http://www.smallbusinessinstitute.biz A B S T R A C T Keywords: Journal of Small Business Strategy 2019, Vol. 29, No. 02, 44-57 ISSN: 1081-8510 (Print) 2380-1751 (Online) ©Copyright 2019 Small Business Institute® w w w. j s b s . o rg Internal auditing is defined by the Institute of Internal Auditors (IIA) as “an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes” (The Institute of Internal Auditors, 2015). Up until the 1990s, internal audit services were exclusively provided by a department or group within the organization (Anderson, Head, Ramamoorti, Riddle, Salamasick, & Sobel, 2017). Today, however, many organizations elect to outsource some (or even all) of their internal audit services to third parties. Utilizing 2015 Common Body of Knowledge (CBOK) survey results data from the Institute of Internal Auditors Research Foundation (IIARF), we first compare the extent of outsourcing of internal audit activities among small, medium, and large organizations in Anglo-culture countries (U.S., Canada, New Zealand, Australia, South Africa, the U.K., and Ireland). The data reveal that small organizations are outsourcing internal audit activities to a greater extent than medium and large organizations. Next, limiting our investigation to small organizations, we examine three types of factors that prior literature suggests may impact an organization’s decision whether or not to outsource internal audit activities. Since all respondents to this survey were internal auditors, all organizations of interest have some presence of internal audit. Thus, instead of studying the presence/ absence of an in-house internal audit department, we examine an organization’s decision whether or not to outsource a portion of their internal audit activities. Specifically, we explore differences related to audit committee involvement, financial health, and chief audit executive (CAE) expertise. Focusing the investigation on small organizations is critical due to the high quantity of small organizations worldwide. In the U.S. alone there were 30.2 million small businesses in 2015 (U.S. Small Business Introduction Audrey N. Scarlata1, Sarah Garven2, Brandon Vagner3, Tammy Bahmanziari4 1Middle Tennessee State University, USA, Audrey.Scarlata@mtsu.edu 2Middle Tennessee State University, USA. Sarah.Garven@mtsu.edu 3Middle Tennessee State University, USA, Brandon.Vagner@mtsu.edu 4Middle Tennessee State University, USA, Tammy.Bahmanziari@mtsu.edu Internal audit outsourcing in small organizations: An exploratory study Outsourcing, CBOK, Internal audit, Small business Few papers have studied internal audit outsourcing in general, and significantly fewer have limited their analysis to small organizations. This study examines the association between small organizations’ propensity to outsource internal audit activities and (1) audit commit- tee involvement, (2) organizational financial health, and (3) need for expertise. Prior studies find mixed evidence when analyzing both large and small organizations concurrently. This study utilizes the Institute of Internal Auditors Research Foundation 2015 Common Body of Knowledge (CBOK) survey results data from chief audit executives (CAEs) of small organizations (<500 employees) based in seven Anglo-culture countries. We find significant associations between both audit committee involvement and organization financial health and internal audit outsourcing in small organizations. APA Citation Information: Scarlata, A. N., Garven, S., Vagner , B. , & Bahmanziari, T. (2019). Internal audit outsourcing in small organiza- tions: An exploratory study. Journal of Small Business Strategy, 29(2), 44-57. http://www.smallbusinessinstitute.biz http://www.jsbs.org 45 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 Administration Office of Advocacy, [U.S. SBA], 2018). The small business role within the overall economy is undeniably significant, with, for example, 99.9 % of all businesses within the U.S. classified as small businesses (U.S. SBA, 2018). The long-term survival of these organizations has lasting impacts on employment rates and economic growth both locally and globally. Unfortunately, two-thirds of small businesses fail, to the extent of closure, within ten years of launch (U.S. SBA, 2018). Analyzing various factors and facets of small organizations, including the internal audit function, is critical to improving their survival rates. Specifically, analysis of the internal audit function is important due to its focus on improving the effectiveness of risk management, control, and governance processes. These aspects of an organization have not only the potential to directly influence organizational survival rates, but also to influence an organization’s ability to flourish. That said, organizations should incorporate internal audit outsourcing in their annual strategic planning discussions to ultimately improve their comprehensive strategic approach, which has been evidenced to positively affect small business performance (Williams, Manley, Aaron, & Daniel, 2018). Not all small organizations outsource all or even some of their internal audit function, and potentially they do not outsource even when they likely should. In this study, we explore factors that have the potential to influence the decision of a small organization with an established in-house audit function to outsource some of its internal audit activities. Understanding these associations can provide insight for both CAEs and management when making internal audit resource allocation decisions. We find support for an association between audit committee involvement and outsourcing. Of the four audit committee variables we examine (existence of an audit committee, number of audit committee meetings held, number of audit committee meetings the CAE was invited to attend, and percentage of audit committee meetings the CAE attended), all four are significant and positively associated with a small organization’s decision to outsource some of its internal audit activities. Prior internal audit research suggests that greater audit committee involvement signals a greater commitment to corporate governance and internal auditing (Anderson, Christ, Johnstone, & Rittenberg, 2012; Barua, Rama, & Sharma, 2010; Carcello, Hermanson, & Raghunandan, 