes in professional standards and changes in the business environment.For a complete analysis of the competencies required from internal auditors, the questionnaire also included items regarding the knowledge that internal auditors consider to be essential for the work that they are engaged in.Thus, in the order of their importance, the areas in which internal auditors believe they must possess adequate knowledge which would enable them to carry out their activity properly, are: Also, the study highlighted the basic skills required from internal auditors at various levels.These were grouped in common skills and specific skills.The common skills are the most important skills required from internal auditors, irrespective of the level that they are at: internal audit staff, internal audit management and chief audit executive.Each must continually improve these skills, throughout their career.The specific skills are the five most important skills required from internal auditors at each level.These skills must be developed as auditors occupy higher positions.Both common and specific skills have been grouped as general, behavioral and technical, and the analysis was carried out depending on the different position that internal auditors can occupy in the internal audit structure of an organization.General competencies are the skills considered to be essential for the completion of certain tasks.In Table 4 these are presented in the order of their importance, together and individually, for all three internal auditing professional categories.As for the general specific competencies, the study provided the following results: • The internal audit staff need especially communicative skills and the ability to use conceptual frames, need problem identification and problem solving skills as well as the ability to use the techniques and tools specific to the fields of accounting and information technology.
• The internal audit managers need management skills, communicative skills, negotiation skills and problem solving skills.
• The chief audit executive needs the ability to enhance the value of the internal audit within the organization, to communicate, negotiate and solve problems, as well as to stay updated on any legislative changes.By analyzing Romanian internal auditors' perception of the general competencies that they need in order to perform their specific activities, one can notice that, in Romania, the need to stay up-to-date with legislative changes is felt more accutely, probably as a consequence of the quasi-continuous instability which characterizes the Romanian legislative environment.
Behavioral skills are represented by the way in which one's own actions are perceived by the others, from the perspective of generally accepted standards.
As in the case of general competencies, the following table presents them in the order of their importance, at the level of the three categories of internal audit professionals, taken together and individually. 6Based on answers to question Q74.Please mark the five most important of the following behavioral skills for each professional staff level to perform their work.

