A Governance Capability System in Internal Auditing: Evidence from Saudi Arabia

Abstract

This study examines whether internal audit competency, structural independence, and technology adoption form an interrelated governance capability structure. A cross-sectional survey of 397 governance, risk, and financial-control professionals in Saudi Arabia was analysed using PLS-SEM. Competency is strongly associated with independence (β = 0.654), while competency (β = 0.366) and independence (β = 0.388) are associated with technology adoption. The model explains 43% and 47% of the variance in independence and technology adoption, respectively. Independence carries a significant indirect association between competency and technology adoption (β = 0.254). The findings support systematic interdependence among the three capabilities. A post hoc model-implied sensitivity analysis shows that alternative directional orderings are covariance-equivalent; accordingly, the evidence supports relational structure but not a unique causal ordering.

1. Introduction

Internal audit functions (IAFs) have evolved considerably from their origins as compliance-monitoring units, assuming increasingly prominent roles in enterprise risk management and strategic governance (Endaya & Hanefah, 2016; Joshi & Karyawati Purba, 2022). Contemporary governance research identifies three capabilities as central to IAF effectiveness: professional competency, structural independence, and technology adoption (Alqudah et al., 2023; Hakami, 2025). Yet these three streams of scholarship have developed largely in parallel, with limited attention to how competency, independence, and technology relate to one another within a coherent governance capability structure.

Most empirical studies treat these capabilities as additive predictors, entering competency, independence, and technology as separate independent variables whose partial associations with governance outcomes are estimated individually (Tawfik et al., 2023). Such outcome-focused models can readily accommodate correlated predictors; what they typically leave unexamined is the joint distribution of the capabilities themselves, treating their intercorrelation as a statistical nuisance rather than as a theoretically meaningful object of study. There are, however, reasons to examine these interrelationships more directly. The resource-based view (RBV) holds that organisational capabilities do not vary independently of one another, and that their joint distribution in respondent assessments is itself theoretically meaningful (Barney, 1991). Institutional theory further suggests that state-directed reform programmes, such as Saudi Arabia’s Vision 2030, create coercive pressures toward coherent governance configurations across organisations (DiMaggio & Powell, 1983).

This study addresses the gap between additive and systemic perspectives by investigating whether competency, independence, and technology adoption exhibit systematic interdependence in respondent assessments of organisational capabilities. Drawing on the resource-based view, we conceptualise the three capabilities as elements of a governance capability system whose joint structure not merely each capability’s separate associations with outcomes is a meaningful object of study. Rather than examining each capability in isolation, the study asks whether they are systematically associated with one another and whether the pattern of association follows a differentiated structural logic, in which some capabilities occupy more central positions within the system than others. Practically, this question matters because understanding the relational structure among governance capabilities enables boards, audit committees, and Chief Audit Executives to make more informed decisions about how to sequence and prioritise capability investments. For example, technology investments may yield limited returns if competency and independence are not developed in parallel.

Saudi Arabia offers an instructive empirical setting for this investigation. The Vision 2030 reform programme has restructured public-sector governance, capital market regulation, and corporate accountability frameworks within a compressed timeframe, reshaping governance structures, professional norms, and regulatory requirements concurrently (Moshashai et al., 2020). This environment produces variation in governance capability profiles, enabling the observation of systemic co-variation among governance capabilities that might be less visible in more stable institutional settings. National regulators also create coercive pressures for governance modernisation that may shape how capabilities are configured within organisations. At the same time, the questions the study raises whether internal audit capabilities form an interdependent system, and which capability occupies the connecting position are relevant to internal audit functions, boards, and professional bodies in any jurisdiction.

This study makes two contributions. First, it provides evidence that internal audit competency, independence, and technology adoption are strongly associated with one another, suggesting that these capabilities should not be treated as weakly related or entirely separate factors in governance research. The findings indicate substantial shared variance among these capabilities, with implications for how they are specified and interpreted in internal audit and governance models. Second, the study identifies a specific structural pattern within these relationships: independence transmits a significant indirect effect between competency and technology adoption, a pattern consistent with independence occupying a distinct connecting position between professional capability and technological capability. The novelty of the study therefore lies in its research question and conceptual positioning rather than in the individual constructs, all of which are well established in internal auditing research: whereas the drivers-of-effectiveness literature asks which capabilities predict internal audit outcomes, this study makes the relational structure among the capabilities themselves the object of inquiry.

The remainder of the paper is organised as follows. Section 2 reviews the literature on each governance capability and identifies the research gap. Section 3 develops the theoretical framework. Section 4 presents the hypotheses. Section 5 describes the methodology. Section 6 reports the results. Section 7, Section 8, Section 9, Section 10, Section 11 and Section 12 cover the discussion, theoretical implications, practical implications, limitations, future research directions, and conclusion.

2. Literature Review

2.1. Internal Audit Competency

Competency in internal auditing encompasses the professional qualifications, technical expertise, analytical capacity, and continuing professional development that collectively enable auditors to execute their responsibilities effectively (Prawitt et al., 2009; Oussii & Boulila Taktak, 2018). It represents the accumulated human capital that auditors bring to governance processes their capacity to identify control deficiencies, evaluate risk exposures, and communicate findings persuasively to boards and audit committees (Endaya & Hanefah, 2016).

The empirical record on audit competency is substantial but reveals important conditionalities. Research has shown that auditor competency is associated with governance outcomes primarily through structures that enable its exercise: competent audit teams generate superior risk assessments within supportive governance environments, and auditor expertise influences financial reporting quality indirectly through audit processes rather than directly (DeFond & Zhang, 2014; Alzeban, 2018). These findings suggest that competency functions as a foundational element within governance systems, but that its value is realised in combination with related structural and technological capabilities (Lenz & Hahn, 2015).

