Internal Audit as a Strategic Risk Management Tool: A Bibliometric Analysis of Public Sector Evolution

INTRODUCTION

Internal audits are undergoing an unprecedented transformation in the public sector, fundamentally reshaping how organizations approach risk management and governance. The internal audit function has evolved from a traditional compliance-focused role into a critical driver of strategic risk management and organization control. Yousif and Mohamed (2022) demonstrate that internal audit practices have advanced significantly, particularly in areas such as risk-based decision-making and strategic planning. This is supported by Syamsuddin et al. (2024), who note that organizations employing advanced internal audit approaches demonstrate higher effectiveness in risk management compared to those using traditional approaches, highlighting the importance of strategic integration within the audit function. The relationship between internal audit and strategic risk management is multifaceted, influenced by organizational governance structures, public sector dynamics, and regulatory requirements. Recent empirical research emphasizes the need for a nuanced understanding of internal audit’s impact on strategic risk management practices. Although many public sector organizations prioritize risk management in their strategic planning, few have strategically integrated internal audit into this process, indicating a significant implementation gap (Correani et al., 2020). This finding aligns with Choori and Kazemi (2023), who argue that organizational barriers and complexity frequently hinder the effective integration of internal audits into strategic risk management frameworks. Public sector governance has fundamentally changed the role of internal audit and strategic thinking. Xuan and Ness (2023) emphasize how emerging risk management approaches and governance models create new strategic imperatives, prompting organizations to reconsider the traditional scope of internal audit. This perspective is reinforced by An and Yoon (2023), who show that organizations with strategically integrated internal audit functions are more effective at managing organizational risk than those retaining a compliance-focused approach. The evolution of public sector governance has created a dynamic environment in which internal audit and strategic risk management have become increasingly intertwined. By adapting to market changes and embracing innovation, organizations can enhance risk management and improve their competitive position (Yuwono & Ellitan, 2025). Theoretical Perspectives on Internal Audit Evolution The evolution of internal audit in public sector risk management is underpinned by several theoretical frameworks that explain its transformation. Agency Theory provides a foundational perspective, positioning internal audit as a monitoring mechanism that mitigates information asymmetry between principals (e.g., citizens, elected officials) and agents (public administrators) in public sector contexts (Genda et al., 2024; Jensen & Meckling, 1976). This theoretical lens explains why internal audits have been traditionally focused on compliance and control functions but falls short in accounting for its strategic evolution. Institutional Theory extends this understanding by explaining how regulatory pressures, professional standards, and industry norms have influenced internal audit practices to adapt to changing governance expectations (Sari, 2022; DiMaggio & Powell, 1983). The perspective accounts for the isomorphic adoption of strategic risk management approaches across public sector organizations, particularly in response to governance reforms and high-profile public sector failures. Resource-based Theory offers another critical perspective, positioning internal audit capabilities as strategic organizational resources that provide competitive advantage through enhanced risk intelligence and governance quality (AlQudah et al., 2022; Barney, 1991). This theoretical lens is particularly relevant in explaining how internal audit develops specialized knowledge and capabilities that support strategic decision-making. Contingency Theory complements the above by suggesting that internal audit's effectiveness as a strategic risk management tool depends on contextual factors such as organizational size, complexity, and environmental uncertainty (Hadiyanti et al., 2024; Trotman & Duncan, 2018; Lawrence & Lorsch, 1967). The integration of these theoretical perspectives provides a robust framework for understanding the shift in internal audit from compliance verification to strategic risk management. The evolution of internal audit scholarships in the public sector lacks a comprehensive bibliometric assessment of its intellectual foundations and developmental trajectory. While extensive research exists on internal audit and risk management independently, systematic analysis of their intersection remains limited. Bibliometric techniques effectively map research networks, identify seminal studies, and address significant knowledge gaps (Marzi et al., 2025). Padayachee et al. (2022) in their study found that today’s risk landscape transforms traditional internal audit approaches by requiring strategic risk assessments, integrated assurance frameworks, and risk-based methodologies. Similarly, Cosa (2024) argues that conventional internal audit frameworks often fail to capture the dynamic nature of public sector risks, necessitating new theoretical perspectives and practical approaches. The integration of internal audit into strategic risk management has created a new public sector governance and control paradigm. Ibeh et al. (2024) identify that risk-based approaches and strategic planning have become central to the internal audit function, transforming how organizations develop and implement risk management strategies. Sari (2022) further showed that organizations with a strategically aligned internal audit function are more likely to identify, mitigate emerging risks and highlight the strategic importance of internal audit transformation. Gurama and Mansor (2021) similarly argue that effective internal audit should assess an organization's controllable capabilities, which, if mismanaged, could lead to operational issues and impair risk management performance. Despite the expanding corpus of scholarship concerning internal audit and strategic risk management, there exists a deficiency in comprehension regarding how the internal audit function has progressed into a strategic risk management instrument within the public sector. While previous studies have examined specific aspects of internal audit in strategic contexts, few comprehensive bibliometric analyses have mapped the intellectual structure of the field's evolution. This gap is particularly evident in the temporal development of research themes, the geographical distribution of scholarly contributions, and the integration of strategic risk management concepts into traditional internal audit frameworks. Furthermore, existing research lacks a systematic analysis of how emerging risk management approaches are reshaping Internal Audit Theory and practice across different public sector contexts. This theoretical fragmentation hinders both scholarly progress and practical applications (Bantleon et al., 2021). The lack of comprehensive bibliometric studies limits our understanding of the research patterns, influential contributions, and emerging trends in this rapidly evolving field. This study employs comprehensive bibliometric methods to address these multifaceted challenges associated with analyzing academic literature on internal audit as a strategic risk management tool in the public sector. It focuses on five key research questions (RQs): RQ1. What are the publication growth trends and patterns in research on internal audit as a strategic risk management tool in the public sector across the Scopus database from 1978 to 2024?

