Information Asymmetries and Intra-Company Monitoring: an Empirical Analysis of Nonlinear Relationships Between Company Characteristics and the Size of the Internal Audit Function

The internal audit function (IAF) has become one of the main pillars of good corporate governance. Empirical findings show that the size of the IAF varies considerably across companies. This study analyzes the relationships between selected company characteristics as determinants of intra-company information asymmetries and the size of the IAF as an indicator of intra-company monitoring. We test these relationships by analyzing comprehensive survey data obtained from chief audit executives from 283 Austrian, German, and Swiss companies. Using a nonparametric regression approach, we identify significant nonlinear relationships between company characteristics and IAF size. The empirical analysis identifies threshold levels for several metric company characteristics, such as the number of employees and the number of subsidiaries, whose relationships with the size of the IAF change its intensity.


Introduction
The level of acceptance of internal auditing as a crucial element of good corporate governance has been increasingly acknowledged (e.g., Carcello et al. 2020;Eulerich and Eulerich 2020;Gramling et al. 2004). Internal auditing can be seen as "a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes" that can "add value and improve an organization's operations" (Institute of Internal Auditors 2016). In this context, the Institute of Internal Auditors, the worldwide standard-setting body, as well as other regulating institutions, such as the United States Securities and Exchange Commission and the New York Stock Exchange, require listed companies to implement an internal audit function (IAF). While the benefits of an effective IAF are manifold and well documented in the literature, research that provides reliable empirical insights on IAF is still incomplete (DeFond and Zhang 2014; Christ et al. 2021).
We investigate from an organizational perspective whether and to what extent several company characteristics that largely determine intra-company information asymmetries are associated with different sizes of the IAF of European companies. A special feature of the empirical method applied in this paper is that it takes into account nonlinear relationships between metric company characteristics and the size of the IAF. Also, it directly estimates the effective nonlinear relationships based on the available observations. The empirical results show that there are significant nonlinear relationships between company characteristics, such as the number of employees, the number of subsidiaries, and the intensity with which different stakeholders use IAF, and IAF size. We identify threshold levels for these metric company characteristics whose relationships with the size of the IAF change its intensity. As a result, the identified nonlinear relationships create a more holistic understanding of the determinants of the size of the IAF.
From an overall governance perspective, stakeholders such as the board of directors, the audit committee, and the company's C-level benefit from an effective IAF in various ways. The improvement of financial reporting quality, the reduction of and timely information about risks, the minimization of liability risks, and the improvement of business processes are some of the practical benefits for companies (e.g., Abbott et al. 2016;Carcello et al. 2020Carcello et al. , 2018Ege 2015;Lin et al. 2011;Prawitt et al. 2011). There are also benefits from a more theoretical point of view. The economic necessity of implementing an IAF is often substantiated with the help of the principal-agent theory. In this view, the board of directors and the audit committee act as principals, while the company's employees are the agents who are often better informed than the principals and, therefore, are able to pursue their own objectives by opportunistic actions. Against this background, an effective IAF is able to reduce information asymmetries through assurance services it offers and it is able to increase the probability that opportunistic actions are detected by an effective internal control system. An increased detection probability will likely be anticipated by the company's employees who will then either reduce or stop their opportunistic actions.
Despite the list of possible practical and theoretical advantages, the size of the IAF and its associated resources are the result of current budgets and historic financial investments that typically cannot be linked to (direct) monetary returns. This leads to the controversial situation in which companies tend to reduce the budgets of and investments in the IAF in the short term, which endangers the functionality of the IAF in the long term. This issue is of particular importance for the head of the IAF who is usually denoted as chief audit executive (CAE) according to the Institute of Internal Auditors (IIA 2021). If the number of employees of the IAF and the associated financial budget are not adequate from the CAE's perspective, the IAF might not be able to sufficiently handle the assigned tasks, which include reducing the information asymmetries in the organization and increasing the probability that opportunistic actions are detected. The Institute of Internal Auditors addresses this challenge in its mandatory guidance of the International Professional Practice Framework (IPPF). One core principle defines that an effective IAF "is appropriately positioned and adequately resourced" (Institute of Internal Auditors 2018). Although the IPPF and its associated core principles are a mandatory standard for IAFs, multiple practitioner and research papers highlight the problem of an adequate resource allocation to internal auditing (e.g., Shelton 2018;Calvin 2021;Christ et al. 2021). In any case, the decision on the resource allocation to internal auditing requires valid knowledge on the relationship between company characteristics and the size of the IAF.
Typical drivers of the IAF size can be derived from specific company characteristics which can be theoretically understood as potential determinants of the level of information asymmetries. Although there is already some empirical evidence on the relationship between company characteristics and the size of the IAF, the overall picture is still incomplete as different dependent and independent variables are used. The size of IAF is usually measured in terms of the associated staff (e.g., Alhajri 2017; Anderson et al. 2012;Carcello et al. 2005a;Scarlata 2020, 2021;Goodwin and Kent 2004;Goodwin-Stewart and Kent 2006) or in terms of a monetary figure that captures the resources of the IAF (Anderson et al. 1993;Barua et al. 2010;Carcello et al. 2005b;Jokipii and Di Meo 2019). The variation of the dependent variable further increases as the absolute values of the IAF staff or the IAF budget are transformed by logarithm (e.g., Anderson et al. (2012) apply the logarithmic value of IAF staff and Carcello et al. (2005b) and Barua et al. (2010) apply the logarithmic value of IAF budget).
