The Effectiveness of Enterprise Risk Management and Internal Audit Function on Quality of Financial Reporting in Universities

This study examined the impact of enterprise risk management (ERM) and internal audit function (IAF) on the financial reporting quality (FRQ) of state universities in Zimbabwe. Utilizing a dataset of 250 respondents from across nine (9) state universities, the researchers examined the effectiveness of ERM and the IAF on the quality of financial reporting in state universities. The researchers employed the contingency theory and studied each university separately to report on items that are specific to each and then also establish a commonality in the definition of parameters to be used in setting up the benchmark against which future performance may be measured. The findings were that there is a strong and significant relationship between ERM and the FRQ and also that there is a positive relationship between the internal audit function and FRQ. Quality internal audit results improved corporate governance systems. The results also underscore the significance and need for central government to establish and monitor a system of good ERM processes that minimize corporate governance breaches and enhance integrity and independence in financial reporting in state universities.


Introduction
The propagation of crises and scandals in recent years in Zimbabwean state enterprises has demonstrated the failure of the current governance systems. "These crises have prompted regulators to provide financial security laws and codes of conduct in the form of the Public Finance Management Act Chapter 22:19, Code of Corporate Governance for Parastatals and State Enterprises, and the Procurement Act, Chapter 2:14" (Smith and Adhikari, 2005:34). These laws give much importance to the concept of mandatory disclosure of financial information by these state run organizations and give, at a minimum, what may be considered as good business conduct. What is still interesting is the fact that none of these state run enterprises has shown an affinity to voluntarily disclose the results of their operations over and above the stipulations or mandatory minimums. Indeed, with globalization the role of voluntary disclosure is increasingly being debated at an international level (Smith, and Adhikari, 2005). Disclosure is situation specific and its measurement is with reference to an assessment of compliance to a set standard giving rise to a disclosure index. Disclosure however remains a theoretical concept that is difficult to measure directly (Marston and Shrives, 1991). The focus of this research was, however not on what is or what is not disclosed but rather on the quality of what is disclosed. It thus puts emphasis on the usefulness and true representativeness of the resultant financial reporting. While some prior studies (Hoyt and Liebenberg, 2011;Richardson, 2006b;Prawitt, 2009;Mayer et al. 2009) have focused on the effect of Enterprise Risk Management (ERM) on firm performance and value, they have not explicitly addressed the relationship between ERM and the quality of the financial reporting process. A strong financial reporting process includes diligence by preparing and monitoring parties such as the audit committee and auditors in providing accurate and transparent financial reports and associated disclosures.
On the other hand, the audit process and audit quality have a significant impact on the quality of financial reports (Knechel et al. 2013). A few prior studies (e.g. Kochetova and Net, 2011;McVay, 2006;Jones et al.2003;Jonas and Blanchet, 2002;Erickson, 2006) have examined the effect of strategic analysis and strategic risk (components of ERM) on auditor judgments, but these studies have not considered the effect of ERM on the audit process and audit judgments from a broader, more holistic contingent perspective. The strength of ERM impacts the company's monitoring of controls over major business risks, which is important for auditors to consider in audit planning (Bell et al. 2002;D'Aquila, 1998;Institute of Internal Auditors (IIA), 2005). Further, although audit committees and Chief Finance Officers (CFOs) are increasingly required to play a critical role with respect to ERM (Mikes, 2009), there has been no research that examines how either audit committees or (Chief Finance Officers) CFOs view the role of ERM in ensuring a high quality financial reporting framework. The importance of this study is therefore to establish the contribution of enterprise risk management and internal audit function towards the quality of financial reporting in universities in a developing country.