Legend: G = global level; E = European level; R = in Romania
Source: Author's processing based on the CBOK 2010 database and Bailey, 2010 Concerning specific behavioral skills other than confidentiality, which is ranked among the first positions in all categories, the study revealed that: • Internal audit staff need to be objective, to rely on good professional reasoning and to be able to collaborate, i.e., to be a good team member.
• Internal auditing team/assignment managers need communication skills, leadership skills, governing skills and staff management skills.Also, they need sensitivity to ethical aspects.
• The chief audit executive needs leadership skills, communicative skills, governing skills and persuasive skills, as well as concern for ethical issues.
In Romania, the internal audit managers' views on confidentiality are surprising, since unlike professionals from other countries, they do not see it as an important requirement (ranked 10).Also, there is a contradiction between the option for building relationships (ranked 4) compared to that of organizing teams (ranked 12), and the relative importance given to communication (ranked 5), since both at European level and globally, the communication skills of internal audit engagement leaders are of primary importance.
Technical skills consist in the application of knowledge or skills to an activity.The importance of technical skills in carrying out the specific objectives, at the level of the three categories of internal audit professionals, taken together and individually, at global level, at European level, and in Romania, is classified below.  Based on answers to question Q75.Please mark the five most important of the following technical skills for each level of professional staff to perform their work.Legend: G = global level; E = European level; R = in Romania Source: Author's processing based on the CBOK 2010 database and Bailey, 2010 The specific technical requirements that the three categories of professionals need are presented below.
• The internal audit staff need thorough knowledge of risk analysis techniques, of data collection and analysis instruments and techniques, the capacity to understand and analyse businesses and to identify control categories.
• The internal audit managers need the ability to understand businesses, skills in the field of operational and management research, in project management, as well as good negotiating skills.
• The chief audit executive needs to thoroughly understand businesses, to be a good negotiator and a good project manager, and also to master the tools and techniques specific to governance, risk analysis, and control assessment.Regarding the technical skills that they should possess, it is significant that Romanian internal auditors do not rate as particulalrly important the understanding of businesses, as it is the case with audit managers and chief audit executives in other countries.The place (14) occupied in the views of Romanian internal audit managers by the need to know the "Techniques of risk analysis and control evaluation" is also surprising, since for auditors in similar positions in other countries, this component ranked fifth, at its lowest.
Many answers given by Romanian internal auditors regarding the categories of knowledge and competencies that they need can be accounted for by the age of the internal audit position in Romanian organizations.The data analysed show that in Romania, in 2010, most organizations (86.42%) had had the internal audit position for less than 10 years, and only 1.23% had had it for over 25 years (Table 8).In fact, the latter must be the case of the internal audit function in an international or multinational company activating in Romania as well, since before 1989 such an activity in a Romanian firm could not take place.Unlike in Romania, where the position of internal auditor is relatively recent, globally and in Europe the activity is significantly older, since about 25% of the companies have had the activity organized for over 25 years.In fact, at global level, in over 55% of the firms, internal audit is past 10 years old, and in Europe, over 50% of the firms have been running the internal audit activity for more than 10 years.
The relatively short time that internal audit has had in Romania explains why the number of internal auditors who declare that they have skills in fields such as accounting, management, finance, IT, technical or other fields than those listed is higher than at global or European level.As one can see in the sample presentation section (Table 2), in Romania, the most frequent university degree among internal auditors included in the research is not accounting (first place globally), but finance, followed by management and internal audit.Nevertheless, more than half of the Romanian internal auditors questioned (56.73%) declare to be experienced in accounting.Anyway, a striking majority (96.15%) declare to have experience as internal auditors.An interesting and predictible aspect is that the number of those who declare to be experienced in a technical field (13.46%) equals the number of those who declare to have majored in a technical field.In order to understand the relationship with the management and executive structures within the organization, we considered it important to analyse to whom the internal audit report is addressed.Thus, as one can see in Table 10, the results were close for the three analysed groups, yet globally, there is a higher rate of reporting to the audit committees.A possible explanation could be that not all jurisdictions share the legal requirement to have an audit committee.For example, in Romania, the Company Law rules the possibility to organize audit committees, without making it compulsory.Also, a study published in 2005 by The International Organization of Securities Commissions (IOSCO, 2005) showed that there is a specific legislation or another type of regulation concerning the requirement to have audit committees in only 53% of the jurisdictions where IOSCO members are based.In emerging countries, such requirements are minimal or absent.Only chief audit executives were asked to answer this question.The explanation above can be easier understood if we analyse Figure 1: the extent to which firms have organized audit committees.In Romania, the low rate of reporting to an audit committee is justified by its absence in many entities.As seen above, this is the case of many internal auditors working for public institutions.If we analyse the distribution of internal auditors based on the category of organizations that they work for (Figure 3), we note that in Romania almost half of the internal auditors (48%) are employed in national organizations, which is explained by the fact that they work mainly in the public sector.

Figure 3. The casting of internal auditors based on geographical position of the organzation
for which they work 13No.9(141)/2016 999 We can notice that at global level and especially in Europe, there is a higher number of internal auditors employed in international or multinational companies.In Romania as well, the number of internal auditors employed in international or multinational companies is significant (35%).
After discussing the characteristic features of internal audit in Romania and worldwide and after identifying the competencies and knowledge that auditors need to carry out their assignments, we propose to identify the trends in the future use of techniques and tools which are currently used by internal auditors.Thus, as one can see in Table 11, in order to deliver high quality internal audit, internal auditors believe that the most useful are: riskbased planning, various ways of electronic communication, analytical review, statistic sampling, data mining techniques and computer-assisted audit techniques.Except for data mining techniques, ranked 12 by Romanian auditors, the rest of the techniques and tools are valued equally by internal auditors worldwide.With respect to the professional certifications of Romanian internal auditors, we note a low percentage in the number of Certified Internal Auditors (CIA).Other certifications are also absent, except for a small number of internal auditors.
The situation relative to the most important professional certifications that internal auditors have or plan to obtain in the following five years is presented below.The auditors were asked to name all their qualifications.
We note that Romanian internal auditors score better at planning to obtain certifications rather than at having them.Globally and at European levels the situation looks much better, meaning that most internal auditors have already obtained Certified Internal Auditor Certificates (CIA), Chartered Professional Accountant or Financial Auditor (CPA) Certificates and Certified Information Systems Auditor (CISA) Certificates.Also, as in Romania, those who work in internal audit structures were interested in obtaining a Certified Internal Auditor Certificate.