The applied independent variables vary across the empirical studies but usually cover a comparable range of company and IAF characteristics. These characteristics include the size of the company with regard to assets, sales or employees, the organizational and financial structure of the company, a company's industry, the characteristics of the CAE and the audit committee, and further mostly categorical information on the relationships between IAF, CAE, audit committee, and the external auditor. The metric independent variables that reflect a company's size are sometimes transformed by logarithm (e.g., Carcello et al. (2005b) and Barua et al. (2010) apply the logarithmic value of total assets).
The relationships between the dependent variable that reflects the size of the IAF and the independent variables are always analyzed with linear regression methods (e.g., Anderson et al. 2012;Barua et al. 2010;Carcello et al. 2005a, b;Goodwin-Stewart and Kent 2006). That is a comprehensible approach when there are effective linear relationships. Nevertheless, the effective relationships between the dependent variable and the independent variables might not be observed by applying variables that are artificially compressed by logarithm. Furthermore, linear regression methods are not able to detect nonlinear relationships or natural thresholds, where linear relationships change or actually end. Particularly, linear regression techniques are not able to measure increasing or decreasing marginal relationships, as linear regressions always estimate a constant marginal relationship between dependent and independent variables. Thus, we expect the further utility of investing into the IAF is decreasing after a specific point, which creates a non-linear relationship between the different independent factors and the investment into the IAF. As a result, the determinants of the size of IAF can be analyzed more precisely by applying nonlinear regression methods on effectively observed variables that are not mathematically transformed.
Furthermore, prior studies analyze the size of IAF by applying survey data particularly on US or Australian companies. Although it is likely that the empirical results can also be transferred to the IAF of companies that are located in other countries, empirical evidence is lacking. In particular, there is no empirical evidence on the IAF of three European companies. The different regulatory environment, such as a two-tier board system with C-Level and Supervisory Board in contrast to onetier board system in Anglo-Saxon countries, may affect the relationships between company characteristics and the size of the IAF. The present study fills this research gap by empirically analyzing comprehensive survey data obtained from chief audit executives from 283 Austrian, German, and Swiss companies.
The paper is structured as follows: Sect. 2 reviews the related literature and shows how intra-company information asymmetries that may result from selected company characteristics require a specific level of intra-company monitoring. Sect. 3 describes the survey data used for the empirical analysis and the applied methodology. The results of the empirical analysis are presented in Sect. 4 and discussed in Sect. 5.

Information Asymmetries and Internal Auditing
The separation of ownership and control is one of the main problems identified in the discussion of good corporate governance. Based on the insights of the principal-agent theory introduced by Jensen and Meckling (1976), this separation creates a problematic relationship between company owners (principals) and managers and/or employees (agents). This relationship is characterized by conflicts of interest and information asymmetries between principals and agents. Agents can use their unique information advantages concerning specific information about the company and/or about their work effort. Thus, principals are limited in their ability to monitor and control agents and all inherent processes in which agents are involved (Sarens and Abdolmohammadi 2011). One expedient way to reduce or prevent agents' opportunistic actions that result from their information advantage is the implementation of a powerful monitoring and control mechanism such as an effective IAF.
Various factors influence the existence and extent of information asymmetries. Prior literature suggests that organizational complexity is associated with information asymmetries (e.g., Bens and Monahan 2004;Bushman et al. 2004;Demirkan et al. 2011;Duru and Reeb 2002;Gilson et al. 2001;Liu and Lai 2012) and greater risk (e.g., Carcello et al. 2005a, b;Simon and Francis 1988;Simunic 1980). Substantial information asymmetries occur in complex organizations since the organizational structure, investment projects, or business operations may be widely affected by hidden information (Liu and Lai 2012). For example, a large, diversified company engaging in international activities requires a stricter monitoring and control environment than a local, single-product company due to "information aggregation problems" (Liu and Lai 2012, p. 353;Krane and Eulerich 2020). Thus, existing information asymmetries can be additionally increased by interactions within the intra-company network (Nuijten et al. 2015). Further exogenous factors that influence the existence and extent of information asymmetries are the company's size, legal structure, internationalization, and the associated cultural differences within the company, industry type, and regulatory environment (e.g., Bushman et al. 2004;Duru and Reeb 2002;Liu and Lai 2012).
Organizationally complex companies are characterized by multiple information asymmetries between audit committees and C-level managers (i.e., principals) on the one hand and employees (i.e., agents) on the other hand. From a principal-agent perspective, internal auditing can be considered as a monitoring and control function performed by principals to reduce or prevent the consequences of the described information asymmetries through assurance and advisory services (Adams 1994;Anderson et al. 1993;DeFond 1992;Ettredge et al. 2000;Sarens and Abdolmohammadi 2011). The larger the consequences of existing information asymmetries are, the higher is the need for effective and efficient monitoring and control activities. A qualified IAF can help in such a situation by acting as a trusted assurance provider for the audit committee and top management (Sarens et al. 2009). Thus, there is a demand for a broad variety of internal audit activities.