2005). Thus, our results suggest that more involved audit committees of small organizations recognize outsourcing to be beneficial in promoting internal audit quality. This could be the result of the committee recognizing a shortfall of required skills on staff or a directive for the in-house internal audit function to focus its activities around routine internal audit activities, with non-routine activities to be outsourced. We also find support for an association between financial health and outsourcing. Both financial health variables we examine (sufficiency of internal audit budget and increase in budget over prior year) are significant and positively associated with a small organization’s decision to outsource some of its internal audit activities. These results suggest that small organizations in poor financial health may elect to cut back or forego spending on various assurance activities, including moneys spent on internal audit outsourcing activities, as these may be considered discretionary items. We do not find support for an association between the need for expertise and outsourcing. Of the five CAE expertise variables we examine (CIA certification, CPA or equivalent certification, hours of annual training, years of experience, and technical specialization), none are significant. These results suggest that when evaluating the decision to outsource some of its internal audit activities, a small organization may take into consideration the competencies of the internal audit function as a whole, not just the leadership of the department. Our results provide implications for practice. The results evidencing that increased audit committee involvement and financial health have a positive and significant association with small organizations’ decision to outsource some of its internal audit activities provides powerful insight for management. Small organizations need to be aware of the quantity and quality of interactions between the audit committee and the CAE. Monitoring this relationship could prove extremely beneficial as outsourcing some of the organization’s internal audit activities may significantly influence the quality of risk management procedures and operating effectiveness of internal controls, ultimately improving the organization’s operations. Additionally, as budget cuts are being made across departments, management should contemplate the potential reduction in technical expertise and specialized skills the organization could realize if 46 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 outsourced internal audit activities are eliminated. Discussions are warranted with CAEs to ensure that after eliminating outsourced audit activities, the internal audit function has “the knowledge, skills, and other competencies needed to perform its responsibilities” (IIA 2016 Standard 1210 – Proficiency) (The Institute of Internal Auditors, 2015). Management should seriously consider internal audit outsourcing as a unique exception to the proposed budget reductions. The paper is organized as follows. The next section discusses relevant literature and research questions. This is followed by the data and research method used in this study. Results are then presented, followed by discussion and implications. Background and Research Questions Despite the benefits of having a completely in- house internal audit function, such as retaining total control over the organization’s internal audit approach and having direct knowledge of all the current critical issues facing the organization (KPMG, 2016), many small organizations may not have adequate personnel on staff to perform all of the internal audit activities needed in their organizations. In order to implement all needed internal audit activities, these organizations must choose whether to divert current resources and/ or hire additional personnel to perform the needed functions in-house or to outsource all or a portion of their internal audit activities. If an organization does choose to outsource some or all of its internal audit activities, many potential benefits may arise. As noted by Gonzalez, Rodriguez, and Sossa (2017), all businesses could benefit from outside advice and counsel when dealing with ongoing business challenges. Advocates of internal audit outsourcing argue that the special expertise of outside contractors, in addition to their ability to potentially deliver substantial savings, are advantages of outsourcing (Kamyabi & Devi, 2011; Majdalawieh & Alkafaji, 2012; Okpara, Ezirim, & Mohammed, 2017; Rittenberg & Covaleski, 1999). Small organizations with little internal audit expertise may find that outsourcing some of their internal audit activities increases in-house internal audit resource availability (Van Peursem & Jiang, 2008). Increased internal audit outsourcing, therefore, may contribute to the strengthening of overall internal audit departmental capabilities in the short-term and could have a lasting technical influence on in-house internal auditors as a degree of knowledge transfer occurs. Additionally, investments in internal audit can contribute to increases in operational efficiencies and safeguarding of assets, decreases in financial accounting risk, and can assist the respective organization in meeting its goals and objectives (Feng, Li, & McVay, 2009). Prior literature suggests three primary reasons associated with the decision to outsource internal audit activities are: (1) level of audit committee involvement, (2) financial health, and (3) need for expertise. We look at each of these factors in turn. Audit Committee Involvement The Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committees (1999) recommends that organizations’ audit committees meet at least four times each year (Anderson et al., 2012), but it is silent on the recommended number of times the audit committee should meet with the CAE. Abdolmohammadi (2013, p. 71) notes that “the literature has generally argued in favor of a strong relationship between the internal audit function and the audit committee of the board” (cf. Cooper, Leung, & Mathews, 1994; Brody & Lowe, 2000; Gramling, Maletta, Schneider, & Church, 2004; Griffiths, 1999; McHugh & Raghunandan, 1994). Prior internal audit research suggests that greater audit committee involvement signals