Journal number 3 ∘ Otar Anguridze ∘
Internal Audit of Pension Funds: The Case of Georgias Funded Pension Scheme

DOI kodi: 10.52340/ekonomisti.2026.03.03

Annotation. Funded pension schemes in emerging economies are growing rapidly and accumulating substantial assets on behalf of millions of participants, placing exceptional demands on governance, risk management, and the internal audit function. This paper examines the extent to which Georgia’s funded pension scheme’s institutional, governance, and control framework conforms to international internal audit standards and the best practices of leading jurisdictions. The study employs a qualitative-analytical design, whose methodological foundation comprises the Internal Audit Capability Model (IA-CM) for the public sector, developed by the IIA Research Foundation and the World Bank; the Ambition Model of the Netherlands chapter of the Institute of Internal Auditors (the edition aligned with the Global Internal Audit Standards 2024 and effective from 9 January 2025); and the quality-assessment framework of the OECD/SIGMA Principles of Public Administration (2023). The study also draws on PEMPAL IACOP guidance, while the comparative evidence base includes a content analysis of the prudential regimes of Australia (APRA), Finland (FIN-FSA), and the Netherlands (DNB), along with a detailed review of Georgian legislative and operational documentation. Drawing on the IA-CM (MacRae & Sloan, 2017) and Ambition Model (IIA Netherlands, 2025) frameworks, an analysis of public sources indicates that the scheme’s legal independence, prudential oversight, and investment framework are highly mature (Level 3 — Integrated). At the same time, as is frequently observed in young funded schemes in emerging markets, the operational and technological dimension of internal audit — principally data-analytics and continuous-auditing capabilities — constitutes the main frontier for development. The paper treats the Georgian scheme as an illustrative case and not as the outcome of an internal audit of a particular institution. Accordingly, the paper offers an adapted IA-CM and Ambition Model and a phased operational roadmap, thereby addressing a gap in the literature on pension reform in emerging markets.

Keywords: internal audit; pension fund; Three Lines Model; Georgia.

Introduction

Pension funds are among the largest groups of institutional investors in the global financial system. They manage substantial long-term assets on behalf of millions of beneficiaries and operate in an increasingly complex regulatory and investment environment (OECD, 2020). Under these conditions, the internal audit function has become a critical element of financial stability and sound governance. In contemporary understanding, the role of internal audit is evolving from traditional compliance testing toward managing strategic risks and creating organizational value (Appelbaum et al., 2017).

Georgias funded pension scheme reflects this global trend. The scheme came into operation on 1 January 2019 and is mandatory for the majority of employees (Law of Georgia on Funded Pensions, 2018). Over a comparatively short period of operation, it has accumulated significant assets and a broad participant base, which objectively increases the importance of governance, control, and independent assurance.

Statement of the problem and the gap in the literature

Most academic literature on internal audit and corporate governance in pension funds draws on experience from developed markets — particularly Anglo-Saxon and Western European jurisdictions (for example, APRA, 2016; De Nederlandsche Bank, n.d.). Young, mandatory funded schemes in emerging markets have been studied far less systematically. This creates a gap in knowledge (a literature gap): comparatively little is known about how the internal audit and control function is arranged in such schemes, and about the extent to which they achieve convergence with international standards at an early stage of institutional development.

The Georgian case is particularly interesting for filling this gap. The scheme is both young and rapidly growing, and the central bank (National Bank of Georgia, n.d.) supervises its investment activity. Analysis of the Georgian scheme therefore offers an opportunity to examine the applicability of international standards and the dynamics of transformation in an emerging market context.

Research questions and objectives

The paper addresses the following research questions:

1. Which core standards and principles do the leading international organizations (IIA, COSO, OECD, SIGMA) establish for the internal audit and control of pension funds?
2. How do leading jurisdictions — Australia, Finland and the Netherlands — implement these standards in practice?
3. To what extent does the institutional, governance and control framework of Georgia’s funded pension scheme conform to these standards and to best practice, as measured by the IA-CM and the Ambition Model?
4. What phased steps would strengthen the scheme’s risk-oriented internal audit and its digital capabilities?

