Internal Audit in Yemen's Public Sector
Internal Audit in Yemen's Public Sector
THESIS ENTITLED
BY:
1
Introduction
As an era of progress, the business size changes from small to a large-scale over thousands of years.
Therefore, the type of business entity and ownership (public and private), the management concept
also has affected. Early from the Taylor and Gilbreth and Acute; time control in scientific
management to the newly developed methods of human behaviour and system control, Enterprise
no longer used the simple way as in the production line and sales. Global business is another
indication of growth. The appraisal system applied to measure the whole system but not for
individual. For the sake of protecting the investors under the rapid changes in the business running.
The changes of production and business size lead to huge amounts of funds for running the
activities of the enterprises therefore, the co-ownership system in the frame of Public Sector
Companies (PSCs) had existed, in which there is separate management and proprietors
(shareholders). For the purpose of protecting funds of those shareholders or investors, appeared to
the light systematic tools, which known as the Internal Audit (IA) and control. Day by day IA
improved until becomes profession has framework consist of regulations, code of ethics, standards,
procedures and staff who has to be qualified to such regulations and professional requirements. IA
will promote the operating efficiency, as well as, help to attain the prescribed goal of business.
Moreover, it can assure the truth of financial report, control system efficiency and the compliance in
following the professional regulations.
Definition of IA has changed or developed according to the development of profession, scope and
objectives of IA. The Institute of Internal Auditors (IIA) has defined IA in its latest definition as “an
independent, objective assurance and consulting activity designed to add value and improve an
organization's operations. It helps an organization accomplish its objectives by bringing a
systematic, disciplined approach to evaluate and improve the effectiveness of risk management,
control and governance processes”.
Internal Audit Function (IAF) evaluates how well the control processes designed by managers’
function and therefore, the extent to which managers can have reasonable assurance business
objectives will realize.
The Institute of Chartered Accountants of India (ICAI) has defined this term as "an independent
appraisal activity within an enterprise whether by staff of the enterprise or by a firm of accountants
appointed for that purpose for the reviews accounting, financial and other operations and controls as
abases for service to management. It involves a specified application of the techniques of auditing".
New definition of IA issued by the ICAI describes IA as "an independent appraisal involving
specified application of the techniques of auditing in accordance with the specific needs of the
enterprise".
2
The following statements describe the rating categories for the assessment of the Internal Audit
Functions’ (IAF) oversight of the effectiveness of and adherence to, the institution’s organizational
and procedural controls. An overall rating of the IAF considers both its characteristics and the
effectiveness of its performance in executing its Mandate in the context of the nature, scope,
complexity and risk profile of the institution. Characteristics and examples of performance
indicators that guide supervisory Judgments in determining an appropriate rating are set out below.
Acceptable: IA performance has been effective. IA characteristics and performance meet generally
accepted industry practices and current professional standards.
Needs Improvement: IA performance has generally been effective, but some significant areas
where effectiveness needs to be improved. The areas needing improvement are not serious enough
to cause prudential concerns if addressed in a timely manner. IA characteristics and/or performance
do not consistently meet generally accepted industry practices and current professional standards.
3
The importance of the study comes from the importance of IAP and its contribution to the
organizations, economy of Yemen at all, as well as, PSCs specifically. The important points are as
follows:
1. This study is considered the first study in the RoY, which studies the IAP in public sector
companies.
2. The IAing has great importance in our age and thus invites us to study its effects on the
efficiency and effectives of the organizations and companies.
3. To know the latest improvement of IAP as a modern function and new vistas
4. This study aims to convey new knowledge into the IA practitioners and researchers.
5. This research will be conducted in the RoY, which is one of the developing countries so that
many other developing countries may get the benefit from it for improve the IA in their
companies or organizations.
6. This study aims to give recommendations to the respective government parties to modify the
regulations and improve the several aspects of IA function.
7. The results of this research will contribute to develop the IA in the PSCs, as well as, in all
sectors.
