Efficiency and Performance Factors in Internal Audits in the Public Sector: A Literature Review ^†

Abstract

PURPOSE—This article reviews some theories and concepts of public management, including those related to public value, opportunity costs and efficiency, in order to analyze the advantages and disadvantages of using Internal Audit in public organizations. METHODOLOGY—Utilizing the literature review as the main tool, this paper draws from various sources presenting the current developments of audit around the public sector from a variety of countries and using information technology as a factor of effectiveness. RESULTS—In Greece, reforms in public administration started after the financial crisis, with Law 4795/2021 strengthening the evaluation systems. Evaluation in Greece is carried out by supervisors, while auditing is carried out by internal auditors with no link between the results. A hybrid audit is proposed for the more effective evaluation of public administration, combining evaluation and audit. These changes aim at greater transparency, security and accuracy in the management of public organizations. ORIGINALITY/VALUE—This study provides a literature review on public sector internal control. In addition, it develops insights, critical reflections and avenues for future research in this area.

1. Introduction

During the crisis period that started in 2010, Greece was confronted with the pathologies in the functioning of the public sector. While, in the private sector, an internal audit is mandatory for listed companies, the Greek government only enacted Law 4795/2021 on the “Internal Control System in the Public Sector” in April 2021. In practice, an internal audit is designed to add value and improve the operations of an organization. Thus, we believe that an internal audit provides the basis for some of the most persuasive arguments for secure governance and accountability [1]. A strong internal audit system is designed to add value and improve processes [2,3].

Also, the Institute of Internal Auditors [4] defined an internal audit as an independent, objective assurance process with the primary purpose of adding value and improving an organization’s operations. It helps achieve its objectives by bringing a systematic, disciplined approach to improving the effectiveness of risk management, control and governance processes. The lack of an effective internal control system is considered one of the main causes of corporate failure [5] and corporate governance codes worldwide now explicitly require companies to disclose information on the effectiveness of their internal control systems [6].

2. Literature Review

2.1. The Case of the USA

Martin, Sanders and Scalan [7] report on the implementation of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework. The COSO framework focuses on assessing the effectiveness of the management of organizations by targeting only the accounting results of each reporting year. Therefore, the audit process is periodic and structured.

Internal auditing is performed by persons who are qualified in the field and certified by the Institute of Internal Auditors. These persons have education and training in relation to the applicable institutional framework, requirements and methods of performing internal auditing. Within these processes, emphasis is placed on combating fraud and corruption [8]. According to Aikins [9], one of the main objectives of the internal audit process in the US is to improve the financial performance of public organizations. This is achieved by focusing on quantitative data, i.e., how organizations, especially at the local level, manage their available resources.

This research shows that an internal audit is particularly important for improving the performance of public sector organizations both directly and indirectly. The direct consequence is that the state has data and an insight into how these organizations operate and can impose compliance measures and remedy the problems faced by these organizations. The indirect consequence is that the fact that an audit is carried out helps to evaluate how to improve performance, to give the managers of the public organizations a better overview of how the organization is operating and to propose solutions to the problems they are managing [9]. Still, based on Hay and Cordery’s [10] research, the internal audit process has improved the coordination and evaluation of public sector performance at the state level in the US. This has contributed to the reduction in public debt, as well as the better organization of public services in states where, historically, lower state-level growth indicators have been observed. There is also an improvement in the level of service of public services in states with significant social problems.

In the US, the US Department of Treasury has also been implementing a simplified control system since 2014, with the aim of providing the central government with a better level of coordination and addressing long-term problems such as the coordination of federal policies with those implemented at the state level. Still, they aim to improve the level of information to citizens on issues related to public sector expenditure management and the performance of public institutions [11].

2.2. The Case of the European Union

For the example of the EU member states, Adhikari and Garseth-Nesbakk [11] mention in their research that there are differences in the effectiveness and processes of internal audits by the state. Whether the audit process will be successful or not seems to be determined by factors such as transparency and the effectiveness of public administration in general.

