Factors associated with the adoption of risk-based internal auditing Nuno Castanheira Montepio, Lavra, Portugal Lu ´cia Lima Rodrigues School of Economics and Management, University of Minho, Braga Codex, Portugal, and Russell Craig Department of Accounting and Information Systems, College of Business and Economics, University of Canterbury, Christchurch, New Zealand Abstract Purpose – The purpose of this paper is to analyse company-specific factors associated with adoption of risk-based auditing. It seeks to explore the role of internal auditing in enterprise risk management (ERM). Design/methodology/approach – Findings are drawn from a questionnaire survey, sent in 2006, to all 96 chief internal auditors who were members of the Institute of Portuguese Internal Auditors. Findings – In planning an annual schedule of audits, the adoption of a risk-based approach is statistically significant in international firms ( p # 0.05) and companies listed on the Portuguese stock market ( p # 0.10). There is a strong (but not significant) association between risk-based annual audit planning and entities which are private, in the finance sector, and large. In planning each audit engagement, adoption of a risk-based approach is correlated positively with entity size. Internal auditing is more proactive in the implementation of ERM in smaller organisations, and is more important in the finance industry and the private sector. Practical implications – A better understanding emerges of factors associated with the adoption of risk-based auditing, together with an enhanced appreciation of the role of internal auditing in ERM. Originality/value – The paper reveals the specific characteristics of companies that are associated with the adoption of risk-based approaches in the internal audit process. It is the first paper published about risk-based internal auditing in Portugal. Keywords Internal auditing, Risk management, Portugal Paper type Research paper Introduction The origins of internal auditing were in ancient times (Chun, 1997). However, it was not until the 1940s that the practice of internal auditing began to assume an important role in organizational strategy and management ( Jin’e and Dunjia, 1997; Dittenhofer, 2001). The professionalization of internal auditing has continued steadily since then. Chapters of the Institute of Internal Auditors (IIA) (the internal audit profession’s recognized authority and principal educator) have been established around the world, including in Portugal. The Instituto Portugue ˆs de Auditores Internos (IPAI) The current issue and full text archive of this journal is available at www.emeraldinsight.com/0268-6902.htm Risk-based internal auditing 79 Received 31 October 2008 Revised 9 May 2009 Accepted 5 July 2009 Managerial Auditing Journal Vol. 25 No. 1, 2010 pp. 79-98 q Emerald Group Publishing Limited 0268-6902 DOI 10.1108/02686901011007315