Factors Affecting the Implementation of Risk-Based Internal Auditing
Round 1
Reviewer 1 Report
Comments and Suggestions for AuthorsReview on paper ‘Factors affecting the implementation of risk-based internal auditing’
The paper addresses the positive and significant impact of management empowerment, internal auditors’ role, risk management system, and risk management training on risk-based internal audit (RBIA) using PLS-SEM approach for Saudi Arabian public sector organizations. Author proposes five hypotheses, four of which were confirmed as research results of the paper.
1. Introduction
Author describes an audit methodology, known as RBIA, but the author did not consider how risks are determined and prioritized in internal audit. In addition, the author did not specify whether the risk levels are strategic or operational or all types of risk. The author wrote about his motivation, but did not explain why public organizations were investigated and what specific risk they have, in contrast to private ones.
Author poses research question and reasonably explains own contribution in the paper. The novelty of his research is RBIA implementation in the Saudi public sector organizations using empirical research.
2. Literature review and hypothesis development
Author introduces explanatory factors in this section, but does not explain about the nature of these factors (for public organizations only or for private ones too). After introducing each factor hypothesis was stated. If the author were to consider public organizations, perhaps he would revise the list of proposed five factors that are mentioned in the paper or introduce additional factors.
Author can take into account internal audit and AI in his research:
https://doi.org/10.1016/j.irfa.2023.103050
https://doi.org/10.1016/j.joitmc.2024.100218
https://doi.org/10.1016/j.accinf.2024.100676
https://doi.org/10.1016/j.respol.2023.104828
3. Methodology
Author explains the five-point Likert scale for his questionnaire. At the same time, the structure of dependent variable and some explanatory variables are not clear. Three variables of the risk management system are unclear (page 7, lines 275-278). Risk management training does not include three clear variables (e.g., using numbers or bullets to indicate of each variable) (page 8, lines 284-285).
Data collection procedure and demographic profiles of respondents were described in good manner.
4. Data processing and Analysis of Results
The author justified the choice of the PLS-SEM research method, visualization of interconnection between variables and defined the interpretation of the obtained results. However, indicators are not specified in fig. 2. It is necessary to explain each indicator. He verified VIF criterion to confirm absence of Multicollinearity for explanatory variables, t criterion and p-values to explain statistical significance/insignificance of corresponding independent variables.
H5. Internal Control System has a significant and positive influence on RBIA implementation. This H5 was not confirmed.
R-square value is less than 50%, but 4 main significant factors on RBIA were revealed.
5. Empirical results and discussion
In this section, the author does not consider whether the Internal Control System is insignificant due to the public sector or other reasons.
6. Implications, limitations, suggestions for future research, and conclusion
It is necessary to specify policy recommendations of the author only to the public sector of Saudi Arabian.
Author achieved the goal of the paper and answered the research question using own hypothesis.
The paper can be recommended after taking into account comments above.
Author Response
Regarding the comments No. 1. Introduction
Regarding the comment about the description of the RBIA (Risk-Based Internal Audit) methodology, I have included additional details on how risks are determined and prioritized within the internal audit process. Specifically, I have expanded upon the methodology section to provide clarity on the process of risk identification and assessment, including the consideration of both strategic and operational risks. By doing so, I aim to enhance the comprehensiveness of our methodology description and its applicability to various risk types.
Furthermore, I have amended the introduction to better articulate the motivation behind investigating public organizations and the specific risks they face compared to private entities. In these revisions, I provide a clear rationale for focusing on public organizations, highlighting the unique challenges and complexities inherent in their operating environments. Additionally, I emphasize the importance of understanding and addressing these specific risks within the context of internal audit practices.
I believe that these revisions strengthen the manuscript by providing a more thorough explanation of the RBIA methodology and its relevance to both public and private organizations.
Regarding the comment No. 2 Literature review and hypothesis development
In response to the reviewer's comment regarding the nature of the explanatory factors introduced in our manuscript, I have made revisions to clarify the focus on public sector organizations. Specifically, I have added a dedicated subsection titled "Internal Auditing in Public Sector Organizations" within the Literature Review and Hypothesis Development section. This addition provides context for the study's focus on the public sector, thereby supporting the relevance of each factor hypothesis outlined in the paper.
