Economic Alternatives, 2019, Issue 2, pp. 287-295 The Role of in Corporate Strategies

Valeria Dineva*1 Introduction n its evolution, the internal audit has Abstract Iundergone a considerable transformation. Internal audit can play an important role Typical of today’s internal audit is that it in corporate social responsibility (CSR) prioritizes processes, systems, strategies strategies. The role depends on the degree rather than operations; it is more focused on of maturity of the organization, including the the present and the future rather than on the maturity of CSR, as well as the degree of past; it provides assessments of integrated maturity of the internal audit. It is essential management and control systems rather than that the internal audit provide assurance individual controls; it goes beyond the financial about the CSR strategies. At the same time, field, striving to be closer to the needs of the internal audit can be a driver, a leader that business and to cover all of its areas. All these will stimulate the creation and development distinctive features are inherent to a high level of a CSR strategy. In fulfilling this role, an of maturity of the internal audit. Corporate internal audit applies a holistic approach. In social responsibility within the company also this context, it is also important to encourage evolves from fragments to complete systems, the development of a comprehensive CSR from sporadic initiatives to comprehensive management and control system. CSR is a management and implementation of specific delicate activity. In this sense, an internal audit strategies implanted and synchronized in the faces many threats. In order to be really useful overall corporate strategy. At each stage of and meet expectations, the internal audit this evolution, the internal audit should have needs to be independent. The competence a role to play in meeting the CSR auditing of internal in the field of CSR, as needs and a role encouraging its transition to well as the business as a whole, needs to be a higher degree of maturity. Apart from this constantly improved. The strategic objectives vertical aspect, the role of the internal audit of the internal audit should be in line with can be explored in a horizontal aspect as the organization’s objectives, including those well, i. e. with regard to the different stages of related to CSR. the CSR strategy. Key words: corporate social responsibility, The study uses key documents that are internal audit, maturity model, control, strategy mandatory guidelines from the conceptual JEL: M14; M42; M48; L2; framework for internal audit, namely, definition, * Valeria Dineva, PhD, Chief Assistant, University of mission, standards, principles issued by the National and World Economy Institute of Internal Auditors (IIA)

287 The Role of Internal Audit in Corporate Social Articles Responsibility Strategies Regarding CSR maturity models 1. Defining the role of internal audit in and sustainable development, the Non- CSR strategies based on research Financial Reporting: Building trust with and analysis of requirements arising internal audit document issued by the from the conceptual framework for European Confederation of Institutes of Internal Auditing (ECIIA, 2015) and the internal audit. Practical Guide issued by the Institute of The requirements for the modern internal Internal Auditors Evaluating Corporate Social audit are set out in the main documents Responsibility/Sustainable Development (IIA, constituting Standards & Guidance – 2010) have been used. The study is based on International Professional Practices the model of maturity developed by V. Dineva Framework (IPPF), (The Institute of Internal and presented in the book Corporate Social Auditors, 2015), namely mission, definition, Responsibility - Theory, basic principles, standards, , and Audit (Peycheva, M., Veysel A., guidelines. Based on these requirements, Dineva, V., 2016). Regarding the role of many features could be derived that shape control and internal audit in the strategies the modern internal audit, but we will only of organizations different sources have selectively address those that are directly been used. (Dinev, M. 2015), (Simeonov, or indirectly linked to strategies in the O., Lambovska, M., 2011) With regard to organizations. CSR strategies, strategies considered by In view of the nature of work of the Peycheva and Stefanov (Peycheva, M., internal audit addressed in the Internal Stefanov, L., 2018), (Stefanova, М, 2018) Audit Standards (The Institute of Internal and Slavova (Slavova, I., 2015) have been Auditors, 2016), three important aspects taken into . In relation to the study can be highlighted, namely , of the role of internal audit in integrated Management and Control. With regard reporting publications by Veysel (Veysel, A., to Governance, Standard 2110 sets out 2018) and by the European Confederation of requirements for internal audit, including Institutes of Internal Auditing (ECIIA, 2015) two directly related to the study: “The have been used. With regard to strategic internal audit activity must assess and make audits a publication by Dineva is referred to. appropriate recommendations to improve (Dineva, V,. 