Contribution and structure of the paper

The paper’s scholarly contribution is threefold. First, it adapts internationally recognized public-sector models — the IA-CM and the Ambition Model of the Netherlands chapter of the Institute of Internal Auditors — to the specific context of pension funds. Second, it conducts an in-depth gap analysis of the Georgian scheme, taking into account the principles of PEMPAL IACOP and SIGMA (2023). Third, it offers empirically grounded operational recommendations.

Theoretical framework and literature review

The evolution of the role of internal audit

In contemporary understanding, internal audit is an independent, objective assurance and consulting activity that creates and enhances organizational value (IIA, 2024). The academic literature emphasizes the shift from transactional testing towards a risk-oriented, strategic approach (Moffitt et al., 2018; Vasarhelyi et al., 2015).

Standards and frameworks of the international organizations

The Global Internal Audit Standards of the Institute of Internal Auditors (IIA Global Internal Audit Standards, 2024). The 2024 Global Internal Audit Standards of the Institute of Internal Auditors, which took effect on 9 January 2025, are structured into 5 domains, 15 principles, and 52 standards. The five domains are: (I) the purpose of internal auditing, (II) ethics and professionalism, (III) governing the internal audit function, (IV) managing the internal audit function, and (V) performing internal audit services (IIA, 2024).

The COSO framework. The 2013 COSO internal control framework comprises 5 components and 17 principles, while the 2017 ERM framework integrates risk with strategic management (COSO, 2013, 2017).

The OECD guidelines. The OECD core principles of private pension regulation (OECD, 2016) and the guidelines for pension fund governance (OECD, 2009) establish international standards for governance and investment risk management.

The SIGMA principles (2023). Principle 27 of the OECD/SIGMA Principles of Public Administration (2023) defines the role of internal audit in improving the management of public administration bodies and constitutes one of the core indicators for monitoring the European Union enlargement process (OECD, 2023).

The Three Lines governance model

According to the Institute of Internal Auditors’ Three Lines Model, the first line manages risk, the second line monitors and ensures compliance, and the third line (internal audit) provides independent assurance to the governing board (IIA, 2024).

Research methodology and international maturity frameworks

This paper employs a qualitative-analytical research design. The assessment of internal audit maturity rests on international models recognized in the public and social sectors: the IA-CM (Internal Audit Capability Model) framework of the IIA Research Foundation and the World Bank (MacRae & Sloan, 2017), the Ambition Model of IIA Netherlands, and PEMPAL IACOP guidance.

The analysis relies exclusively on publicly available documentation — legislative acts, the open frameworks of international regulators and published aggregate statistics — and is illustrative and analytical in character. Its purpose is to demonstrate the applicability of international frameworks using the example of a young mandatory scheme in an emerging market, and not to conduct an internal audit of any institution or to provide a public diagnosis of its control weaknesses.

The IA-CM, IIA Ambition Model and PEMPAL IACOP frameworks

The maturity-assessment instrumentation used in this study combines the following authoritative sources:

• Internal Audit Capability Model (IA-CM) for the Public Sector: a five-level model (Initial, Infrastructure, Integrated, Managed, Optimizing) developed by the IIA Research Foundation and the World Bank, which assesses internal audit across 6 core elements (Institute of Internal Auditors Research Foundation, 2009; MacRae & Sloan, 2017).
• IIA Ambition Model: a model developed by the Netherlands chapter of the Institute of Internal Auditors and aligned with the Global Internal Audit Standards 2024, which applies the five-level hierarchy of the IA-CM and rests on the standards in force from 9 January 2025 (IIA Netherlands, 2025).
• PEMPAL IACOP and SIGMA (2023): the quality-assurance guidance of the Internal Audit Community of Practice (IACOP) of the Public Expenditure Management Peer-Assisted Learning (PEMPAL) network (PEMPAL IACOP, 2020) and the indicators of the SIGMA Principles of Public Administration (2023) (OECD, 2023).