From a resource-based perspective, competency possesses characteristics consistent with a strategic resource: it is heterogeneous across organisations, difficult to replicate in the short term, and embedded in organisation-specific tacit knowledge (Barney, 1991; Joshi & Karyawati Purba, 2022). Nevertheless, RBV also recognises that the value of any resource is conditional on its organisational context competency without the structural autonomy or technological infrastructure that form part of the same governance capability system may remain underutilised.

2.2. Structural Independence as an Enabling Governance Capability

Structural independence in internal auditing refers to organisational arrangements that insulate auditors from management influence. These include direct reporting lines to audit committees rather than executive management, independent authority over Chief Audit Executive appointment and removal, unrestricted access to organisational records and personnel, and budgetary autonomy from management control (Gramling et al., 2004; Christopher et al., 2009). Agency theory provides the canonical rationale: internal auditors serve as information intermediaries between principals and agents, and independence is the mechanism through which auditors credibly reduce information asymmetry (Gramling et al., 2004). Christopher et al. (2009) document how threats to this independence management approval of the audit budget, weak functional reporting to the audit committee, and use of the function as a management training ground can compromise the governance role of internal audit.

The empirical literature consistently links independence to internal audit quality and governance outcomes. Alzeban (2018) found that the financial reporting benefits of a competent and independent internal audit function are not realised when the chief executive officer is involved in appointing the Chief Audit Executive, indicating that structural arrangements condition the value of audit capability. Alqudah et al. (2023) showed that independence and management support are among the empowerment factors most strongly associated with internal auditors’ effectiveness.

The relationship between competency and independence merits closer theoretical attention. Competent auditors who demonstrate technical expertise, professional judgment, and adherence to professional standards are more likely to be perceived as credible by audit committees and boards (Endaya & Hanefah, 2016; Sarens & De Beelde, 2006). This credibility may facilitate the granting of structural autonomy: audit committees are more willing to approve direct reporting lines, unrestricted access, and budgetary independence when they have confidence that the function will exercise that autonomy responsibly. Conversely, where competency is perceived as low, audit committees may be reluctant to grant independence, fearing that the function lacks the expertise to exercise autonomous judgment effectively. This reasoning does not assert a temporal sequence which cross-sectional data cannot establish but rather predicts a positive systemic association between competency and independence across organisations. The relationship is likely bidirectional or driven by common institutional factors, yet the theoretical expectation of co-variation remains clear.

Independence may also be associated with technology adoption through its effect on organisational authority. Audit functions reporting directly to audit committees may have greater authority to mandate data access across organisational units, sustain technology investments over time, and integrate audit systems without management interference. These structural advantages suggest that independence is likely to co-occur with technology adoption rather than vary independently of it.

2.3. Internal Audit Technology Adoption

Technology adoption in internal auditing encompasses the deployment of data analytics tools, artificial intelligence-assisted anomaly detection, robotic process automation, continuous auditing platforms, and integration with enterprise resource planning systems (Appelbaum et al., 2017; Christ et al., 2021). These technologies extend the range, depth, and timeliness of governance intelligence that internal audit functions can produce, enabling auditors to analyse entire transaction populations, identify anomalies in real time, and provide audit committees with dynamic risk dashboards.

Recent research has examined how advanced technologies are reshaping internal audit practices. Mustafa and Aysan (2026) explored the adoption of agentic AI in financial control frameworks, highlighting how governance structures condition the effective deployment of autonomous auditing systems. Their findings underscore the importance of organisational readiness and control frameworks in technology-enabled auditing. Hakami (2025) found that technological capability was a key determinant of internal audit efficiency among Saudi small and medium enterprises adopting cloud-based tools, principally within a supportive regulatory and governance environment. Where structural independence is weak, technology adoption may instead generate surveillance-oriented audit activities that serve management interests rather than governance objectives. Technology is therefore best understood as an operational capability whose effectiveness depends on its position within a broader governance capability system that includes competency and independence.

From an RBV perspective, the returns to technology investment depend on existing capability configurations. Organisations without competent audit teams may struggle to select, configure, and interpret advanced audit technologies (Appelbaum et al., 2017). Organisations without structural independence may lack the authority to mandate data access and integrate audit systems. This suggests that technology adoption is likely to co-occur with high competency and strong independence across organisations an expectation consistent with the governance capability system perspective proposed in this study.

2.4. Research Gap

The foregoing review reveals a persistent gap. The internal audit effectiveness literature has matured around a drivers-of-effectiveness logic in which competency, independence, and technology are each studied as predictors of internal audit outcomes (Lenz & Hahn, 2015). Within this tradition, the capabilities are treated as parallel inputs, entered as separate independent variables in additive regression models (Tawfik et al., 2023), and their intercorrelations are handled as a statistical nuisance rather than a theoretical object. The additive approach thus treats the capabilities’ intercorrelation as a statistical nuisance to be partialled out rather than as a theoretically meaningful object, leaving the way they relate to one another unexamined.

From a resource-based perspective, this assumption is difficult to sustain. Organisational capabilities may not be independently distributed; they may instead form a governance capability system in which the value and joint distribution of each capability is bound up with the others (Barney, 1991). If competency, independence, and technology are systematically interrelated, the additive approach which holds other capabilities constant while estimating the effect of one may remove precisely the variation that is theoretically interesting. This study addresses the gap by examining whether the three capabilities exhibit systematic interdependence in respondent assessments of organisational capabilities, conceptualising them as elements of an integrated governance capability system.