Although the tasks of the IAF are not similar to the tasks of external auditing, multiple areas of responsibility are overlapping each other and several applied methods are comparable for internal and external audits (e.g., Barr-Pulliam et al. 2021;Sarens et al. 2009;Lin et al. 2011). As both functions help reduce potential information asymmetries between principals and agents, prior research in the field of external auditing can also help extend the knowledge on IAF. Prior research on external auditing reveals a link between (external) audit quality and a reduction in information asymmetries (Dechow et al. 2010). It also demonstrates that high-quality external auditing mitigates possible information asymmetries in financial reporting (Datar et al. 1991;DeFond 1992;Francis and Wilson 1988;Titman and Trueman 1986). Following Dopuch and Simunic (1982), larger external audit companies can provide a higher audit quality and are more likely to detect possible accounting errors and manipulations. Numerous studies provide empirical evidence on the positive relationship between audit firm size and audit quality (e.g., Becker et al. 1998;Francis et al. 1999;Krishnan 2003;Reynolds and Francis 2000). Furthermore, external auditors in larger audit firms tend to have larger and/or more specialized resources and institutionalized professional training programs than external auditors in smaller au-dit firms (e.g., Craswell et al. 1995;Liu and Lai 2012). More financial resources can be used by larger audit firms to undertake higher investments in information technology, and they create the opportunity to increase company-specific knowledge in the long run (Liu and Lai 2012). Although these studies focus on external auditing, the generally comparable nature of internal and external auditing allows a transfer of this line of argumentation to the internal audit setting. The IAF requires a specific amount of resources to fulfill the desired activities and support the audit committee and top management in monitoring the company. As a result, the size of the IAF likely depends on company characteristics and the delegated intra-company tasks and services that at least partially deviate from the services that an external auditor performs.

Company Characteristics and the Size of the IAF
Based on the arguments from the section above, five prior studies (which are closely related to the present study and further described in Table 1) have analyzed company characteristics that explain or influence the size of the IAF. All five studies analyze comparable dependent and independent variables and apply OLS regressions. Four out of the five studies use data from publicly listed U.S. companies. The studies by Carcello et al. (2005a, b) and Barua et al. (2010) directly relate to the regulatory changes of the Sarbanes-Oxley Act due to the time of their data collection. Anderson et al. (2012) analyzes a sample of publicly listed U.S. companies in the subsequent period, 2007-2008, and Goodwin-Stewart and Kent (2006 use a sample of Australian companies. A main common finding of these studies is that the size of the IAF, as measured by either the number of employees in the IAF or the budget of the IAF, increases with the company size and is positively related to specific industries and the oversight function of the audit committee. Furthermore, the studies show that financial information in terms of accounting-based key performance indicators is not related to the size of the IAF. These studies also present contradictory results for the relationships between the number of segments and the size of the IAF and between the number of foreign subsidiaries and the size of the IAF. While Goodwin-Stewart and Kent (2006) find a negative relationship between the number of segments and IAF size, Carcello et al. (2005b) find no statistically significant relationship. With respect to the number of foreign subsidiaries, Anderson et al. (2012) provide empirical evidence for a positive relationship, whereas Carcello et al. (2005b) find no statistically significant relationship for the total number of subsidiaries or the number of foreign subsidiaries. Overall, prior research does not find consistent results that sufficiently describe and explain the size of the IAF.
The existing studies use several explanatory variables that cover the company characteristics, that may relate to the size of the IAF. As previous studies on IAF only apply linear regression techniques, nonlinear relationships between company characteristics and the size of IAF could not be detected. To overcome this shortcoming and to ensure that our results are comparable with previous results we apply comparable company characteristics that likely affect the extent of information asymmetries within a company and therefore justify different sizes of IAF. In particular, K  (1) size, (2) legal structure, (3) internationalization, (4) industry, (5) listing, and (6) integration of the IAF within a company are important company characteristics and proxies for complexity that have the potential to be directly related to the size of the IAF.