a greater commitment to corporate governance and internal auditing (Anderson et al., 2012; Barua et al., 2010; Carcello et al., 2005). Conversely, Felício, Rodrigues and Samagaio (2016) investigate the impact of audit committee characteristics on financial performance with mixed results. However, little research has been performed on the influence of audit committee involvement on internal audit outsourcing. The two primary studies that have been conducted provide conflicting results. However, their audit committee involvement and outsourcing variables were fundamentally different. Abbott, Parker, Peters and Rama (2007) analyzed audit committee involvement from a perspective of how many times the audit committee met on an annual basis. Utilizing pre-SOX data, they found that active audit committees are less likely to outsource routine internal auditing activities. Using post-SOX data, Abdolmohammadi (2013) analyzed audit committee involvement from a perspective of whether the CAE meets or talks 47 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 with the audit committee chairman in addition to regularly scheduled meetings, and whether the CAE attends meetings with the audit committee regularly. Abdolmohammadi (2013) found that audit committee involvement was positively and significantly associated with the outsourcing of internal audit activities when proxied as whether the CAE meets or talks with the audit committee/chairman in addition to regularly scheduled meetings but found no association when proxied as whether the CAE attends meetings with the audit committee regularly. Although the two studies’ findings are not consistent, they are also not directly comparable as the outsourcing of routine and non- routine activities were not distinguished from each other in the second study as in the first. This leads to our first research question. RQ1: Is audit committee involvement associated with internal audit outsourcing in small organizations? Financial Health Prior literature suggests that cost savings is a common motive for outsourcing internal audit activities (Carcello et al., 2005; Carey, Subramaniam, & Ching, 2006; Robinson et al., 2008; Lankford & Parsa, 1999). In the current competitive environment for SMEs, some organizations may engage in more knowledge- intensive work and outsource less knowledge-intensive work (Ahluwalia, Mahto, & Walsh, 2017). Increased efficiency and technological competencies of external internal audit providers (Carey et al., 2006; Okpara et al., 2017; Selim & Yiannakas, 2000) have been found to be factors when organizations attempt to cut costs. Thus, due to the potential cost savings that outsourcing may provide, organizations in poor financial health may be more likely to outsource some of their internal audit activities. On the other hand, as noted by Carcello et al. (2005), as internal auditing is an administrative function, money spent on internal audit activities may be considered a discretionary expense that can be reduced during difficult financial times. Thus, organizations in poor financial health may choose to cut back spending on internal audit activities, including foregoing internal audit outsourcing activities. This leads to our second research question. RQ2: Is financial health associated with internal audit outsourcing in small organizations? Need for Expertise Risk management is at the forefront of most organizations and has the potential to impact the decision to outsource the internal audit function. Consequently, we believe the lack of formal training and other indicators of in-house expertise could lead an organization to outsource in an effort to acquire the necessary expertise. However, some internal audit activities require organization specific expertise or knowledge of sources of competitive advantage, proprietary information, or organization-specific technology (Edwards, 1997; Williamson, 1991), leading organizations to keep the internal audit function in-house to protect this information. For example, prior research has found that organizations are less likely to outsource the internal audit function due to the potential loss of confidential knowledge and competitive advantage (Barac & Motubatse, 2009; Widener & Selto, 1999). Thus, there are incentives for small organizations to keep internal audit activities completely in-house or outsource some portion of these activities. As noted previously, an advantage of outsourcing internal audit services includes the special expertise provided by external parties. Carey et al. (2006) found that technological competence was associated with the decision to outsource internal audit, and Selim and Yiannakas (2000) found that the most important factor in the decision to outsource the internal audit function was the perceived access to internal auditors with specialized knowledge and skills. Public accounting firms arguably have the most advanced technological competence and highly trained specialists in the field. Public accounting firms are experts in providing assurance in the reliability of financial information and evaluation of internal controls. As a result, they enjoy a reputation of competence through the rigorous training required in the field and provide organizations an excellent pool of well-trained staff to hire for internal audit outsourcing. Therefore, if an organization lacks adequate in-house expertise, it is relatively easy for the organization to outsource some of its internal audit activities to one of these firms. This leads to our final research question. RQ3: Is the need for expertise associated with internal audit outsourcing in small organizations? 