RQ2.

Which journals have demonstrated the highest productivity and impact in publishing research on the internal audit's role in public sector strategic risk management, as measured by publication metrics and citation impact?

RQ3.

Who are the most influential authors, and what are their significant contributions to research on

RQ4.

Which countries have made substantial contributions to research on internal audit's evolution as a strategic risk management tool in the public sector, and how are these contributions geographically distributed?

RQ5.

What are the key research themes and emerging trends in the internal audit's role as a strategic risk management tool in the public sector, as revealed through keyword network analysis?

This research maps the intellectual landscape of internal auditing as a strategic risk management tool in the public sector. It provides crucial insights for academics and practitioners navigating modern governance challenges. The findings help identify emerging research directions related to the internal audit's strategic role, highlight underexplored public sector risk management areas, and guide future scholarly investigations in this rapidly evolving field of internal audit practice and theory.

METHODOLOGY Materials and Methods This study employs a bibliometric methodology to examine the evolution of internal audit as a strategic risk management tool in the public sector. The research utilizes advanced analytical tools, specifically mapping analysis via VOSviewer and trend evaluation through ScientoPy. A comprehensive data set was constructed by extracting relevant publications from the Scopus database, using defined search criteria. The dataset formation is grounded in specific keyword combinations outlined in Table 1, which are crucial for identifying relevant literature on internal auditing and risk management in public sector contexts. The search strategy was designed to capture the multifaceted nature of the internal audit's role in strategic risk management within public organizations. The primary search terms were deliberately selected to encompass both traditional internal audit terminology ("internal audit*", "internal control*", "internal assurance") and risk management concepts ("risk*", "governance", "control*"), while restricting the scope to public sector contexts ("public*", "government*", "state"). Boolean operators were employed to ensure comprehensive coverage of relevant literature while minimizing irrelevant results. This approach aligns with best practices in systematic literature reviews and bibliometric analyses (Ahmi, 2022). Data collection spanned the period from 1978 to 2024, and concluded on January 26, 2025, to ensure thorough coverage. The choice of the Scopus database was deliberate, given its prominence as a leading bibliometric research source in academic settings (Ahmi, 2022). Scopus was selected over alternative databases such as Web of Science or Google Scholar due to its comprehensive coverage of public administration, accounting, and management journals, as well as its robust metadata quality for bibliometric analysis purposes.

