Internal audit reporting in Maltese organisations : an analysis

Abstract

Purpose: The purpose of this study is to analyse the internal audit reports (IARs) as currently prepared by Maltese internal auditors. This includes an ascertainment of the regulatory framework relating to internal audit reporting followed by auditors, identification of the characteristics of IARs, and assessment of their style, format and contents. In addition, the study analyses the reporting process together with the distribution of IARs and their use. Design: To achieve the objectives of the study, data is obtained from forty-two e-mailed questionnaires, twelve of them backed up by an interview. The participants in the research are in-housed and outsourced internal auditors, as the preparers of IARs, and their auditees, as the users of IARs. Findings: The findings reveal that although international reporting standards are followed, some organisations actually adapted them to suit their needs. The study also indicates that although IARs encompass most of the suggested characteristics, the auditors' and auditees' responses regarding the reports' style differ. Moreover, similarities in the general report contents are evident among organisations. Furthermore, internal auditors consistently discuss findings with management and follow-up recommendations. Reports to the Audit Committee are frequent and such committees, together with management, make extensive use of IARs. Nevertheless, IARs are used less extensively by external auditors. Conclusion: The study concludes that internal auditing in Malta has come a long way and improvements are evident with respect to both reporting and attitudes towards the function. Moreover, although report users are generally satisfied with the IARs, there is still room for improvement especially with regard to the need for more simplicity and consistency of reports and for better communication to tackle the perceptions and utility gaps. Whilst the practice of outsourcing the internal audit function is increasingly being accepted, there are no indications of major variations in the reporting practices of in-housed and outsourced auditors. There is also room for wider use of IARs by EAs.