Literature Review
Different authors define financial reporting quality in different ways. Asare et al (2008) define quality as '…a hierarchy of accounting qualities, with relevance and reliability considered the primary ones. In addition, the statement has a set of criteria, such as representational faithfulness, verifiability, neutrality, predictive value, feedback, comparability, consistency, and timeliness". One is then compelled to probably conclude that overall financial reporting quality is thus assessed on the basis of how well the reporting entity has covered each of the criteria given above. The Jenkins Committee (1994) did not refer to the "quality of financial reporting" but rather the "quality of reported earnings." Its definition is not very instructive, and it appears that quality is related to both the ability to predict and the relevance of the information. In identifying quality, the Jenkins Committee used several concepts that emphasize users' needs, such as understanding the nature of a company's businesses and performance, changes affecting the company, management's perspective, and others. Larcker et al. (2004), consider accounting quality as a factor useful in coming up with an industrial bond issue rating and not as an end in itself. They affirm that firms that consistently make timely and informative disclosures are considered less likely to withhold relevant unfavourable information. Although one should expect that "better" corporate governance leads to improved financial reporting, there is a lack of consensus as to what constitutes "financial reporting quality. Jonas and Blanchet (2002, 353) state, "in light of Sarbanes-Oxley Act (2002) new requirements, auditors, audit committee members, and management are now struggling to define "quality of financial reporting." Cohen et al. (2008) assert that rather than define "quality of financial reporting," it was more important to analyze factors such as earnings management, financial restatements, and fraud that clearly inhibit the attainment of high quality financial reports. One would then be expected to infer financial reporting quality by reference to the presence of these factors as evidence of a breakdown in the financial reporting process. Also one has to examine the role of the various players in the governance mosaic, as discussed below and the extent to which these players either individually or collectively influence the attainment of financial reports that are free from material misstatements and misrepresentations. This synergistic interplay is what regulates financial reporting quality and is the main focus of this study.

Good Corporate Governance:
The corporate governance mosaic impacts the quality of financial reporting (e.g., transparency, objectivity) and, in the extreme, earnings manipulation and outright fraud. The governance mosaic includes those stakeholders inside and outside the firm. Unfortunately, prior research and the accounting profession have concentrated their focus primarily on the board of directors and the audit committee. This has given the impression that these two are the only or most important players in the governance mosaic. This is not so. For instance, the external auditor plays a significant role in monitoring financial reporting quality and hence can be viewed as an important participant in the governance process. All other players work synergistically in the corporate governance mosaic and deserve equal air play as the audit committee and the board of directors. Examples of such other actors include, but are not limited to, regulators, legislators, financial analysts, stock exchanges, courts and the legal system, and the shareholders. More so, current debate has failed to talk to the interplay between the stakeholders. These interactions such as those among the audit committee, the external auditor, the internal auditor, the board, and the management are crucial to effective governance and to achieving high quality financial reporting (Sarbanes-Oxley Act 2002). This interplay is also affected by outside forces such as by regulators and stock exchanges as well as by pressure to meet the stringent expectations of financial analysts. Thus external players often shape and influence the interactions among the members of the mosaic who are more directly involved in the governance of the organisation.
Also pathetic to research on corporate governance is the manner in which the governance debate has been unfairly looked at. Corporate governance plays a much more important role within an organisation. Larcker et al. (2004, 1) also debate this lack of deeper research by saying that current research has not been able to explain managerial behaviour and how this impacts organizational performance. Cohen et al. (2002) conducted an interview study with experienced auditors and revealed that management has a significant influence over these parties. Some of the auditors in that study argue that if management does not want to be "governed", they can't be (Cohen et al. 2002:582). Moreover, management is fraudulently capable of placing passive, compliant members on the board who may satisfy regulatory requirements but are reluctant to challenge their appointers, the management.

Theoretical Framework:
The study adopted the Social learning theory. This theory suggests that setting the tone at the top will inspire individuals within the organization to emulate the behaviour of attractive role models like ethical leaders (Bandura, 1977(Bandura, , 1986. Utilizing social learning theory, research suggests that good corporate governance trickles-down from the top level of management, to immediate supervisors, and ultimately to employees. For the financial reporting process, this trickle down impact is important because it means that by setting the tone at the top, ethical leaders can influence the reporting behaviour of not only management but also of those employees making the day-to-day decisions including final accounts preparation like deputies or assistant bursars and accounting assistants.
Hypotheses Development: Developing the discussion further, we investigated how the triad combination of internal audit function quality, ERM and good corporate governance work synergistically to create a control environment that can influence the quality of financial reporting. Since the strength of the internal audit function in ERM and good corporate governance are integral components of internal control, my interest is in examining how these two factors come together and influence an accounting decision which will ultimately affect reporting quality. Accordingly, we put forward the following hypothesis: H1: "In an entity with a strong IAF and a weak ethical leader, accountants will be less willing to make a dubious journal entry than in all other conditions. Specifically, accountants will be less willing to make a questionable entry when there is a strong IAF and a weak ethical leader. H0: In an environment with a weak IAF and a strong ethical leader, accountants will most likely take down instructions without questioning and hence lead to poor financial reporting".
The latter discussion also results in the following sub-hypothesis HSub: An environment with a strong IAF and a strong ethical leader is most likely to produce quality financial reports.

