{'fraction_non_alphanumeric': 0.022072818812549886, 'fraction_numerical': 0.011266654386934364, 'mean_word_length': 5.442840189873418, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Using Triangulation to View Internal Audit’s Governance Functioning

Internal audit departments of organisations are regarded as an integral component of the combined assurance model alongside the audit committee, management and the external auditors. The primary users of the work of internal audit are the audit committee, senior management, other levels of management and to some extent, the external auditors. This wide audience served by internal audit reinforces the importance of IAFs’ work, which deals with important aspects facing the entity. Internal audit is therefore able to reduce the lack of information availability for the audit committee on matters concerning risk management, internal control and governance. However, a study conducted on audit committee effectiveness, it was found that 40% of audit committees in national government departments in South Africa are not fully effective and are failing to contribute towards improving internal control, risk management, governance and financial reporting practices. Audit committees’ effectiveness in contributing to risk management, internal control and governance was measured at 63%, 76% and 62% respectively, in a comprehensive study on audit committees in the South African public sector. This indicates that their oversight in these areas, especially risk management and governance, is not yet effective. These findings are concerning given that audit committees have a legal mandate to assist government departments in these areas. Internal audit functions are key in assisting audit committees in their governance oversight responsibility. The present study reports on the extent to which internal audit in the eight metropolitan municipalities in South Africa assists audit committees in their governance oversight responsibility, focusing on the scope of work of internal audit with reference to its governance mandate. A data transformation triangulation design was followed to describe internal audit’s functioning.


INTRODUCTION
More than ever before, internal audit departments around the world are faced with the challenge of assisting key stakeholders such as the audit committee and senior management in discharging their responsibilities. Organisations face many risk, governance and control-related challenges and having proper functions in place to assist in managing these challenges is integral to the success of organisations.
Internal auditors are entrusted with providing stakeholders with independent objective assurance and consulting expertise on internal control, risk management and governance processes with the overall aim of assisting organisations to achieve their objectives (Sarens, Christopher & Zaman, 2013:308).
Internal audit departments of organisations are regarded as an integral component of the combined assurance model alongside the audit committee, management and the external auditors. The primary users of the work of internal audit are the audit committee, senior management, other levels of management and to some extent, the external auditors (International Federation of Accountants, 2013). This wide audience served by internal audit reinforces the importance of IAFs' work, which deals with important aspects facing the entity.
Internationally, legislation such as the Foreign Corrupt Practices Act and the Sarbanes-Oxley Act contributed to increased responsibility placed on boards and audit committees. This is also evident in South Africa with reference to the King Code of Governance (hereafter King III). Audit committees are tasked with reporting back to the board of directors on the state of internal control (especially as it relates to internal financial control), risk management and governance processes (Ferreira, 2007:3).
Internal auditors are greatly involved in these areas of internal control, risk management and governance and are thus in a prime position to serve as 'informants' to audit committees as these cannot be present on a day-to-day basis. Through a sound working relationship, internal audit assists audit committees in achieving their internal control, risk management and governance responsibilities (Goepfert, Soileau & Sumners, 2013:71).
Internal audit is therefore able to reduce the lack of information availability for the audit committee on matters concerning risk management, internal control and governance.
However, according to a study conducted by van der Nest (2006:v,232), it was found that 40% of audit committees in national government departments in South Africa are not fully effective and are failing to contribute towards improving internal control, risk management, governance and financial reporting practices. Moreover, van der Nest (2008:182,184) found that audit committees' effectiveness in contributing to risk management, internal control and governance was measured at 63%, 76% and 62% respectively, indicating that their oversight in these areas, especially risk management and governance, is not yet effective. These findings are concerning given that audit committees have a legal mandate to assist government departments in these areas (MFMA, 2003:s166). South Africa's peak audit institution, the Auditor-General South Africa, has specifically stated that internal audit departments do not adequately evaluate internal control and as a result, they fail to effectively communicate with audit committees on matters such as accounting, risk management and loss control (Auditor-General South Africa, 2011:32;Auditor-General South Africa, 2012:86;Auditor-General South Africa, 2013:31, 35, 75, 103). The Auditor-General South Africa (2012:87) deduced that audit committees are not yet effective in local government to a large extent due to the lack of interaction / information flow from internal audit to executive councils and mayors.
It is therefore important that internal audit's work on internal control, risk management and governance be relevant to the extent it assist the users of internal audit services in their oversight responsibility.
The present study reports on the extent to which internal audit in the eight metropolitan municipalities in South Africa assists audit committees in their governance oversight responsibility, focusing on the scope of work of internal audit with reference to its governance mandate. Note that due to the broad nature of internal audit work, it is not possible to cover all areas of internal control, risk management and governance; this study thus reports only on the governance aspect of internal audit functioning and the extent to which IAFs assist audit committees in this regard. Follow up articles will address internal control and risk management.
In the next section, the research methodology is explained, followed by a literature review on internal audit's governance functioning. The results are then discussed and the conclusion is presented.

