The Effectiveness of Internal Audit and Risk Management Implementation on Operational Risk Governance and Operational Performance

Abstract

This study examines how internal audit effectiveness and risk management implementation influence operational risk governance and, in turn, operational performance. Using a quantitative explanatory design and survey data from non-bank financial institutions applying risk-based audit practices, we estimated a PLS-SEM model to test direct and mediated effects. The results show that both internal audit effectiveness and risk management implementation significantly strengthen operational risk governance, which subsequently improves operational performance. Operational risk governance also mediates the effects of the two antecedents on performance. These findings underscore the importance of integrating the Three Lines model with ISO 31000 and COSO ERM to institutionalize risk culture, enhance control effectiveness, and support evidence-based decision making. The study contributes by offering an integrated governance perspective for non-bank financial institutions and provides actionable insights for regulators and practitioners seeking sustainable operational resilience.