This study in general aims to examine the quality's level of IAP in public sector companies in the
RoY for the purpose of developing the weak areas. Therefore, to achieve this general objective, the
researcher put the following group of objectives:
i. To evaluate the several components or aspects of IA as applied in the PSCs in the RoY in
order to develop the weak aspects.
ii. To know the view of practitioners and academic lecturers to the profession of IA and how far
can be developed in the RoY.
iii. To study to which extent the professional laws and regulations are developed and reliable to
contribute toward professionism IA.
iv. Two study the availability of code of ethics and practical standards of IA in the RoY, as well
as, which code of ethics and standards adopted.
v. To examine the extent of internal auditors obligation to the regulations, standards if any and
systems of IA through their works, responsibilities and authorities.
vi. To study the relationships level between external and internal auditor (COCA in the case of
PSCs and accounting firm assigned by it).
4
Hypotheses
This study tries to solve the problem of the study through answering its question and achieving
its objectives. Hence, IA is a profession has framework has characteristics, which consists of
certain components, which put under investigation because they represent the main determinants
of Internal Audit Department (IAD). Therefore, any weakness or strength in these determinants
is going to weaken or strengthen the IAP. Consequently, for identifying and disclosing the
position of IAP in the RoY systematically and subsequently determine the requirements of
improving it. the researcher has identified those determinants namely; IA procedures,
professional laws and legislations, code of ethics and standards, internal auditor competencies,
internal auditor's relationship with external auditor, IA reporting, as well as, according to the
mass development of information technology, IA in the IT environment has taking into
consideration. For the purpose of studying and analyzing the professional position (availability
and quality) of those determinants, the study has expressed them in form of ideal hypotheses put
under test and analysis as shown below:
5
and influence of IA determinants; IA procedures, legalizations and laws, professional standards
& code of ethics, independence, internal auditor competences, relations with external auditor, IA
reporting and competence of internal auditor in IT environment on IAP. This model is1:
Y=
∑ (X i ¿ ) , i=1 ,2 , … , n , ¿ (2.1)
n
n=8 ,
where:
Y IAP level in PSCs in the RoY,
n Number of independent variables,
X1 Availability of proper IA procedures,
X2 Quality of professional legislations and laws related to IA,
X3 Availability of Professional standards and code of ethics regulate IA,
X4 Independence level, organisationally and functionally,
X5 Competences of internal auditors,
X6 Relationships of internal auditor and external auditor,
X7 Components and quality of IA reporting and
X8 Information system audit.
Furthermore, this model is consisting of two sub models, which mathematically presented in
Equations 2.2, 2.3. These two sub models have designed to express the relation between the
independent variables X 1 , X 4 , as dependent variables in respect with their components or
determinants (independent variables). The independent variables of X 1 (IA procedures) are
planning, evaluation of ICSs, IA programs and documentation. The independent variables of X 4
(the independence) are organizational and functional independence. This sub model formulated
in Equation 2.22:
X1=
∑ (Z i ) , i=1 ,2 , … , n , (2.2)
n
n=4 ,
where:
X1 Availability of proper IA Procedures,
n Number of independent variables,
Z1 Availability and application level of IA planning,
Z2 Evaluation of ICSs,
Z3 Availability and application level of IA programs and
Z4 Availability of documentation.
K1+ K2
X 4= , (2.3)
2
1
This equation has developed for the study model in case give equal weight for all independent variables and other
equation has been used for the same in case of weighting the independent variables by different weights which
explain in the section of variable weighting of this chapter.
2
The researcher has given equal weights for all independent variable of the sub models, which designed in
Equations 2.2, 2.3.
6
where:
X4 Level of independence, organisationally and functionally,
K1 Level of organizational independence and
K2 Level of functional independence.
The researcher utilised two methods of analysis to obtain the result of research models. First: one
sample t test for the different determinants of the study model. Second: linear regression for
predicting the value of dependent variables through the values obtained for independent
variables.
Variables Weighting
The general components of IA were expressed as independent variables, which their availability
and quality’s level that determine position level of IA (dependent variable). The question of what
weight assign to each independent variable indicating its importance toward IAP. For example,
profession without standards is too difficult to call it profession, so the availability and
compliance with element of professional standards has high influence on the IA but in respect of
the IA procedures, if there is some weak areas do not highly shackle the profession. For this
reason, the researcher has assigned weight (correlation coefficient) for each independent element
according to its significance and effect on IAP. Therefore, the researcher has developed the
following equation to calculate the study result. Moreover, the researcher has analyzed the
responses with both ways (equal weights and different weights) and has clarified the difference
between the results, which, obtained through the both ways.