The research framework utilizes two analytical software tools: ScientoPy and VOSviewer, each serving unique analytical roles. ScientoPy is a bibliometric analysis instrument that systematically assesses key research components, such as dominant themes, author contributions, geographic distributions, and significant publications (Abdullah, 2022). It provides transparent and reproducible analysis protocols as an open-source, Python-based tool. Its advanced pre-processing capabilities are particularly beneficial, effectively reducing biases in individual publications (Ruiz-Rosero et al., 2019). The ScientoPy analysis was configured with the following parameters: (1) annual publication counts with a five-year moving average for trend smoothing; (2) journal productivity metrics, including annual growth rate (AGR), average documents per year (ADY), percentage of documents in the last years (PDLY), and h-index calculations; (3) author impact assessment using citation counts and h-index metrics; and (4) country contribution analysis with normalized citation impact calculations to account for publication volume variations. VOSviewer creates detailed co-occurrence maps of authors' terms related to digital technologies and strategic management for visualization and network examination (Ahmi, 2022). This method facilitates the systematic identification and analysis of research themes that have influenced global scholarly discourse on the implications of digital transformation on strategic management. For the keyword network analysis, VOSviewer was configured with the following parameters: (1) minimum occurrence threshold of 5 for keywords to be included in the analysis; (2) full counting method for co-occurrence calculation; (3) association strength normalization method to minimize bias toward high-frequency terms; and (4) cluster resolution parameter set at 1.0 to identify distinct thematic groupings. Pre-processing of Retrieved Datasets The dataset underwent rigorous pre-processing to ensure data integrity, including the elimination of duplicates and consolidation of key data points using ScientoPy. As indicated in Table 2, the initial data collection produced 1,134 unrefined data items from Scopus-indexed publications. The analysis revealed that no articles were excluded based on document-type filtering criteria. From the original 1,134 papers, a preliminary screening process identified two papers that did not meet the inclusion criteria, representing 0.18% of the initial dataset. These papers were excluded due to irrelevant content or insufficient focus on internal audit and strategic risk management in public sector contexts. Specifically, the exclusion criteria applied during the preprocessing phase included: (1) articles focusing exclusively on private sector contexts without public sector implications; (2) publications addressing financial statement auditing without explicit internal audit or risk management connections; and (3) papers that mentioned internal audit or risk management only tangentially, without substantive discussion of their relationship. This careful screening process ensured that all included publications directly addressed the research focus on internal audit as a strategic risk management tool in public sector contexts. After a thorough screening, 1,132 papers remained for subsequent analysis. This refined dataset comprised articles examining the internal audit's role as a strategic risk management tool in the public sector, establishing a solid basis for practical bibliometric analysis.

RESULTS

The investigation's findings thoroughly respond to the research questions in the methodology. Results are systematically presented using visualizations generated through ScientoPy and VOSviewer, offering clear evidence to support each research question. Publication Growth Trends Figure 1 and Table 3 present the bibliometric analysis of research publications on internal auditing as a strategic risk management tool in the public sector, covering the period from 1978 to 2024. The analysis shows a total of 1,132 publications retrieved from the Scopus database. The data indicates a strong growth pattern in research activity, with an annual growth rate (AGR) of 27%. This growth is particularly significant when compared to related fields such as public administration research (average AGR: 12%) and accounting research (average AGR: 18%), highlighting a distinct momentum in scholarly interest surrounding the strategic role of internal auditing. The analysis shows an average of 137 documents annually (ADY), demonstrating consistent scholarly output. Additionally, 24.2% of the publications have been produced in recent years (PDLY), suggesting growing contemporary interest in internal audit's strategic role in public sector risk management. This recent acceleration aligns with increased regulatory focus on public sector risk management and governance following global financial and public health crises.

The publications achieved an h-index of 66, indicating significant scholarly impact and citation performance. This metric reflects both the quantity of publications and their citation impact, suggesting that research in this field is not only expanding but also contributing to academic discourse. Figure 1 illustrates these publication trends over the period studied, showing a clear upward trajectory in research output, particularly accelerating in recent years. This growth pattern reflects the increasing importance of internal audit as a strategic risk management tool in public sector research and practice.

PDLY

h-Index

Scopus

Note: AGR=Average growth rate, ADY=Average documents per year, PDLY=Percentage of documein the last years, h-index=standard scholarly metric in which the number of published papers, and the number of times their author is cited, is put into relation

