Internal Audit Monitor 2017: good governance deserves a good internal audit function

The first Internal Audit Monitor mapped which Dutch listed companies have an internal audit function (IAF), how it is organised and how companies without an IAF explain that. No such complete overview existed until then. Robert Bogtstra (ONE Risk Advisory) and Remko Renes (Nyenrode Business University) carried out the study on behalf of the Stichting Vaktechnisch Onderzoek of IIA Netherlands. The report was published on 16 January 2018 and describes the situation at the end of 2016, the year in which the revised Dutch Corporate Governance Code gave the IAF a prominent place. That year has been the starting point of the series ever since.

How many listed companies had an internal audit function?

At the end of 2016, 52% of Dutch listed companies had an internal audit function. The picture varied strongly with size: all twenty AEX companies had an IAF, against two of the 29 local companies. Compared with 2010, the number of functions had risen in every index.

Seven companies, together 7% of the total, announced that they would start an internal audit function during 2017, partly in response to the revised Code. Not every other company without an IAF explained why: 15% of all listed companies gave no explanation. Some of these were dormant or empty listed companies.

From a full function to separate audit activities

Internal audit functions came in all shapes and sizes, which is easily explained by differences in size and type of organisation. At most listed companies it was a full, independent function: a Chief Audit Executive employed by the company, reporting to the board and with access to the audit committee. The study used the IIA definition and referred to the Internal Audit Ambition Model of IIA Netherlands, in which a full function reaches at least the third of five levels. The study also found other forms:

• a function fully outsourced to an external provider;
• a function that combines internal audit and risk management under one person;
• a function with a limited scope, for example only operational audits of projects or only certain regions;
• audit activities without a formal function, such as reviews of the control framework by the finance department or an audit programme carried out by controllers.

With a limited scope, parts, activities or regions of the organisation fall outside the work of internal audit, and directors and supervisory board members have to obtain their information on those areas from other sources. The researchers considered full outsourcing undesirable, because ultimate responsibility for the function cannot effectively rest with a third party. They recommended a Chief Audit Executive employed by the company, supplemented with external specialists where needed. They called the combination with risk management workable under conditions, with the caveat that internal audit cannot then provide assurance on the risk management it carries out itself. The Internal Audit Monitor 2021 explored that subject further.

The explanatory notes to the Code do describe outsourcing as an adequate alternative when the size of the company does not lend itself to an in-house internal audit department, provided the supervisory board and the audit committee remain involved as set out in the provisions of principle 1.3. In practice, full outsourcing remained an exception: according to the Internal Audit Monitor 2025, it concerned between four and eight companies in each year from 2016 to 2024.

Size doesn’t matter

The main message of the study was that size need not be a reason to forgo an internal audit function. Smaller listed companies without an IAF broadly gave two arguments: an in-house function would be too expensive, and its value to the organisation would be limited. On closer inspection, the researchers found, that reasoning usually rests on a misunderstanding. The idea that a credible function needs at least three staff also proved persistent in the interviews, while practical tailoring and a growth model are perfectly possible.

The report gave directors and supervisory board members of smaller companies several routes:

• start with support from within the organisation, for example by having staff from the control organisation carry out part of the audit work;
• use a growth model instead of setting up a full function straight away, for example by starting with the effectiveness of the control framework in specific areas;
• co-sourcing: a head of internal audit on the payroll, supplemented with external specialists when needed;
• and if there is to be no in-house department after all, a sound explanation of the reasons and of the alternative measures.

The word interim solution was chosen deliberately: after a practical start, the function should grow towards maturity. To assess the value of an IAF, directors and supervisory board members can ask themselves, among other things, whether controls may be inefficient or ineffective, whether there is a need for independent assurance on them, whether the board and the audit committee have sufficient information, whether there have been unforeseen losses or fraud in recent years, and whether major organisational changes are planned.

Later editions confirm that message. It was precisely among the smaller AScX companies that the share with an internal audit function grew most, from 39% in 2016 to 68% in 2024.

From the Peters Committee to the 2016 Code

The position of internal audit in Dutch governance grew strongly over twenty years. The Forty recommendations of the Peters Committee (1997) did not yet mention internal audit. The first Corporate Governance Code (the Tabaksblat Code, 2003) referred to the internal accountant, operating under the responsibility of the management board. The amended Code of 2008 (Frijns Committee) introduced the internal auditor, gave the internal auditor access to the external auditor and the chair of the audit committee, and asked the audit committee to assess each year whether an internal auditor is needed if there is none.

The revised Code of 2016 (Van Manen Committee) gave the internal audit function its own principle, 1.3, with provisions on appointment and dismissal, assessment, the work plan, performance of the work, reporting and the absence of an internal audit department. The principle describes the task: assessing the design and operation of the internal risk management and control systems. The management board is responsible for the function; the supervisory board oversees it. If there is no internal audit department, best practice provision 1.3.6 has the supervisory board assess each year, partly on the advice of the audit committee, whether adequate alternative measures have been taken and whether an in-house department is needed, and include its conclusions in its report.

Those provisions still apply. The Code of December 2022, applicable from financial year 2023, added to best practice provision 1.3.2 that the functioning of the internal audit function is assessed by an independent third party at least once every five years. The 2025 Code left principle 1.3 unchanged and added the Risk Management Statement (VOR). Since 3 February 2026 the 2025 Code has been designated by law through the Decree on the contents of the management report; as always, it works on a comply-or-explain basis.

How the series continued

The Internal Audit Monitor has tracked developments since. In 2020 an interim study covering 2016 to 2018 appeared in the Maandblad voor Accountancy en Bedrijfseconomie: the share with an IAF rose to 64%. According to the Internal Audit Monitor 2021, the share of listed companies with an IAF had risen to 67% by the end of 2020; that edition also looked at the quality of explanations and at combining internal audit with risk management. According to the Internal Audit Monitor 2025, around 72% of listed companies based in the Netherlands had an internal audit function in 2024: 58 of 81.

About the study

The study mapped the situation at the end of 2016 through desk research into publicly available documents, such as annual reports and corporate governance statements, supplemented with interviews on the different forms. The population consisted of the Dutch listed companies in the AEX, AMX and AScX indices and the local companies. The 2010 figures are taken from the study by Johan Scheffe in Audit Magazine (2011). The report was published by IIA Netherlands; the text may be used with acknowledgement of the source.

Download the report: Internal Audit Monitor 2017 (PDF, in Dutch)

Would you like to know which form of internal audit function suits the size of your organisation, or how co-sourcing or a growth model would work in your situation? Please get in touch with us.