Y = β1 X 1 + β 2 X 2 + β 3 X 3 + β 4 X 4 + β5 X 5 + β 6 X 6 + β 7 X 7 + β 8 X 8 (2.4)
where:
β = effective weights of the independent variable to dependent variable.
X 1 , X 2 , … … … … ., X 8 = Refer to the specification of Equation 2.1.
7
3. (50-74) per cent discovers that, IAP level is acceptable with need to some required actions
for improvement.
4. (25-49) per cent indicates that, IAP is under developed and there are many of its
determinants are weak or unavailable.
5. (0-24) per cent reflects that there is no IAP by any means.
After reviewing, the normative literature and developing the theoretical framework to
describe and explain IAP in modern organizations the field questions were formulated. Hence,
the researcher conducted group and personal meetings and open-ended interviews with several
numbers of CAEs, audit section managers, inspection section managers, and senior auditors of
PSCs that are the sample of the study in order to know:
- The current position of IAP in the company,
- The problems and difficulties of IA as viewed by workers, mangers in this field, and
- To get answers to some questions asked by the researcher.
The Survey Instrument
The researcher designed a special survey questionnaire for this study to collect data that are
related to applied section of this study, which depends on the known scales.
The Researcher put some of questions especially those who had not ready scales and those
questions that are suited for Yemeni environment. The questionnaire consisted of eight positions
that represent the determinants of IAP, as well as, reflect its quality’s level distributed in to three
8
parts that contained 75 questions; sixty-nine shall be filling by all respondents and six questions
filled by CAEs only, which have been asked in interviews and repeated in the questionnaire to
insure the creditability of interviews responses. The first part of the questionnaire gathered
demographic information on respondents. The second part consisted of scale items that utilize a
5-point Likert type scales. The anchors included: 1-strongly disagree to 5-strongly agree while
third part consist of two substantive questions.
Secondary Sources
Along with the primary data, the researcher has also compiled secondary data from various
sources like books, researches, previous studies, statistical and issued reports, publications,
magazines, journals, newspapers etc. For the purpose of collecting data, the researcher visited the
several libraries, institutions and offices in Yemen and India.
Sample Design
The population of this study is PSCs in Sana'a, Ibb, Taiz and Aden governorates. Research
population is the internal auditors of different positions (job title) in PSCs until 2009 that
represent CAEs, audit section managers, inspection section managers, senior internal auditors
and junior internal auditors). The researcher gave attention to the homogeneity of population that
the sample of this study was selected from it and the degree of accuracy. Population size in
number of PSCs in the RoY is twenty four company; sample selected out of the population was
nineteen, which represents 79 per cent of the population of the study. The researcher has utilized
following technique for selecting the sample:
First, a stratified and cluster sampling method was utilized to determine the number of
respondents required from each governorate and determine the number of respondents required
from each company and branch according to the size of population in each governorate,
company and branch. Afterwards, a random sampling was used to select 225 respondents that
were distributed in different cities out of 346 the total size of population. The sample (mailing
list) for this study was obtained from the statistical annual report of the ministry of industry and
trade for the year of 2008, which contains information about the numbers of PSCs running in
different sector that are located in different governorates and cities. The minimum size of sample
9
should be at least 200 to ensure appropriate result and to minimize the chance of getting good or
perfect goodness-of-fit indices due to suitable sample size. However, small sample sizes, less
100, are also likely to be problematic because they are likely to result in poor goodness-of-
indices. The targeted usable sample size for this study was set at 225.
Pilot Test
Since most of the measurement items are developed for the purpose of this study, pre-test of the
measurement instrument is necessary to validate the items in the scales. A pre-test of the
measurement instrument is conducted in several stages. First, the survey questionnaire has
discussed with some experts and professors in some universities to examine it and get their
feedback, opinions and suggestions for revising it. Second, the survey questionnaire is circulated
to several faculties and graduate students in the Departments of Accounting and business
administration at college of management sciences in Alandalus University for Science and
Technology. Participants are asked to provide feedback regarding the layout, wording and ease
of understanding of the measurement items. The feedback has taken into account in the revision
of the questionnaire. The revised questionnaire is pre-tested using a convenience sample of
CAEs, audit and inspection section managers of PSCs in the selected cities; this arranged
questionnaire is delivered by hand to selected respondents. The responses from pre-test are
analyzed to test the reliability and validity of the measurement items. The questionnaire is
revised based on the reliability and validity test and the final version of the questionnaire is
developed. The questionnaire is produced in a booklet form.