More specifically, the article shows that in Italy and Slovakia, over time, there is a lack of concrete methods for internal evaluation and a lack of adaptation of the way the public sector operates, whereby best practices from the private sector are not adopted. On the other hand, it emerges that, in France, EUR 1.5 billion has been invested in improving the audit process while introducing reforms in the way public sector budget control is carried out. This has contributed to increasing the levels of transparency and credibility of the public sector and is expected to contribute to increasing the credibility of public administration [11]. Then, according to Rauskala and Saliterer [12], in Austria, a federal system of defining the internal audit process is implemented which, on the other hand, is structured into three levels; federal, state and local. Austria has a long tradition of internal control and clear laws defining how the public sector is to be financed, controlled and reformed, which makes internal control easier. The 2007–2013 reform at the central government level also prompted a change in the way an internal audit is conducted, with a focus on introducing provisions to ensure (a) focus on performance, (b) gender equality, (c) transparency, (d) efficiency, (e) law enforcement, and (f) fairness in internal audits.

Also, in Austria, there are three main ways in which auditing is carried out—that of internal audits, internal evaluations and external audits. Most ministries at the federal level in the nine autonomous Länder stipulate that different auditors will carry out different types of audit.

Internal audits in this state include the following [12]:

• A cost–benefit analysis;
• Assessing the extent to which the organization is adapted to the national standards/institutional framework in force;
• The extent to which there is performance against accounting standards and national accounts and the balance sheet of the organizations.

Then, in the research of Christiaeans and Neyt [13], the authors discuss internal control in Belgium with a focus on reforms in performance evaluation and control systems in that country. According to this article, the role and process of an audit is defined from 2013 onwards by the respective Supreme Audit Institution (SAI).

Internal control is carried out by supervisory authorities and auditors who are independent. In particular,

• The Department for Monitoring Commitments undertakes monitoring of the extent to which public bodies’ commitments are respected, based on an audit of the accounts and reports submitted.
• The Inspectorate of Finance oversees the way in which financial control is exercised and is an independent authority with specific responsibilities set out by the Federal Minister of Finance.
• The internal audit services are independent and supervised by the federal government in relation to their mode and framework of operation.

2.3. The Case of the United Kingdom

Then, focusing the research interest on the example of the United Kingdom, it is highlighted that this state has a long experience in implementing internal control in both the private and public sectors [14]. It is noted that, according to Caperchione [15], in the United Kingdom, the European Union also played an important role. The EU set the macroeconomic targets of the member states and, therefore, the way in which the Financial Reporting Advisory Board of the UK Treasury made decisions. It also stipulated that internal audits should be carried out in a manner similar to that of other EU member states.

The way in which an internal audit is carried out in this state is set out in the UK Corporate Governance Code and is regulated according to the institutional framework in force and the data from annual audits of organizations in the UK. The characteristics of internal audits are regulated based on four (4) criteria: the independence of the internal auditors, their expertise, the number of members registered in the respective registers and the frequency of meetings [14]. The internal audit system applied in the UK is, basically, hybrid. This means that it combines the practices of independent expert audit with individual self-reporting. In this way, a stable and reliable audit by experienced auditors is achieved and, at the same time, human resources are pushed to increase their ability to maintain high performance and operate with greater transparency on a daily basis. Therefore, the problem of audit staticity and reliability is solved and it becomes easier to impose changes [16].

2.4. Internal Audits in Greek Public Administration

We start with a study conducted by Karagiorgos et al. [3] in the context of internal audits in our country. Through their research, empirical data were presented concerning the evaluation of internal control in a Greek hotel unit. This research argues for a correlation between a company and a control system. The authors concluded that the operation of an internal control system in hotel companies can directly affect its financial and accounting data and subsequently reshape its efficiency rates. This means that an internal control system, when established, could play an integral operational role.