48 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 Method Data The Common Body of Knowledge (CBOK) Global Internal Audit Practitioner Survey data is provided by the Institute of Internal Auditors Research Foundation (IIARF). The first of these series of surveys was implemented in 1972, and the CBOK 2006 survey was the first international survey. We use data from the most recent CBOK survey (2015) in our study. Surveys were sent internationally to internal auditors at various levels (participants ranged from staff level to CAEs) to gather information about internal audit departments. Participants in the 2015 survey included 14,518 Institute of Internal Audit (IIA) members from over 160 countries. Similar to Abdolmohammadi (2013), we limit the sample to seven Anglo-culture countries to alleviate the concern that any differences found may be the result of cultural attributes, resulting in 3,248 observations. These countries include the U.S., Canada, New Zealand, Australia, South Africa, the U.K., and Ireland. We also limit our sample to responses from CAEs as CAEs are presumed to be both knowledgeable and instrumental in the decision to outsource, resulting in 791 responses. Focusing on small organizations (< 500 employees) in particular, the sample drops to 236 observations. We lose an additional 21 responses due to respondents not answering or responding with “I don’t know” to the outsourcing question, for a final sample of 215. The number of responses vary between questions, resulting in different sample sizes for each variable examined. A complete listing of all variables used in the study can be found in the Appendix. In order to gain a sense of how prevalent outsourcing of internal audit activities is in small organizations compared to medium and large organizations, before limiting our data to small organizations, we first examine the CBOK (2015) question “What percentage of your organizations’ internal audit activities were performed by a third party in the past calendar year?” We find that small organizations are outsourcing their internal audit activities to a greater extent than medium and large organizations. Organizations with less than 500 employees reported outsourcing around 27.1% of their internal audit function, compared with 20.8% for medium firms (501-10,000 employees) and 21% for large firms (10,001+ employees) (p = 0.065). The next section provides insight into what factors appear to influence a small organization’s decision to outsource some of its internal audit activities. Variable Measures The outsourcing variable we examine in our study relates to whether or not an organization with an established internal audit function chooses to outsource any portion of its internal audit activities. The CBOK (2015) question we use is, “In the previous calendar year, were some of your organizations’ internal audit activities provided by a third party?” Our current study analyzes audit committee involvement’s influence on internal audit outsourcing using three audit committee involvement-related items from the CBOK (2015) data that we have identified as potential significant indicators of the decision to outsource. CAEs were asked (1) “Is there an audit committee or equivalent in your organization?”; (2) “Approximately how many formal audit committee meetings were held in the last fiscal year (including in- person meetings, telephone meetings, online meetings, and so on)?”; and (3) “Approximately how many formal audit committee meetings was the chief audit executive (CAE), or director, invited to attend (entirely or in part) during the last fiscal year?” Additionally, we divided the answer to question (3) by the answer to question (2) to determine the percentage of meetings attended by the CAE. CBOK (2015) has two financial health-related items we have identified as potential significant indicators of the decision to outsource. CAEs were asked (1) “From last year to this year, how did your internal audit department budget change?” (1 = Increased, 2 = Decreased; 3 = Remained the same) We used a binary variable where 1=Increased, 0=Not Increased for this question; and (2) “In your opinion, how sufficient is the funding for your internal audit department relative to the extent of its audit responsibilities?” (1 = Not at all sufficient, 2 = Somewhat sufficient; 3 = Completely sufficient). CBOK (2015) has five expertise-related items we have identified as potential significant indicators of the decision to outsource: CAEs were asked (1) “Which professional certifications and/or qualifications do you have related to internal auditing? (Choose all that apply).” One of the options was “CIA (Certified Internal Auditor).” We used a binary variable (selected/not selected) for CAE responses to this option; (2) “How 49 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 many hours of formal training related to the internal audit profession do you receive per year?”; (3) “In addition to performing general internal audit activities, do you have an area of technical specialization for which you have had formal training and in which you spend a majority of your time working?” (1=I do not have a technical specialization for my internal audit work; 2=Accounting; 3=Financial reporting; 4=Fraud; 5=Information technology (IT); 6=Ethics; 7=Compliance; 8=Legal; 9=Risk Management; 10=Operations; 11=Management; 12=Engineering; 13=Construction; 14=Environmental auditing; 15=Performance auditing; 16=Other) ). We recoded this to a binary variable in which 1=Had a specialization and 0=No specialization; (4) “How many hours of formal training related to the internal audit profession do you receive per year?”; and (5) “Which professional certifications do you have in areas other than internal auditing? (Choose all that apply)” One of the options was “Public accounting and chartered accountancy (such as CA, CPA, ACCA, ACA).” We used a binary variable (selected/not selected) for CAE responses to this option. Results Descriptive statistics for the pooled sample are reported in Table 1, Panel A. Interestingly, less than half of CAEs surveyed hold a CIA or CPA certification (47.9% and 47.0%, respectively) and less than half saw their budgets increase over prior year (45.9%). More than half indicated that their internal audit function outsourced some of its internal audit activities in the past year (57.7%) and an overwhelming majority have an audit committee or equivalent (90.1%). Panel B reports univariate tests of our variables of interest for subsamples of organizations that outsourced (Outsource = 1) and did not outsource (Outsource = 0). We discuss the results related to each of our three outsourcing categories in turn. Audit Committee Involvement Of small organizations that outsource some of their internal audit activities, 97.2% have an audit committee, compared with 80% of organizations that do not outsource (p = 0.000). The number of