Research Questions:
The following research questions guided data collection through surveys and interviews:  How does the internal audit function in an organisation relate to the risk management practice within that very organisation?  What is the relationship between ERM and good corporate governance?  What is the relationship between ERM, good corporate governance and the internal audit function?  What is the relationship between ERM; GCG; IAF and financial reporting quality?

Methodology
This study utilized a multiple case study design. Case studies are "an exploration of a 'bounded system' of a case or multiple cases over time through detail, in depth data collection involving multiple sources of information rich in context" (Creswell: 2013). In order to gain multiple perspectives in the area of ERM, IAF and CG as they relate to financial reporting quality, this study used the maximum variation sampling strategy (Creswell, 1998). To achieve this, two hundred and fifty (250) accounting professionals or personnel were recruited from the nine (9) state universities in Zimbabwe to participate in the study. The personnel included both executives and non-executives from the nine (9) state universities including one individual from each identified as the risk champion from that particular institution. There were also personnel from the IAF of each institution, an assistant bursar and a deputy bursar from each university, a representative from any such grouping in each university as is mandated to see to the risk management of the university other than the risk champion. The participants were identified with the assistance of a gatekeeper. The research used both a qualitative and quantitative approach to gather, analyze and describe findings.
Primary Data: Primary data was obtained from respondents using interviews and questionnaires administered to personnel in seven (7) of the nine (9) state owned universities in Zimbabwe.
Secondary Data: Secondary data was collected through the review of published financial statements, annual reports, and strategic plan documents of respective state universities. The internet was also widely consulted on current issues and publications on activities. A self-administered, structured questionnaire, interviews and documents were used to collect data. Factor analysis: The characteristics used in the variables of the conceptual framework were tested using factor analysis to establish whether they were good measurements. The extraction method used was the principle component analysis and the rotation method was Varimax with Kaiser Normalization. Items under internal audit function with a correlation of less than 0.4 were excluded from the rotation table (Richardson, 2006b) while under good corporate governance, items with correlation of less than 0.5 were excluded.

Findings
Factor Analysis of the Good Corporate Governance scale: Table 2 below, shows that seven constructs were appropriate for measuring good corporate governance, given, that they explained 72% of the total variance. The construct on clear institutional strategy accounted for 8% of the variance, while effective risk management explained 15% of the variance, discipline explained most of the variance 12%, fairness explained 10% of the variance, social responsibility represented 3%, self-evaluation 13% and transparency explained 11% of the variance. From the findings it is clear that the self-discipline, self-evaluation, effective risk management and transparency constructs are the most important (with Eigen values of 4.409 and 2.176 respectively). On the other side of the scale; social responsibility and institutional strategy as well as fairness were found to be of insignificant importance (with Eigen values of 1.747, 1.589 and 1.466 respectively).
Factor Analysis of the Internal Audit Quality scale: Internal audit quality accounted for 28% of the variance. According to table 2, a four-construct scale proved to be the most appropriate for measuring quality of the internal audit function in accounting for this total variance. The internal audit reporting structure construct accounted for the most variance of 12%. The independence construct explained 8% of the variance, with 5% being explained by the internal audit existence construct. Internal audit composition and capacity accounted for 3% of the variance. From the findings, it has been observed that internal audit reporting structure (with an Eigen value of 3.13) within the university system is the most important construct of internal audit function quality. The independence of the internal audit function is next in importance with an Eigen value of 1.519 whilst the existence construct at 5% and the internal audit team composition and capacity construct at 3% are of lesser importance (Eigen values of 1.186 and 1.026, respectively).   Relationship between good corporate governance and financial reporting quality: This relationship is shown as significantly strong with r=0. 421.This clearly shows that good corporate governance plays a significant role in ensuring that financial reporting process produces quality results.

