Purpose The purpose of this study is to propose a framework for the evaluation of the perceived value internal audit functions add to their organisations. The framework is based on service quality measurement principles, specifically SERVPERF, which is applied to internal auditing. Design/methodology/approach Insights obtained from the literature on internal auditing and service quality disciplines were synthesised to identify and structure value-adding attributes of internal auditing. A thematic analysis of published profiles (by Protiviti) of various organisations’ internal audit functions were analysed and evaluated against those attributes identified in the literature to formulate an evaluation framework based on service quality measurement principles. Findings The identified value-adding attributes were categorised according to the dimensions of the SERVPERF service quality measurement instrument to formulate a framework for evaluation of the value added by internal audit functions. It was found that the SERVPERF dimensions appear to be relevant to internal auditing. The SERVPERF instrument was therefore adapted to evaluate the value added by internal auditing as a service. Practical implications This paper contributes to both the theory and practice of internal auditing by proposing formal dimensions of a value-adding internal audit service which can then serve as a reference point from which to evaluate the value added to an organisation. The framework can serve as a starting point for internal audit functions to develop their service offering and/or form the foundation of stakeholder satisfaction surveys. Originality/value The study contributes to the literature by applying service quality principles to internal auditing. A holistic framework that can be used for the evaluation of the value added by internal audit functions based on stakeholder perceptions is proposed. The framework juxtaposes attributes of value-adding internal auditing with recognised service quality performance measures. The notion of value added is investigated to better understand the concept in the context of internal auditing services.

This paper assesses risk management practices at South African universities by analyzing the extent of risk management disclosure recommended by King IV and the level of risk governance maturity. This study was motivated by #Feesmustfall disruptions, which pointed to the lack of effective risk management, preparedness for volatility and increased scrutiny by stakeholders. A qualitative content analysis using a risk disclosure checklist was conducted on 18 annual reports and analyzed using an exploratory research design. The results revealed that over 80% of the sampled South African universities have disclosed most of their risk management practices, showing an improved disclosure due to King IV’s “apply and explain” philosophy as introduced in 2016. However, there were areas of improvement identified, such as: defining and approval of risk appetites and tolerance; development and implementation of business continuity plans; confirming the unpreparedness for volatility; annual revision of policies; and integration of risk management into the culture and daily activities of the university. This paper builds upon previous studies that highlighted a lack of detailed disclosures in South African organizations’ annual reports. This study also provides interesting insights into the impact of social events on organizational practices and supports the notion that legislative accounting practices should echo stakeholders and societal expectations.