audit committee meetings held also differs between groups. Organizations that outsource report an average of 6.28 meetings held per year, compared with 4.98 meetings for organizations that do not outsource (p = 0.006). We also investigate the difference between the number of audit committee meetings that the CAE was invited to attend and find similar results (6.01 versus 4.28, p = 0.000). We find that CAEs of outsourcing organizations attend 96.2% of meetings, while those that do not outsource attend only 89.3% of meetings (p = 0.027). Overall, these findings support RQ1 (Is audit committee involvement associated with internal audit outsourcing in small organizations?). Financial Health Our two measures of financial health center on the organization’s budget. Our first measure is internal audit departmental budget change since last year. Over half of outsourcing organizations (52.0%) report a recent increase in their internal audit budget, while only 36.9% of small organizations that did not outsource report an increase (p = 0.032). Our second measure relates to budget sufficiency. CAEs of outsourcing organizations felt their budgets were between somewhat and completely sufficient relative to the responsibilities of the department (2.32 on a scale of 3), which was more sufficient than those who did not outsource (2.17 on a scale of 3) (p = 0.085) Both of these findings support RQ2 (Is financial health associated with internal audit outsourcing in small organizations?). Need for Expertise Organizations that outsource have a slightly lower percentage of CAEs with CIA certification (46.0% versus 50.5%) but a slightly higher percentage of CAEs with CPA certification (49.2% versus 44.0%). However, the differences for both types of certification are not significant between groups. There are also no significant differences between years of CAE experience, technical specialization, or hours of annual training attended between groups. Thus, we do not find support for RQ3 (Is the need for expertise associated with internal audit outsourcing in small organizations?). Additional Descriptive Statistics Table 2, Panels A through E provide additional information about the sample. Panel A details the types 50 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 Table 1 Descriptive statistics Panel A: Pooled Sample Descriptive Statistics Variable N Minimum Maximum Mean Std. Deviation Outsource 215 0.00 1.00 0.577 0.495 Audit Committee Involvement AC_EXIST 181 0.00 1.00 0.901 0.300 AC_MTG_HELD 163 0.00 15.00 5.804 2.952 AC_MTG_INVITE 161 0.00 12.00 5.385 2.817 AC_PERC_ATTEND 158 0.00 1.00 0.938 0.187 Financial Health BUDG_INC_PRIOR 207 0.00 1.00 0.459 0.500 SUFF_BUDG 210 1.00 3.00 2.262 0.613 Expertise TECH_SPEC 215 0.00 1.00 0.679 0.468 CERT_CIA 215 0.00 1.00 0.479 0.501 CERT_CPA 215 0.00 1.00 0.470 0.500 HRS_TRAIN 215 0.00 200.00 43.521 20.325 YRS_EXP 215 0.00 50.00 16.502 10.015 Panel B: Univariate Statistics for Outsourced (Outsource=1) and Did Not Outsource (Outsource=0) Subsamples Outsourcing =1 Outsourcing = 0 Variable N Mean N Mean Significance t-Statistic Audit Committee Involvement AC_EXIST 106 0.972 75 0.800 0.000*** 3.942 AC_MTG_HELD 103 6.282 60 4.983 0.006*** 2.763 AC_MTG_INVITE 103 6.010 58 4.276 0.000*** 3.913 AC_PERC_ATTEND 103 0.962 55 0.893 0.027** 2.226 Financial Health BUDG_INC_PRIOR 123 0.520 84 0.369 0.032** 2.159 SUFF_BUDG 124 2.320 86 2.174 0.085* 1.730 Expertise TECH_SPEC 124 0.685 91 0.670 0.815 0.234 CERT_CIA 124 0.460 91 0.505 0.509 -0.662 CERT_CPA 124 0.492 91 0.440 0.449 0.758 HRS_TRAIN 124 43.468 91 43.593 0.964 -0.045 YRS_EXP 124 16.032 91 17.143 0.423 -0.803 ***, **, & * indicate significance at the 1%, 5% and 10% levels, respectively, two-tailed. 51 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 of organizations (ORG_TYPE) included in the sample. Panel A reveals that for-profit organizations, including privately held (non-listed) and publicly traded organizations, represent 55.35% of the organizations in the sample. Participants were asked to choose the IIA institute with which they primarily identified (and presumably where the organization in which they work is located). Panel B (IIA_INST) results disclose that the majority, (67.91%), of the organizations identify primarily with the U.S.. Panel C provides information about the number of years for which the organization has had an internal audit department in place (IA_AGE_CAT). The participants were asked to provide the number of years. The data in Panel C was grouped into five categories. Interestingly, most of the organizations (62.36%) have internal audit departments that are less than 15 years old. Approximately 5% of the respondent organizations have internal audit departments that have been in place 35 years or more. Panel D presents information about the geographic scope (SCOPE) of the organization or governmental entity. Panel D indicates that the majority of the sample organizations operate regionally (38.60%), followed by nationally (25.58%). Panel E presents data concerning the number of internal audit employees in the internal audit departments (IA_SIZE_CAT) of the sample organizations. Panel E reveals that 86.73% of the respondent organizations had less than ten employees in their internal audit department. Table 2 Additional descriptive statistics Panel A: Organization Type The survey question was as follows: “What is the type of organizations for which you currently work?” Type of Organization Frequency (%) of Responses Privately held (non-listed) organizations 37.21 Publicly traded (listed) organizations 18.14 Public sector (including federal, regional, and local government, government agencies, and government-owned organizations) 24.19 Non-for-profit organization (not related to government) 16.28 Other 4.19 N=215 Panel B: Anglo-Culture Country The survey question was as follows: “Select the IIA institute with which you primarily identify. (If you are from a country included in IIA-North America, select your country name.)” IIA Institute Participant Identifies With Frequency (%) of Responses Australia 7.44 Canada (IIA-North America) 7.91 New Zealand 2.79 South Africa 10.23 United Kingdom & Ireland 3.72 United States (IIA-North America) 67.91 N=215 52 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 Panel C: Internal Audit Department Age The survey question was as follows: “Approximately how many years has the internal audit department been in place in at your organization?” We categorized responses into groups as noted above. Age of Internal Audit Department Frequency (%) of Responses Less than 5 years 22.58 5 to 14 years 39.78 15 to 24 years 23.12 25 to 34 years 9.14 35 years or more 5.38 N=186 Panel D: Geographic Scope The survey question was as follows: “What is the geographic scope of your organization or government enti- ty?” Geographic Scope of the Organization Frequency (%) of Responses Local (operating in one municipal level body such as a city or county) 17.21 Regional (operating in a province or state within an independent country) 38.60 National (operating throughout an independent country) 25.58 International or multinational (operating in more than one independent coun- try) 17.67 Other 0.93 N=215 Panel E: Size of Internal Audit Department The survey question was as follows: “Approximately how many fulltime equivalent employees make up your internal audit department?” The question asked participants to input an exact number of IA employees, which was recoded into categories (see the Appendix)* Number of Internal Audit Employees Frequency (%) of Responses 1 to 3 62.56 4 to 9 24.17 10 to 24 8.53 25 to 49 2.37 50 to 299 2.37 N=211 *We found neither the size of the internal audit department nor the age of the department was significantly associated with the decision to outsource. 53 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 Discussion And Implications Provided that 99.9% of all businesses within the U.S. are classified as small business and that two thirds fail within ten years of launch (U.S. SBA, 2018), internal audit’s role of monitoring organizational risks and assessing internal control effectiveness is critical for the survival of small organizations. For some small businesses, outsourcing some or even all of their internal audit activities may be necessary in order to ensure all needed internal audit activities are performed. Thus, it is important for small organizations to understand (1) the benefits and drawbacks of outsourcing internal audit activities, and (2) the organizational factors that appear to influence the decision to outsource internal audit activities. We first find support for an association between audit committee involvement and outsourcing. All four audit committee involvement variables analyzed are significant and positively associated with a small organization’s decision to outsource some of its internal audit activities. Our findings suggest that more involved audit committees of small organizations recognize outsourcing to be beneficial in promoting internal audit quality. Thus, small organizations need to be aware of the quantity and quality of interactions between the audit committee and the CAE. Monitoring this relationship could prove extremely beneficial, especially during difficult financial times, as outsourcing some of the organization’s internal audit activities may significantly influence the quality of risk management procedures and operating effectiveness of internal controls, and ultimately improve the organization’s operations and financial situation. Second, we find support for an association between financial health and outsourcing. Both financial health variables we examine are significant and positively associated with a small organization’s decision to outsource some of its internal audit activities. Our findings are not consistent with prior literature that suggests cost savings is a common motive for outsourcing internal audit activities (Carcello et al., 2005, Carey et al., 2006; Robinson, 2008; Lankford & Parsa, 1999). If cost savings was a significant motive for small organizations to outsource internal audit activities, we would expect to find a greater likelihood of outsourcing as the perception of budget sufficiency decreased and if the actual budget decreased. However, we find the opposite. It is possible that the difference in our findings relative to prior research could be a result of a different sampling emphasis and time period. For example, due to more limited resources, internal audit departments of small organizations, compared to larger organizations, may be directed to do more with less during difficult financial times. Our results are concerning, as they suggest that small organizations in poor financial health may elect to cut back or forego spending on various assurance activities, including moneys spent on internal audit outsourcing activities, as these may be considered discretionary items. From a practice standpoint, these results can provide insight to small business consultants when advising clients in financial turmoil. It is important for these consultants to appropriately weigh the costs and benefits of internal audit outsourcing prior to advising management to simply cut all outsourcing activities. As a result of eliminating internal audit outsourcing, the efficiency and effectiveness of internal controls could suffer, and inadequate responses to risk may result which could put the organization in jeopardy. Additionally, as budget cuts are being made across departments, management should contemplate the potential reduction in technical expertise and specialized skill the organization could realize if the outsourcing budget is affected, and discuss with CAEs their plan to ensure needed outsourcing is not going to be entirely eliminated. Management may want to consider internal audit outsourcing as a unique exception to the proposed budget reductions. Lastly, we do not find support for an association between the need for expertise and outsourcing. Although we do not find support for this association using various CAE characteristics as a proxy for expertise, when evaluating the decision to outsource, a small organization may take into consideration the competencies of the internal audit function as a whole, not just the leadership of the department, as we examined. Limitations and Future Research Our study has a few limitations worth noting. First, the study is limited to Anglo-culture countries (U.S., Canada, New Zealand, Australia, South Africa, the U.K., and Ireland). Analysis of countries outside of these