Between the Internal Audit Monitor 2017 and the Internal Audit Monitor 2021, a follow-up study appeared in the Maandblad voor Accountancy en Bedrijfseconomie (MAB). In it, Robert Bogtstra and Inge Garretsen (then still under the name FSV Risk Advisory, now ONE Risk Advisory) and Remko Renes (Nyenrode Business University) tracked the internal audit function at Dutch listed companies over the years 2016 to 2018, the first years under the revised Corporate Governance Code. The article, titled “Compliant in principle! and in practice?”, was published on 22 April 2020. Besides developments in numbers, it assesses the quality of explanations given by companies without an internal audit function.
From 53% to 64% in two years
At the end of 2016, 53% of Euronext Amsterdam listed companies with their registered office in the Netherlands had an internal audit function; at the end of 2018 this was 64%. In 2017, the first year under the revised Code, eight new functions were established, followed by two more in 2018. In 2018 more than half of all companies (53%) had an in-house independent function. The other companies with a function opted for outsourcing, a combination with risk management or a function with a limited scope.
| Form | 2016 | 2017 | 2018 |
|---|---|---|---|
| In-house function | 41 | 46 | 51 |
| Outsourced | 4 | 7 | 6 |
| Combined with risk management | 5 | 5 | 4 |
| Limited scope | 1 | 2 | 1 |
| No function, next year | 7 | 1 | 1 |
| No function, explained | 24 | 32 | 31 |
| No function, not explained | 14 | 4 | 3 |
| With an internal audit function | 51 (53%) | 60 (62%) | 62 (64%) |
| Total | 96 | 97 | 97 |
All AEX companies had an internal audit function. In the AMX, one company still lacked one at the end of 2018, against four in 2016. In the AScX the share rose from 39% to 57%, among local companies from 10% to 24%. The share of companies that gave no explanation at all for not having a function fell from 15% in 2016 to 3% in 2018.
How good are the explanations?
The Code works on a comply-or-explain basis. A company without an internal audit department explains, under best practice provision 1.3.6, which alternative measures are in place. According to the Code, an explanation of a departure should in any event state how and why the company departs, whether the departure is temporary, and which alternative measure has been taken and how it achieves the purpose of the provision or contributes to good corporate governance. The researchers rated the explanations of the 34 companies without an internal audit function for 2018 on a five-level scale derived from earlier compliance research by Nyenrode Business University.
| Level | What the explanation contains | Number |
|---|---|---|
| Evaluative | The alternative measures, with an explanation of how they achieve the purpose of the provision or contribute to good corporate governance | 3 |
| Argumentative | A description of the alternative measures | 7 |
| Informative | A reason for not having a function, without specific alternative measures | 19 |
| Incorrect | Some text, but no reason and no alternative measures | 5 |
| Not explained | No mention of the internal audit function at all | 0 |
| Total | 34 |
Only three companies gave an explanation that meets the standard of the Code. The most common explanation was a brief reference to the size of the organisation, without saying which alternative measures are then in place. Companies that did describe those measures mentioned, among other things, work carried out on parts of the business by an external provider, self-assessments, peer reviews, ISO or NEN certificates and the culture of the organisation. A good example described visits by management to foreign subsidiaries, additional procedures by local audit firms on top of the statutory audit, regular visits by group finance, and the board’s conclusion that the findings revealed no material deficiencies in internal control.
Size alone is not an argument
According to the researchers, the argument that an organisation is too small does not hold. The explanatory notes to the Code take an in-house internal audit department as the starting point and describe outsourcing as an appropriate alternative if the size of the company does not lend itself to one, with the supervisory board and audit committee remaining involved. In the researchers’ view, a company is never too small for an internal audit function: through co-sourcing, an in-house head of internal audit supplemented with external specialists, or through outsourcing, a function can be set up cost-efficiently with few staff of its own.
Comply and explain
The researchers advocated comply and explain, following the example of the South African corporate governance code King IV. Explanation helps organisations to see corporate governance not as box-ticking, but as something to apply mindfully, with due regard for their own circumstances. Boards would then also explain, when they comply, how they obtain independent assurance on governance, risk management and internal control.
The study closed with questions for further research: what is the real reason why smaller companies have no internal audit function, how does that relate to the maturity of the company, and are companies with a function more effective or more successful than companies without one?
How the series continued
This study built on the Internal Audit Monitor 2017. According to the Internal Audit Monitor 2021, the share of listed companies with an IAF had risen to 67% by the end of 2020, and according to the Internal Audit Monitor 2025 to around 72% in 2024. The quality of explanations remained a point of attention in those editions too.
About the study
The study is based on desk research into public sources for the years 2016 to 2018: annual reports, management board and audit committee regulations, corporate governance statements, press releases, LinkedIn profiles and job advertisements. The population consisted of the companies with their registered office in the Netherlands listed on Euronext Amsterdam, classified by the composition of the indices at the end of each year; investment companies are not included. The later Internal Audit Monitors recalculated the figures on a changed population, so they differ slightly, for example 52% instead of 53% for 2016. The article was published in the Maandblad voor Accountancy en Bedrijfseconomie, volume 94, issue 3/4 (2020), and is open access.
Would you like to know how to substantiate and explain the design, or the absence, of an internal audit function? Please get in touch with us.