I recently attended an internal audit conference outside of North America. One of the keynote speakers delivered a presentation on what he thought was a very provocative theme. It was his assertion that internal auditors are not "independent," thereby (he asserted) the very definition of internal auditing was flawed. He knew I was in the audience, and I believe he fully expected I would challenge his views as being inaccurate. In fact, his assertion that internal auditors are not independent is not provocative at all. The International Standards for the Professional Practice of Internal Auditing (Standards) does not assert that the internal auditor is independent. Often people confuse the organizational attribute of "independence" with the individual attribute of "objectivity," which internal auditors are expected to maintain.
It has been almost 10 years since I served as a member of The IIA's Internal Audit Standards Board (IASB). We were charged with the most extensive overhaul of the Standards in more than a generation. I remember vividly the passionate debates in which we engaged on topics as essential to the fabric of our profession as independence and objectivity. As I recall, there was no real debate about whether an individual internal auditor is independent. Clearly as employees of their enterprise, neither the chief audit executive nor any of his or her staff can technically be independent from that very enterprise. Yet it is critical that the internal audit activity be free to execute its responsibilities. It is vital that the board of directors be comfortable that internal auditing's efforts are not being thwarted by one or more senior executives of the organization.
In the end, we agreed that "independence" is an organizational attribute. Standard 1100 – Independence and Objectivity states: "The internal audit activity must be independent, and internal auditors must be objective in performing their work." In clarifying what independence means in the context of the Standards, the accompanying interpretation states:
"Independence is the freedom from conditions that threaten the ability of the internal audit activity or the chief audit executive to carry out internal audit responsibilities in an unbiased manner. To achieve the degree of independence necessary to effectively carry out the responsibilities of the internal audit activity, the chief audit executive has direct and unrestricted access to senior management and the board."
In case there is any further doubt about what is meant by independence, Standard 1110 – Organizational Independence further clarifies that:
"The chief audit executive must report to a level within the organization that allows the internal audit activity to fulfill its responsibilities. The chief audit executive must confirm to the board, at least annually, the organizational independence of the internal audit activity."
In addition to "organizational independence," the Standards also clearly define objectivity. Once again, Standard 1100 – Independence and Objectivity states:
"Objectivity is an unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they believe in their work product and that no quality compromises are made. Objectivity requires that internal auditors do not subordinate their judgment on audit matters to others."
In the final analysis, while we as internal audit professionals may not be independent of the organization, we must nonetheless maintain our objectivity when conducting our work.
While my blog represents my own views, and not necessarily those of the IASB, I do believe the IASB has been very clear and consistent on its views on this topic: The internal audit activity should be independent, and the internal audit professionals who staff it should remain objective. For additional insight on independence and objectivity, The IIA Research Foundation has published an excellent monograph: Independence and Objectivity: A Framework for Internal Auditors.
I welcome your thoughts.