Relationship between governance-risk-compliance approach and internal audit function: The structural equation model research on the effect of internal audit responsibilities on the GRC approach

Since the first years in which internal audit was accepted as a profession in the modern world, it has updated its activities at regular intervals according to the needs of the business world. Governance, risk management and compliance are the focus of the internal audit profession. The idea that these three concepts, which directly affect the success of the enterprise, are dealt with together is expressed by the abbreviation of Governance-Risk-Compliance (GRC). This abbreviation has evolved into a technology-based approach that argues that these three domains should be tackled in a holistic perspective. The internal audit function, which becomes the most important supporter and strategic mentor of the business management, should take on the role of participant beyond the assurance and consultancy services to adopt new approaches. But it should not exceed the limits required by the profession. In our study, the internal audit and the GRC approach were discussed theoretically and the conceptual framework was evaluated. The aim of our study is to investigate the relationship between the responsibilities of the internal audit function and the GRC approach. Within the scope of the study, the data collection tool obtained by the item pool evaluation study in line with the literature and expert opinions received responses from the TİDE member 247 internal auditors. In order to test the research model, the data obtained from the internal auditors were analyzed with Exploratory Factor Analysis, Confirmatory Factor Analysis and Structural Equation Model. For the purposes of the study, internal auditors' opinions regarding the responsibilities of internal audits were compared with the opinions of the sample group consisting of 72 business executives who are traded in Borsa İstanbul with the shares of companies and 96 independent auditors having KGK authorization certificate. In addition, the differences between the views were compared in terms of the current situation and the situation in practice. In comparative analysis, independent samples t tests and paired samples t tests were used. As a result of the study, a statistically significant relationship was found between the benefits of the GRC approach and the risk, information technologies and governance responsibilities of internal audit. A negative correlation was found between the benefits of the GRC approach and the risk responsibilities that should not be assumed. It has been concluded that the compliance of the internal audit with the responsibility limits increases the benefits of the GRC approach. In addition, remarkable conclusions were reached between the views of the sample groups and between the current situation that should be taken and situation in practice.