RESEARCH DESIGN AND METHODOLOGY
This section contains an overview of the research design, the sampling strategy, questionnaire design, data analysis and presentation as well as methodological considerations such as trustworthiness.

Overview of the research design
In order to report on the extent to which internal audit's governance mandate assists audit committees in their governance oversight responsibility, a mixed method approach was followed, and specifically, a data transformation triangulation design was adopted. This is shown in Figure 1 below.

Figure 1: Data transformation triangulation design
Source: Creswell,n.d:63 In this regard, after the literature review, a questionnaire was compiled for audit committee members in metropolitan municipalities in South Africa (QUAN data collection and analysis). The annual reports for all eight metropolitan municipalities were also obtained from their respective websites and loaded onto Atlas.ti for qualitative content analysis, which was then used to create frequency counts (QUAL data analysis and TRANSFORMATION to quan data). The data sets from the questionnaires and the annual reports were then used for comparative and validative purposes, which contributed to the rigour of the study and a better understanding of internal audit governance functioning.

Sampling strategy
In order to conduct the research, eight information-rich (Patton, 1990) municipalities were selected in South Africa. Patton (1990) explains that information-rich participants can provide informative information for other participants not included in the sample.
In this regard, certain criteria must be established, or alternatively, existing criteria can be used, which separates the sample from the rest of the population. In order to select information-rich municipalities in South Africa, the following criteria out of the Municipal Structures Act was used. The municipality must be: a) a conurbation featuringi. areas of high population density; ii. an intense movement of people, goods and services; iii. extensive development; and iv. multiple business districts and industrial areas; b) a centre of economic activity with a complex and diverse economy; c) a single area for which integrated development planning is desirable; and d) have strong interdependent social and economic linkages between its constituent units.
In South Africa, only eight municipalities meet this criteria. These are the eight metropolitan municipalities, as opposed to the smaller local and district municipalities.

Questionnaire design, data analysis and presentation
The literature review was used to create an online questionnaire based on internal audit's functioning with reference to its governance mandate. This was sent to each audit committee chairperson in metropolitan municipalities in South Africa. For each area, audit committees needed to state the extent to which the specific areas of internal audit assist them (the audit committees) in their governance oversight responsibility. Audit committees had a choice of selecting between 'to a large extent', 'to a lesser extent' and 'not at all'. The data from the questionnaires was captured in IBM SPSS which was used to create frequency tables indicating the responses.
For the analysis of the annual reports, a basic coding frame was developed in order to extract information out of the reports indicating the type of governance work performed by internal audit. This is presented in Table 1 below. After the annual reports were coded with the code 'governance mandate', Atlas.ti was used to create a qualitative text matrix across the eight metropolitan municipalities to show the areas of governance involvement. Apart from the qualitative matrix, the amount of times reference was made to internal audit's governance mandate was quantified and then triangulated with the audit committee questionnaire responses. This is presented in the tables in section 4.3.