We continue with Giannakis [17], who investigated “Internal audit in central public administration as a mechanism for promoting administrative efficiency: the case of Greece compared to internationally applicable standards”. The aim of this research was to identify the reasons that make internal audits in the public sector qualitative and effective. This research was carried out by distributing questionnaires to audit institutions contained in the Greek government. The questions that were asked through the survey were about the quality rate of audits, the skills of the workforce, independence and the position that management takes in the internal audit. The first conclusion that the researcher came to is about the direct relationship between audit quality and audit performance. Of course, this does not mean that the quality rate in our country is satisfactory, since negative issues emerged which overshadow the positive results of the audit. The external audit and the difficulty of cooperation with the internal audit are also involved in the quality part. It is then concluded that there is potential for quality development of the workforce involved in internal audits. In terms of the independence of the internal control system, positive conclusions are drawn, since we confuse independence with the performance of the organization.

Finally, there was a negative view on the assistance of management in the internal control system, which has room for improvement.

Finally, Rodakos [18] focused on the function of internal audits and governance in the public sector and health sector and how these are affected by audit activity. The research took place in health facilities in Greece and 128 people working in health facilities participated. It was also reported that these 128 people reside in Attica, mainland Greece and on Greek islands. The results of their answers were collected and showed the initial conclusions of the survey. Through the questionnaires, and also through the use of variables that show characteristics of internal control, we conclude that there are points that need improvement in various internal control activities. The main conclusion of the research is that there are ways for internal audits to help Greek health care facilities, and there should be a strong emphasis on the control environment and also on corporate governance.

3. Information Technology as a Factor of Effectiveness

Information technology has proven itself as an important tool for audits and in particular for internal audits. Numerous applications, pieces of software and programs help organizations and auditors facilitate information processing. Some of these applications are widely used worldwide (Alteryx. Inc, Microsoft Power BI, Spreadsheet Auditor, e.g., Falcony, Microsoft, etc.). Furthermore, there are Computer-Aided Auditing Techniques (CAATs) that enhance productivity and optimize the functions of internal auditing. These tools can provide support at every phase of the internal audit process [19].

The organization’s management enables internal audit to make use of modern software technologies and experts’ expertise to achieve higher quality standards. In Alkebsi and Aziz’s [20] research, a correlation between the importance of technology use and internal audit performance was found; in addition, a positive correlation was identified between management support and the effectiveness of internal audits. However, it was also observed that the adoption of new technologies in internal audits remains at a relatively low level [21]. However, in today’s business environment, where technologies are a driving factor, organizations increasingly require auditors with proficient IT skills [5]. Previous studies have shown that IT technology enhances departmental efficiency within organizations and also provides a positive side effect by empowering the organization to utilize it effectively [22].

Technology plays a vital role in ensuring the accurate recalculation and verification of information in financial statements [19]. Organizations that utilize technology effectively can achieve a strategic advantage. The effectiveness of internal controls is influenced by the quality of the technological innovations employed [16]. Additionally, technology encompasses electronic data processing, which impacts both business performance and management practices [8].

Nevertheless, it is essential for both management and internal audit teams to thoroughly evaluate the type of technology they plan to integrate into their workflows. This includes conducting a cost–benefit analysis and performing a security audit before adopting any new technology [20]. Information technology should be tailored to meet the specific quality requirements of each scenario, considering factors such as the country, audit complexity, and data volume. Using technology that falls below the required standards can negatively impact the organization, leading to issues such as an inability to identify errors and inconsistencies, delayed response times, or inaccurate conclusions. Such shortcomings can significantly increase risks and potentially harm the organization as a whole.

Modern information technology represents a significant financial investment for organizations, requiring careful evaluation to ensure its value. Public organizations, in particular, often need IT systems to comply with international standards, laws, and regulatory frameworks, such as the Sarbanes–Oxley (SOX) Act. Enacted in 2002, SOX establishes practices for financial record-keeping and reporting, applying to both public companies and, in certain provisions, private companies. The Act, named after Senator Paul Sarbanes and Representative Michael Oxley, emphasizes accountability, with stricter penalties for fraudulent activities and enhanced independence of external auditors. The COVID-19 pandemic greatly hastened the use of remote work technologies in auditing, emphasizing the importance of secure online solutions such as cloud platforms and collaborative tools.

