Opinions on Operations of Internal Auditors Towards Enterprise Risk Management at Chiang Mai University

Abstract

This research aims to study opinions on operations of internal auditors towards enterprise risk management at Chiang Mai university and to provide guidelines for developing the work of internal auditors to manage risks effectively. The study sample consisted of 249 individuals, including 234 members of the risk management committee responsible for developing risk management plans through the Chiang Mai University Risk Management System (CMU-RM), calculated using the Taro Yamane formula, and 15 internal auditors from Chiang Mai University, selected through purposive sampling. Data was collected using questionnaires. The statistical methods used for data analysis included frequency, percentage, mean, standard deviation, analysis of variance (ANOVA), and pairwise comparison using Fisher’s Least-Significant Difference (LSD) at a statistical significance level of 0.05.

          The data analysis revealed that different job positions and durations of work in risk management significantly affect the level of opinion regarding the qualifications of internal auditors according to the International Standards for the Professional Practice of Internal Auditing in risk management at a statistical significance level of 0.05. This is particularly true for knowledge of risk and basic information technology controls, as well as information technology audit techniques. Those holding the position of internal auditor and those with more than 7 years of experience in risk management have significantly lower levels of opinion than other groups. Additionally, differences in the level of opinion regarding the role of internal auditors in the university's risk management in terms of strategy and operations were found, especially in the areas of strategic risk management consulting and information system risk assessment. Internal auditors and those with more than 7 years of experience gave significantly lower levels of opinion than other groups. The research results reflect the limitations in the attitudes and skills of internal auditors, who may focus more on operations than strategic involvement. They also highlight the challenge of enhancing the information technology knowledge and capabilities of internal auditors to align with professional standards and continuously changing risks. The research suggests that internal auditors should be encouraged to understand the organization's strategic direction and develop information technology skills to improve risk management efficiency in accordance with international internal auditing professional standards.