Publications by Source Title

Figure 2 and Table 4 show the bibliometric analysis of source titles in internal audits as a strategic risk management tool in public sector research, identifying the top 10 contributing journals based on publication metrics. This analysis directly addresses Research Question 2 (RQ2) by revealing which journals have demonstrated the highest productivity and impact in this field. The Managerial Auditing Journal leads with 68 publications and an h-index of 22, demonstrating an annual growth rate (AGR) of 1.5 and average documents per year (ADY) of 2, with a percentage of documents in the last year (PDLY) of 5.9%. Its dominance reflects its specialized focus on auditing research with particular emphasis on practical applications, making it a natural venue for research on internal audit's strategic role. Accounting Horizons follows with 24 publications, recording an h-index of 17, which reflects its broader disciplinary scope while maintaining significant contributions to this specialized field. In comparison, auditing ranks third with 23 publications (AGR: 0, PDLY: 0%, hindex: 17), demonstrating stable but not growing contributions to the field. Finance Research Letters shows significant recent growth with 22 publications (AGR: 5.5, ADY: 10, PDLY: 90.9%, h-index: 8), which indicates emerging interest in quantitative approaches to understanding internal audit's strategic impact. This journal's rapid growth suggests a methodological shift toward more sophisticated analytical techniques in exploring the relationship between internal audit and risk management outcomes. The Journal of Financial Crime contributes 21 publications (AGR: -2, ADY: 3, PDLY: 28.6%, h-index: 10), underscoring the important connection between internal audit functions and fraud prevention in public sector contexts. Citation impact, measured by h-index ranges from 22 for the Managerial Auditing Journal to 1 for Quality - Access to Success, reflecting varying levels of research influence across journals. Notably, newer journals like Cogent Business and Management (14 publications) and International Review of Financial Analysis (13 publications) show strong recent growth with PDLY values of 57.1% and 92.3%, respectively, indicating emerging venues for research on internal audit's strategic role in public sector risk management. This diversification of publication venues suggests growing interdisciplinary interest in the field, with research expanding beyond traditional audit and accounting journals.

PDLY

h-Index

Managerial Auditing Journal

Accounting Horizons

Auditing

Finance Research Letters

Journal of Financial Crime

Cogent Business and Management

International Journal of Accounting Information

Systems

International Review of Financial Analysis

Journal of Corporate Accounting and Finance

Quality - Access to Success

Note: AGR=Average growth rate, ADY=Average documents per year, PDLY=Percentage of documents in the last years, h-index=standard scholarly metric in which the number of published papers, and the number of times their author is cited, is put into relation

Publications by Author

Table 5 shows the bibliometric analysis of influential authors in internal audit as a strategic risk management tool in public sector research, identifying the field's top 10 most cited publications. This analysis directly addresses Research Question 3 (RQ3) by identifying the most influential authors and their significant contributions to this field based on citation analysis. Bargeron et al. (2010) lead with 358 citations for their work examining the impact of Sarbanes-Oxley on risk management and governance frameworks in public sector organizations. Their research established a critical link between regulatory frameworks and organizational risk management behaviors, demonstrating how compliance requirements can drive strategic changes in internal audit functions. Rezaee (2005) follows with 286 citations for research on the internal audit's role in public institutions' fraud prevention and risk assessment. This seminal work established a foundation for understanding the internal audit's role in identifying and mitigating emerging risks beyond traditional compliance approaches. Beneish et al. (2008) rank third with 283 citations for their study on internal control mechanisms and strategic risk management approaches. Their research demonstrated the critical connection between internal control quality and information uncertainty, highlighting the internal audit's strategic importance in reducing organizational risk through enhanced information quality. Armstrong (1987) contributes significantly, with 278 citations, to research on the evolution of internal audit and control systems in public sector governance. This historical perspective provides an important contextual understanding of how internal audit functions have evolved in response to changing governance expectations. Notable contributions include Ettredge et al. (2006), with 239 citations for their work on strategic integration of internal control frameworks in public organizations, which demonstrated how regulatory requirements influence internal audit practices and organizational outcomes. Bell and Carcello (2000), with 221 citations, for their research on financial reporting risk assessment methodologies in public sector auditing, developed analytical frameworks that have significantly influenced how internal audit functions approach risk assessment in public sector contexts. The citation analysis reveals a clear evolution in research focus, from traditional compliance and control perspectives toward more strategic approaches to risk management and governance. This progression reflects the field's growing recognition of the internal audit's potential contribution to organizational strategic objectives beyond compliance verification.