3. Theoretical Framework

3.1. Resource-Based View and Governance Capability Structure

The resource-based view holds that organisational capabilities do not exist in isolation; their value and their distribution across organisations are shaped by the presence of other capabilities (Barney, 1991; Barney & Arikan, 2001). This perspective has informed extensive research on how organisational practices combine in human resource management and operations settings, but it has received limited attention in accounting and governance research, where capabilities are more commonly modelled as separate, additive predictors.

A governance capability system, as we conceptualise it in this study, is a set of organisational attributes whose values are jointly determined and whose pairwise relationships follow a differentiated rather than uniform or random pattern. The boundaries of this concept relative to adjacent constructs warrant explicit statement. First, it differs from an additive perspective, in which each capability contributes a separable, independent association with outcomes, such that the capabilities’ joint distribution is not itself a meaningful object of study. Second, it differs from the capability-bundle construct, which denotes sets of practices deliberately assembled by management and evaluated through their joint effects on performance (MacDuffie, 1995; Flynn et al., 1995); bundle research remains outcome-referenced, whereas the present concept concerns the observed structure of the capabilities themselves. Third, it differs from strict complementarity in the strategic management sense (Milgrom & Roberts, 1995), which holds that the marginal value of one capability increases with the level of another and is typically evidenced through multiplicative effects on downstream outcomes; the present study includes no outcome construct and tests no such interactions. Fourth, it differs from configurational approaches, which classify organisations into discrete profiles or archetypes of capability combinations; the present concept instead makes continuous, relational claims about how capabilities co-vary and which capability occupies a connecting position. The study’s claims are accordingly deliberately modest and are confined to the structure of the capabilities themselves: whether they co-vary strongly, and whether that co-variation follows a discernible pattern. This confinement is also what keeps the contribution within internal auditing and corporate governance research rather than strategic management: the constructs, the setting, and the implications concern the internal audit function’s governance role.

Two RBV-derived principles are particularly relevant to this conceptualisation. First, capabilities that develop under shared organisational conditions common leadership decisions, shared budgetary processes, shared exposure to regulatory pressure are likely to co-vary, because the factors that shape one capability also shape the others. Second, within such a system, capabilities need not be equally positioned: some may function as more central or connecting elements, through which associations between other capabilities are substantially routed, while others occupy more peripheral positions. The proposed framework therefore generates two testable implications: first, the associations among competency, independence, and technology should be positive and substantial, indicating that these capabilities do not vary independently; second, the specific structural pattern of these associations should reveal a differentiated rather than uniform structure for example, one capability occupying a connecting position between the other two.

3.2. Institutional Complement to the Resource-Based View

While the RBV emphasises capability heterogeneity as a source of competitive distinctiveness, institutional theory draws attention to countervailing pressures toward convergence (DiMaggio & Powell, 1983). In environments undergoing state-directed reform such as Saudi Arabia under Vision 2030, organisations face coercive pressures from regulators, mimetic pressures from peer organisations, and normative pressures from professional bodies (Moshashai et al., 2020). These institutional pressures may reduce capability heterogeneity by pushing organisations toward similar governance configurations, and in doing so may themselves produce systemic co-variation among governance capabilities.

The framework proposed in this study integrates insights from both perspectives. From the RBV, it adopts the premise that governance capabilities are not independently distributed but form a structured system shaped by shared organisational conditions. From institutional theory, it recognises that the specific pattern of co-variation may also reflect institutional pressures toward coherent governance configurations rather than purely organisation-driven dynamics. These explanations are not mutually exclusive; in the Saudi context, both may operate simultaneously, and the cross-sectional data cannot distinguish between them. This ambiguity is acknowledged as a limitation, and replication across institutional contexts would be required to disentangle organisation-level dynamics from institutional pressures as sources of the observed governance capability structure.

3.3. Governance Capability Interdependence

Integrating the RBV and institutional perspectives yields two core implications that guide the empirical analysis. First, the associations among competency, independence, and technology should be positive and substantial: respondents reporting high levels of one capability should also tend to report high levels of the others, and the variance explained in each capability by the remaining capabilities should be considerable. Second, the interdependence should exhibit a specific structural pattern: the association between competency and technology should operate substantially through independence, reflecting a structure in which independence occupies a connecting position between the two more distal capabilities. This is a cross-sectional, structural claim about how capabilities co-vary in respondent assessments not a claim about temporal sequence, causal order, developmental hierarchy, or multiplicative effects on downstream outcomes.

3.4. Governance Capabilities as a System

The pattern of results anticipated here strong pairwise associations, substantial shared variance, and a specific indirect pathway structure rather than uniform correlation would be consistent with treating competency, independence, and technology adoption as elements of a governance capability system, as conceptualised in Section 3.1. Under this perspective, the question of how strongly competency is associated with independence, and how this shapes the association between competency and technology, is not a preliminary step before estimating the separate effect of each capability; it is a substantive empirical question in its own right, one that the capabilities’ joint distribution in respondent assessments a distribution potentially shaped by shared antecedents, mutual reinforcement, or both helps to address. This study examines that question directly.

4. Hypotheses Development

4.1. Competency and Structural Independence

The first hypothesis concerns the association between internal audit competency and structural independence. Competent auditors signal technical expertise, professional judgment, and adherence to professional standards, which in turn cultivates credibility with audit committees and boards (Endaya & Hanefah, 2016). Audit committees are more likely to approve direct reporting lines, unrestricted access to organisational records, and budgetary independence when they are confident that the function will exercise that autonomy responsibly. Where competency is perceived as limited, committees may withhold structural protections, concerned that the function lacks the expertise to use autonomy effectively.

