No abstract

The three lines of defense model (TLoD) aims to provide a simple and effective way to improve coordination and enhance communications on risk management and control by clarifying the essential roles and duties of different governance functions. Without effective coordination of these governance functions, work can be duplicated or key risks may be missed or misjudged. To address these challenges, professional standards recommend that the chief audit executive (CAE) coordinates activities with other internal and external governance stakeholders (assurance providers). We consider survey responses from 415 CAEs from Austria, Germany, and Switzerland to analyze determinants that help to implement the TLoD without any challenges and to explore the extent of (coordination) challenges between the internal audit function and the respective governance stakeholders. Our results show a great variance in the extent of coordination challenges dependent on different determinants and the respective governance stakeholder.

The position of an internal audit function (IAF) as a 'servant of two masters' (i.e., management and the audit committee) may lead to a conflict of priorities. In this setting, the tone at the top set by the Chief Audit Executive (CAE) plays a critical role in balancing the potentially competing priorities of the 'two masters'. We test two hypotheses in a mixed experimental design with the communicated preferences of the CAE to subordinates (cost reduction vs. effectiveness of internal controls) as a between-subjects factor, and levels of ambiguity (low, medium, high) manipulated within-subjects. Findings suggest that the emphasis in the CAE's message can influence internal auditors' judgments, and such influence is more pronounced when task ambiguity is high, resulting in the elimination of a significantly greater number of internal controls and the design of less effective processes. We discuss implications of our results for modern IAFs and the role of the CAE.

No abstract

and also thank the Deutsche Forschungsgemeinschaft (DFG) and Schmalenbach-Gesellschaft für Betriebswirtschaft e.V. (SG) for financial support. Special thank to John Flower and Franziska Ohle for checking the use of my English language.