Relationship between the internal audit function and financial reporting quality:
The results of the correlation matrix in Table 4 above shows that there was a positive significant relationship between the IAF and financial reporting quality (r=0.314, P-value <1%). The positive relationship implies that as the IAF improves the quality of services, financial reporting quality also improves. This clearly indicates that as the internal audit function performs its duty with diligence and independently with an enabling reporting structure, then an institution is more likely to digress from manipulation of transactions and results and thus produce quality financial reports that are free from misstatement and misrepresentation.

Relationship between financial reporting quality and enterprise risk management:
A positive and significant relationship was also found to exist between ERM in aggregate and financial reporting quality (r=0.266, P-value < 1%). Deductively this shows that the stronger the efforts at instituting an enterprise wide risk management process the more likely the university is to quickly curb any anomalies in reporting and the result will be quality financial statements.
Multiple regressions: Regression analysis was performed using stepwise regression method to explain the variability of the relationship between the independent variables of ERM, GCG and IAF and, on the other hand, financial reporting quality as the dependent variable in state universities.  The results in table 6 above, show that there some significant positive relationships between the IAF constructs and GCG indicating that in state universities the internal audit function impacts greatly on the nature and quality of the governance systems. This is clear and consistent with the following findings made by Roth (2002). These are supported by the  Selective application and practice of good corporate governance construct had 3 significant correlations (i.e. against internal audit reporting structure: r=0.233, p-value<1%; 'internal audit independence': r=0.123, p-value<5%; and 'Internal Audit Existence, Composition of Team and Capacity': r=0.111, p-value<5%)  "Some practice of good corporate governance" abstract had 2 significant correlations ((i.e. against "internal audit reporting structure": r=0.108, p-value<0.05; and 'Internal Audit Existence, Composition of Team and Capacity': r=0.110, p-value<0.05)  This positive relationship indicates that it is probable that when the internal audit function improves in quality (and thus adding value to its services), the quality of good corporate governance moves from non-compliance through selective application of best practice to absolute observation and adoption of good corporate governance styles. Deductively this will terminate in the entity's financial reporting quality increasing. The interpretation of this positive influence is that when the institution's management accepts and fully embraces ERM (management buy-in), and when they put in efforts at establishing and supporting the existence of a risk management framework and that this risk management framework allows for the effective running of the risk management process through the intentional and dedicated spread of knowledge on enterprise risk management, this would result in improved financial reporting quality. This implies that the state university's financial reporting quality will improve from 'non-compliance with statute' to 'some compliance with statute'; and ultimately to absolute compliance with statutory dictates'.   Table 7 shows that there was a mixture of both positive and negative significant correlations between ERM x IAF and good corporate governance constructs. Internal audit existence x ERM existence or institutionalization of the internal audit function and enterprise risk management had negative significant correlation with good corporate governance; and IAF x ERM quality had positive significant correlations with good corporate governance.
 The interpretation, as observed, is that when the quality of internal audit is coupled up with quality enterprise risk management the result is most likely to be the continual improvement of good corporate governance practices. With good corporate governance one expects quality financial reporting to prevail.

