Internal Audit of Pension Funds: The Case of Georgias Funded Pension Scheme

Abstract

DOI kodi: 10.52340/ekonomisti.2026.03.03 Annotation. Funded pension schemes in emerging economies are growing rapidly and accumulating substantial assets on behalf of millions of participants, placing exceptional demands on governance, risk management, and the internal audit function. This paper examines the extent to which Georgia’s funded pension scheme’s institutional, governance, and control framework conforms to international internal audit standards and the best practices of leading jurisdictions. The study employs a qualitative-analytical design, whose methodological foundation comprises the Internal Audit Capability Model (IA-CM) for the public sector, developed by the IIA Research Foundation and the World Bank; the Ambition Model of the Netherlands chapter of the Institute of Internal Auditors (the edition aligned with the Global Internal Audit Standards 2024 and effective from 9 January 2025); and the quality-assessment framework of the OECD/SIGMA Principles of Public Administration (2023). The study also draws on PEMPAL IACOP guidance, while the comparative evidence base includes a content analysis of the prudential regimes of Australia (APRA), Finland (FIN-FSA), and the Netherlands (DNB), along with a detailed review of Georgian legislative and operational documentation. Drawing on the IA-CM (MacRae & Sloan, 2017) and Ambition Model (IIA Netherlands, 2025) frameworks, an analysis of public sources indicates that the scheme’s legal independence, prudential oversight, and investment framework are highly mature (Level 3 — Integrated). At the same time, as is frequently observed in young funded schemes in emerging markets, the operational and technological dimension of internal audit — principally data-analytics and continuous-auditing capabilities — constitutes the main frontier for development. The paper treats the Georgian scheme as an illustrative case and not as the outcome of an internal audit of a particular institution. Accordingly, the paper offers an adapted IA-CM and Ambition Model and a phased operational roadmap, thereby addressing a gap in the literature on pension reform in emerging markets. Keywords: internal audit; pension fund; Three Lines Model; Georgia. Introduction Pension funds are among the largest groups of institutional investors in the global financial system. They manage substantial long-term assets on behalf of millions of beneficiaries and operate in an increasingly complex regulatory and investment environment (OECD, 2020). Under these conditions, the internal audit function has become a critical element of financial stability and sound governance. In contemporary understanding, the role of internal audit is evolving from traditional compliance testing toward managing strategic risks and creating organizational value (Appelbaum et al., 2017). Georgias funded pension scheme reflects this global trend. The scheme came into operation on 1 January 2019 and is mandatory for the majority of employees (Law of Georgia on Funded Pensions, 2018). Over a comparatively short period of operation, it has accumulated significant assets and a broad participant base, which objectively increases the importance of governance, control, and independent assurance. Statement of the problem and the gap in the literature Most academic literature on internal audit and corporate governance in pension funds draws on experience from developed markets — particularly Anglo-Saxon and Western European jurisdictions (for example, APRA, 2016; De Nederlandsche Bank, n.d.). Young, mandatory funded schemes in emerging markets have been studied far less systematically. This creates a gap in knowledge (a literature gap): comparatively little is known about how the internal audit and control function is arranged in such schemes, and about the extent to which they achieve convergence with international standards at an early stage of institutional development. The Georgian case is particularly interesting for filling this gap. The scheme is both young and rapidly growing, and the central bank (National Bank of Georgia, n.d.) supervises its investment activity. Analysis of the Georgian scheme therefore offers an opportunity to examine the applicability of international standards and the dynamics of transformation in an emerging market context. Research questions and objectives The paper addresses the following research questions: Which core standards and principles do the leading international organizations (IIA, COSO, OECD, SIGMA) establish for the internal audit and control of pension funds? How do leading jurisdictions — Australia, Finland and the Netherlands — implement these standards in practice? To what extent