could yield differing results. Second, one could 54 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 argue that the study is too widely focused. However, when attempting to isolate North America or just the United States, our number of participants, and subsequently power, were both significantly reduced, although the results remained consistent. Finally, the study has a limitation in that the survey it is based on was conducted during 2015, which was in the midst of one of the greatest bull markets of all time. Many small organizations were realizing astounding growth at this time. Thus, our financial health results may not be generalizable during a bear market or an industry downturn, when severe internal audit budget fluctuations are likely to occur. Our study provides several avenues for future research. Results from this study indicate that audit committee involvement has a significant association with small organizations’ decision to outsource some of their internal audit activities. Literature would benefit from research analyzing the dynamics of audit committee involvement and what in particular about the involvement leads to an increase in the likelihood of internal audit outsourcing. Additionally, the literature would benefit from research analyzing further the relationship between small organization financial health and internal audit outsourcing. Specifically, what costs and benefits are considered in the decision to outsource internal audit activities when small organizations realize shrinking budgets? How much consideration is given to the technical capabilities and skills of the in-house internal audit department when deciding whether or not to eliminate outsourcing of internal audit activities? References Abbott, L. J., Parker, S., Peters, G. F., & Rama, D. V. (2007). Corporate governance, audit qual- ity, and the sarbanes-oxley act: Evidence from internal audit outsourcing. The Accounting Re- view, 82(4), 803-835. Abdolmohammadi, M. (2013). Correlates of co-sourc- ing/outsourcing of internal audit activities. Au- diting: A Journal of Practice & Theory, 32(3), 69-85. Ahluwalia, S., Mahto, R. V., & Walsh, S. T. (2017). Innovation in small firms: Does family vs. non-family matter? Journal of Small Business Strategy, 27(3), 39-49. Anderson, U. L., Christ, M. H., Johnstone, K. M., & Rittenberg, L. E. (2012). A post-SOX examina- tion of factors associated with the size of inter- nal audit functions. Accounting Horizons 26(2), 167-191. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., Salamasick, M., & Sobel, P. J. (2017). Inter- nal auditing: Assurance & advisory services, (4th ed.). Lake Mary, FL: Internal Audit Foundation. Barac, K., & Motubatse, K. N. (2009). Internal audit outsourcing practices in South Africa. African Journal of Business Management, 3(13), 969- 979. Barua, A., Rama, D. V., & Sharma, V. (2010). Audit committee characteristics and investment in in- ternal auditing. Journal of Accounting and Pub- lic Policy, 29(5), 503-513. Blue Ribbon Committee on Improving the Effective- ness of Corporate Audit Committees (1999). Re- port and recommendations of the Blue Ribbon Committee on improving the effectiveness of corporate audit committees. The Business Law- yer, 54(3), 1067-1095. Brody, R. G., & Lowe, D. J. (2000). The new role of the internal auditor: Implications for internal auditor objectivity. International Journal of Au- diting, 4(2), 169–176. Carcello, J. V., Hermanson, D. R., & Raghunandan, K. (2005). Factors associated with US public com- panies’ investment in internal auditing. Account- ing Horizons, 19(2), 69-84. Carey, P., Subramaniam, N., & Ching, K. C. W. (2006). Internal audit outsourcing in Australia. Account- ing & Finance, 46(1), 11-30. Cooper, B. J., Leung, P., & Mathews, C. (1994). In- ternal audit: An Australian profile. Managerial Auditing Journal, 9(3), 13–19. Edwards, S. (1997). The brain gain. CA Maga- zine-Chartered Accountant, 130(3), 20-25. Felício, A., Rodrigues, R., & Samagaio, A. (2016). Corporate governance and the performance of commercial banks: A fuzzy-set QCA approach. Journal of Small Business Strategy, 26(1), 87- 101. Feng, M., Li, C., & McVay, S. (2009). Internal control and management guidance. Journal of Account- ing and Economics, 48(2-3), 190-209. Gonzalez, A. C., Rodriguez, Y., & Sossa, A. (2017). Leadership and governance decisions in family business performance: An application of fuzzy sets logic. Journal of Small Business Strate- gy, 27(1), 51-66. Gramling, A. A., Maletta, M. J., Schneider, A., & 55 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 Church, B. K. 2004. The role of the internal audit function in corporate governance: A synthesis of the extant internal auditing literature and direc- tions for future research. Journal of Accounting Literature, 23, 194–244. Griffiths, P. 1999. Understanding the expectations of finance directors towards internal audit and its future. Managerial Auditing Journal, 14(9), 489–496. Kamyabi, Y., & Devi, S. (2011). The impact of account- ing outsourcing on Iranian SME performance: Transaction cost economics and resource-based perspectives. World Applied Sciences Jour- nal, 15(2), 244-252. KPMG. (2016, September 25) Outsource vs. insource in internal audit: What’s the right approach? Retrieved from https://home.kpmg.com/au/ en/home/insights/2016/09/internal-audit-out- source-vs-insource.html Lankford, W. M., & Parsa, F. (1999). Outsourcing: A primer. Management Decision, 37(4), 310-316. Majdalawieh, M., & Alkafaji, Y. (2012). Outsourc- ing the internal audit activities: An empirical study of practices in the United Arab Emirates (UAE). Internal Auditing-Boston, 27(6), 25. McHugh, J., & Raghunandan, K. 1994. Hiring and fir- ing the chief internal auditor. Internal Auditor, 51(4), 34–39. Okpara, E., Ezirim, C. B., & Mohammed, U. (2017). Firm size, industry type and internal audit out- sourcing in Nigeria: Evidence from SMEs. In- ternational Journal of Business, Accounting, & Finance, 11(1). Rittenberg, L. E., & Covaleski, M. (1999). Outsourc- ing the internal audit function: The British gov- ernment experience with market testing. Inter- national Journal of Auditing, 3(3), 225-235. Robinson, P., Lowes, P., Loughran, C., Moller, P., Shields, G., & Klein, E. (2008). Why settle for