Discussion
Relationship between the internal audit function and enterprise risk management: IAF was found to have a positive, weak and insignificant relationship with ERM. This implies that the presence or absence of an internal audit function has very little and insignificant influence on the success or failure of the ERM process within an organization. This is consistent with the findings made by Dickinson (2010) who however goes further to assert that IA must maintain a degree of independence within the organization to ensure that "…they are in a position to critically assess the effectiveness of risk management and the adequacy of the control environment". Regardless of whether ERM and internal audit operate as distinct and separate units, or are closely aligned, it is imperative that they leverage off each other, continually developing knowledge of the environments in which they operate. The two must work within the same risk management framework and conduct dialogue to continually question and engage each other's perspective of the nature and severity of the risk profile. It is important that the IAF plays both a monitoring and participative role in ensuring that the risks the organization is exposed to are sufficiently mitigated. IA also checks on compliance to best practice in mitigating identified risks. IA and ERM also play complementing roles in the corporate governance processes of a university. In actual fact, IA is an inherent component or construct of ERM. No effective ERM effort can be implemented without roping in the eagle eye of internal audit. Dickinson (2010) also concludes his findings by saying that there are circumstances where the two functions of internal audit and ERM do not operate effectively. This happens when management dictates to internal audit in order to divert attention away from high risk areas. Resultantly this is why some organizations have enabling reporting structures that allow for IA to operate independently and for reporting channels that allow direct communication to the audit committee.
Relationship between internal audit function and financial reporting quality: According to the findings, there exists a significant positive relationship between internal audit function quality and financial reporting quality. The presence of the IAF in a university brings along the following benefits: improved accuracy of information, confirmed compliance to policy and statutory dictates, avoided cost since using internal audit means no external consultants are hired to do this with the result that the savings are put to improving other facets of financial reporting. IAF existence enhances compliance to laws and regulations to mitigate potential future fines or legal cases. Turner (2001) asserts that internal audit quality and external auditor tenure are important determinants of audit effectiveness and that their combined effect plays a critical role in preventing and detecting fraudulent misstatements. Mitra (2009) found that the shorter an auditor's tenure, the higher the risk of misstatement in the financial reporting process Relationship between internal audit function and good corporate governance: There is some significant positive relationship between IAF and GCG indicating that in state universities the internal audit function impacts greatly on the nature and quality of the governance systems. This is clear and consistent with the findings made by Roth (2002) on the generalized relationship between internal audit and value addition through corporate governance. On the other hand, however, Abbott (2005), found that that the competence and independence of the audit function is negatively associated with the occurrence of fraudulent accounting misstatements. Fairchild (2009) suggest that auditor tenure may have conflicting effects on the detection and /or revelation of management fraudulent behavior.
Relationship between good corporate governance and financial reporting quality: There was a positive and significant relationship found between GCG and financial reporting quality. This is consistent with the findings by Krishnamoorthy et al. (2002), who ascend that if constructs on good corporate governance are adhered to religiously, then the result is absolute compliance with statutory and preset dictates. This is interpreted as quality financial reporting. McDaniel et al. (2002) however found out that it was difficult to agree on what may be called quality financial reporting. Different organizations' assessments of relevance and comparability characteristics of quality were different from one organization to the next. According to the author this dilemma also exists in the comparison of the concept when done by financial accountants (literates) as compared to general business and investment experts. Literates raise more concern than experts on items that are non-recurring or receive high salience in the press.
Relationship between internal audit function, enterprise risk management, good corporate governance and financial reporting quality: According to Dickinson (2010), there are various models of governance but the generally accepted models are two of the main components of governance structure which are: the effectiveness of management's risk management practices and the internal audit's monitoring of how effective these practices are. It is no surprise that the variables in the conceptual framework to this study were found to influence each other and also affecting the dependent variable, FRQ, at varying magnitudes. The independent variables i.e. ERM and GCG (encompassing IAF) were found to be influencing financial reporting quality positively. However, ERM has the greatest influence. The variables: ERM and GCG positively and significantly relate to financial reporting quality. However, according to Armstrong et al. (2010), there is little evidence on the causal effect of corporate governance on financial reporting and they attribute this to the joint endogeneity of governance mechanisms and accounting systems. On the other hand, Cheng and Warfield 2005, found a negative relationship between managerial equity incentives and the quality of financial reporting. Others find no relation between the two. These mixed findings clearly indicate a lack of consensus as to whether there is that relationship or causal effect between corporate governance and financial reporting (and FRQ). The endogeneity of CG and FR and the determinants of each are equally intertwined and no clear cut distinction or causal effect can be inferred.

Conclusion
Internal audit function quality was found to influence financial reporting quality in the following manner: in that the strength, or quality, of the IAF will contribute to a distinctly different control environment depending on the strength of the good corporate governance in the university. This has been tested and proven to be true in the study. Internal audit plays the dual role of a promoter and supporter of both accuracy and process of financial reporting. The IAF serves as an independent party to help ensure that internal control over financial reporting and the corporate governance process are effective (i.e., process objective) in ultimately producing accurate financial results (i.e., accuracy objective).

Recommendations
 Government, through the relevant line ministries, should move in to supervise state universities and help uphold the principles of good corporate governance. This effort should be enforced through the mandatory request for the establishment and running of an efficient enterprise risk management system at each institution.  Central government is encouraged to see to the existence and running of an effective ERM system in all state universities. This will ensure the existence of commonality in reporting frameworks, thus establishing a benchmark against which future performance can be measured. After all state enterprises rely heavily on subsidies accruing from taxpayers and if this is anything to go by, one would expect these institutions to effectively and efficiently use resources allocated to them this way.