Risk-based internal audit practices in a retail organisation

Abstract

Purpose: This study aims to understand how risk-based internal audit (RBIA) is utilised and implemented at a large retail business in Cape Town, South Africa and how it is used for audit planning purposes. Design/methodology/approach: Case study research was used to better understand the practice of RBIA. Semi-structured interviews were conducted with internal auditors, managers, and the chief audit executive (CAE) of the business. Interview transcripts were inductively coded to identify overarching themes. Findings: It was found that RBIA is used to some extent, however, there seems to be a lack of evaluation of organisational risk maturity before RBIA plans are prepared, which could limit the effectiveness of internal audit activities. The study does not imply that results will be generalisable to all South African retail businesses or other industries. However, the study serves as an exploration into the topic for consideration by other researchers as well as for the improvement of RBIA in practice. Originality/contribution: Since the retail sector plays a critical role in the South African economy, this research sought to contribute to the existing body of knowledge regarding RBIA of retail businesses. Unique access to understanding the real workings of an internal audit function (IAF) was obtained. The collected data could help practitioners improve their audit approach for increased audit effectiveness. Internal auditors could better understand their contribution to the business and help retailers see the benefit of an IAF.