Manifold Conceptions of the Internal Auditing of Risk Culture in the Financial Sector

Abstract

This exploratory study investigates the manifold conceptions of the internal auditing (IA) of risk culture prevalent among four influential actors of the financial sector-regulators, normalizers, consultants, and implementers. By inductive analysis of 20 interviews and 295 documents, we illustrate a two-step interpretive scheme utilized by the four actors in their IA approaches of risk culture: defining broad goals and designing visibility schemes. The visibility schemes were tied to the demarcation, measurement, as well as the IA data collection techniques of risk culture. Our results indicate two dichotomous interpretations among the four actors concerning the IA of risk culture. The first interpretation, prevalent among regulators and implementers, promotes the control of risk culture primarily through verification. The second interpretation, adopted by consultants and normalizers, promotes the control of risk culture by IA along with the empowerment of employees through training programs. Our results not only contribute to understanding IA expansions, specifically to non-tangible domains such as risk culture but also enrich the literature exploring the mechanisms different stakeholders utilize to shape weakly professionalized IA practices.

Banks’ risk culture and management control systems: A systematic literature review

“…Thus, in banks, different tasks are accompanied by a different view on risks. Bruce (2014) adds to this discussion that banks should incorporate different worldviews, as a pluralistic view strengthens risk management and risk culture, and Sinha and Arena (2018) show that different stakeholders also have various perspectives, which need integration. To accomplish this goal instruments are needed that can bridge the gap between these different views and that promote a common goal-setting process with regard to risk orientation.…”

“…These differences complicate the development of an adequate risk culture within European banks, particularly the ones that operate internationally, because they are confronted with different requirements. Sinha and Arena (2018) investigate the viewpoints of regulators as well as normalizers, consultants, and implementers on risk culture. Their sample consists of 20 interviews and 295 documents.…”

Can Risk Culture Implementation Raising Internal Audit Quality in Case Time Budget Pressure is High?

“…Often, the audit report of the audit board of republic Indonesia becomes the basis for conducting an examination. The results of their work should be used as the initial guidelines for the audit board of republic Indonesia to carry out the examination [1].…”

Exploring risk culture controls: to what extent can the development of organizational risk culture be controlled and how?

“…For example, Sinha and Arena (2020) investigate internal auditing conceptions of risk culture in the financial sector among regulators, normalizers, consultants and implementers and show that risk culture can be controlled through verification (by using guidelines) and training programs for employees, but the authors do not investigate the entire spectrum of risk culture controls and their categorization. Moreover, they focus narrowly on risk culture in the internal auditing in financial organizations.…”

“…On that basis, we conducted a qualitative study with 32 semi-structured interviews in 30 different firms with 37 participants who worked as top managers of German firms. To obtain a broad perspective and to follow Sinha and Arena (2020), who recommend exploring a variety of viewpoints, we included interviews with heads of risk management and other senior managers. To address our third research question on contextual factors, we included a variety of firms and covered a variety of industries and ownership structures with our interviews.…”