Levels of internal audit maturity (according to the IA-CM / Ambition Model)

On the basis of a synthesis of the international frameworks, maturity is assessed across 5 hierarchical levels:

• Level 1 — Initial: ad hoc, unsystematic, manual performance; no formal practice exists.
• Level 2 — Infrastructure: established baseline procedures and infrastructure, but limited technology.
• Level 3 — Integrated: standardized, risk-based auditing, full independence, use of data analytics.
• Level 4 — Managed: management of processes by quantitative measures, continuous auditing, automation of internal control.
• Level 5 — Optimizing: continuous innovation, artificial-intelligence and machine-learning technologies, strategic value at the business level.

Table 1 presents a maturity matrix adapted to the context of a pension scheme, based on the IA-CM, the Ambition Model and the SIGMA (2023) frameworks.

Table 1. Levels and elements of internal audit maturity (adapted from the IIA/World Bank IA-CM, the IIA Ambition Model and the SIGMA 2023 frameworks)

Dimension / Element	Level 1 (Initial)	Level 2 (Infrastructure)	Level 3 (Integrated)	Level 4 (Managed)	Level 5 (Optimizing)
1. Role and independence	No mandate	Administrative subordination	Functional reporting to the board	Full autonomy and resources	Strategic partnership
2. Professional practice	Reactive inspection	Compliance auditing	Risk-based auditing (RBA)	Quantitative risk analytics	Continuous improvement
3. Governance structure	Opaque allocation	Formal audit committee	Unified board and committee	Independent experts	Global benchmark
4. Risk management and COSO	Localized review	Traditional compliance	Integrated COSO ERM	Predictive risk analytics	AI-enabled ERM
5. Accountability	Minimal information	Annual reporting	Public dashboards	Real-time reporting	Interactive portal
6. Audit technologies	Manual review	Excel/Word documentation	Data analytics and CAATs	Continuous auditing and RPA	AI/ML forecasting

Source: the author’s adaptation of the IA-CM (MacRae & Sloan, 2017), the IIA Ambition Model (IIA Netherlands, 2025) and the OECD/SIGMA (2023) frameworks.

Comparative analysis of international practice

Australia (APRA). The Australian Prudential Regulation Authority (APRA) applies the PAIRS methodology and the SPS 510/520 standards, which correspond to Level 4–5 maturity in the IA-CM hierarchy (APRA, 2016, 2021).

Finland (FIN-FSA). The Finnish Financial Supervisory Authority (FIN-FSA) conducts a continuous supervisory dialogue (Level 4 maturity) (FIN-FSA, 2019; IMF, 2023).

The Netherlands (DNB). The central bank of the Netherlands (DNB) requires three independent key functions (De Nederlandsche Bank, n.d.; IMF, 2017). Notably, the Ambition Model of the Netherlands Institute of Internal Auditors is a global benchmark.

Digital transformation in internal audit

According to the IA-CM and the IIA Ambition Model, the transition of internal audit from the standardized level (Level 3 — Integrated) to the managed and optimizing stages (Level 4/5 — Managed/Optimizing) requires the quantitative assessment of processes and technological transformation (MacRae & Sloan, 2017; IIA Netherlands, 2025). The contemporary academic literature emphasizes that data analytics, robotic process automation (RPA) and continuous auditing play a decisive role in this process — an approach whose origins date back to the 1990s (Vasarhelyi & Halper, 1991) — while the methodology for its implementation in contemporary audit practice is described in detail in more recent studies (Appelbaum et al., 2017; Moffitt et al., 2018).

Integrating data analytics into auditing brings significant opportunities but also methodological and organizational challenges, including those related to data quality and auditors’ competencies (Earley, 2015). The rapid development of artificial intelligence and automation is progressively transforming the auditor’s role (Kokina & Davenport, 2017), although using these technologies requires careful management of ethical risks — transparency, accountability, and bias (Munoko et al., 2020). Accordingly, so-called explainable artificial intelligence (Explainable AI) methods, which ensure compatibility with audit evidence and documentation requirements, have become a topical direction of inquiry (Zhang et al., 2022). In the context of a pension fund, these approaches are particularly relevant for continuously monitoring a large investment portfolio.

Gap analysis using the case of Georgia’s funded pension scheme

A gap analysis was conducted based on publicly available documentation — the legislative framework and published aggregate indicators — using the IA-CM, the Ambition Model, and the SIGMA (2023) frameworks. The analysis is illustrative in character and seeks to present the maturity profile characteristic of a young mandatory scheme in an emerging market; it does not constitute the outcome of an internal audit of any institution.