In descriptive statistical analysis, the data is summarized and described numerically within a
certain group of individuals. No generalizations or conclusions can be drawn beyond such a
group. The Mean (X), Standard Deviation (SD) and Standard Error (SE) are usually used in
carrying out descriptive analysis. In inferential statistical analysis, unlike the descriptive one,
generalizations and conclusions are drawn from samples based on observation. It should be
10
noted that statistical inference or generalization is based upon the theory of probability. A variety
of different statistical techniques are used to determine the probable degree of accuracy of
generalizations about the population from which a sample or set of data is selected. Normal
Distribution Test, One-way t Test, F-test, ANOVA, the MANOVA and Correlation Test are among
the tests used in an inferential statistical analysis.
12
divided to its determinants, which expressed in eight hypotheses, where the results of these eight
hypotheses are as follows:
1. IAF in RoY is in in-house only, where it provides by IAD established within the
organization.
2. The Yemeni laws and regulations do not enhance the professionalism of IA whereas this
laws do not identify and impose any specific IA code of ethics and standards over IA
practitioners or/and IAD.
3. The Yemeni professional laws and legislations do not enhance the professionalism of IA
even there is no systematic adherence to these laws such as delay in establishing the IAD in
the stipulated time and personnel, promotion of IAD staff and IAD does not make the
information available to the external auditor as impose in the law.
4. Lack of national professional organization (governmental or independent) regulates the IAP
in regard of issuing compulsory code of ethics and professional standards and supervising
their implementation.
5. While there is no national professional framework of IA, as well as, the laws do not specify
any framework in respect of IA therefore, the works of IAD not done through standardized
principles in different PSCs.
13
6. The relationship and cooperation between the internal and external auditor is weak in real
field because they do not held meetings, both of them do not make their working papers and
information available to each other and external auditor does not rely on the work of IAD in
his work.
7. IAD and Internal auditor are to some extent independent organizationally and functionally.
8. The Internal auditors are not well competence and qualified to conduct the IA works
because of academic accounting education does not provide IA desirable level and
professional training is weak and most of them do not bear professional certificates, as well
as, continuous education program for internal auditors do not exist.
9. Based on the study results, it is clear that some PSCs have not historically placed a strong
emphasis on relevant education and experience in making appointments to different
positions within the IAD. In addition, there has been little or no oversight to ensure only
qualified individuals are appointed. The role of the COCA in approving the appointments is
not clearly defined. These conditions can have a detrimental effect on the effectiveness of IA
and could be viewed as not establishing the proper “tone at the top” regarding the
importance of IA activities. For this reason, minimum education and experience
requirements reviewed and proved clearly.
10. Management in various levels does not pay desired attention to the work of IAD because
thought of non-internal auditors, as well as, some internal auditors is still considering IA is
the function of hunting the mistakes. Therefore, it does not reach to the modern concept of
IAP, which is independent assurance and consulting activity aims to add value and improve
an organization's operations. It helps an organization to accomplish its objectives.
11. There is no clear identification of authorities and responsibilities of IAD and its staff
because of the law does not impose that each IAD should prepare and maintain audit charter.
12. There is a big gap between IT development and IA requirements of internal auditors’
competencies and qualification and audit techniques used to audit the IS.
13. There is clear influence of Globalization on IA characteristics and quality in the RoY
because it found that the availability and quality IA components are better than that of pure
national PSCs such as banks and telecommunication companies.
Conclusion
After presenting and analyzing the data by utilizing several techniques and exploring the study
results in details, the study reaches to interpret the result according to the rates developed and
study model. Consequently, while IA level scores availability – with equal weights and unequal
weights – was 46.7 and 46.09 successively. Therefore, it belongs to the scale or interval of 25 -
49 per cent, which debates that; the IAP is under developed and there are many of its
14
determinants are weak or unavailable and in need to many developing actions. This conclusion
result has also presented with the study model in Figure 5.37.
