Internal Auditing and Risk Governance in Moroccan Public Hospitals: A Conceptual Framework and Theoretical Propositions for Empirical Validation

Abstract

This article aims to develop a conceptual framework for analyzing the conditions under which internal auditing could contribute to risk governance in Moroccan public hospitals. It draws on several complementary theoretical foundations, including New Public Management, the organizational specificities of hospitals, characterized by professional bureaucracy and the plurality of institutional logics, Enterprise Risk Management (ERM), and the evolution of the roles and organizational positioning of the internal audit function. Building on this theoretical integration, five research propositions are formulated. These address, respectively, the organisational positioning and competencies of internal auditing, the relationship between its assurance and advisory roles, its potential capacity to overcome fragmentation in risk management arrangements, the moderating role of risk culture, and the risks associated with the ceremonial adoption of the internal audit function. The proposed framework is contextualized through secondary documentary sources relating to the Moroccan hospital system, including an action plan from a university hospital, a national survey on risks associated with medical devices, and a case study focusing on haemodialysis. These sources provide contextual illustrations rather than empirical evidence of the effectiveness of internal auditing. Accordingly, the article's contribution lies in developing a context-specific conceptual framework and identifying theoretical relationships whose validity remains to be empirically examined. The absence of direct empirical validation constitutes a limitation of this study and opens avenues for future research within Moroccan public hospitals.