Article

Scopus

Publications by Countries

Figure 3 and Table 6 illustrate the bibliometric analysis of countries' contributions to internal audit as a strategic risk management tool in public sector research, highlighting the top 10 contributing nations worldwide. This analysis directly addresses Research Question 4 (RQ4) by identifying which countries have made substantial contributions to research on internal audit's evolution as a strategic risk management tool and revealing their geographical distribution. The United States leads the field with 361 publications, showing strong performance with an annual growth rate (AGR) of 2.5, average documents per year (ADY) of 20, and percentage of documents in the last year (PDLY) of 11.1%, achieving a h-index of 47. This dominance reflects the early development of internal audit research traditions in the United States, influenced by its robust regulatory framework following corporate governance reforms such as the Sarbanes-Oxley Act. The high h-index indicates not only publication volume but also substantial scholarly impact. China follows with 198 publications, demonstrating remarkable growth with an AGR of 27, ADY of 61.5, and PDLY of 62.1%), along with an h-index of 26. These metrics reflect China's emerging focus on public sector governance and internal control systems as part of broader public administration reforms. The high PDLY value indicates that a substantial proportion of China's contributions have occurred recently, suggesting an accelerating research trajectory. Indonesia ranks third with 110 publications (AGR: 1.5, ADY: 21, PDLY: 38.2%, h-index: 12), while Malaysia contributes 74 publications (AGR: -3, ADY: 9, PDLY: 24.3%, h-index: 15). The significant contributions from these Southeast Asian countries highlight regional interest in strengthening public sector governance through enhanced internal audit capabilities. The United Kingdom maintains a strong presence with 60 publications and an h-index of 20, despite showing no growth (AGR: 0), reflecting its established but stable research tradition in this field. Citation impact, as measured by h-index, ranges from 47 for the United States to 4 for Ukraine, reflecting varying levels of research influence across countries. This disparity suggests opportunities for knowledge transfer and collaborative research to enhance the global impact of contributions from emerging research communities. The geographical distribution reveals both established research centers and emerging contributors, suggesting an evolving global research landscape with potential for diverse theoretical and methodological perspectives.

PDLY

h-Index

United States

China

Indonesia

Malaysia

United Kingdom

Australia

Canada

South Africa

South Korea

Ukraine

Note: AGR=Average growth rate, ADY=Average documents per year, PDLY=Percentage of documents in the last years, h-index=standard scholarly metric in which the number of published papers, and the number of times their author is cited, is put into relation

Publications by Authors’ Keywords and Emerging Trends

Figure 4 visualizes the bibliometric analysis of authors' keywords and emerging trends in internal audit as a strategic risk management tool in public sector research through network mapping. This analysis directly addresses Research Question 5 (RQ5) by identifying key research themes and emerging trends in the internal audit's role as a strategic risk management tool, as revealed through keyword network analysis. The network visualization reveals three significant clusters: 1. Internal audit-related terms (shown in red), includes core terms such as "internal control," "audit quality," and "assurance" - This cluster represents the foundational concepts and methodological approaches within traditional internal audit practice. The density of connections within this cluster indicates a well-established conceptual framework for understanding core internal audit functions. 2. Risk management concepts (displayed in blue), encompassing "risk assessment," "governance," and "compliance" - This cluster reflects the growing importance of risk-oriented approaches within internal audit practice. The connections between these terms suggest an integrated understanding of risk management processes and their relationship to organizational governance. 3. Strategic management approaches (depicted in green), featuring "strategic planning," "performance measurement," and "public sector management" - This emerging cluster represents the integration of internal audit into broader strategic management frameworks. The positioning of these terms indicates their growing influence in reshaping the internal audit's organizational role. The strongest connections appear between "internal audit" and "risk management" as central nodes, with multiple bridging terms like "corporate governance," "internal control systems," and "strategic risk" linking the clusters. This interconnected structure demonstrates the evolution of internal audit from a compliance-focused function toward a more integrated strategic role within organizational risk management frameworks.

The spatial distribution indicates that risk-based audit approaches dominate the field, while emerging themes around "digital transformation," "sustainability assurance," and "agile auditing" appear in the peripheral nodes, suggesting new research directions. These emerging concepts reflect adaptation to changing technological, environmental, and organizational contexts, pointing toward future evolution in internal audit practices. Temporal keyword analysis emergence (not shown in Figure 4 but analyzed through ScientoPy) reveals a progression from compliance-oriented terminology in earlier periods toward more strategic and valuefocused concepts in recent publications. Terms like "value creation," "strategic alignment," and "integrated assurance" show increasing frequency in publications from 2019-2024, supporting the identified trend toward strategic integration of internal audit functions. This network analysis provides insights into the evolution of the internal audit's role in strategic risk management and emerging areas of scholarly inquiry, revealing both established research domains and emerging frontiers for future investigation.