Methodological norms
In order to ensure the trustworthiness of the study, a full audit trail was kept in Atlas.ti for the analysis of the annual reports. The questionnaire items were subjected to a Cronbach alpha which resulted in an internal consistency score of 0.868.

LITERATURE REVIEW OF INTERNAL AUDIT'S GOVERNANCE FUNCTIONING
The Standards provide a mandatory framework for what the practice of internal auditing should be (IIARF, 2005:41). The core of the work can be found in Standard 2100, Nature of Work, which defines the functioning (the purpose for which it is employed) of internal audit.
The core functions of evaluating control, risk management and governance processes can also be found in the definition of internal auditing, which is also mandatory guidance for internal audit practitioners.
These functional areas of internal control, risk management and governance -and the fact that these are regarded as the core work areas of internal audit -have been acknowledged by various authors, showing evidence of internal audit's involvement in these areas (as cited by Ramamoorti & Weidenmier, 2004:315;Burnaby, Hass & Abdolmohammadi;2006:854;Jones, 2013:10).
Standard 2100 Nature of Work defines the functional areas of internal audit, namely, Standard 2110 (governance), 2120 (risk management) and 2130 (control). Figure 2 below shows this relationship. control and risk management. The Standards in Figure 1 provide more detail of what is expected of internal audit with reference to governance, internal control and risk management. This article focuses on the governance aspect of internal audit functioning.

Governance as a functional area of internal audit -Standard 2110
Numerous governance codes introduced worldwide resulted in entities being more accountable for their actions and seeking independent assurance on whether their governance processes are working. Hence, governance aspects became a top priority for internal auditors (Coetzee et al., 2012b:11). Governance codes and legislation such as that introduced by the Treadway Committee, Cadbury Committee, Basel II,

Institute of Directors (SA) and the Organisation for Economic Co-operation and
Developments' Principles of Governance, all contributed to the increased role of internal audit in governance processes (Coetzee et al., 2012b:7-9).
Mandatory guidance for internal audit on its role in governance can be found in Standard 2110. The Standard states that for internal audit to accomplish its governance responsibility, it must assess and make recommendations on entities' governance processes (also cited by Abdolmohammadi, 2013:70). This can be achieved by: • Promoting ethics and values within the organiz[s]ation; • Assessing the state of the organiz[s]ation's ethical climate and the effectiveness of its strategies, tactics, communications and other processes in achieving the desired level of legal and ethical compliance; • Providing consulting services to help the organiz[s]ation establish a robust ethics program[me] and improve its effectiveness to the desired performance level; • Serving as a subject matter expert on ethics-related issues and as a member of the organiz[s]ation's ethics council; • Acting as a catalyst for change, promoting and recommending enhancements for the organiz[s]ation's governance structure and practices; • Contributing to effective organiz[s]ational performance management and accountability; • Communicating risk and control information to the appropriate areas of the organiz[s]ation; and • Coordinating the activities of, and communicating information between the board, external and internal auditors and management.
Over and above its governance mandate, internal audit must evaluate the design, implementation and effectiveness of organisations' ethics-related objectives, programmes and activities (Parillo, 2013:33). Lastly, information technology governance and how it supports organisational strategies and objectives must also be assessed by internal audit.
Information technology governance is pivotal for organisations' survival in an everchanging competitive environment.