1. Company size influences the existing information asymmetries in an organization and increases the probability that agents exhibit opportunistic behavior. Larger companies can be described as more complex than smaller ones since increased numbers of employees, processes, or projects lead to a complex company structure with a branched flow of information, which allows for diverse information asymmetries. While principals' ability to reduce possible information asymmetries and to directly and tightly control operations is very high in small businesses, an increase in company size also increases possible agency costs and the risk of losing direct control over the business (Goodwin-Stewart and Kent 2006). As a result, the implementation of effective internal monitoring and control mechanisms, such as the IAF, is extremely important in larger companies (e.g., Anderson et al. 2012;Wallace and Kreutzfeldt 1991). 2. The legal structure of a company is another characteristic of this company's complexity that may affect the size of the IAF. The legal structure of a company can be characterized by the number of subsidiaries that are legally independent entities of a company. On the one hand, a larger number of subsidiaries is associated with higher risk and more complex monitoring structures. The challenges in monitoring and controlling numerous subsidiaries are manifold and lead to higher agency costs. The overall governance structure has to work well enough to control the whole legal structure of the company. In particular, all processes and (individual) financial reporting systems must be aligned and evaluated to generate valid information for a consolidated financial statement. Thus, this line of argumentation would justify a greater need for an effective IAF in those companies. On the other hand, the founding of subsidiaries and the creation of separate responsibility areas could simplify the assignment of decisions, decrease information asymmetries, and limit the potential scope of opportunistic actions, such as shirking or empire building at the expense of other business units or the whole company. As a result, it is also plausible that a larger number of subsidiaries decreases the need for a large IAF. The existing empirical evidence is not convincing, as Anderson et al. (2012) take into account only the number of foreign subsidiaries, and Carcello et al. (2005b) find no statistically significant relationship for the total number of subsidiaries. 3. A company's internationalization is another important company characteristic. Internationalization is a common way to extend business activities, enter new markets, or benefit from cost arbitrage effects. Although new markets offer multiple opportunities, new and unknown threats arise as well. Furthermore, the geographical distance between domestic and foreign business activities complicates the monitoring and control measures, and as a result, agents can often act without any direct monitoring. Bartlett and Goshal (1992) summarize that the very act of going international multiplies a company's organizational complexity. Furthermore, high country-related diversification leads to more complex financial reporting pro-cesses (Duru and Reeb 2002). Overall, information asymmetries should increase as internationalization becomes more extensive (e.g., Callen et al. 2005;Khurana et al. 2003;Thomas 1999). As a result, there should be a demand for an extensive IAF when internationalization, e.g., in terms of a high percentage share of foreign sales, is extensive. Prior studies have found mixed results for the number of foreign subsidiaries of the organization and the investment in the IAF. While Carcello et al. (2005b) do not identify a significant relationship, Anderson et al. (2012) do. 4. Different studies present empirical evidence that the industry type is directly related to the risk level of a company (e.g., Beasley et al. 1999;Carcello et al. 2005b;Maletta and Wright 1996). Thus, industry-specific regulations about the governance structure can increase the size of the IAF. In particular, we must distinguish between the financial and non-financial industries. The financial industry is highly regulated and can be characterized by large and complex risks that regularly exceed the risks faced by non-financial companies. As a result, financial companies are more likely to implement an extensive IAF than non-financial companies (e.g., Barua et al. 2010;Goodwin-Stewart and Kent 2006;Wallace and Kreutzfeldt 1991). For example, the Basel Committee on Banking Supervision (2011) offers guidance on organizing the IAF in banks, and it promotes the IAF as the "third-line of defense" (Basel Committee 2011; ECIIA and FERMA 2010) and as a crucial part of the internal banking supervision system. Thus, the average size of internal audit functions in the banking industry is significantly larger than in the non-regulated industry. Based on these compliance challenges and the described company risk, the complexity of monitoring and controlling the business can be assumed to be higher in financial companies than in non-financial companies, and it will lead to a higher investment into IAF staffing. 5. An additional company characteristic is the listing status. Contrary to non-listed and family-owned companies, listed companies exhibit larger agency conflicts due to the strict separation of ownership and control. The public relevance and associated stakeholder needs of most listed companies also increase the complexity of listed companies and the overall risk level, as every (negative) development can directly influence the stock price (Anderson et al. 2012). The regulatory environment of listed companies requires or at least encourages the implementation of an IAF. In general, listed companies have stricter requirements regarding their governance structure, IAF, and internal controls (e.g., NYSE Listed Manual Section 303A.07(c) (NYSE 2013); Notice of Filing of Proposed Rule Change to Require that Listed Companies Have an Internal Audit Function (SEC 2013)). These stricter requirements increase the demand for higher external audit quality and better internal auditing (DeFond and Zhang 2014). As a result, listed companies should implement an extensive IAF to increase the effectiveness of other governance mechanisms and to signal management quality to shareholders. 6. The integration of the IAF within a company and its relationship with different stakeholders, such as external auditors and regulators, are determining factors of an effective IAF as well (Eulerich et al. 2017;Sarens and De Beelde 2006). In particular, interactions with the C-level and the supervisory board (two-tier board model) and/or audit committee (one-tier model) play a crucial role in aligning the focus and activities of the IAF. The audit committee and the C-level should protect owners' investment by monitoring, e.g., the organizational risk, the internal control system, and the financial reporting process (DeZoort et al. 2002;Sarens and Abdolmohammadi 2011;Spira 2002). The audit committee and/or the C-level is in charge of this task, as they decide on the budget and other resources that should be used for the IAF (Eulerich et al. 2017). Possible ways to discuss the integration of the IAF within the company and its relationship to external stakeholders are manifold. One plausible argumentation could be that, e.g., a strong audit committee is a substitute for further control activities and thus reduces the demand for an extensive IAF. Another interpretation could be that different internal and external stakeholders desire an extensive IAF as a supportive partner and a useful source of information to perform their tasks (Raghunandan et al. 2001;Sarens and Abdolmohammadi 2011;Sarens et al. 2009;Scarbrough et al. 1998).