This logic does not assert that competency causes independence in a temporal sense the cross-sectional design cannot establish such causality. Rather, it predicts that competency and independence will be positively associated in respondents’ assessments, consistent with both credibility mechanisms and shared organisational or institutional conditions that shape both capabilities together. Empirical evidence supports this expectation: Alzeban (2018) found that the benefits of internal audit competency and independence for financial reporting quality depend on how the Chief Audit Executive is appointed, and Alqudah et al. (2023) showed that independence and management support are jointly associated with internal auditors’ effectiveness. Accordingly:

Hypothesis 1. 

Internal audit competency is positively associated with structural independence.

4.2. Competency and Technology Adoption

The second hypothesis concerns the relationship between internal audit competency and technology adoption. Competent auditors possess the technical knowledge to evaluate digital audit tools, distinguish between productive innovations and marketing claims, and select technologies appropriate for their governance context (Appelbaum et al., 2017). Without this evaluative capacity, technology investments may be poorly matched to governance needs. Competency also shapes the capacity to configure and implement audit technologies effectively, since many digital tools require substantial customisation to align with organisational data structures. The concept of absorptive capacity further supports this expectation: a function’s accumulated expertise conditions its ability to recognise, assimilate, and apply emerging technologies (Cohen & Levinthal, 1990). Accordingly:

Hypothesis 2. 

Internal audit competency is positively associated with technology adoption.

4.3. Independence and Technology Adoption

The third hypothesis concerns the association between structural independence and technology adoption. Adopting advanced audit technology requires organisational commitments that may be more readily secured by independent audit functions: access to transactional data across multiple units, integration with enterprise resource planning systems, sustained budgetary allocations, and authority to require participation in audit data collection. Direct reporting lines to audit committees may provide the authority necessary to mandate data access; budgetary autonomy may allow sustained technology investment over time; and structural insulation from management may facilitate the integration of audit systems with organisational infrastructure (Christopher et al., 2009). Consistent with this reasoning, Hakami (2025) found that technology-enabled internal audit efficiency in Saudi small and medium enterprises was associated with a supportive regulatory and governance environment. Accordingly:

Hypothesis 3. 

Structural independence is positively associated with technology adoption.

4.4. The Indirect Effect of Structural Independence

The fourth hypothesis concerns the indirect association between competency and technology adoption through structural independence. If competency and independence are positively associated (H1), and independence and technology adoption are positively associated (H3), then part of the association between competency and technology adoption may operate through independence a pattern that would indicate independence occupies a connecting position within the proposed governance capability system. This expectation does not require a causal interpretation: regardless of the underlying process, a significant indirect pathway through independence would suggest that the three capabilities form a structure in which independence sits between the other two, rather than one in which all three associations operate through separate, unconnected channels. Accordingly:

Hypothesis 4. 

Internal audit independence transmits a significant indirect effect between internal audit competency and technology adoption.

5. Methodology

5.1. Research Design

A quantitative, cross-sectional survey design was employed. This approach is appropriate for examining patterns of association among governance capabilities and for testing indirect effect hypotheses about the structure of a governance capability system. Cross-sectional designs capture the joint distribution of capabilities at a point in time, enabling the observation of systemic co-variation in respondents’ assessments of organisational capabilities. However, they cannot establish temporal order or causal direction, and no such inferences are drawn here.

5.2. Sample and Data Collection

Data were collected via a structured questionnaire administered to governance, risk, and financial control professionals employed by Saudi Arabian organisations. Because no comprehensive sampling frame of governance professionals exists in the Saudi context, a purposive sampling strategy was employed, targeting individuals occupying governance-relevant roles internal auditors, risk managers, financial controllers, chief financial officers, and audit committee members who could speak knowledgeably to their organisation’s internal audit practices. To ensure representation across organisational contexts, respondents were recruited from four sectors (financial services, energy and industrial organisations, retail and consumer goods, and public or governmental entities) via professional networks, organisational contacts, and industry associations with access to governance-related professionals. Given this purposive design, the sample should be understood as broadly representative of governance professionals accessible through these channels rather than as a probability sample of a defined population.

Of 450 questionnaires distributed within this purposive pool, 412 were returned and 397 were retained as usable following screening for completeness and response quality, yielding a completion rate of 88.2% among distributed questionnaires. The sectoral composition of the final sample was financial services (29.7%), energy and industrial organisations (26.2%), retail and consumer goods (22.4%), and public or governmental entities (21.7%). Approximately 45.6% of respondents reported more than ten years of professional experience, indicating a sample weighted toward experienced practitioners with substantive knowledge of their organisations’ governance arrangements.

The empirical unit of analysis is the professional respondent’s assessment of organisational internal-audit capabilities. The available dataset does not contain organisation identifiers sufficient to determine the exact number of distinct organisations represented or to test whether some respondents share organisational membership. The 397 responses therefore must not be interpreted as 397 independent organisational profiles. Sectoral breadth and the recruitment channels provide evidence of heterogeneous organisational contexts, but possible within-organisation dependence cannot be formally evaluated from the available data. This issue is treated as an inference limitation rather than as evidence about the number of organisations represented.

Non-response bias was assessed by comparing early and late respondents across sector, role, and professional experience. No statistically significant differences were observed (p > 0.10), suggesting that non-response bias within the distributed pool is unlikely to materially affect the findings. As with any purposive sample, however, generalisation beyond the organisations and professional networks accessed should be made with appropriate caution.

5.3. Measures

Three latent constructs were measured using five-point Likert scales (1 = strongly disagree, 5 = strongly agree). All items were adapted from established instruments and translated into Arabic following standard back-translation procedures.

