Internal Control and Risk-Based Audit Approaches in Waqf Institutions: A Systematic Review from Islamic Perspectives

Abstract

Waqf institutions play a vital role in the socio-economic development of Muslim communities. However, they face complex governance challenges due to the perpetual nature of waqf assets and the necessity of upholding Shariah principles. Effective internal control systems and risk-based audit approaches are therefore essential to ensure accountability, transparency, and the realization of maqasid al-shariah (the higher objectives of Islamic law). Despite the significance of this topic, no comprehensive systematic review has yet integrated Islamic perspectives into the framework of internal control and auditing within waqf institutions. This study aims to: (1) identify and analyze internal control practices in waqf institutions grounded in Shariah principles; (2) evaluate the implementation of risk-based audit approaches in the context of waqf auditing; (3) examine key challenges and barriers to the effective application of control and audit systems; and (4) explore the integration of Islamic values—maqasid al-shariah, accountability (mas’uliyyah), and trust (amanah)—within internal control and audit frameworks for waqf institutions. A systematic literature review (SLR) was conducted using the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) methodology. Relevant literature published between 2010 and 2025 was retrieved from six major academic databases—Scopus, Web of Science, ProQuest, EBSCOhost, Emerald Insight, and Google Scholar. From a total of 1,247 identified articles, 42 met the inclusion criteria and were analyzed using thematic analysis and framework synthesis. The findings reveal five key insights. First, internal control systems in waqf institutions require an adaptation of the COSO framework through the addition of a sixth component: the “Shariah Compliance and Governance Layer,” encompassing the Shariah Supervisory Board, Shariah audit, and maqasid performance measurement. Second, adoption of risk-based auditing remains limited—only 31% of institutions have fully adopted it, with Shariah compliance risk cited as the top priority (95% frequency). Third, a novel risk category, “Perpetuity Risk,” unique to waqf institutions, was identified. Fourth, a paradigm shift is occurring from rule-based Shariah compliance toward principle-based maqasid achievement in audit approaches. Finally, the dual accountability framework—vertical accountability to Allah and horizontal accountability to stakeholders—creates a distinctive yet complex governance mechanism.