Using institutional theory, this study investigates Internal Audit Function (IAF) effectiveness in environments characterised by a high risk of corruption. A qualitative approach was adopted, comprising 24 in-depth semi-structured interviews with experienced internal auditors from Indonesian public universities. The findings reveal that the institutional environment fails to provide sufficient support to the IAF to operate effectively, including mitigating corruption risks. Unfavourable organisational structure, unsupportive cultures and behaviours, and limited backing from management and audit committee undermine IAF’s effectiveness. In addition, reliance on ad hoc staff and contractual employment model with limited competency constrains the IAF’s capacity to operate effectively. The study further highlights the importance of ensuring that the scope of the IAF is not restricted from accessing areas identified as the most vulnerable to corruption risk.