DISCUSSION

Interpretation of Findings

The bibliometric analysis of internal audit as a strategic risk management tool indicates notable patterns and trends that merit detailed exploration. This section evaluates the primary findings through critical academic discourse while acknowledging broader implications and constraints. In addressing Research Question 1 (RQ1), the analysis reveals compelling growth patterns in research output, with an AGR of 27% and ADY of 137 publications. This significant growth suggests increasing recognition of the strategic importance of internal audits, moving beyond traditional compliance roles. The high h-index (66) indicates substantial scholarly impact, though this may reflect citation patterns favoring established methodologies over innovative approaches. The substantial PDLY (24.2%) demonstrates growing contemporary relevance, particularly as public sector organizations face increasingly complex risk landscapes. However, this growth pattern raises questions about whether quantity translates to quality in advancing theoretical frameworks. This publication trend analysis extends existing theoretical perspectives by demonstrating an evolution in how internal audit is conceptualized within public sector contexts. The significant growth trajectory aligns with Institutional Theory’s predictions of isomorphic change in response to evolving governance requirements (DiMaggio & Powell, 1983), while the increasing focus on strategic aspects supports resource-based perspectives on internal audit as an organizational capability (Barney, 1991). The analysis challenges the traditional Agency Theory perspectives that position internal audit primarily as a monitoring mechanism, suggesting instead a more nuanced role that integrates strategic risk management activities with traditional assurance functions (Jensen & Meckling, 1976). Regarding Research Question 2 (RQ2), the publication source analysis reveals nuanced research dissemination patterns. The Managerial Auditing Journal's dominance (68 publications, h-index: 22) suggests strong practitioner influence in shaping research agendas. The emergence of specialized journals like Finance Research Letters (AGR: 5.5, PDLY: 90.9%) indicates growing methodological sophistication, particularly in quantitative risk assessment approaches. However, the concentration of publications in traditional audit journals may indicate limited cross-pollination with broader public management literature. The varying h-indices (22 to 1) reveal potential gaps between theoretical development and practical application. From a theoretical perspective, this journal distribution pattern suggests a fragmentation in knowledge development, with specialized audit and accounting journals dominating the discourse. This fragmentation may limit the integration of diverse theoretical perspectives that could enrich the understanding of the internal audit's strategic role. The findings align with Zhang (2024) and Jedynak and Bąk (2020) that interdisciplinary approaches are essential for advancing risk management research in public governance contexts. Similarly, Ng et al. (2022) highlight how risk-based internal auditing can benefit from interdisciplinary methods, advocating for diverse perspectives to enhance internal control systems and promote better governance practices in public organizations. The author’s analysis for Research Question 3 (RQ3) demonstrates significant evolutionary patterns in research focus. Bargeron et al. 's (2010) work on Sarbanes-Oxley (358 citations) marks a pivotal shift toward risk-based governance frameworks, while Rezaee's (2005) research (286 citations) establishes foundational fraud prevention paradigms. Beneish et al.'s (2008) contribution (283 citations) highlights the critical intersection of internal control and information uncertainty. These citation patterns suggest a gradual transformation from compliance-focused to strategy-oriented research, though questions remain regarding the public sector contextual applicability.

This evolutionary trajectory in scholarly influence extends Contingency Theory by demonstrating how internal audit research has adapted to changing contextual factors in public sector environments (Lawrence & Lorsch, 1967). The prominence of governance-focused publications supports institutional perspectives on how regulatory frameworks shape internal audit practices, while the emerging emphasis on information uncertainty aligns with resource-based views of internal audit as a strategic information processing capability (Barney, 1991). The citation analysis reveals a theoretical progression from conformance-oriented approaches toward performance-oriented perspectives that integrate strategic risk management with traditional assurance functions. The geographical distribution analysis as in Research Question 4 (RQ4) reveals complex research dynamics. The United States' leadership (361 publications, h-index: 47) reflects its established regulatory framework and research infrastructure. China's remarkable growth (AGR: 27, PDLY: 62.1%) suggests emerging perspectives on public sector governance. The contributions from Indonesia (110 publications) and Malaysia (74 publications) introduce valuable insights from developing administrative contexts. However, this distribution also highlights potential Western-centric biases in theoretical frameworks and methodological approaches. From a theoretical standpoint, geographical analysis challenges universalistic approaches to internal audit by highlighting the contextual variations in how different countries conceptualize and implement internal audit functions. The findings support contingency perspectives that emphasize the importance of cultural, regulatory, and institutional factors in shaping effective internal audit practices (Yulianto et al., 2024; Trotman & Duncan, 2018). The emerging contributions from Asian countries suggest a diversification of theoretical perspectives beyond Western-centric models, potentially enriching the understanding of how internal audit functions operate across different governance contexts. This geographical analysis extends and refines existing theoretical frameworks by demonstrating the importance of contextual factors in shaping the internal audit's strategic role. The keyword network analysis (RQ5) uncovers sophisticated interconnections between research themes. The visualization reveals three significant clusters: internal audit-related terms (shown in red), including "internal control," "audit quality," and "assurance"; risk management concepts (displayed in blue), encompassing "risk assessment," "governance," and "compliance"; and strategic management approaches (depicted in green), featuring "strategic planning," "performance measurement," and "public sector management." These clustering patterns demonstrate the multifaceted nature of the internal audit's evolving role in public sector risk management. However, the temporal evolution of keywords suggests gaps in addressing contemporary challenges, particularly in digital transformation, sustainability assurance, and agile auditing frameworks. Network visualization also indicates potential research silos between traditional audit approaches and emerging strategic risk management paradigms, which may constrain theoretical advancement in the field. The keyword network analysis makes a significant theoretical contribution by empirically mapping the conceptual landscape of internal audit research. The identification of distinct but interconnected thematic clusters extends integrated theoretical models that combine agency, institutional, and resourcebased perspectives (Barney, 1991; DiMaggio & Powell, 1983; Jensen & Meckling, 1976). The network structure suggests that the internal audit's strategic role emerges at the intersection of multiple theoretical domains, supporting Ramazanova and Lambekova (2022) for integrative theoretical frameworks in governance research. The peripheral position of emerging themes like digital transformation and sustainability assurance indicates theoretical gaps that present opportunities for theory development, particularly in understanding how technological and environmental factors reshape the internal audit's strategic capabilities.