Other guidance on governance
Practice Advisory 2110-1 indicates that the scope of governance is broad and that each entity must apply those principles of good governance which are best suited to its environment. It is therefore important that the Chief Audit Executive (CAE) work with senior executives to determine how governance should be defined for audit purposes. Practice Advisory 2110-2 further states that a relationship exists between risk and control and that during audit planning the CAE must: • Ensure that the audit addresses those controls in governance processes that are designed to prevent and detect events that could have a negative effect on the entity's strategy, goals and objectives; • When defining the scope of the governance audit, consider the controls which manage multiple risks across the entity as this could be informative for other audits; and • Consider relying on results of other audits which assessed controls in governance processes which could be of value for the current audit.
Practice Advisory 2110-3 provides very specific guidance on the assessment of governance processes. It is important for the CAE to include in the audit plan high risk governance processes which were highlighted in the risk assessment and to include any other requests from senior executives regarding governance assessments (IIA, 2012). In cases where governance processes are not matured, the CAE should consider a consulting engagement rather than a formal assessment of governance processes (IIA, 2012). Overall, it is important for internal audit to consider using the results from other engagements in the governance audit as these could provide valuable insights. These results could include findings from other internal or external assurance providers and consideration should be given to any other adverse incidents which could prove useful for the current governance audit. Due to the nature of governance audits, the auditor should consider discussing results with management or even legal counsel before the start of the governance audit and before issuing the results .

RESULTS
The following sections present the results. First, the analysis of the annual reports is presented, followed by the responses from the questionnaires, after which the two data sets are triangulated.

Analysis of annual reports
Governance is one of three core functional areas defined in Standard 2100 of the International Standards for the Professional Practice of Internal Auditing. It follows then, that if internal audit wishes to add value, it must provide governance-related consulting and assurance services to the metropolitan municipality. After the analysis of the annual reports of the municipalities, the following was evident, as it relates to internal audit's governance mandate (shown in Table 2 below):

Analysis of questionnaire responses
The Standards require internal audit to assess and make recommendations on municipalities' governance processes and provide extensive mandatory guidance on what internal audit should do to accomplish its governance responsibility. Fulfilling its responsibility thus enables internal audit to provide the audit committee with assurance on key governance-related matters. Audit committees must be in a position to advise municipal council, the accounting officer and other management on effective governance (MFMA, 2003:s166(2)(a)(vi)) -the role of internal audit is therefore crucial in assisting audit committees in this regard. A summary of responses is presented in Tables 3 to 10 and related discussions below.

Audit committee views on internal audit's ethics-related functions
The objective of this section is to describe the extent to which audit committees find internal audit's work on ethics-related processes useful in assisting them in their governance oversight responsibility. ethics-related governance functioning and the extent to which this assists audit committees in their governance oversight responsibility. Most of the audit committees in municipalities (75%) indicated that internal audit's assessment of the ethical climate of the municipality assisted them in their governance oversight responsibility. This could entail internal audit evaluating the prevailing culture at senior managerial level, which could be valuable to audit committees in their oversight capacity.
Internal audit acting in an advisory capacity on ethics-related issues is perceived as assisting audit committees less in their oversight capacity relating to effective governance. All audit committees (100%) shared this opinion. This could be attributed to the fact that internal audit acting in an advisory or consulting capacity is perceived as being less objective and that audit committees prefer a more assurance-based approach from internal audit. This is thus an area where internal audit can spend less resources and focus instead on areas which audit committees perceive as being more useful.
Seventy-five percent of audit committees in the municipalities agreed that internal audit's evaluation of the design, implementation and effectiveness of ethics-related objectives and programmes assisted them in their governance oversight responsibility.
The Standards require internal auditors to assist municipalities in establishing a robust ethics programme. However, half of audit committees in municipalities indicated that this did not particularly assist them in their governance oversight responsibility. This could be due to the fact that audit committees are more concerned with establishing whether the ethics-related programmes are working as opposed to internal audit's involvement in instituting such programmes.