2014) the organization’s governance processes for The results of studies in the practice of making strategic and operational decisions“ internal auditing have been used (Peycheva, and „Promoting appropriate ethics and values M., Miteva, A., Harizanova-Bartos, H., 2017), within the organization”. The performance as well as studies by the International Institute standards 2110.A1 and 2110.A2 specify: of Internal Auditors, studies conducted by “The internal audit activity must evaluate the KPMG in 2016, and more. design, implementation, and effectiveness of The aim of the study is to outline the role the organization’s ethics-related objectives, of internal audit in CSR strategies and to programs, and activities“ (2110.A1) and „The establish the factors that determine it. internal audit activity must assess whether The methods used are: secondary data the information technology governance of analysis, comparative-historical method, the organization supports the organization’s observation method and the method of system strategies and objectives” (2110.A2). analysis. With regard to , the

288 Economic Alternatives, Issue 2, 2019 Articles performance standard 2120.A1 requires in response to the associated with that “the internal audit activity must evaluate CSR and the achievement of its strategic risk exposures relating to the organization’s objectives. governance, operations, and information Internal audit standards require internal systems regarding the: Achievement of auditors to have the necessary knowledge, the organization’s strategic objectives.” skills and other abilities to fulfill their individual With regard to Control, the performance responsibilities (Standard 1210 - Competence). standard 2130.A1 requires that “the internal This requirement is also a basic principle of audit activity must evaluate the adequacy internal auditing. and effectiveness of controls in responding With regard to corporate social to risks within the organization’s governance, responsibility and sustainable development, operations, and information systems regarding internal auditors should have specific the: Achievement of the organization’s competences related to good knowledge of strategic objectives.” standards, for instance SA 8000, ISO 26 000, On the basis of the above mentioned standard AA 1000, ISO 14000 (Peycheva, M. standards, the role of internal audit in relation 2015, pp. 35-78). A study conducted in Bulgaria to CSR strategies can be defined, and (Peycheva, Miteva, Harizanova-Bartos, 2017, more precisely what is expected of it in this p.81-91) shows that internal auditors are not direction, namely: familiar with the standards related to social yy Internal audit should assess and give responsibility and its individual aspects. This appropriate recommendations on strategic decision-making processes applies to both the public and private sector. related to corporate social responsibility; To questions with regard to all standards related to social responsibility, all internal yy Internal audit is expected to play a auditors, i.e. 100% of respondents, answered significant role in one of the core elements of CSR, namely ethics. Internal audit they did not know the standards. The analysis should evaluate and give appropriate of these results outlines a gap in internal recommendations on the processes auditors’ knowledge. Effective solutions can involved in promoting ethical relationships be using external experts or performing joint and values within the organization, audits with external auditors (co-sourcing). and internal audit must assess the In addition to specific competences, establishment, implementation and internal auditors should also have common effectiveness of ethics tasks, programs competences related to the nature of and activities within the organization; work of internal auditing (Governance, yy Internal audit must assess whether IT Risk Management and Control), as well management within the organization as knowledge of the use of business, supports CSR strategies and objectives; strategies, and more. A survey (Rose, J. yy Internal audit must assess the 2015) shows that internal auditors evaluate management of CSR-related risks, the lowest their competences in Business especially those that would hinder acumen/judgment (3.50) and Governance, the achievement of the CSR strategic risk, and control (3.43) on a scale of 5 to 1, objectives; from the highest to the lowest. yy Internal audit should assess the The quoted results indicate a possible adequacy and effectiveness of controls threat to the role of internal auditing in CSR