That demand would justify the formation of an extensive and powerful IAF. Nevertheless, different objectives and tasks of internal and external stakeholders are always an additional challenge for the IAF. If the IAF closely cooperates with different stakeholders in the organization, the IAF must satisfy more interests and thus perform more tasks. As a result, extensive use of the IAF requires appropriate equipment with financial and staff resources to fulfill all objectives.
The theoretical reasoning and the empirical findings with respect to the extent of the IAF emphasize that there is a relationship between the intra-company information asymmetries and the need for monitoring through an effective IAF. In particular, increasing intra-company information asymmetries should require a more extensive intra-company monitoring which could be facilitated by an adequately equipped IAF. To empirical analyze this conceptual hypothesis we have to operationalize intracompany information asymmetries and the extent of intra-company monitoring. In the following, the intra-company information asymmetries are operationalized by a range of company characteristics and the extent of intra-company monitoring is operationalized by the size of the IAF.

Sample Based On Survey Data
Our initial sample is based on a large by-invitation-only web-based survey. We developed the survey in cooperation with the national IIA chapters from Austria, Germany, and Switzerland, and the questionnaire was pretested by seven CAEs from different organizations. The national chapters of the Institute of Internal Auditors provided the data under the conditions of anonymity and confidentiality. Therefore, respondents cannot be identified and there is no information other than what was asked for in the questionnaire (e.g., no financial indicators). Country effects should be very limited within the sample, as all three countries have a comparable regulatory environment and tradition with regard to the IAF, although Austria and Germany have a two-tier board model and Switzerland has a one-tier board model as the U.S. Especially since the guidelines of the International Professional Practice Framework published by the Institute of Internal Auditors serve as the worldwide IAF framework, our data and our results are transferrable to other countries.
The questionnaire contained more than 100 questions from multiple areas of internal auditing (including the organization of the IAF, relationships with different stakeholders, and quality management). The full questionnaire is available as an online appendix. Of 1916 questionnaires sent, 415 were returned (response rate of 21.7%). Of the returned questionnaires, 283 were completely and correctly filled out with respect to the 12 variables considered in the following empirical analysis model. As a result, the final sample consists of 283 observations.

Dependent and Independent Variables
The variables used in our empirical analysis were directly derived from the questionnaire. Table 2 lists all variables along with their scales, content, and category. We consider seven metric and four categorical independent variables and one dependent variable in our analysis. The dependent variable is IAF_Size representing the total number of employees in an organization's IAF; it serves as a proxy for the overall size of the IAF.
All metric independent variables are company characteristics that indicate an organization's size and/or complexity and determine the existing information asymmetries within a company. Note that size and complexity characteristics are manifold, may overlap each other, and cover numerous areas of an organization. Furthermore, Signing of the company's audit plan (2) Audit committee and supervisory board sign, (1) either audit committee or supervisory board signs, (0) neither audit committee nor supervisory board signs ACMeet Categorial Meetings between the CAE and the audit committee (1) CAE has private meetings with the audit committee, (0) CAE does not have any private meetings with the audit committee size and complexity are often used as synonyms for dimensions of an organization that are more complicated and difficult to understand, e.g., the IT infrastructure, the existence of an international production process, or different regulatory environments. Of the broad variety of possible company characteristics, we focus on seven metric variables that capture an organization's size and/or complexity and that were mostly used in previous studies on IAF. The metric independent variables include the total number of full-time equivalent employees (Employ), the number of objects that should be covered by the IAF (AudObj), the number of subsidiaries (Sub), the percentage share of foreign sales (ForSales), the percentage share of unplanned audits (UnplAud), the percentage share of working time dedicated to assurance tasks (Assur), and stakeholder intensity (StakeIntens). The metric independent variable StakeIntens covers internal and external stakeholders' needs with respect to the IAF. Using a five-point Likert scale with the range [1; 5], the participants rated the extent to which six different stakeholders use the IAF and its outcomes. The six stakeholders are the supervisory board, the audit committee, the C-level (including the CEO and CFO), the external auditor, the regulator, and the auditee. The metric independent variable StakeIntens is the sum of the six ratings of the six stakeholders and ranges within the interval [6; 30].
The categorical variables capture further company characteristics and intra-company relationships. The dummy variable Industry indicates whether the company has an affiliation with the finance or insurance sectors. The dummy variable Listing indicates whether the company is listed on the stock market. Furthermore, we include the relationship between the CAE and the audit committee. The way in which the audit plan is approved is covered by the variable AudPlanSig, and the dummy variable ACMeet reflects whether the CAE has personal meetings with the audit committee.