Internal Audit Competency (IAC) was measured with four items adapted from Oussii and Boulila Taktak (2018) and Tawfik et al. (2023). Items captured professional qualifications, technical expertise, continuing professional development, and analytical capacity. Representative items include: “Internal auditors in our organisation possess the professional qualifications required for their roles” and “Our internal audit team demonstrates strong technical expertise in auditing standards.”

Internal Audit Independence (IAI) was measured with four items adapted from Alzeban (2018) and Gramling et al. (2004). Items captured direct reporting lines to the audit committee, independent appointment authority, unrestricted access to records, and budgetary autonomy. Representative items include: “The internal audit function reports directly to the audit committee, not executive management” and “Internal audit has unrestricted access to all organisational records and personnel.”

Internal Audit Technology Adoption (IAT) was measured with four items adapted from Hakami (2025) and Appelbaum et al. (2017). Items captured data analytics tools, enterprise resource planning integration, automated anomaly detection, and digital reporting dashboards. Representative items include: “Our internal audit function uses data analytics tools for continuous auditing” and “We deploy automated anomaly detection techniques in audit procedures.”

The three constructs were specified reflectively, consistent with the multi-item scales from which they were adapted. Technology adoption spans heterogeneous tools and could alternatively be modelled as a composite (formative) organisational condition; the present study retains the reflective specification used in the source instruments and does not reclassify it post hoc without a measurement redesign. Given the marginal internal consistency of the IAT scale (α = 0.677), findings involving this construct are interpreted with corresponding caution.

5.4. Reliability and Validity

The measurement model was assessed using standard criteria: internal consistency reliability (Cronbach’s α and composite reliability ρc), convergent validity (average variance extracted, AVE), and discriminant validity (HTMT ratio). Analyses were conducted using PLS-SEM (SmartPLS 4.1.1.8) with 5000 bootstrap resamples (Hair et al., 2019).

Table 1. Reliability and Convergent Validity.

Construct	α	ρa	CR (ρc)	AVE
Internal Audit Competency (IAC)	0.794	0.836	0.866	0.619
Internal Audit Independence (IAI)	0.831	0.834	0.889	0.668
Internal Audit Technology Adoption (IAT)	0.677 a	0.674	0.805	0.508

Note: ^a The Cronbach’s α for IAT (0.677) is marginally below the conventional 0.70 threshold. However, Cronbach’s α is a conservative estimate of reliability that is sensitive to the number of items and assumes equal indicator weighting. Composite reliability (0.805), which is generally preferred in PLS-SEM, exceeds the recommended threshold. AVE (0.508) surpassed the recommended threshold of 0.50, supporting convergent validity. Findings involving IAT are therefore interpreted with appropriate caution.

reports the reliability and convergent validity statistics.

Composite reliability values ranged from 0.805 to 0.889, exceeding the recommended threshold of 0.70. AVE values ranged from 0.508 to 0.668, each exceeding the threshold of 0.50 required for convergent validity.

Table 2. Discriminant Validity (HTMT Ratios).

Construct Pair	HTMT	90% CI
IAC ↔ IAI	0.830	[0.776, 0.879]
IAC ↔ IAT	0.783	[0.716, 0.847]
IAI ↔ IAT	0.785	[0.719, 0.848]

Note: IAC = Internal Audit Competency; IAI = Internal Audit Independence; IAT = Internal Audit Technology Adoption. All HTMT ratios fall below the conservative threshold of 0.85, and bootstrap 90% confidence intervals for all three construct pairs exclude 1.00 (upper bounds ranging from 0.847 to 0.879), providing statistical confirmation that discriminant validity is established even under the more conservative HTMT inference test (Henseler et al., 2015). The relatively elevated HTMT value for the IAC–IAI pair (0.830) is consistent with the theoretical expectation, developed in Section 3, that competency and independence are closely interdependent governance capabilities. Discriminant validity and substantive construct interdependence are conceptually distinct criteria; the results indicate that the three constructs remain statistically separable while exhibiting the strong interrelationships that motivate this study’s central contribution.

reports the discriminant validity assessment.

5.5. Structural Model Estimation

PLS-SEM was selected as a variance-oriented estimator suited to the pre-specified structural model and to bootstrap-based inference on the direct and indirect pathways; it was not chosen on the basis of sample size, and covariance-based SEM would also be a viable approach for confirmatory testing of this model. The structural model was estimated using PLS-SEM with 5000 bootstrap resamples to obtain standard errors and bias-corrected confidence intervals (Hair et al., 2019). The analysis tested the direct paths specified in H1, H2, and H3, and the indirect path specified in H4. The results of these tests are reported in Section 6.

5.6. Common Method Bias

Because the measures were collected from single respondents in a cross-sectional survey, common method variance (CMV) was assessed cautiously (Podsakoff et al., 2003). Harman’s single-factor test showed that the first unrotated factor explained 28.3% of total variance. A marker-variable analysis using organisational tenure also produced only a small average correlation with the focal constructs (average r = 0.04). These diagnostics do not eliminate CMV, but neither indicates an obvious dominant common-method factor.

In response to the reviewer, we also conducted a model-implied construct-level collinearity sensitivity check. Because the respondent-level latent-variable scores and the original SmartPLS full-collinearity output were not available, this calculation is not presented as Kock’s software-estimated full-collinearity VIF test (Kock, 2015). Instead, the correlation structure implied by the reported standardised structural coefficients was reconstructed (rIAC,IAI = 0.654; rIAC,IAT ≈ 0.620; rIAI,IAT ≈ 0.627), and each construct was regressed on the other two. The resulting VIFs were approximately 2.001 for IAC, 2.030 for IAI, and 1.887 for IAT, all below 3.3. Appendix A reports the derivation and limitations of this sensitivity diagnostic.