Figure 5.37 Study Model’s Final Result
Independent Variables
IA Legalizations Standards & Internal Relations with IA
Independence IS Audit
Procedures & Laws Code of Ethics Auditor External Auditor Reporting
46.1%
Depent. Variable
Legalization Professional
&Law
Internal Audit in Practice
Environment PSCs in the Republic Environment
of Yemen.
The undeveloped position of IAP in PSCs in the RoY resulted specifically from; lack of clarity
and limitations exist in some provisions of laws and regulations of IAP, lack of uniformed and
compulsory PPF guiding the internal auditors in practice. The qualifications and competence of
internal auditors are below par to perform the IAF professionally, the external and internal
auditors' relationship is unwell to make their work integral and complemented. Moreover, the
internal auditors are not qualified to carry out the internal audit functions in the information
technology environment.
Based on the findings derived from this research endeavour, the investigation arrived at the
following conclusion.
Many discussions had done about IA, its nature, elements and factors of evolution and
development of IA within the academics, legislations and practitioners’ levels. The purposes of
this study were to explore the current position of IA in PSCs in Yemen and to look at
requirements for developing it. However, the findings mentioned above indicate that
enhancement of IAP in future depends basically on the accomplishment of a group of
arrangements, consequently the following are the main recommendations of the study:
i. Amending and improving the laws and regulations related to IA (PMR 25/1986, 217/1999) in
order to include provisions in respect of:
1- Code of ethics, which must be followed by the internal auditors,
2- Professional standards authorized by law,
3- Impose the PSCs to maintain audit charter, policy and procedure manual for IAD,
4- Widening the concept of IAP in respect of function provider into a profession can be
provided by out-source, in-house practitioners or both of them. Because the PMR 25/1986
15
and 217/1999 treated the IAP as in-house function provides through IAD staff within the
company only,
5- IA professional body and its authorities and responsibilities, and
6- Professional qualifications and disqualifications of internal auditors in all positions
(certifications of internal auditors).
ii. Professionalism of IA by formulating PPF for internal audit in the manner of PPF of the IIA
of USA, UK and India …etc. to be convenient for the Yemeni environment, which includes
clear definition for internal audit, code of ethics, professional practice standards and practice
advisories.
iii. Professional bodies and practitioners must participating in forming the legislations such as
those laws and regulations related to IAP.
iv. Establishing national IA professional body for regulate and organize the IAP in the country.
v. Establishing Audit Committees within each organization fall under the law of IA.
vi. Improving the professional and academic education for internal auditors (continuing
education program), Through developing the academic syllabus of accounting courses in
order to include sufficient part related to IA, as well as, opening IIA branches for providing
professional education for practitioners.
vii. Each PSC must maintain and provide continuous training and development programs to the
practitioners of IA with according with professional practice standards.
viii. Continuous training and development programs sponsored by the computer information
technology must be provided to practitioners of the IA in computerized information systems
environment.
ix. Top management should be given short seminars about the importance and role of IA in
achieving the objectives of organizations, as well as, spread the thought of corporate
governance among the executives in all managerial lines and IA role in enhancing it.
x. Making systematic continuous evaluation program for IA activities externally by the
authorized bodies and internally by self-quality assurance program and peer review system.
xi. Internal control systems and procedures manuals of each PSC should be properly and fully
documented and make them available to the internal auditors, as well as, inform them with
any update for them.
xii. Recommendations for Future Research: based on the results of this study, future studies are
needed for examining the characteristics and performance of IA either acceptable or still in
need for more development. Following are recommendations for some recommended future
researches:
1. Research on the impact of operational or performance auditing on Public and private
sector companies.
2. Research on the role of IA in developing the performance of PSCs.
16
3. Role of IA in the prevention and detection of fraud.
4. Do internal auditors have the necessary skills to gain commitment from auditees?
5. Reviewing the effectiveness of IA in PSCs.
6. Framework for internal auditors to add value in PSCs.
7. Role of PSCs internal auditors in risk management.
8. Role of IA in promoting sound management controls in organizations.
9. The impact of IT on IA in the RoY.
17