Audit committee views on internal audit's governance assessments
The objective of this section is to summarise audit committee views on IAFs' assessments of governance processes and the extent to which these assist audit committees in their governance oversight responsibility. Table 4 below presents the results. Division of Revenue Act and any other applicable legislation. It could therefore be expected that considerable reliance would be placed on the assistance provided by internal audit in this regard, and particularly its work in compliance auditing. However, half of audit committees in municipalities indicated that this work area of internal audit did not assist them in their oversight capacity.
Audit committees in metropolitan municipalities find internal audit's communications on risk and control information very useful in assisting them in their governance oversight responsibility (87.50%). This is to be expected, as audit committees are legally responsible to act in an advisory capacity in areas of internal control, risk management and effective governance (MFMA, 2003:s166). Internal audit thus plays a crucial role in this regard to audit committees.
As part of the internal audit report, recommendations must be given. Audit committees in municipalities (75%) find recommendations after a governance audit useful in assisting them in their oversight responsibility. This forms the foundation for audit committees to adhere to their legal mandate with reference to section 166 which states that they must advise municipal council, the accounting officer and other management staff on effective governance within the municipality.
Section 166 of the MFMA states that audit committees must act in an advisory capacity on risk management and effective governance for a specific municipality. Internal audit can assist audit committees in this regard by performing assessments of high risk governance processes. Audit committees in metros (75%) indicated that they did find such assessments useful in assisting them with risk management and governance oversight. Internal audit can thus continue focusing on high risk items which are important for audit committees.
Seventy-five percent of audit committees indicated that internal audit's assessments of weak controls in governance processes assisted them in their governance oversight responsibility. In this regard, IAFs assist audit committees in complying with their legal requirement to provide advice on internal control (MFMA, 2003:s166).
Again, it is clear that internal audit greatly assists audit committees (75%) in their governance oversight as it relates to performance management accountability.
Section 166 makes stipulates that audit committees must advise on performance management and the MFMA and MSA make it a legal requirement for internal audit to assess the performance management system of a municipality.
The Standards require internal audit to evaluate information technology controls in support of governance objectives. Fewer audit committees in municipalities (62.50%) considered this to be an area where internal audit assisted them in their governance oversight responsibility.

Audit committee views on IAFs' meetings on governance processes
The objective of this section is to summarise audit committee views on IAFs' meetings on governance processes and the extent to which these assist audit committees in their governance oversight responsibility. Table 5 below summarises the results.

Total responses
Internal audit meetings with the audit committee in order to define governance processes within the municipality --2 25.00% 6 75.00% 8 Internal audit meetings with the audit committee in order to define the scope of a governance audit --3 37.50% 5 62.50% 8 Internal audit meetings with management to discuss audit findings before release to the audit committee --2 25.00% 6 75.00% 8 Internal audit meetings with the legal department in order to define the scope of a governance audit 2 25.00% 3 37.50% 3 37.50% 8 Internal audit meetings with the legal department to discuss audit findings before release to the audit committee 1 12.50% 3 37.50% 4 50.00% 8

Source: Calculated from IBM SPSS
One of the means of increasing audit committee and internal audit interaction is through regular meetings. The majority of audit committees in municipalities (75%) found it useful to meet with internal audit to define governance processes. In this manner, internal audit can align itself with audit committee expectations when it comes to governance processes, thereby placing itself in a better position to satisfy audit committees in this regard. Audit committees have a legal mandate to report back on the effectiveness of governance processes within the municipality and having regular meetings with internal audit can align audit committee responsibility with legal requirements as internal audit will perform the work and give feedback to the audit committee.
Audit committees find it useful to meet with internal audit. However, it is not always feasible to meet beforehand for every governance audit to define the scope of the audit. This is evident from the findings as smaller amount of audit committee members (62.5%) indicated that they did not meet for the purpose of defining the scope of the governance audit. Once internal audit and the audit committee define their understanding of governance processes, the CAEs are responsible for defining the extent and nature of testing, which could be the reason for the audit committee response.
It is best practice for internal audit to discuss draft internal audit findings with the management concerned for the area under audit. This is important to clarify any issues. Such discussions are of value to audit committees in municipalities (75%) because they use internal audit findings in their decision-making. Knowing that the draft findings were discussed with management places more reliance and credibility on the work.
Half of audit committees indicated that internal audit meetings with the legal department to discuss results before release failed to assist them in their governance oversight responsibility. This could be due to the fact that not many internal audit engagements require results to be discussed with the legal department.
Again, discussion with the legal department to define the scope of governance audits serves little purpose in assisting audit committees (62.50%) in discharging their governance oversight responsibility.