Taken together, the Harman test, marker-variable result, and model-implied collinearity sensitivity check do not indicate an obvious dominant common-method pattern. Nevertheless, none of these post hoc diagnostics can rule out CMV in a single-respondent design, and the findings are interpreted accordingly.

6. Results

Table 3. Direct Path Coefficients.

H	Path	β	SD	t	p	95% CI
H1	IAC → IAI	0.654	0.027	24.153	<0.001	[0.599, 0.705]
H2	IAC → IAT	0.366	0.048	7.705	<0.001	[0.271, 0.458]
H3	IAI → IAT	0.388	0.045	8.665	<0.001	[0.300, 0.475]

Note: IAC = Internal Audit Competency; IAI = Internal Audit Independence; IAT = Internal Audit Technology Adoption. All paths statistically significant at p < 0.001.

reports the direct path coefficients for H1, H2, and H3.

Hypothesis 1 predicted that internal audit competency is positively associated with structural independence. The results support this hypothesis: the path coefficient is strong and significant (β = 0.654, p < 0.001). Hypothesis 2 predicted a positive association between competency and technology adoption; this hypothesis is also supported (β = 0.366, p < 0.001), though the direct association is more moderate than the competency–independence relationship. Hypothesis 3 predicted that structural independence is positively associated with technology adoption; this hypothesis is supported (β = 0.388, p < 0.001), with a path coefficient comparable in magnitude to that from competency to technology adoption.

Table 4. Indirect Effect (H4).

Path	Indirect β	SD	t	p	95% CI
IAC → IAI → IAT	0.254	0.032	7.892	<0.001	[0.191, 0.317]

Note: IAC = Internal Audit Competency; IAI = Internal Audit Independence; IAT = Internal Audit Technology Adoption. The confidence interval excludes zero, supporting H4. VAF = 0.254/(0.254 + 0.366) = 0.41.

reports the test of the indirect effect specified in H4.

Hypothesis 4 predicted that structural independence transmits a significant indirect effect between competency and technology adoption. The results support this hypothesis: the indirect effect is significant (β = 0.254, p < 0.001), its confidence interval excludes zero, and the variance accounted for (VAF) of 41% indicates that a substantial portion of the competency–technology association is routed through independence.

Table 5. Coefficients of Determination (R²).

Endogenous Construct	R2	Adjusted R2
Internal Audit Independence (IAI)	0.428	0.426
Internal Audit Technology Adoption (IAT)	0.470	0.467

reports the explained variance for the two endogenous constructs.

Competency explains 43% of the variance in structural independence, and competency and independence together explain 47% of the variance in technology adoption. These results establish the pattern estimated in the theory-guided specification, but they do not by themselves establish that this directional ordering is unique.

Post Hoc Competing-Model Sensitivity Analysis

To address this issue, we reconstructed the correlation structure implied by the reported standardised paths and compared all six complete recursive orderings of the three constructs. Because a complete three-variable recursive model is saturated, these alternative orderings are covariance-equivalent: each can reproduce the same model-implied correlation matrix. The exercise therefore cannot identify a statistically superior causal direction. It does, however, show that the original IAC → IAI → IAT ordering is one admissible representation of a strongly interrelated three-construct structure, while other orderings remain observationally compatible with the same cross-sectional covariance pattern. Appendix B reports the calculations. Accordingly, the original ordering is retained as a theory-guided specification, not as an empirically unique ordering.

7. Discussion

The findings reported in Section 6 are consistent with the governance capability system conceptualisation advanced in Section 3, in which competency, independence, and technology adoption are systematically interrelated rather than independently distributed. This section considers the substantive interpretation of each association in turn.

The association between competency and independence (β = 0.654) is the largest of the three direct associations. Its magnitude is consistent with the expectation that competent auditors accrue credibility with boards and audit committees, which in turn facilitates the granting of structural autonomy. However, the cross-sectional design cannot determine whether competency enables independence, independence enables competency, or both are jointly driven by unobserved organisational characteristics; all three interpretations are theoretically plausible. The defensible conclusion is that competency and independence are systematically co-present in respondents’ assessments at levels inconsistent with independent variation a pattern consistent with a governance capability system shaped by shared organisational conditions and by institutional pressures for coherent governance modernisation.

The moderate and comparable paths from competency (β = 0.366) and independence (β = 0.388) to technology adoption indicate that technology adoption is associated with both capabilities in the theory-guided specification. The indirect effect (β = 0.254; VAF = 41%) shows that a substantial portion of the model-implied competency–technology association is represented by the pathway through independence. The post hoc sensitivity analysis qualifies the interpretation: alternative complete recursive orderings are covariance-equivalent, so the cross-sectional data do not establish independence as the uniquely determined connecting capability. The original ordering remains theoretically motivated by credibility, absorptive-capacity, and organisational-authority mechanisms.

Taken together, the findings show that the three respondent-rated capabilities are substantially interrelated. This does not make additive regression or SEM invalid, nor does it imply that correlated predictors cannot be estimated separately. Rather, it motivates a different substantive question: whether the pattern of relationships among the capabilities is itself theoretically informative. The governance capability system perspective developed here focuses on that relational structure while recognising that stronger claims about complementarity, configuration, or causal sequencing require designs that directly test those properties.

The institutional theory lens offers a complementary interpretation. The positive associations observed may reflect not only the joint development of governance capabilities under shared organisational conditions, but also institutional isomorphism, whereby regulatory mandates push organisations toward coherent governance configurations (DiMaggio & Powell, 1983). These explanations are not mutually exclusive, and both may be operative in the Saudi context. Research disentangling organisation-driven co-development from institutionally driven convergence would be theoretically valuable.