does the institutional, governance and control framework of Georgia’s funded pension scheme conform to these standards and to best practice, as measured by the IA-CM and the Ambition Model? What phased steps would strengthen the scheme’s risk-oriented internal audit and its digital capabilities? Contribution and structure of the paper The paper’s scholarly contribution is threefold. First, it adapts internationally recognized public-sector models — the IA-CM and the Ambition Model of the Netherlands chapter of the Institute of Internal Auditors — to the specific context of pension funds. Second, it conducts an in-depth gap analysis of the Georgian scheme, taking into account the principles of PEMPAL IACOP and SIGMA (2023). Third, it offers empirically grounded operational recommendations. Theoretical framework and literature review The evolution of the role of internal audit In contemporary understanding, internal audit is an independent, objective assurance and consulting activity that creates and enhances organizational value (IIA, 2024). The academic literature emphasizes the shift from transactional testing towards a risk-oriented, strategic approach (Moffitt et al., 2018; Vasarhelyi et al., 2015). Standards and frameworks of the international organizations The Global Internal Audit Standards of the Institute of Internal Auditors (IIA Global Internal Audit Standards, 2024). The 2024 Global Internal Audit Standards of the Institute of Internal Auditors, which took effect on 9 January 2025, are structured into 5 domains, 15 principles, and 52 standards. The five domains are: (I) the purpose of internal auditing, (II) ethics and professionalism, (III) governing the internal audit function, (IV) managing the internal audit function, and (V) performing internal audit services (IIA, 2024). The COSO framework. The 2013 COSO internal control framework comprises 5 components and 17 principles, while the 2017 ERM framework integrates risk with strategic management (COSO, 2013, 2017). The OECD guidelines. The OECD core principles of private pension regulation (OECD, 2016) and the guidelines for pension fund governance (OECD, 2009) establish international standards for governance and investment risk management. The SIGMA principles (2023). Principle 27 of the OECD/SIGMA Principles of Public Administration (2023) defines the role of internal audit in improving the management of public administration bodies and constitutes one of the core indicators for monitoring the European Union enlargement process (OECD, 2023). The Three Lines governance model According to the Institute of Internal Auditors’ Three Lines Model, the first line manages risk, the second line monitors and ensures compliance, and the third line (internal audit) provides independent assurance to the governing board (IIA, 2024). Research methodology and international maturity frameworks This paper employs a qualitative-analytical research design. The assessment of internal audit maturity rests on international models recognized in the public and social sectors: the IA-CM (Internal Audit Capability Model) framework of the IIA Research Foundation and the World Bank (MacRae & Sloan, 2017), the Ambition Model of IIA Netherlands, and PEMPAL IACOP guidance. The analysis relies exclusively on publicly available documentation — legislative acts, the open frameworks of international regulators and published aggregate statistics — and is illustrative and analytical in character. Its purpose is to demonstrate the applicability of international frameworks using the example of a young mandatory scheme in an emerging market, and not to conduct an internal audit of any institution or to provide a public diagnosis of its control weaknesses. The IA-CM, IIA Ambition Model and PEMPAL IACOP frameworks The maturity-assessment instrumentation used in this study combines the following authoritative sources: Internal Audit Capability Model (IA-CM) for the Public Sector: a five-level model (Initial, Infrastructure, Integrated, Managed, Optimizing) developed by the IIA Research Foundation and the World Bank, which assesses internal audit across 6 core elements (Institute of Internal Auditors Research Foundation, 2009; MacRae & Sloan, 2017). IIA Ambition Model: a model developed by the Netherlands chapter of the Institute of Internal Auditors and aligned with the Global Internal Audit Standards 2024, which applies the five-level hierarchy of the IA-CM and rests on the standards in force from 9 January 2025 (IIA Netherlands, 2025). PEMPAL IACOP and SIGMA (2023): the quality-assurance guidance of the Internal Audit Community of Practice (IACOP) of the Public Expenditure Management Peer-Assisted Learning (PEMPAL) network (PEMPAL IACOP, 2020) and the indicators of the