An organization's board of directors is essential to good governance. It can provide an independent, authoritative voice on key decision-making, help guide strategic thinking, and contribute to organizational integrity. But lack of true independence can dampen that support. Board priorities may teeter between what's good for the organization and what executive management or shareholders would prefer, which often may be at odds. Divided board loyalties can be detrimental to organizational governance, and particularly to the internal audit function.
In a worst-case scenario, the board of directors may try to influence internal auditors' activity indirectly or steer policies to best match shareholders' interests, resulting in a loss or weakening of internal audit value and independence. Moreover, because the organization's top management answers to the board, internal audit's independence could be further impaired in situations where the CEO also serves as a board member. It also introduces the possibility of ethical lapses and other wrongdoing.
Of course, effective oversight — and internal audit — requires a qualified audit committee. In part, the committee should help ensure that internal auditing is not influenced by top management. And according to IIA Standard 1110, internal audit achieves organizational independence effectively "when the chief audit executive reports functionally to the board." But given its positioning as a sub-unit of the board, and the board's responsibility for appointing audit committee members, the committee may still show allegiance to executive priorities — even when they conflict with effective governance practices. If the board's support of internal auditing is weak, the audit committee's support, in turn, may also fall short.
Boards of directors focused exclusively on shareholder interests, emphasizing share price and profit generation, may believe their only responsibility is to increase the organization's value. In fact, with today's hyper-competitive global market, companies face more and more pressure to increase profits, potentially at the expense of following regulations or company policies. And if internal audit's reporting might negatively impact those priorities, then the risk of its findings being discarded or ignored are heightened. That risk is further exacerbated with audit committee members also serving on the full board, as they may be more inclined to agree with boards or executives who deprioritize the need for effective governance.
Still, many organizations — particularly in the public sector — do not have audit committees or the equivalent of a board-level presence. Oversight structures that include a board and audit committee, while flawed, at least provide a measure of governance assurance and support for internal audit independence. But auditors need to be aware that the potential for divided board loyalties is a risk in nearly every organization, and the possibility of compromised oversight is a very real one.