8. Theoretical Implications

This study contributes to internal audit governance research by providing evidence that internal audit competency, independence, and technology adoption do not vary independently in respondents’ assessments of organisational capabilities. Prior research has established that each of these capabilities individually relates to governance outcomes (Endaya & Hanefah, 2016; Joshi & Karyawati Purba, 2022; Lenz & Hahn, 2015); the present study extends this literature by examining how these capabilities relate to one another, documenting shared variance (R² = 0.43–0.47) and a significant indirect pathway (VAF = 41%).

8.1. From Additive to Systemic Logic

Additive regression and SEM can accommodate correlated predictors and do not require orthogonality. The distinction advanced here is therefore substantive rather than statistical. Outcome-focused additive models ask for the partial association of each capability with an outcome, whereas the present study asks whether relationships among the capabilities themselves are theoretically informative. The results indicate substantial interrelationships among the three respondent-rated capabilities. Researchers may therefore benefit from reporting and interpreting this relational structure alongside, rather than instead of, conventional outcome-focused models.

8.2. A Systems Perspective on Governance Capabilities

The pattern of positive associations, substantial explained variance, and the theory-guided indirect pathway is consistent with the proposed governance capability system conceptualisation. The competing-model sensitivity analysis also shows that this evidence does not uniquely identify independence as the connecting capability. This perspective does not require, and this study does not claim, that the capabilities multiply one another’s effects on downstream outcomes; that question remains open and would require an outcome-based design. What the present evidence supports is a more modest but still consequential claim: the capabilities are sufficiently interrelated that their associations with one another not only their separate associations with outcomes are a meaningful object of study in their own right.

8.3. Integration of RBV and Institutional Theory

The finding that governance capabilities co-occur systematically is consistent with the broader resource-based proposition that organisational resources do not operate in isolation (Barney, 1991; Barney & Arikan, 2001). The integration of institutional theory adds an important qualification: in a reform-intensive setting, the observed governance capability structure may reflect coercive pressures for governance modernisation as much as organisation-driven co-development of capabilities. When organisational practices converge under institutional pressure, the resulting associations among practices may partly be artefacts of regulatory compliance rather than evidence of organisation-level systemic development. Comparative research across institutional contexts with varying regulatory intensity would help clarify which mechanism is primary.

9. Practical Implications

Although the data were collected in Saudi Arabia, the practical questions the findings raise how internal audit capabilities should be evaluated, developed, and resourced as a set face boards, audit committees, and internal audit leaders in any jurisdiction.

9.1. For Boards and Audit Committees

Boards and audit committees evaluating internal audit effectiveness should assess the entire capability configuration rather than focusing on any single dimension. A function with sophisticated technology but limited competency or weak independence may represent an imbalanced configuration that delivers the visibility of governance investment without its substance. Where capability assessments diverge substantially technology adoption high, competency or independence low this warrants inquiry into whether the technology investment is being deployed within a governance configuration capable of supporting its effective use. Because the three capabilities are strongly interrelated, committees should also expect that interventions targeting one capability, such as a technology investment, will not occur in isolation from the function’s standing on competency and independence, and may be more or less effective depending on that standing. Evaluating capabilities jointly, rather than as a checklist of separately scored items, follows directly from the capability structure documented here.

9.2. For Chief Audit Executives

For Chief Audit Executives, the findings suggest that capability development is more productive when pursued as a portfolio than in isolation. Investing heavily in technology while neglecting competency or independence may yield limited returns, given that competency and independence together explain 47% of the variance in technology adoption. Independence’s apparent connecting position also gives Chief Audit Executives a concrete argument in resourcing discussions: structural protections functional reporting to the audit committee, budgetary autonomy, unrestricted data access are not merely compliance features but appear bound up with the function’s ability to translate professional expertise into technological capability. The appropriate implication is not a prescribed developmental sequence, which cross-sectional data cannot support, but that balanced investment across all three dimensions is likely to be more effective than concentrated investment in any single capability.

9.3. For Internal Auditors

For practising internal auditors, the findings underscore that professional development and technological fluency are complements rather than substitutes. Auditors who build recognised expertise strengthen the credibility on which structural autonomy rests, and that autonomy in turn appears associated with the conditions under which advanced audit technologies can be deployed meaningfully. Individual investment in certification, data analytics skills, and professional standards is therefore best understood as contributing to a wider capability system, not only to personal advancement.

9.4. For Regulators, Global Professional Bodies, and Saudi Policymakers

For regulators and standard-setters, the findings suggest that governance reform programmes may be more effective when designed around integrated capability frameworks rather than isolated mandates. Requirements focused exclusively on technology adoption may achieve little in organisations that lack the competency to implement technology responsibly or the independence to deploy it in the service of governance rather than management. For global professional bodies such as the Institute of Internal Auditors and national institutes, the interdependence perspective implies that professional development pathways, competency frameworks, and maturity models should address competency, independence, and technology as elements of a single capability system rather than as independent dimensions. Training focused exclusively on technical competency may have limited impact where structural independence is absent or technology adoption remains low; integrated frameworks that assess and develop the three capabilities jointly would better equip the profession for an evolving governance environment.

For Saudi policymakers specifically, these findings have implications for the implementation of Vision 2030 governance reforms. The Capital Market Authority and other regulatory bodies could consider developing integrated governance capability frameworks that encourage organisations to assess and develop competency, independence, and technology adoption jointly. For example, corporate governance codes could include provisions that require audit committees to report not only on whether technology has been adopted, but also on whether the internal audit function has the competency to use that technology effectively and the structural independence to deploy it in the service of governance objectives. This would help prevent technology investments from becoming symbolic rather than substantive governance improvements.