Methodology
The relations between the metric independent variables and the dependent variable are analyzed using an additive regression model with polynomial splines (see e.g. Lohmann and Ohliger 2017 for an application in business research). Applying polynomial splines can be very useful when modeling an unspecified function f(·). That approach allows the consideration of nonlinear relationships between each metric independent variable and the dependent variable without any restrictions (Hastie and Tibshirani 1990;Stone 1985). In contrast to a linear model which requires the linearity constraint, the application of an additive regression model allows more precise detection and analysis of the estimated nonlinear relationships. Thereby, an additive regression model can also be applied when the independent variables are not continuously but discretely scaled (Beck and Jackman 1998).
As Eq. 1 shows, the additive regression model consists of the unspecified functions f1(x1), f2(x2), ..., fp(xp). If every unspecified function is a linear function, the additive regression model represents a special case as it coincides with a linear regression model.
Each function f(·) can be modeled by means of a polynomial spline. A spline of rank l > 0 is a function f : [xmin, xmax] ! R with the following attributes: f(·) is a polynomial of rank l within the intervals [kj, kj + 1) with 1 ≤ j < m , and f(·) is (l -1)times continuously differentiable. The range of each independent variable, whose lower and upper limits are xmin and xmax, respectively, is divided into a number of intervals. The boundaries of those intervals are denoted as knots kj with j =1, ..., m . To ensure a sufficient data fit, a separate polynomial of rank l is estimated for each interval. The attribute that f(·) is (l -1)-times continuously differentiable guarantees that in each interval, the polynomials build a spline without discontinuities at the interval boundaries. As a result of this requirement, the function f(·) is smooth (Kneib 2006).
To model the splines, it is possible to use the base functions that relate to either the truncated power series (Hastie and Tibshirani 1990) or the B-spline-base (Kneib 2006). Both approaches involve two subjective design elements: although knots are usually arrayed equidistantly or on the basis of the quantiles, choosing the number m and the position of the knots is subjective. These problems can be avoided if penalized splines are used. More specifically, this method involves using a polynomial spline with a large number of knots to approximate function f(·). The large number of knots ensures that the approximation is flexible, meaning that how the knots are arrayed is not particularly important. To achieve a balance between flexibility and smoothing, it is necessary to establish an additional penalty term for every spline function in the maximum likelihood estimation of the additive regression model. This term penalizes highly different interval-specific polynomials. In the problem of likelihood maximization, the penalty term is weighted with a smoothing parameter λ, which controls the variability of a penalized spline (Eilers and Marx 1996). Higher values of λ decrease the variability of function f(·) and increase the smoothness of function f(·). However, it is not possible to increase both smoothness and adaption to the data simultaneously. For that reason, to objectify the smoothing parameter λ, it is necessary to apply the generalized cross-validation criterion (Eilers and Marx 1996;Green and Silverman 1994). As a consequence, to determine the smoothing parameters, it is necessary to minimize the generalized cross-validation criterion.
We apply penalized splines to model the nonlinear effects of the metric independent variables Employ, AudObj, Sub, ForSales, UnplAud, and Assur. We put each function f(·) in concrete terms by using basic functions of rank g = 3 for each penalized spline and 10 equidistant intervals. The smoothing parameter is determined by the generalized cross-validation criterion. We also use splines to model the independent integer variable StakeIntens, following Beck and Jackman (1998). Equation 2 shows the additive regression model for the dependent variable IAF_Size. We treat the categorical independent variables as dummy variables. We contrast our result with a linear regression model that is given by Eq. 3.

Descriptive Statistics and Correlations
The descriptive statistics of the dependent and independent variables are presented in Table 3. All metric variables are left-hand distributed, as each mean exceeds the corresponding median. That means that there are more observations with small values of the metric variables and that there are fewer observations with large values of the metric variables. One hundred nine observations relate to companies of the finance or insurance sector (38.5%), and 107 observations come from publicly listed companies (37.8%). The categorical variable AudPlanSig shows that in the majority of observations, neither the audit committee nor the supervisory board signs the audit plan (70.0%). Furthermore, the dummy variable ACMeet indicates that the CAE usually has private meetings with the audit committee (24.4%). The analysis uses a multivariate additive model to examine the effects of selected company characteristics on the size of the IAF. To apply this method, we must take into account multicollinearity between the independent variables. Using correlated independent variables in a multivariate additive regression model may make  it difficult to distinguish the effects of each independent variable on the dependent variable. It also affects the standard errors and the statistical significance tests of the corresponding spline estimations and estimated coefficients (Studenmund 2016). In our analysis, we examine the correlations between each pair of independent variables on the basis of the lowest scale of two independent variables. The Bravais-Pearson correlation coefficient measures the correlation between metric independent variables, and Cramér's V measures the correlation between categorical independent variables. Cramér's V also measures the correlation between a metric and a categorical independent variable, provided that the metric independent variable is classified into five categories that are based on quantiles. Table 4 presents the correlations between each pair of independent variables.
The highest correlations occur between the metric independent variables Employ, Sub, and ForSales. This observation is in line with what we expected to find, as an organization's size and complexity are likely to overlap each other and cannot clearly be distinguished. This means that in a regression it is only useful to consider these three independent variables simultaneously when their individual effect on the dependent variable is estimated in separate regressions. The remaining correlations between the metric independent variables are low (< 0.234), so there is no need to apply further restrictions. Furthermore, we find a high correlation between the metric independent variable StakeIntens and the four categorical independent variables.