SIGMA Principles of Public Administration (2023) (OECD, 2023). Levels of internal audit maturity (according to the IA-CM / Ambition Model) On the basis of a synthesis of the international frameworks, maturity is assessed across 5 hierarchical levels: Level 1 — Initial: ad hoc, unsystematic, manual performance; no formal practice exists. Level 2 — Infrastructure: established baseline procedures and infrastructure, but limited technology. Level 3 — Integrated: standardized, risk-based auditing, full independence, use of data analytics. Level 4 — Managed: management of processes by quantitative measures, continuous auditing, automation of internal control. Level 5 — Optimizing: continuous innovation, artificial-intelligence and machine-learning technologies, strategic value at the business level. Table 1 presents a maturity matrix adapted to the context of a pension scheme, based on the IA-CM, the Ambition Model and the SIGMA (2023) frameworks. Table 1. Levels and elements of internal audit maturity (adapted from the IIA/World Bank IA-CM, the IIA Ambition Model and the SIGMA 2023 frameworks) Dimension / Element Level 1 (Initial) Level 2 (Infrastructure) Level 3 (Integrated) Level 4 (Managed) Level 5 (Optimizing) 1. Role and independence No mandate Administrative subordination Functional reporting to the board Full autonomy and resources Strategic partnership 2. Professional practice Reactive inspection Compliance auditing Risk-based auditing (RBA) Quantitative risk analytics Continuous improvement 3. Governance structure Opaque allocation Formal audit committee Unified board and committee Independent experts Global benchmark 4. Risk management and COSO Localized review Traditional compliance Integrated COSO ERM Predictive risk analytics AI-enabled ERM 5. Accountability Minimal information Annual reporting Public dashboards Real-time reporting Interactive portal 6. Audit technologies Manual review Excel/Word documentation Data analytics and CAATs Continuous auditing and RPA AI/ML forecasting Source: the author’s adaptation of the IA-CM (MacRae & Sloan, 2017), the IIA Ambition Model (IIA Netherlands, 2025) and the OECD/SIGMA (2023) frameworks. Comparative analysis of international practice Australia (APRA). The Australian Prudential Regulation Authority (APRA) applies the PAIRS methodology and the SPS 510/520 standards, which correspond to Level 4–5 maturity in the IA-CM hierarchy (APRA, 2016, 2021). Finland (FIN-FSA). The Finnish Financial Supervisory Authority (FIN-FSA) conducts a continuous supervisory dialogue (Level 4 maturity) (FIN-FSA, 2019; IMF, 2023). The Netherlands (DNB). The central bank of the Netherlands (DNB) requires three independent key functions (De Nederlandsche Bank, n.d.; IMF, 2017). Notably, the Ambition Model of the Netherlands Institute of Internal Auditors is a global benchmark. Digital transformation in internal audit According to the IA-CM and the IIA Ambition Model, the transition of internal audit from the standardized level (Level 3 — Integrated) to the managed and optimizing stages (Level 4/5 — Managed/Optimizing) requires the quantitative assessment of processes and technological transformation (MacRae & Sloan, 2017; IIA Netherlands, 2025). The contemporary academic literature emphasizes that data analytics, robotic process automation (RPA) and continuous auditing play a decisive role in this process — an approach whose origins date back to the 1990s (Vasarhelyi & Halper, 1991) — while the methodology for its implementation in contemporary audit practice is described in detail in more recent studies (Appelbaum et al., 2017; Moffitt et al., 2018). Integrating data analytics into auditing brings significant opportunities but also methodological and organizational challenges, including those related to data quality and auditors’ competencies (Earley, 2015). The rapid development of artificial intelligence and automation is progressively transforming the auditor’s role (Kokina & Davenport, 2017), although using these technologies requires careful management of ethical risks — transparency, accountability, and bias (Munoko et al., 2020). Accordingly, so-called explainable artificial intelligence (Explainable AI) methods, which ensure compatibility with audit evidence and documentation requirements, have become a topical direction of inquiry (Zhang et al., 2022). In the context of a pension fund, these approaches are particularly relevant for continuously monitoring a large investment portfolio. Gap analysis using the case of Georgia’s funded pension scheme A gap analysis was conducted based on publicly available documentation — the legislative framework and published aggregate indicators — using the IA-CM, the Ambition Model, and the SIGMA (2023) frameworks. The analysis is