10. Limitations

Several limitations constrain the interpretation of the findings and suggest directions for future research.

The cross-sectional design prevents causal inference, and relational language “associated with,” “linked to” has been used throughout. Nevertheless, three forms of endogeneity are relevant. Omitted variable bias may be present: unobserved factors such as board quality, organisational culture, or firm size may influence all three capabilities simultaneously, producing the observed associations independently of any underlying systemic structure. Reverse causality cannot be excluded: independence may strengthen competency, and technology adoption may enhance credibility perceptions in ways that feed back into both. Measurement error in the self-report instrument may also attenuate or amplify estimated associations. These forms of endogeneity are inherent to single-wave survey designs; they are mitigated, though not eliminated, by the theoretical grounding of the hypothesised relationships and by the consistency of the findings with prior research on each pairwise capability relationship.

The reliance on self-reported perceptions introduces additional concerns. Respondents may overstate their organisation’s capabilities, and perceptual biases may generate correlations among self-reported measures that do not correspond to objective co-variation. Future research could supplement self-report data with objective indicators certification rates, reporting structure documentation, technology expenditure records that are not subject to common-source contamination.

The single-country sample limits generalisability. Saudi Arabia under Vision 2030 is an unusually active reform environment, and the institutional pressures that may partly drive the observed associations are context specific. The findings may not apply to countries with different governance traditions, regulatory environments, or reform intensities. Cross-national replication is essential to establish whether the governance capability structure observed here reflects context-specific institutional dynamics or more general patterns of capability co-development.

The marginal internal consistency of the technology adoption scale (Cronbach’s α = 0.677) is a further limitation. Although composite reliability exceeds the conventional threshold, the alpha value suggests modest item-level consistency, and findings involving the IAT construct should be interpreted with appropriate caution. Scale refinement or expansion is recommended in future research.

The empirical unit of analysis also warrants caveat. The 397 responses represent professional assessments of organisational capabilities, not 397 verified independent organisations. Because the available dataset does not contain organisation identifiers, the number of distinct organisations and the extent of any within-organisation clustering cannot be established. Consequently, standard errors may be optimistic if substantial clustering is present, and organisation-level generalisation should be made cautiously. Future research should retain organisation identifiers and use clustered or multilevel designs where multiple respondents represent the same organisation.

Finally, the study examined only three governance capabilities. Whether the systemic interdependence perspective extends to capabilities such as strategic risk assessment, stakeholder engagement, or regulatory expertise remains an open question.

11. Future Research Directions

Several productive directions for future research emerge from this study. Longitudinal designs tracking the same organisations over multiple periods would permit direct examination of whether governance capability configurations are stable, whether capabilities develop in sequence, and whether changes in one capability precede or follow changes in others. Such designs would also enable stronger causal inference than cross-sectional surveys can support.

Cross-national replication is essential to assess generalisability. Comparing organisations in countries with differing governance traditions, regulatory frameworks, and reform trajectories would help determine whether the capability structure observed in Saudi Arabia reflects general patterns of capability co-development or context-specific institutional dynamics. Countries with limited regulatory mandates for governance modernisation would provide a useful contrast for disentangling organisation-driven co-development from institutionally driven convergence.

Future research should also develop and validate objective measures of governance capabilities to complement the self-reported instruments used here. Certification rates and continuing education records could proxy competency; reporting structure documentation and budget approval processes could proxy independence; software licence counts and technology expenditure data could proxy technology adoption. Triangulating objective and perceptual measures would strengthen the validity of capability assessments and reduce concerns about common method bias.

Expanding the capability set examined would further enrich the systemic interdependence perspective. Whether capabilities such as risk assessment sophistication, regulatory expertise, or stakeholder engagement co-vary with competency, independence, and technology and whether they belong to the same governance capability system are questions the present framework does not address. Configurational methods, including latent profile analysis and qualitative comparative analysis, may be particularly well suited to mapping broader capability configurations in appropriately designed future studies.

Finally, the mechanisms connecting capabilities within the proposed system warrant direct investigation. The indirect effect finding reported here is descriptive: it shows that a substantial portion of the competency–technology association routes through independence, but it does not explain why. Qualitative studies examining how audit committees and Chief Audit Executives perceive the relationships among competency, independence, and technology, and how governance decisions are made in practice, could illuminate the processes that generate the observed structure.

12. Conclusions

This study examined whether three internal audit governance capabilities professional competency, structural independence, and technology adoption exhibit systematic interdependence in professional respondents’ assessments of organisational internal-audit practices. The findings show substantial relationships among the three capabilities and a significant theory-guided indirect pathway through independence, a pattern consistent with the governance capability system conceptualisation developed in this study.

Competency is strongly associated with structural independence, explaining 43% of its variance. Competency and independence together explain 47% of the variance in technology adoption. Independence transmits a significant indirect effect between competency and technology adoption, with a variance accounted for of approximately 41%. These results are consistent across all four hypotheses.

The study extends internal audit governance research by advancing the concept of a governance capability system and providing evidence consistent with treating the relationships among capabilities as a substantive object of inquiry alongside conventional additive modelling. The integration of institutional theory acknowledges that the observed structure may also reflect coercive pressures for governance modernisation in a reform-intensive setting, and future research is needed to disentangle these explanations.

For researchers, the implication is that governance capabilities should be studied as a system rather than as isolated attributes. For practitioners boards, audit committees, Chief Audit Executives, internal auditors, and professional bodies the implication is that capability investment is most likely to yield governance improvements when pursued jointly and with attention to how competency, independence, and technology relate to one another. Despite its limitations, this study provides empirical grounds for re-examining how governance capabilities are conceptualised: not as additive modules, but as elements of an interrelated governance capability system.