Internal Audit Independence – What Impacts It?

 by

Phil Flora

What impacts an Internal Auditor's independence? If you are a Chief Audit Executive (CAE) that reports functionally to the Audit Committee and administratively to the Chief Executive Officer (CEO), you have generally addressed the basic question of organizational independence. Does that mean the audit function is always independent? Or not? 

The correct answer is maybe yes and maybe no. Practically, the structure referenced above appears to be the optimal set-up to facilitate CAE independence. Independence provides the opportunity for Internal Audit to fulfill its role in organizational governance; however, there are several more important direct, indirect, and/or subtle things that impact auditor independence.

Consider some examples of other things that impact auditor independence below:

• Budget approval that includes salaries, training and other resources – who really sets the baseline for the budget and has control of budget approval no matter what the IA Charter shows?
• Communications in private with the Audit Committee/Board of Directors that end up being shared with the CAE's peer executive base without further discussion with the CAE.
• Threat(s) made by influential high level management personnel to the CAE with the purpose of influencing the CAE’s actions that are outside of the IA Charter and Standards. Communication of this situation to the Audit Committee Chair results in it being a misunderstanding and there are no consequences for this action.
• Boards that do not request reporting and/or follow-up on significant policy, project, program, and/or business model approval changes that impact organizational success. Does this demonstrate limited understanding of the governance process and provide evidence that accountability is not important if the business bottom line stays strong?

Would any of the above items concern you if you were the CAE?  If the CAE's peer executive base  and Audit Committee/Board of Directors are comfortable with these activities occurring why should the CAE be concerned? Do professional standards need to be followed if key leadership says its okay under these specific circumstances? Wow, why would the CAE make such a big deal of it? Simple.

No matter how it is done - direct, indirect, or subtle attempts to influence and/or impair the independence of a CAE can compromise his/her effectiveness and resultant value to the organization. That includes the Board, management, regulators, shareholders, the public, etc., all who may meet the definition of primary stakeholder based on the type of organization being referred to.

What is the definition of Independence? The Institute of Internal Auditors defines Independence in the International Professional Practices Framework (IPPF) as follows: the freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit responsibilities in an unbiased manner. ⁽¹⁾

During the IIA International Conference in Houston, Texas in 2006, the CEO of a major insurance company elegantly mentioned three (3) critical traits needed by a CAE for success. The trait I thought most interesting was “courage”. Do CAE’s need to be skilled at providing “Bad News” or does providing bad news mean IA is not part of the team? Without courage it will be difficult for a CAE and audit function to maintain an appropriate level of independence. Another important element is that all key parties understand and follow their important role. Without the Audit Committee/Board and/or the CEO understanding and helping to reinforce the role of audit within the organization, independence issues may not be evident but may exist.

The bottom line about independence is that for a CAE to be effective in the organization’s governance process, he/she needs to be considered a “trusted advisor” to both the Board and the CAE's peer executive base. Without having the ability to influence/educate the Board/CAE's peer executive base about key risk areas and make recommendations to reduce risk, strengthen controls and improve governance processes, how will Internal Audit add value to the organization? Critical to this process is that management seriously considers the information shared by Internal Audit and acts on recommendations to improve operations. This normally occurs when a relationship with mutual respect is evident.

In conclusion, if someone doesn’t have the CAE’s back, maintaining independence will be a difficult, if not impossible, task.

Please remember when reading about independence in a book, professional standards, or an audit charter, that maintaining an appropriate level of independence is more difficult than it appears to be.  While dealing with the everyday audit challenges the CAE must have the Audit Committee/Board and CEO support and understanding of Internal Audit’s role.  Be practical about your approach, but at all costs defend your professional integrity and independence even under duress. Independence is a state of mind, and if you think in any way that you may not be independent in your role as an internal auditor...you’re probably not independent. The true answer is up to you!

Good fortune and let me know what your perspective on independence for a CAE means to you.

⁽¹⁾ The Institute of Internal Auditors (IIA) – IPPF - Glossary

Send Phil an Email