Regression Results
The estimations of the performed regression models are presented in Table 5. Models 1-4 are additive regression models, while Model 5 is a linear regression model. All regression models use IAF_Size as the dependent variable. Models 1-3 separately take into account the independent variables Employ, Sub, and ForSales, and Model 4 includes all metric and categorical independent variables. With respect to the metric independent variables in models 1-4, the results in Table 5 show the equivalent degrees of freedom dff, which represent the variability of the estimated splines of the metric independent variables and, therefore, the extent of nonlinear relationships.
The value dff = 1 shows that the estimated spline corresponds to a linear function, and the increasing degrees of freedom indicates that the level of nonlinearity increases. The asterisks denote the level of significance, based on the likelihood ratio test that Wood (2017) recommends. The results in Table 5 for the categorical independent variables and the results for the linear regression of Model 5 include the regression coefficients. Again, the asterisks denote the level of significance based on the likelihood ratio test.
The estimations of Models 1-4 indicate that the metric independent variables Employ, Sub, and StakeIntens have a statistically significant effect on IAF_Size. The values of the equivalent degrees of freedom dff show that the metric independent variables Employ, Sub, and StakeIntens have a nonlinear effect on IAF_Size. The constant assumes a statistically significant positive value in each of the four model K estimations and indicates that in general, the sample companies exhibit a significant size of IAF. With respect to the categorical independent variables, our results show that companies in the finance or insurance sectors have a statistically significantly larger IAF_Size than non-financial companies in the sample. Furthermore, the categorical independent variable AudPlanSig shows that IAF_Size decreases when the audit committee and/or the supervisory board sign the audit plan. The adjusted R 2 values show that the model estimations explain a meaningful share of the variance of the dependent variable IAF_Size.
The statistically significant effect of the categorical independent variable Aud-PlanSig on IAF_Size can be explained by the effort of the audit committee and/or the supervisory board to limit the "empire-building" aspirations of the IAF management. The empire-building behavior of managers is well documented in the literature and is theoretically and empirically analyzed (e.g., Hope and Thomas 2008;Jensen 1986Jensen , 1993Naveen 2006). The theory on empire-building assumes that managers can increase their power in an organization by increasing the financial, human, or information resources under their control. The theory can also be applied to an IAF and its responsible managers. If we interpret the signing of the audit plan as an indicator for stricter monitoring of the IAF, the audit committee and the supervisory board can mitigate the empire-building behavior of the IAF.
A comparable observation can also be made for the linear estimation of Model 5. The apparent contrast is that the constant assumes a less statistically significant negative value and that the adjusted R 2 is 20% lower than in Model 4. The reason for that is that Model 5 does not take into account nonlinear relationships between the metric independent variables and IAF_Size. The estimation of Model 5 is distorted and does not capture the actual relationships. However, Model 5 serves as a benchmark, as linear regression was also used in previous studies.
The additive regression estimations in models 1-4 provide empirical evidence that there are nonlinear relationships with respect to the metric independent variables Employ, Sub, and StakeIntens because dff > 1.00. Consequently, to describe the nonlinear effects' direction, we must analyze the spline patterns in detail. Fig. 1 depicts the spline patterns of the metric independent variables that have a statistically significant effect on IAF_Size (Model 4). The black line represents the estimated spline. The value of the metric independent variable is plotted on the x-axis. The effect on the dependent variable is plotted on the y-axis. Higher values on the y-axis denote a higher number of employees in the IAF. Because the number of employees who work in the IAF also depends on the values of the other variables, we cannot use the estimation to determine the total number of employees. The 95% confidence band is shaded gray. To compare the estimated spline patterns with the estimated linear functions, we insert the estimated linear functions of Model 5 as dashed lines. Fig. 1 also depicts the empirical density function of each independent variable as a dotted line with the maximum value on the right side.
The spline pattern of the metric independent variable Employ is split into two parts. Within that range, 0 ≤ Employ ≤ 10,000, the increase in Employ increases IAF_Size. The effect is increasingly reduced. Because most observations are located in the range 0 ≤ Employ ≤ 2000, the 95% confidence band is narrow at relatively small values for Employ. When Employ > 10,000, the positive effect of Employ on K IAF_Size is slightly reversed. However, in this area, the estimation becomes less certain because there are fewer observations, and the 95% confidence band is thus wider. The empirical evidence shows that Employ has a positive effect on IAF_Size and that this positive effect is stopped at a threshold value that is given by Employ = 10,000. That observation is in line with the theoretical model in Sect. 3 as the increase in the number of employees likely increases the information asymmetry to a larger extent when the number of employees is small. One argumentation for why an additional increase in the number of employees does not further increase the IAF's size is that a larger IAF is better able to gain efficiency benefits and realize synergy effects compared to a smaller IAF. In contrast to the estimated spline pattern, the linear function underestimates the positive effect on IAF_Size when a small number of employees increases, and the linear function overestimates the effect on IAF_Size when a large number of employees increases.