289 The Role of Internal Audit in Corporate Social Articles Responsibility Strategies strategies, namely inadequate competence of organization’s strategy and the CSR strategies. internal auditors. In this regard, it is necessary to improve the According to the definition, an internal processes of setting goals for, planning and audit is an independent and objective activity. programming of the internal audit that are Independence and objectivity are formulated linked to those of the organization. A KPMG as a basic principle for internal auditing. survey, conducted amongst internal auditors, Standard 1100: Independence and Objectivity points to the strategic alignment of internal pays special attention to these principles. audit plans with the organization’s strategy And if objectivity is a personal characteristic, among the top 10 risk areas for internal independence is institutional and is essential auditing. A study (Harrington L., Piper, A., for expressing the free opinion of internal 2015) shows what the assessment of internal auditors and providing their assessments. auditors regarding the alignment of the audit This is particularly true for corporate social plan with the organization’s strategic plan is responsibility and its strategies. Corporate by geographical region. In Latin America and social responsibility is a delicate area. When the Caribbean, 72% of respondents believe assessing its management and implementing that their audit plan fully or almost completely strategies, non-adverse facts about the coincides with the strategic plan of the company may be found, for example: CSR is organizations. In comparison to Europe and more of an advertisement; strategies are only Central Asia this percentage is 57%, for North for the company’s website, etc. It is difficult to America 54%, for South Asia 43%. The results report to the Board. It is also difficult for other are unsatisfactory as it is evident that there areas when irregularities are found, but they is no complete synchronization of the audit concern the internal image of the company, plan with the organization’s strategic plan, whereas in the event of any CSR irregularities, which may be a deterrent to the strong role the internal audit “ruins the good” image of the company, i.e. the external image of the the internal audit may have in CSR strategies. company is compromised. Something that According to another study (The Institute of even the Board would not want to hear. That Internal Auditors Research Foundation (IIARF), is why it is so important for internal auditors 2014), social audits and sustainability audits not to be pressured to submit findings. In this (corporate social responsibility, environment, regard, the results of a survey conducted etc.) were included in the scope of internal among internal auditors (Harrington L., Piper auditors in only 20% of respondents, whereas A., 2015) are of interest. Asked whether they ethics audit comprise 68% and rank sixth in were pressured to refuse or change their the list of 24 types of audit engagements. findings, 64% -66% said they were never A study (Cowan M., Camfield H., English S. pressured. The other figures are worrying, and Hammond S., 2014) shows that nearly 20% -29% said they were pressured once in half (49 percent) of all internal auditors in the their careers, and 5%-14% preferred not to survey did not participate in the assessment answer this question, which suggests that of their company culture. These results they were pressured. In a situation of exerted unambiguously show a weakness of CSR pressure, the role of internal auditing in CSR audits that threatens the role of the internal strategies would be under serious threat. audit in the CSR strategies. It is essential that the overall strategy While the study results above do not of the internal audit unit is in line with the directly address CSR strategies, they can be

290 Economic Alternatives, Issue 2, 2019 Articles seen as potential threats to CSR strategies, strategic ones, advice and consultations on namely: clarifying the necessary communications yy That the internal audit is not independent; and ensuring their effective implementation, yy That internal auditors do not have as well as recommendations on the control sufficiently specific competencies in environment, controls and risk assessment CSR, as well as general competencies methods. with regard to the business and the At the „Managed“ maturity level, the CSR nature of work of internal audit; criteria are: availability of CSR performance yy That audit plans are inconsistent with metrics that are reported to the public; CSR activities and strategies. CSR is integrated into the activity by means of separate processes; integrating CSR 2. The role of internal audit in CSR indicators, objectives and strategies that are strategies depending on the level of fully managed; risks associated with CSR are maturity of CSR and the stages of known and managed; appropriate controls CSR strategies. are in place. At this level, the recommended role of the internal audit is to provide advice In order to define the role of internal on the development of comprehensive audit in CSR strategies, Dineva`s CSR strategies as well as advice on building a maturity model can be used (Peycheva system for preparing and presenting CSR M., Veysel A., Dineva V., 2016, p.212-213), information, and reporting and introducing which shows the role of the internal audit appropriate controls to ensure their reliability, depending on the level of maturity of quality and . This requirement is CSR. The model consists of five levels of maturity: indifferent, fragmented, aware, becoming increasingly important in relation managed and optimized. Each level is to integrated reporting. As Ali Veysel notes, characterized by relevant maturity criteria “Integrated accountability is different from for CSR. At each level, there are focuses financial accountability in the principle of and role of the internal audit. If we carefully “strategic focus and orientation towards the look at the model at its highest levels of future”. Furthermore, the financial report does maturity, we will see the most active role not provide information on understanding, of the internal audit in terms of strategies. reporting and responding to the legitimate For example, the level of “Awareness” is needs and interests of key stakeholders.” characterized by the fact that certain units, (Veysel A., 2018, p. 35). As evident from the functions, activities identify and evaluate quote, the concept of CSR for stakeholders risks typical of CSR. Separate CSR is an integral part of the concept of strategies are formulated, for example, for integrated accountability, and therefore individual stakeholders (clients, employees, assessments, confirmation, and internal audit etc.), but they are mostly declarative, not recommendations are an imperative need. tied to a comprehensive CSR strategy, At the “Optimized” level, CSR is part of not integrated into the corporate strategy, the mission, principles and performance and are not aligned with other strategies indicators of the organization; there are and activities. Reporting at this stage is clearly established engagement selective. Here, the role of the internal audit processes; the management and control may be related to recommendations aimed of CSR are part of the overall corporate at improving CSR activities, including the governance and overall control system; CSR is

291 The Role of Internal Audit in Corporate Social Articles Responsibility Strategies a factor influencing business decision-making The role of the internal audit in the processes across the organization, including strategic control assessment is examined by at Board level; public statements are created Ognyan Simeonov “From the point of view for the public. At this level, the recommended of the assessment function of the internal role of the internal audit is to perform strategic audit, it is important to evaluate the controls audits. According to a study by the Institute related to the implementation of the strategic of Internal Auditors Research Foundation objectives, i.e. the assessment of strategic (IIARF) (2014) , Reviews addressing linkage control and control systems.” (Simeonov, O., of strategy and performance (e.g. balanced Lambovska, M., 2011, p.138) scorecard) are only 26% which shows that The stages of the CSR strategy can be these types of audits are practiced on a small formulated in different ways. Marina Stefanova scale in the internal auditing practice. addresses four consecutive steps, namely The specifics of strategic audit are forming a responsible team, formulating a reviewed by Valeria Dineva. “Strategic audit mission, strategy and goals, synchronizing can be performed as a consulting engagement with the available management system, or as an assurance engagement. The including performance indicators. (Stefanova, consulting engagement is appropriate at the M., 2018, p. 248) stage of preparing and formulating a strategy, At each stage of the strategy, internal whereas the assurance engagement is audit can play a specific role. For example, appropriate for assessing the implementation the internal audit role will be preventive and of the strategy and, in general, the outcomes useful at the stage of “formulating a mission, of the strategy. This type of audit implies a strategy and goals”, especially in the process very good competence of internal auditors.” of goal setting, as Ognyan Simeonov points (Dineva, V, 2014, p.145) out. “In addition to this role in assessing and Strategic audits may relate to the supporting the management of the internal implementation of the overall CSR strategy or control system, internal audit may also play a its individual stages. Goals could also vary: role in the overall governance of organizations, e.g. an assessment of the implementation in the processes of targeting. Insofar as or evaluation of the control system and the the objectives are the starting point for risk extent to which it supports the implementation assessment and the building of the entire of the strategy or, in particular, an assessment system, the internal audit can of the strategic control. “Strategic control is identify incompleteness, ambiguity, lack of carried out on the conditions that ensure the specificity and measurability in the process performance of a strategic task is completed” of their understanding, in order to assist (Dinev, M., 2015, p. 274). Furthermore, Mihail management in their definition. (Simeonov, O., Dinev specifies that “The form of strategic Lambovska, M., 2011, p.54) control expands the possibilities of control The “synchronization with the available impact, clearly highlights its qualities of management system” stage is very important prevention, comprehensiveness and flexibility. from a managerial point of view. At this stage, The good organization of control allows it is also necessary to integrate CSR and us to encompass and regulate, ultimately its strategy into the organization’s overall purposefully manage strategic processes and strategy because, as noted by Irena Slavova, phenomena in social development.” (Dinev, CSR can create benefits for companies M., 2015, p. 277) when integrated into their operations when

