Recently, I was told the story of a chief audit executive (CAE) with a problem. Unfortunately, the story is not uncommon, and I am not aware of an easy solution to the CAE's situation.
The CAE returned from an overseas trip involving the investigation of a potential fraud reported through the hotline. Even before he had a chance to open his e-mail, the chief executive officer (CEO) called him into his office for a briefing on the results. The CAE of course obeyed and told the CEO that there had indeed been a fraud involving the loss of a few million dollars. The fraud involved some of the local management team, and a breakdown in the financial controls had prevented discovery.
After the CAE left, the CEO had an angry conversation with the chief financial officer (CFO), blaming him for the poor controls and the loss. The CAE found out when the CFO called him into his office for a yelling session. The CFO told him he should not have said anything to the CEO without talking to the CFO first. More upsetting, the CFO said he thought the CAE had exaggerated the situation.
Although the CAE reports directly to the audit committee and thinks he has their support, he believes that his relationship with the CFO is probably beyond repair. He expects he will have to leave at some point. He knows that even if he gets the support for the investigation results from the audit committee, he still has to work day-to-day with the CFO. As the chair of the audit committee of one of my prior companies told me (yes, I have been in a situation like our friend's), the CFO has a "bigger business card." If there is a conflict, the CFO will always win; unless he or she is already in trouble, little will be said or done.
Too often, the CAE is the bearer of bad news — news that top executives don't want to hear. There may be pressure, even if subtle, to downplay the situation. While almost all will resist the pressure, it can be intense.
How many of us have struggled about how to talk to the audit committee about pressure on financial and operational management to "make the numbers" without equivalent messaging not to bend the rules?
A large number of CAEs have told me, over the years, how they were forced to leave after an incident where they felt their professional ethics were under attack. Sometimes the departure was not for months, but it was inevitable.
I don't know of a solution. But I believe that The IIA can offer assistance. It can create a sort of hotline for CAEs (or other auditors) facing a professional or ethical dilemma. The IIA staff should be able to find a group of experienced CAEs who can listen and offer advice.
Do you agree? Is there a better solution?