Audit committee views on IAFs' knowledge of other audits
This section discusses whether audit committees finds IAFs' knowledge from other audits useful in defining the scope of governance audits and whether this assists audit committees in their governance oversight responsibility. Table 6 below summarises audit committee views. assisting them with their governance oversight responsibility. This could be due to the fact that internal audit knows which other areas in the entity impact on important governance processes, which in turn, means that governance audits will be geared towards higher risk areas.

Audit committee views on IAFs' attempts to increase the governance maturity of the municipality
This section discusses whether internal audit's work on the governance maturity levels of the municipality assist audit committees in their governance oversight responsibility. Table 7 below summarises audit committee views. governance maturity are an area which greatly assists them in their governance oversight responsibilities. This is due to the fact that the higher the governance maturity levels of the municipality, the more effective the governance controls are deemed to be, which provides assurance to the audit committee about governance processes.

Audit committee views on IAFs' coordination activities
The objective of this section is to determine whether internal audit coordination activities assist the audit committee in their governance oversight responsibility. Table   8 below summarises audit committee views. present. In addition, simply because coordination takes place, does not mean that a flow of important governance information has also taken place.

Audit committee views on the IAFs' change agent role
This section determines whether audit committees find internal audit's change agent role in the governance structures of the municipality useful in assisting them in their governance oversight responsibility. Table 9 below summarises audit committee views.

Points of triangulation
For internal audit's governance work areas, the total amount of work as per the annual reports was totalled (total actual work per work area (all municipalities)). This amount for each work area was divided by the theoretical work that should be done by internal audit. During the literature review, the study defined 21 governance areas. This amount was multiplied by eight (all the municipalities) to arrive at the totals (theoretical work per literature review (all municipalities)). The percentage of work done was calculated by dividing the actual work per annual report with the theoretical work. The frequency counts were thus further transformed into quantitative data. Based on annual report data, the perception given is that internal audit only performs 8% of possible governance work. This paints a negative picture for the reader of annual reports and is not a true reflection of the work performed by internal audit. This can be seen in Table 10 below.

Source: Own calculation
It is clear from Table 10 that the perceived work of internal audit regarding its governance mandate is negligible in annual reports and if this is indeed the true extent of work, audit committees and other management will be uninformed on important governance aspects facing the municipality.
In order to obtain a clearer picture on the above results, the annual report analysis was compared with the audit committee questionnaire responses. The audit committee responses on the areas of governance were totalled for areas where audit committees indicated both "to a large extent" and "to a lesser extent". The fact that audit committees selected "to a lesser extent" does not mean internal audit did not perform the work, hence its inclusion in the total. Table 11 below shows the results. which it assists audit committees in their governance oversight is much greater than depicted in annual reports. This could be due to the fact that no legal obligation exists for internal audit to report in annual reports. This therefore provides a golden opportunity for increased internal audit disclosure. Audit committees in metropolitan municipalities indicated that internal audit does 95% of governance work (vs 8% in annual reports). The fact that internal audit does more also stems from the responses of participating CAEs which indicate that IAFs are crucial informants to the audit committee on governance.

Conclusions
Internal audit plays a crucial role in the combined assurance model. This study explored IAFs' role in governance holistically through content analysis of annual reports and by asking audit committees to indicate the extent to which IAFs assist them in their governance oversight. To further understand IAFs' governance functioning, the questionnaire data and content analysis were triangulated, showing that in the public eye, IAFs appear to be doing much less than they actually do. There is thus a golden opportunity for the Institute of Internal Auditors to establish global guidelines regarding the disclosure of IAFs' work in public reports.
The study also indicated the governance areas that key stakeholders such as audit committees find useful in assisting them in their oversight responsibility. This can be used by other IAFs to realign their internal audit plans with the key areas of importance for audit committees and other management.