Table 4 . 4 General
General competencies required from internal auditors, at global level, based on the position of the auditor the value of the internal audit activity 7 8 Keeping up-to-date with industry and regulatory changes and professional IT/ICT frameworks, tools, and techniques 5 10 Cultural fluency and foreign language skills 9 11 4 Based on answers to question Q76.Please indicate the importance of the following competencies for you to perform your work at your position in the organization.Source: Author's processing based on the CBOK 2010 database and Bailey, 2010

Figure 1 .
Figure 1.The existence of audit committees in companies11

Figure 2 .
Figure 2. 40 hours of formal training per year12

Table 1 . Comparative analysis regarding the education of internal auditors who answered the 2010 CBOK questionnaire 1 The highest level of formal education (not certification) completed Global Europe Romania
1Based on answers to question Q7.What is your highest level of formal education (not certification) completed?Source: Author's processing based on the CBOK 2010 database One can notice that only in Romania the internal auditors hold at least one university degree, since otherwise it is impossible for them to work as internal auditors.Consequently, one can see that in Romania the number of internal auditors with a BA in Economics (38.46%) is higher than globally (29.40%) and in Europe (16.17%).Also, possibly due to prejudice which deems internal audit activities to be focused on financial accounting aspects, in Romania there is the lowest number of internal auditors (5.77%) who hold a university degree in a field other than Economics, as compared to the global (10.71%) and the European (7.46%) average.

Table 2 . Comparative analysis of the academic majors of the internal auditors who answered the 2010 CBOK questionnaire 2 The academic major(s) or the most significant fields of study Global Europe Romania
Regarding the fields in which the internal auditors majored, we note that globally most respondents majored in Accounting (50.36%).In Romania, the percentage of Accounting majors is 35.58%, and in Europe it is 30.66%.In Romania, the statistics regarding university majors are quite surprising, namely a high percentage of internal auditors (34.62%) declare to have majored in an Internal Audit related field, as compared to significantly lower percentages globally (23.62%) and in Europe (27.79%).Also, we can notice the high number of Finance majors (38.46%) working as internal auditors, compared to the global level (24.93%) and the European level (28.22%).Significant differences are recorded in the case of majors in technical fields, as 13.46% of Romanian internal auditors participating in the study hold a degree in a technical field, as compared to only 5.84% in Europe and 4.23% globally.

Table 5 . General competencies that the internal auditors need, at global level, European level and in Romania 5 General competencies, ranked by their importance to internal auditors Global Europe Romania
Based on answers to question Q76.Please indicate the importance of the following competencies for you to perform your work at your position in the organization.
Source: Author's processing based on the CBOK 2010 database

Table 8 . The age of the internal audit activity in organizations 8 How long has your organization's internal audit activity been in place?
Based on answers to question Q12.Specify your professional experience (please mark all that apply).

Table 9 . The professional experience of internal auditors
Based on answers to question Q12.Specify your professional experience: (please mark all that apply).Source: Author's processing based on the CBOK 2010 database

Table 10 . The destination of internal auditors reports 10 Where do you administratively report (direct line) in your organization Global Europe Romania
10Based on answers to question Q14.Where do you administratively report (direct line) in your organization?Source: Author's processing based on the CBOK 2010 database

Table 11 . Internal auditors' preference for the use of various audit techniques and tools 14 The extent the internal audit activity uses or plans to use the following audit tools or techniques on a typical audit engagement
Based on answers to question Q69.Indicate the extent the internal audit activity uses or plans to use the following audit tools or techniques on a typical audit engagement.
14Source: Author's processing based on the CBOK 2010 database