During the pandemic, the software company “Blackline Systems” offered audit and accounting solutions. Additionally, in December 2021, the company hosted a webinar to gather insights on the adoption of enhanced controls during COVID-19. Among the participants, 50% reported prior experience with at least one modern IT control system, 32% lacked familiarity with such systems, and 18% had no experience with any control system or related procedures [23].

Automation and IT applications have proven effective in reducing risks associated with manual processes, enhancing transparency, and improving internal controls [24]. Key examples include digitizing and centralizing data, which minimizes human error and fraud risks. Technologies such as big data and artificial intelligence are now fundamental, enabling organizations to handle vast information volumes, streamline audits, and generate reports efficiently. Despite these benefits, adopting such technologies involves significant costs, necessitating cost–benefit analyses and strong internal controls to ensure successful implementation.

By leveraging advanced analytics and integrating systems, organizations can eliminate manual tasks, enhance data accuracy, and achieve better internal control [25]. Ultimately, investments in IT and digital transformation promise improved organizational efficiency and governance.

4. Results

EU member states have methods based on common objectives and standards. However, in states such as Italy and Slovakia, it appears that standards are adopted by the private sector, but the same level of coordination and control is not found in the public sector [11]. Furthermore, in France, internal audits are performed by the central government, which aims to control all procedures, such as the budget, and is responsible for achieving the transparency and credibility of its public administration [11]. In Belgium, the process defined by the Supreme Audit Institution and the Inspectorate of Finance is applied. There is also an exceptional degree of specialization. The audit regards not only the financial statements but also performance results regarding whether the public sector and its organizations met their commitments [13].

Austria is a federal state and exercises internal control at three levels: federal, state and local [26]. In Greece, the objectives are to improve performance and protect against irrational management. This is perhaps easier in Greece than in the US, as coordination is carried out at the central government level [26,27]. Austria emphasizes not only performance, but also gender equality, transparency and fairness. Three methods are commonly used in Austria: cost–benefit analysis, the evaluation of reports in relation to the implementation of legislation and the audit of balance sheets [12]. As an EU member state, according to Kyriakidou and Vazakidis [27], Polychronidou et al. [28], Chytis et al. [26], Chalevas et al. [29] and Spanos and Liapis [30], evaluation is performance-focused. This performance refers to both the organization in general (consolidation) and the human resources. However, it also protects the organization from problems through internal control and the citizen from problems that may arise within the organization.

Similar conclusions were also drawn for the US [7,9,10,11]. In particular, American organizations’ goals for internal audits are to combat fraud, improve expertise, and improve performance and service to citizens [7,9,10,11].

Finally, in the UK, it is found that there are commonalities with the EU. For example, as in Austria, the UK has a long experience and tradition of internal audits, and hence experience and expertise in the field [12,14,15,31]. The role of coordinating internal audits is performed by the Financial Reporting Advisory Board and the UK Corporate Governance Code. The audit system is a mixture of audits performed by statutory auditors and internal reporting. The objectives of internal audits are to assess the performance of human resources and the organization, as well as to coordinate the dynamic process of public sector development and its reforms [14,15,16,31,32].

5. Conclusions

Audits should be carried out by independent authorities in order to be valid, reliable and accurate. Through this, security and transparency are promoted, which enables public administration to exercise suitable levels of control. In Greece, most important changes were enacted after the fiscal crisis of 2009. During that period, the Greek government undertook a series of reforms and measures necessary to restructure major issues of the public sector. Furthermore, through new legislation in 2021, Greece improved the framework of public internal control and strengthened the evaluation systems of the public sector. However, in Greece, in many cases, internal audit result evaluations are carried out by the supervisors of each department, while the audit is performed by certified internal auditors. There is evidence that evaluation and audit results are not correlated or used with the purpose of synergy, as found in the cases of Austria and the UK. In the latter, results are combined, allowing a more comprehensive assessment of the public sector, its administration and performance quality. The prospect of a mixed-method audit approach in Greece has interesting scope for future research.