Furthermore, I acknowledge the reviewer's suggestion to consider potential revisions or additional factors tailored specifically to public organizations. While my current analysis focuses on the proposed five factors, I recognize the importance of exploring additional factors that may be unique to the public sector context. In light of this, I have carefully considered the reviewer's feedback and believe that my study contributes significantly to the understanding of the factors affecting the implementation of risk-based internal auditing within public sector organizations.
Regarding the comment No. 3 concerning Methodology
In response to the reviewer's comments on the clarity of variables within the risk management system and risk management training, I have revisited the relevant sections and provided additional clarification. Regarding the risk management system, I confirm that it comprises three distinct variables: (1) existing procedures, (2) defined accountabilities within the organizational structure, and (3) the role of either the current risk manager or an isolated risk management unit. I have made revisions to ensure that these variables are explicitly delineated within the text.
Similarly, for the risk management training variable, I have clarified that it encompasses three specific components: (1) documentation and (2) assessment of work-related risks, in addition to (3) improving the quality of internal auditing and risk management practices. These revisions aim to enhance the transparency and understanding of the variables under investigation.
Regarding the comment No. 4 concerning Data processing and Analysis of Results
The reviewer's concern about the lack of specification of indicators in Figure 2, I would like to clarify that the indicators are indeed explained in detail in Section 3.1 (Questionnaire and Variable Measurement) of the manuscript. Additionally, all indicators are explicitly specified in Table 2, providing a comprehensive overview of the variables and their respective measurements.
Furthermore, I want to assure the reviewer that I have carefully adhered to best practices in data analysis and interpretation. Specifically, I have verified the Variance Inflation Factor (VIF) criterion to confirm the absence of multicollinearity for explanatory variables. Additionally, I have utilized the t criterion and p-values to determine the statistical significance or insignificance of corresponding independent variables.
Regarding Hypothesis 5 (H5) concerning the influence of the Internal Control System on RBIA implementation, I acknowledge the reviewer's observation that this hypothesis was not confirmed. While this outcome was unexpected, I have thoroughly examined our data and methodology to ensure the validity and reliability of our findings.
Although the R-square value is less than 50%, I have identified and emphasized four main significant factors influencing RBIA implementation in our study. I believe that these findings contribute valuable insights to the existing literature and have important implications for practitioners and researchers in the field
Regarding the comments No. 5. Empirical results and discussion
In response to the reviewer's comment regarding the consideration of the significance of the Internal Control System, I have carefully revisited the relevant section and made amendments to explicitly address the significance of the Internal Control System within the public sector context.
I now acknowledge that the significance of the Internal Control System may vary due to factors unique to the public sector, as suggested by the reviewer. Our revisions include a discussion on how the characteristics and operating environment of public sector organizations may influence the effectiveness and relevance of the Internal Control System on RBIA. By incorporating this perspective, I aim to provide a more comprehensive understanding of the implications of ICS within the context of our study.
Regarding the comment No. 6. Implications, limitations, suggestions for future research, and conclusion
I have taken note of the suggestion to specify policy recommendations exclusively for the public sector of Saudi Arabia. In response, I have revised the manuscript to include policy recommendations tailored to both the public sector of Saudi Arabia and other relevant contexts.
Reviewer 2 Report
Comments and Suggestions for AuthorsDear authors,
Thank you for allowing me to revise your paper on “Factors affecting the implementation of risk-based internal auditing”. This paper investigates the factors affecting risk-based internal audit (RBIA) implementation in public sector organizations in Saudi Arabia. The issue highlighted in this paper is relevant and the methodology is well described. The design of the Table can be revised to improve the readability of the results.
Table 1 (Demographic profiles of respondents) need to be technically edited. Notes in table 3 (Discriminant validity) under table or notes is not true - ME= management empowerment or MS, RMS or RM.