Institutional context and dynamics (2019–2025)

According to published public data, by November 2025 the scheme’s assets had exceeded GEL 8 billion, while the number of participants had reached 1.7 million (Pension Fund of Georgia, 2025). In 2024, a significant legislative reform merged the separately constituted investment and supervisory boards into a single governing board (Ministry of Economy and Sustainable Development of Georgia, 2024).

Gap analysis (according to the IA-CM and the Ambition Model)

Table 2 presents the maturity profile characteristic of a scheme of this type, together with development priorities, based on a comparison with international frameworks. It emphasizes development directions that typically characterize young funded schemes at an early stage of institutional maturation, rather than specific shortcomings.

Table 2. Internal audit maturity profile and development priorities for a funded pension scheme (gap analysis according to the IA-CM and the Ambition Model)

Dimension / Element	Typical level	Target level	Development direction (Gap)	Development priority
1. Role and independence	Level 3 (Integrated)	Level 4 (Managed)	Consolidating a clear operational demarcation between the compliance and audit functions	Medium
2. Supervisory model	Level 3 (Integrated)	Level 4 (Managed)	Strengthening automated data-exchange capabilities with the regulator	Medium
3. Governance structure	Level 3 (Integrated)	Level 4 (Managed)	Consolidating the arrangements of the audit committee following governance reform	Medium
4. Risk management and COSO	Level 2 (Infrastructure)	Level 4 (Managed)	Systematically integrating non-financial, ESG and cyber risks into the COSO ERM framework	High
5. Accountability	Level 3 (Integrated)	Level 4 (Managed)	Developing interactive dashboards and reporting on portfolio risks	High
6. Audit technologies	Level 2 (Infrastructure)	Level 4 (Managed)	Developing data-analytics and continuous-auditing capabilities commensurate with the scale of assets	High

Source: the author’s analysis on the basis of public documentation and the IA-CM/Ambition Model frameworks.

Discussion

The analysis reveals an asymmetry characteristic of young schemes in emerging markets: the legal and supervisory dimension is highly mature (Level 3 — Integrated), while internal audit\\'s technological maturity remains at a comparatively early stage (Level 2 — Infrastructure). Viewed through the principles of PEMPAL IACOP and SIGMA (2023), this indicates that asset growth should be matched by a commensurate pace of development in internal audit’s digital capabilities, which, in the long term, determines the capacity for timely risk identification.

Conclusions and a phased operational roadmap

. Principal conclusions

The analysis indicates that in schemes of this type the strategic focus is progressively shifting from institutional arrangements to raising the technological and operational maturity of internal audit — from Level 2 to Level 4 (Managed). This conclusion is relevant to comparable funded schemes in emerging markets.

Phased operational roadmap (actionable roadmap)

The roadmap set out below is general and transferable in character and may be applied by comparable funded schemes in emerging markets to raise the maturity of internal audit in phases:

• Phase 1 (1–6 months — institutional consolidation): updating the internal audit charter to conform with the Global Internal Audit Standards of the IIA (2024) and with the Level 3/4 requirements of the IA-CM.
• Phase 2 (6–12 months — methodological transformation): extending the COSO ERM framework; integrating cybersecurity risks and the risk of breaching investment limits.
• Phase 3 (12–24 months — digital transformation): implementing CAATs and data-analytics tools (Python/SQL); establishing a continuous-auditing module for investment transactions (IA-CM Level 4).

References

Appelbaum, D., Kogan, A., & Vasarhelyi, M. A. (2017). Big data and analytics in the modern audit engagement: Research needs. Auditing: A Journal of Practice & Theory, 36(4), 1–27. https://doi.org/10.2308/ajpt-51684

Australian Prudential Regulation Authority. (2016). Prudential Standard SPS 510 governance. APRA.

Australian Prudential Regulation Authority. (2021). Findings from APRA’s superannuation thematic reviews. APRA.

Committee of Sponsoring Organizations of the Treadway Commission. (2013). Internal control — Integrated framework. COSO.

Committee of Sponsoring Organizations of the Treadway Commission. (2017). Enterprise risk management — Integrating with strategy and performance. COSO.

