Beyond Institutional Pressures: Understanding Internal Audit Maturity Through The Structuration Theory in Malaysian Publicly Listed Companies

This study explores internal audit maturity (IAM) in Malaysian public-listed companies (PLCs), where audit functions are mandated by Bursa Malaysia’s Main Market Listing Requirements but continue to exhibit uneven practices. Framed by Giddens’ duality of structure, the research ‎evaluates whether IAM extends beyond the “Repeatable” stage, how maturity differs across ‎audit arrangements, and how antecedent adoption contributes to maturity. A content analysis of 200 annual reports was conducted using a checklist aligned with the International Professional Practices Framework (IPPF), and IAM was modelled as a higher-order construct using a two-stage structural equation modelling approach. Discriminant validity concerns led to a ‎reconceptualisation of audit structure, processes, and relationships into a formative construct ‎termed Internal Audit Organisational Capability, with resources maintained as a separate ‎dimension. The findings reveal that the overall level of maturity is modest yet higher than the ‎basic repeatable stage, with in-house functions outperforming outsourced and co-sourced models. ‎These results challenge institutional theory’s expectation of uniform adoption under regulatory ‎pressure and highlight the importance of agentic practices in shaping audit capability. The study ‎contributes by refining the conceptualisation of IAM and demonstrating that maturity arises from ‎both institutional structures and the active agency of auditors.