292 Economic Alternatives, Issue 2, 2019 Articles corporate social activities are part of the Peycheva (Stefanov, L., Peycheva, M., strategy of organization and are related to its 2018, p.), the integrated approaches that goals.” (Slavova, I., 2015, p. 118) the internal auditors will implement can be The successful synchronization of adopted. It is important to assess how the HR the CSR strategy with the management Unit supports the CSR strategies. It should system is an indicator of the high maturity be determined whether any training has been of CSR to achieve optimization. In fact, conducted with a view to understanding integration and synchronization with all and implementing the CSR strategies, existing systems is needed. At this stage whether the key staff members involved in internal audit has an essential role - to their implementation are selected, how they provide assurance about the integration were selected, on the basis of what criteria, of CSR and the synchronization with other whether they are aware of the resulting systems, for example in the control system obligations, and whether these obligations and the risk management system, the are specified in the job descriptions, and so human resources management system, on. Furthermore, the integrated assessment the environmental management system can continue to identify whether the risks (EMS), the ethics, etc. In assessing the of incompetence, ignorance, non-discipline integration and synchronization of CSR in the implementation of CSR strategies and CSR strategies with other activities are identified, evaluated and managed and strategies, the internal audit should and whether they are integrated into the apply an adequate integrated and holistic overall risk assessment of the organization. approach. Here are two examples, though The search for and the establishment of non-exhaustive. The first example is related synchrony can also continue by making a to ecology. “The EMS requires taking into comparison with the risk culture, ethics, account all significant environmental aspects compliance function, if any. The internal and determining environmental risks and audit assessment should also integrate ecological performance indicators.” (Ivanova the assessment of corporate culture D., A. Haradinova, E. Vasileva, 2016, р. 61) In because, as noted by Yanitsa Dimitrova, this regard the internal audit should establish “corporate culture is also a kind of complex whether the environmental aspects defined message oriented (directly or indirectly) in the environmental management system towards the consumer, aiming to expose are relevant in the CSR strategy. Also, the in the best way the unique characteristics internal audit should assess whether the of a company, and oriented towards the environmental risks are included in the employees - to frame their joint actions overall risk assessment of the organization and to create organizational behavior in and whether their impact on the CSR order to implement the corporate strategy.” implementation is evaluated. It is essential (Dimitrova Y., 2015, p. 65) to assess how these risks are managed, Many other examples can be presented, whether controls to mitigate them are in with similar reasoning to the above, but even place, and so on. if they stop here there are good reasons to The other example is related to human outline the following conclusions about the resources management. Based on the role of the internal audit, depending on the responsibilities of the HR Unit in relation to level of maturity of CSR and the stages of the social responsibility defined by Miroslava CSR strategies:

293 The Role of Internal Audit in Corporate Social Articles Responsibility Strategies yy a distinctive feature of high maturity strategies of the organizations, including CSR levels is the availability of CSR strategies strategies. and a comprehensive CSR strategy, The main role expected of the internal skillfully and successfully integrated audit in relation to the CSR strategies is to into the overall corporate strategy and provide assurance about their performance, synchronized with other strategies and credibility, accountability, and efficiency. In activities; addition to the implementation stage, the yy at each maturity level of CSR there internal audit may provide estimates of its should be an adequate level of maturity individual steps. Also, the internal audit should of the internal audit, capable of assess the strategic control, the CSR control providing assurance and encouraging system and its capacity to support the strategy. improvement; Another direction