De Nederlandsche Bank. (n.d.). Supervision of pension funds. DNB. Retrieved July 28, 2026, from https://www.dnb.nl

Earley, C. E. (2015). Data analytics in auditing: Opportunities and challenges. Business Horizons, 58(5), 493–500. https://doi.org/10.1016/j.bushor.2015.05.002

Financial Supervisory Authority. (2019). Annual report 2019: Supervision responsive to changes in the operating environment. FIN-FSA.

Institute of Internal Auditors. (2024). Global internal audit standards. The Institute of Internal Auditors.

Institute of Internal Auditors Netherlands. (2025). Internal audit ambition model: Application guide (aligned with the Global Internal Audit Standards 2024). IIA Netherlands.

Institute of Internal Auditors Research Foundation. (2009). Internal audit capability model (IA-CM) for the public sector: Overview and application guide. The IIA Research Foundation.

International Monetary Fund. (2017). Kingdom of the Netherlands: Financial sector assessment program (IMF Country Report). International Monetary Fund.

International Monetary Fund. (2023). Finland: Financial sector assessment program (IMF Country Report). International Monetary Fund.

Kokina, J., & Davenport, T. H. (2017). The emergence of artificial intelligence: How automation is changing auditing. Journal of Emerging Technologies in Accounting, 14(1), 115–122. https://doi.org/10.2308/jeta-51730

Law of Georgia on Funded Pensions. (2018). Legislative Herald of Georgia. English translation retrieved July 28, 2026, from https://matsne.gov.ge/en/document/view/4280127

MacRae, E., & Sloan, B. C. (2017). Internal audit capability model (IA-CM) for the public sector (Rev. ed.). The Internal Audit Foundation.

Ministry of Economy and Sustainable Development of Georgia. (2024). Changes to the governance structure of the Pension Agency. Government of Georgia.

Moffitt, K. C., Rozario, A. M., & Vasarhelyi, M. A. (2018). Robotic process automation for auditing. Journal of Emerging Technologies in Accounting, 15(1), 1–10. https://doi.org/10.2308/jeta-52132

Munoko, I., Brown-Liburd, H. L., & Vasarhelyi, M. A. (2020). The ethical implications of using artificial intelligence in auditing. Journal of Business Ethics, 167(2), 209–234. https://doi.org/10.1007/s10551-019-04376-1

National Bank of Georgia. (n.d.). Funded pension scheme. Retrieved July 28, 2026, from https://nbg.gov.ge/en/page/funded-pension-scheme

Organization for Economic Co-operation and Development. (2009). OECD guidelines for pension fund governance. OECD Publishing.

Organization for Economic Co-operation and Development. (2016). OECD core principles of private pension regulation. OECD Publishing. https://doi.org/10.1787/9789264268265-en

Organization for Economic Co-operation and Development. (2020). Pensions at a glance 2020: OECD and G20 indicators. OECD Publishing. https://doi.org/10.1787/b6d3dcfc-en

Organization for Economic Co-operation and Development. (2023). The principles of public administration (2023 ed.). OECD Publishing. https://doi.org/10.1787/7f5ec453-en

PEMPAL IACOP. (2020). Quality assurance and improvement guide for public sector internal audit. Public Expenditure Management Peer-Assisted Learning (PEMPAL).

Pension Fund of Georgia. (2025). Statistical data on pension assets, returns, and participants. Pension Fund of Georgia (LEPL Pension Agency). https://pensions.ge/en/

Vasarhelyi, M. A., & Halper, F. B. (1991). The continuous audit of online systems. Auditing: A Journal of Practice & Theory, 10(1), 110–125. https://doi.org/10.2308/auditing.1991.10.1.110

Vasarhelyi, M. A., Kogan, A., & Tuttle, B. M. (2015). Big data in accounting: An overview. Accounting Horizons, 29(2), 381–396. https://doi.org/10.2308/acch-51071

Zhang, C. A., Cho, S., & Vasarhelyi, M. A. (2022). Explainable artificial intelligence (XAI) in auditing. International Journal of Accounting Information Systems, 46, 100572. https://doi.org/10.1016/j.accinf.2022.100572

---