The spline pattern of the metric independent variable Sub is also split into two parts. In the first part, an increasing number of subsidiaries decreases the number of employees in the IAF (Sub ≤ 50). An explanation could be based on the assumption that the founding of subsidiaries is useful to separate areas of responsibilities, which simplifies the assignment of decisions and associated results and thus reduces the potential scope of opportunistic actions. An alternative explanation of this empirical finding could be that the probability of preventing or detecting opportunistic actions is decreased when business operations are performed by legally independent subsidiaries. As a result, the cost-benefit consideration leads to a decreasing number of employees in the IAF. Above the threshold Sub > 50, the spline pattern of the metric independent variable Sub is flat. Presumably, the positive effect of the separation of areas of responsibilities is offset by the increasing complexity due to a larger number of subsidiaries. The estimation becomes less certain above the threshold Sub > 50 because there are just a few observations, and the 95% confidence band becomes very wide. In contrast to the estimated spline pattern, the linear function assumes the constant negative effect that an increasing number of subsidiaries has on IAF_Size.
The spline pattern of the metric independent variable StakeIntens shows that increasing stakeholder intensity always increases IAF_Size. That effect intensifies when StakeIntens exceeds the threshold value of approximately 20. This means that the marginal effect of a change in StakeIntens on IAF_Size is larger when stakeholder intensity is high. However, the estimation becomes less meaningful within the peripheral areas because there are fewer observations and the 95% confidence band becomes wider. Although there is a threshold where the effect strength changes, the linear function leads to comparable results.

Discussion
The present study examines whether and to what extent several company characteristics affect the size of the IAF. We rely on responses from 283 CAEs from three different European countries to analyze company-related factors that shape the size of the IAF. We find empirical evidence that company characteristics that affect the level of existing information asymmetries within the company have an effect on the size of the IAF which is an indicator of intra-company monitoring. In particular, IAF size increases with the number of employees (at least until Employ ≤ 10,000) and with the intensity of interaction between the IAF and its internal and external stakeholders. We also provide empirical evidence that the IAF is more extensive when the company belongs to the finance or insurance sectors. Furthermore, the analysis provides the empirical result that the size of the IAF decreases when the number of subsidiaries decreases (at least until Sub ≤ 50) as well as when the audit committee and/or the supervisory board are in charge of the audit plan. Overall, the size of the IAF is considerably more affected by company characteristics that relate to the company's organizational structure (e.g., size, legal structure) than by those that relate to the company's audit tasks (e.g., number of audit objects, unplanned audits). This is in line with the results of Anderson et al. (2012) and extends the perspectives of Carcello et al. (2005a, b) and Barua et al. (2010). Nevertheless, the applied methodology and the identified nonlinear relationships between the independent variables and IAF size create a more holistic understanding of the mechanisms that drive intra-company monitoring.
The effects of selected company characteristics on IAF size could balance each other out, as the effect directions are partially opposed. For example, the size of the IAF is likely comparable in a larger company with a lower number of subsidiaries and in a smaller company with a higher number of subsidiaries. The different relationships between company characteristics and the size of the IAF suggest that a company's organizational structure shapes the existing information asymmetries and, therefore, affects the demand for a more or less extended IAF. The nonlinear spline functions of Employ can be applied as a useful benchmark when the relation between the number of employees and the number of employees in the IAF is analyzed over time. Such a comparison can reveal whether the growth in the number of employees in the IAF keeps pace with the growth in the total number of employees. Furthermore, regulators may use our results to identify company characteristics that can trigger a mandatory need to implement or adjust the IAF. In addition to the scientific contributions, those results offer helpful insights for practitioners.
Despite the empirical evidence, the present study is subject to three different limitations. First, the analysis is based on three European countries with comparable regulatory regimes. Although this international study covers two-tier and one-tier governance frameworks and enhances the understanding of the IAF, it provides empirical findings for a distinct regulatory and cultural environment. To establish whether the obtained results hold for other countries, an international comparative study with more observations is still necessary (Sarens and Abdolmohammadi 2011). Second, we use the number of employees in the IAF as a proxy for IAF size. Contrary to our approach, Carcello et al. (2005b) and Barua et al. (2010) use the IAF budget as a dependent variable. While the budget only indicates the IAF's financial resources, the number of employees in the IAF likely captures at least the quantity in terms of manpower with greater precision. The empirical results will depend on the concrete definition of the dependent variable. Third, as the present study is theoretically grounded on principal-agent theory, other theoretical concepts, such as behavioral theories, are not taken into account when we selected the applied set of independent variables. Taking into account further theoretical approaches could extend the set of explanatory variables and, therefore, could gain further insights on IAF. For example, there are several unconsidered governance factors, such as shareholder structure, corporate strategy, or the activities of other governance functions that could affect the identified relationships. Possible future research should include further governance factors and functions to facilitate a full understanding of the overall governance structure and its influencing factors in the sense of integrated governance.