Author Response
First of all, I would like to thank the reviewer so much for complimenting me on the work that was done on the paper and how it is structured.
I have addressed the technical editing issues in Table 1 (Demographic profiles of respondents) and have ensured its accuracy. Additionally, I have reviewed and corrected the notes in Table 3 (Discriminant validity) to accurately reflect the variables, MS, RM, and RMT as management support, risk management, and risk management training, respectively.
Finally, I appreciate the reviewer's positive remarks regarding the paper's strong empirical design and data analytics. Your feedback has been invaluable in enhancing the quality of our manuscript, and I am grateful for your support and encouragement.
Reviewer 3 Report
Comments and Suggestions for AuthorsSee comments attached.
Comments for author File: 
Comments.pdf
See comments attached.
Author Response
First of all, I would like to thank the reviewer so much for complimenting me on the work that was done on the paper and how it is structured.
Regarding comment #1.a.
I want to assure you that I have gone through the paper to make the necessary corrections. Also, I have sought the assistance of a professional proofreader to ensure the highest level of accuracy and consistency. Furthermore, I have improved the presentation of the paper by clearly labelling equations, tables, sections, and subsections to enhance its readability.
Regarding comment #1.b.
Thank you for forwarding the reviewer's comments on our manuscript. I am pleased to receive their positive feedback and appreciate their insightful suggestions for improvement. Regarding the reviewer's comment on adopting a more concise writing style and avoiding generalities, I want to assure both the reviewer and the editorial team that I have already taken significant measures to address these concerns in the abstract, Introduction, and Discussion sections of our manuscript. I understand the importance of clarity and specificity in communicating the key findings and contributions of our study. Specifically, I have revised these sections to ensure that each sentence effectively contributes to the discussion of our research outcomes and their implications. I have made conscious efforts to articulate the implications of our study in a clear and precise manner, avoiding vague statements and ensuring that they are supported by the evidence presented in the manuscript. I am committed to upholding the standards of rigor and clarity expected by the journal and its readership. Therefore, I appreciate the reviewer's guidance in this regard and are confident that the revisions I have made address their concerns satisfactorily.
Regarding comment #1.C. on delineating the contribution of the study to both the literature and practice, I want to assure both the reviewer and the editorial team that I have carefully revised the manuscript to address this concern.
In particular, I have enhanced the discussion of the contribution to practice to ensure that it extends beyond the context of Saudi Arabia. Recognizing the international readership of JRFM, I have provided a broader perspective on how the findings of our study can be applicable and beneficial to practitioners worldwide. I have highlighted practical implications that are relevant across different cultural and organizational contexts, thereby enriching the applicability of our research beyond a single geographical region.
Furthermore, I have expanded our discussion of the contribution to academia by emphasizing how our study extends the established literature. I have provided a comprehensive review of relevant theoretical frameworks and empirical studies, demonstrating how my research builds upon existing knowledge and fills gaps in the literature. By clearly articulating the theoretical foundations and methodological innovations of my study, I aim to contribute meaningfully to the advancement of scholarly discourse in our field.
Regarding comment #2.a. the reviewer's suggestion to include a Figure illustrating the hypotheses stated in the paper, I have considered the reviewer's recommendation and have made the necessary revisions.
I am pleased to inform you that I have added Figure 1 at the end of Section 2 (Literature Review and Hypothesis Development) to visually depict the conceptual model along with the hypotheses. This figure aims to provide readers with a clear and concise visualization of the conceptual framework guiding my study, facilitating a better understanding and interpretation of the proposed hypotheses.
I believe that the inclusion of this Figure enhances the clarity and coherence of our manuscript, aligning it more closely with the expectations of the journal and its readership.
Regarding comment #2.a. I am pleased to confirm that I have included detailed descriptions below the captions of both figures as per the reviewer's suggestion.
Regarding comment #3 regarding the concern raised about common method bias, I want to assure the reviewer that I have addressed this issue in the study. I have conducted a comprehensive common method bias test as recommended in the literature. See page No. 11 section No. 3.3.
