Conclusion and research implications
This paper has attempted to establish the conceptual foundations of the role of internal auditing in corporate governance using, as an illustrative lens, the function’s role in assisting management in dealing with risk. It has argued that internal auditing can be conceptualized as providing: ex post assurance about the execution of economic activities within management’s preconceived frameworks and ex ante advisory services that enhance the rationality of economic activities and the accompanying controls of organizations. Nevertheless, both activities allow room for Esmark’s (in press) “regulatory game of freedom and security” that nevertheless tends toward increased security. This overall heuristic does not discount that variations in corporate governance practices across both countries (see e.g. Macdonald and Beattie, 1993) and companies can influence the power/knowledge dynamics of the governance setting. This discourse-specific and, thus, institution-specific understanding of the Foucauldian framework can be set against the tendency to view governmentality as an account of overarching power/knowledge, as cautioned against in our account of governmentality above and as explicitly rejected by Foucault (see, e.g. Foucault, 1991, p. 53). The way in which internal audit services are predominantly used may be influenced by key concerns and operating characteristics of the relevant governance framework.