less? Deloitte consulting 2008 outsourcing re- port. Retrieved from https://public.deloitte.com/ media/0524/us_bnet_chs_DeloitteConsulting- 2008Outsourcing%20Report_1207.pdf Selim, G., & Yiannakas, A. (2000). Outsourcing the internal audit function: A survey of the UK pub- lic and private sectors. International Journal of Auditing, 4(3), 213-226. The Institute of Internal Auditors. (2015). The IPPF: The Framework for Internal Audit Effective- ness. Retrieved from https://global.theiia.org/ standards-guidance/Pages/Standards-and-Guid- ance-IPPF.aspx U.S. Small Business Administration Office of Advo- cacy. (2018). Frequently Asked Questions About Small Business. Retrieved from https://www. sba.gov/sites/default/files/advocacy/Frequent- ly-Asked-Questions-Small-Business-2018.pdf Van Peursem, K., & Jiang, L. (2008). Internal audit outsourcing practice and rationales: SME evi- dence from New Zealand. Asian Review of Ac- counting, 16(3), 219-245. Widener, S. K., & Selto, F. H. (1999). Management control systems and boundaries of the firm: Why do firms outsource internal auditing activ- ities? Journal of Management Accounting Re- search, 11, 45-73. Williams Jr, R. I., Manley, S. C., Aaron, J. R., & Dan- iel, F. (2018). The relationship between a com- prehensive strategic approach and small busi- ness performance. Journal of Small Business Strategy, 28(2), 33-48. Williamson, O. E. (1991). Strategizing, economizing, and economic organization. Strategic Manage- ment Journal, 12(S2), 75-94. https://home.kpmg.com/au/en/home/insights/2016/09/internal-audit-outsource-vs-insource.html https://home.kpmg.com/au/en/home/insights/2016/09/internal-audit-outsource-vs-insource.html https://home.kpmg.com/au/en/home/insights/2016/09/internal-audit-outsource-vs-insource.html https://public.deloitte.com/media/0524/us_bnet_chs_DeloitteConsulting2008Outsourcing%20Report_1207.pdf https://public.deloitte.com/media/0524/us_bnet_chs_DeloitteConsulting2008Outsourcing%20Report_1207.pdf https://public.deloitte.com/media/0524/us_bnet_chs_DeloitteConsulting2008Outsourcing%20Report_1207.pdf 56 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 Appendix Variable Mapping Data was obtained from the CBOK 2015 Global Internal Audit Practitioner Survey (Lake Mary, Florida, USA: The Internal Audit Foundation). Question number and wording are provided below. Visit www.theiia,org/CBOK for more information. The views in this study reflect the researchers’ opinions, and are not intended to represent the position or policies of The IIA or the Internal Audit Foundation. Variable Name CBOK Variable Question Wording Outsourcing OUTSOURCE Q38 In the previous calendar year, were some of your organizations’ internal audit activities provided by a third party (either internal or external to your organization)? (CAEs only) 1=yes, 2=no, 3= I don’t know (Recod- ed 1=yes, 0=no) Organizational Characteristics ORG_TYPE Q24 What is the type of organization for which you currently work? 1=Privately held, 2=Publicly traded, 3=Public Sector, 4=Not-for-profit, 5=Other SCOPE Q27 What is the geographic scope of your organization or government entity? 1=Local (operating in one munic- ipal level body such as a city or county), 2=Regional (operating in a province or state within an indepen- dent country), 3=National (operating throughout an independent country), 4=International or multinational (operating in more than one independent country), 5=Other IIA_INST Q9 7=Australia, 21=Canada (IIA-North America), 78=New Zealand, 102=South Africa, 117=United Kingdom & Ireland, 118=United States (IIA-North America) IA_AGE_CAT Q510 Approximately how many years has the internal audit department been in place in at your organization? 1= <5, 2= 5-14, 3= 15 to 24, 4 = 25 to 34, 5=35+ IA_SIZE_CAT Q41SPECIFIED_1_Clean- Q41Specified_cleasnednu- mericNumberoffulltim1 Approximately how many full-time equivalent employees make up your internal audit department? The specified variable (exact number) was recoded into the following catergories:1=0 to <4, 2= 4 to <10, 3=10 to <25, 4= 25 to <50, 5= 50 to <300 Audit Committee Involvement AC_EXIST Q108 Is there an audit committee or equivalent in your organization? 1=yes, 2=no (Recoded to 1=yes, 0=no) AC_MTG_HELD Q109SPECIFIED_1_ CleanQ78aSpecified- cleansednumericNumber- ofmeeting Approximately how many formal audit committee meetings were held in the last fiscal year (including in-person meetings, telephone meetings, online meetings, and so on? AC_MTG_INVITE Q110SPECIFIED_1_ CleanQ78bSpecified- cleansedNumberofmeet- ingsSpecif Approximately how many formal audit committee meetings was the chief audit executive (CAE), or direc- tor, invited to attend (entirely or in part) during the last fiscal year? 57 A. N. Scarlata, S. Garven, B. Vagner, & T. Bahmanziari Journal of Small Business Strategy / Vol. 29, No. 2 (2019) / 44-57 AC_PERC_ATEND Q110/Q109 Percent of audit committee meetings that the CAE was invited to attend (Created Variable) Financial Health BUDG_INC_PRIOR Q46 From last year to this year, how did your internal audit department budget change? 1=Increased, 2=Decreased, 3=Remained the same (Recoded to 1=Increased, 0=Did Not Increase) SUFF_BUDG Q47 In your opinion, how sufficient is the funding for your internal audit department relative to the extent of its audit responsibilities? 1=Not at all sufficient, 2=Somewhat sufficient, 3=Completely sufficient Technical Expertise CERT_CIA Q21_1 CIA (Certified Internal Auditor) 0=not selected, 1=selected CERT_CPA Q22_2 CPA (Certified Public Accountant) 0=not selected, 1=selected YRS_EXP Q520 Total Years of Experience TECH_SPEC Q20 In addition to performing general internal audit activities, do you have an area of technical specialization for which you have had formal training AND in which you spend a majority of your time working? 1= I do not have a technical specialization for my internal audit work, 2=Accounting, 3= Financial report- ing, 4= Fraud, 5= Information technology (IT), 6= Ethics, 7= Compliance, 8= Legal, 9= Risk management, 10= Operations, 11= Management, 12= Engineering, 13= Construction, 14= Environmental auditing, 15= Performance auditing, 16= Other (Recoded to 1=yes, 0=no) HRS_TRAIN Q823_1 How many hours of formal training related to the internal audit profession do you receive per year?