This critical analysis highlights both significant progress and persistent challenges in the field. While research volume and sophistication have increased substantially, questions remain about theoretical innovation, contextual relevance, and practical applicability. The findings suggest a need for more integrated research approaches that bridge traditional audit functions with contemporary strategic management paradigms, particularly in diverse public sector contexts. Implications for Theory and Practice Theoretical Implications The bibliometric analysis reveals significant theoretical implications beyond the foundational perspectives discussed in the introduction. Our findings demonstrate an evolution in theoretical conceptualization that extends traditional frameworks in several key directions. The citation analysis shows a clear theoretical progression from compliance-verification to value-creation paradigms, with highly cited works like Bargeron et al. (2010) and Beneish et al. (2008) establishing critical connections between regulatory frameworks, information quality, and organizational risk outcomes. This progression challenges the conventional binary between conformance and performance by revealing how strategic risk management capabilities emerge from, rather than compete with, robust assurance foundations (Anisetti et al., 2021; Spears et al., 2013; Lalli, 1998). The geographical analysis further extends contingency perspectives, by empirically demonstrating how research contributions from different regions (particularly emerging Asian contributions) introduce contextual variations that enrich our theoretical understanding of internal audit's strategic role beyond Western-centric models. These findings suggest that theoretical development in this field requires greater integration of diverse cultural and institutional perspectives, particularly in conceptualizing how internal audit functions navigate the complex interplay between local governance structures and global risk management standards. Our network visualization of research themes makes a unique theoretical contribution by empirically mapping the intellectual structure of the field, revealing patterns that cannot be discerned through conventional literature review approaches. The identification of three distinct but interconnected thematic clusters (internal audit methodologies, risk frameworks, and strategic management) challenges siloed theoretical approaches and demonstrated how internal audit's strategic value emerges precisely at the intersection of these domains. The temporal evolution of keywords from compliance-focused to strategic value-oriented terminology suggests that theoretical development in this field follows a maturation pattern that parallels organizational capability development. However, the peripheral positioning of emerging themes like digital transformation, sustainability assurance, and integrated risk governance indicates substantial theoretical gaps in understanding how technological and environmental factors reshape internal audit's strategic capabilities. These gaps present critical opportunities for theoretical innovation, particularly in developing integrated frameworks that explain how internal audit functions transform technical assurance capabilities into strategic organizational resources that enhance public sector risk intelligence and governance quality across diverse contextual settings. Practical Implications The findings from this bibliometric analysis offer valuable practical insights for stakeholders involved in public sector governance and risk management. Public sector organizations should strategically position internal audit functions beyond traditional compliance roles (Gurama and Mansor, 2021), integrating them into strategic planning and decision-making processes. This integration requires organizational structures that facilitate communication between internal audit, risk management, and executive leadership, supported by governance frameworks that clarify roles and responsibilities. Internal audit functions should develop expanded competencies that balance traditional assurance activities with strategic risk advisory capabilities, particularly in emerging areas like digital transformation, sustainability governance, and integrated assurance approaches (Mahyoro & Kasoga, 2021). Policymakers and professional bodies should consider these organizational evolving trends (Foo et al., 2020) when developing regulatory frameworks and professional standards for internal audit practice. Rather than focusing exclusively on compliance requirements, governance frameworks should emphasize the internal audit's contribution to strategic risk management and organizational value creation (Yulianto et al., 2024). Professional development programs should incorporate competencies related to strategic thinking, risk intelligence, and organizational change to prepare internal auditors for expanded roles. Furthermore, fostering a culture of continuous learning, mentorship, and knowledge sharing can facilitate smoother leadership transitions and mitigate the risks associated with succession gaps (Azmi et al., 2025). Hence, knowledge transfer initiatives should be established to bridge geographical disparities in internal audit practice development, facilitating the exchange of innovative approaches across diverse public sector contexts. By embracing these practical implications, stakeholders can enhance the internal audit's contribution to effective risk management and governance in increasingly complex public sector environments (Foo et al., 2020). Limitations and Future Research Recommendations This bibliometric analysis identifies several significant limitations that require careful consideration. While comprehensive, reliance on the Scopus database may exclude valuable contributions from nonindexed sources, particularly from developing regions' public sector audit research. The current dataset's focus on English-language publications overlooks important insights from non-English research traditions in public sector internal audit practices. The temporal scope (1978-2024) may not fully capture emerging trends in the internal audit's evolution as a strategic risk management tool. While the keyword analysis identifies significant research themes, it may not adequately reflect the nuanced challenges internal audit functions face across different public administrative systems. Additionally, the bibliometric approach itself, though systematic, may not capture the qualitative depth of theoretical developments in internal audit's transformation from traditional assurance to strategic risk management roles. Future research should address these limitations through several key directions: 1.