in which the internal audit yy apart from the vertical aspect of the level can be useful is to provide assurance about of maturity, the role of the internal audit the management of the risks that threaten the can also be viewed horizontally at the implementation of the CSR strategies. The stages of the CSR strategy, as well as usefulness of the internal audit also depends in evaluating the processes of integration on the capacity and opportunities that it has, and synchronization with other activities to provide advice, opinions, recommendations and strategies; to help implement the CSR strategies as well yy at the high levels of maturity, the internal as to improve them. audit is expected to perform strategic In any case, implementing integrated audits by applying integrated and holistic approaches. and holistic approaches in assessing CSR strategies and its individual aspects would 3. Conclusions increase the efficiency of the internal audit activity and lead to multiplier and synergy Modern internal audit could and should play effects for CSR and the organization as a a significant role in CSR strategies. Actually, the role of internal audit in CSR strategies is whole. All the options for a strong role of the determined by the level of maturity of CSR, as internal audit imply high levels of maturity of well as by the level of maturity of the internal CSR in the organization that are characterized audit itself. The results of the abovementioned by the existence of strategies. With low levels studies show not a strong commitment of the of maturity, when no CSR strategies are in internal audit to CSR, which together with the place, internal audit can also play an important lack of competence and independence, pose role as a catalyst and inspiration for CSR serious threats that may become obstacles development, promote strategic processes to the role of the internal audit in the CSR related to CSR, including development and strategies. In this regard, it is necessary to implementation of appropriate strategies. strengthen and improve the competences References of internal auditors and this applies to both the CSR-specific competences and some Cowan Michael, Camfield Helen, English common competencies essential for auditing Stacey and Hammond Susannah, State of the CSR strategies. It is also necessary to Internal Audit Survey 2014 -Adapting to ensure the independence of the internal audit, Complex Challenges?, Thomson Reuters as well as to align the audit plans with the 2014;

294 Economic Alternatives, Issue 2, 2019 Articles Dinev, M. (2015). Kontrol i regulirane v Excellence, The Global Internal Audit socialnoto upravlenie (in Bulgarian), Common Body of Knowledge, The Institute izdatelski kompleks UNSS, Sofia. of Internal Auditors, 2015 Dineva, V. (2014). Metodologicheski aspekti Simeonov, O., Lambovska. M. (2011). na vatreshnija odit. Izsledvane v Sistemi za upravlenski kontrol; izd. zastrahovatelnija sektor, IK ATL-50, Sofia. Universitetsko izdatelstvo „Stopanstvo” (in Dimitrova Y., (2015). Korporativna kultura, Bulgarian) izd. Kolbis Mezhdunaroden transfer AD, Slavova, I. (2015). Korporativnata socialna Sofia otgovornost v Bulgaria: razvitie, ECIIA Non-Financial Reporting: Building ogranichenija i predizvikatelstva, trust with internal audit, 2015 Ikonomicheski i Socialni Alternativi, broj 2, Harrington L., Piper A. (2015). Driving 2015 (in Bulgarian) Success in a Changing World 10 Imperatives Stefanov, L., Peycheva, M. (2018). for Internal Audit Practitioner , The Global Upravlenie na choveshkite resursi, Izdatelski Internal Audit Common Body of Knowledge, kompleks UNSS (in Bulgarian) The Institute of Internal Auditors. Stefanova, M. (2018). Korporativna Ivanova D., A. Haradinova, E. Vasileva ustojchivost i otgovornost, izd. „Sv. Grigorij (2016). Environmental performance of Bogoslov“, companies with environmental management systems in Bulgaria, Quality – access to The Institute of Internal Auditors, Standards success, 17 (172); & Guidance — International Professional Practices Framework (IPPF), 2015; KPMG Internal audit: Top 10 Key risks in 2016 The Institute of Internal Auditors, International standards for the professional Peycheva M. (2015). Socialen odit i odit na choveshkite resursi (in Bulgarian), IK ATL- practice of internal auditing (standards), 50 2016; Peycheva M.; Veysel A., Dineva V. (2016). The Institute of Internal Auditors (IIA), Korporativna socialna otgovornost – teoriya, Evaluating Corporate Social Responsibility/ otchetnost i odit, (in Bulgarian), IK ATL-50); Sustainable Development; IPPF–Practice Guide; 2010 www.theiia.org/guidance; Peycheva, Miteva, Harizanova–Bartos (2017). Izsledvane na potrebnostite ot The Institute of Internal Auditors Research provezhdane na socialen odit i prilagane na Foundation (IIARF). Internal Audit Around standarti za socialna i ekologichna the World – A Perspective on Global otgovornost, Izdatelski kompleks UNSS, Regions, 2014. Sofia Veysel, A., (2018) Oditorski angazhimenti Rose, J., Mapping Your Career – za izrazjavane na sigurnost otnosno Competencies Necessary for Internal Audit integrirani otcheti IK ATL-50.

295