Theoretical Integration: Scholars should empirically test the theoretical relationships identified through this bibliometric analysis, particularly examining how the three distinct research clusters (internal audit methodologies, risk management frameworks, and strategic public sector governance) interact in practice. Future studies could investigate which theoretical perspectives (agency, institutional, resource-based, or contingency theory) provide the strongest explanatory power for internal audit's strategic role and under what contextual conditions these theoretical frameworks are most applicable in diverse public sector environments.

Contextual Research: Given the geographical disparities in research contributions identified in our analysis, further studies should examine how the internal audit's strategic role varies across different cultural, regulatory, and institutional contexts. Comparative cross-country studies would be particularly valuable in understanding how the proposed variables operate in diverse public sector environments.

Technological Integration: The keyword analysis revealed emerging themes around digital transformation that require further investigation. Future research should examine how technological advancements reshape internal audit capabilities as well as their strategic contribution to risk management, particularly focusing on how the eight identified independent variables are being transformed by digital innovations.

Longitudinal Studies: The field would benefit from longitudinal research examining the evolution of internal audit functions from compliance verification to strategic risk management roles. Such studies could track changes in internal audit maturity, strategic alignment, and resource allocation over time, providing insights into the developmental pathways of effective internal audit functions.

Methodological Diversification: Future studies should employ mixed method approaches that combine the quantitative strengths of bibliometric analysis with qualitative insights from case studies and in-depth interviews. This methodological pluralism would enhance understanding of the complex relationships identified in our conceptual framework.

These recommendations aim to advance both theoretical understanding and practical application of internal audit in public sector risk management. By addressing the identified limitations and pursuing these research directions, scholars can contribute to a more comprehensive understanding of how internal audit functions evolve into strategic risk management tools across diverse public sector contexts.

CONCLUSION

This bibliometric analysis has mapped the intellectual landscape of internal audit as a strategic risk management tool in the public sector through a systematic examination of 1,132 publications from the Scopus database (1978-2024). The findings reveal a significant evolution in research focus from traditional compliance approaches toward strategic risk management integration, with robust growth (AGR: 27%), substantial scholarly impact (h-index: 66), and distinct research clusters centered on audit methodologies, risk frameworks, and strategic management. The United States maintains its research leadership with 361 publications, while China demonstrates a remarkable growth (AGR: 27%), reflecting geographical diversification in scholarly contributions. The study's contribution extends beyond mapping research trends by providing a foundation for theoretical advancement and practical innovation in how internal audit functions contribute to public sector strategic risk management. The identified research clusters suggest both established knowledge domains and emerging frontiers, particularly around digital transformation, sustainability assurance, and integrated governance approaches. While acknowledging limitations related to database coverage and methodological constraints, this research establishes a platform for future scholarly investigations that can empirically test the relationships across diverse public sector contexts. By illuminating internal audit's evolution from compliance verification toward strategic risk integration, this study offers valuable insights for scholars advancing theoretical understanding and practitioners navigating the complex challenges of contemporary public sector governance.

ACKNOWLEDGEMENT

This research received no specific grant from any funding agency in the public, commercial, or nonfor-profit sectors.