From the very first day I became an internal auditor, the word "independence" took on particular significance. As a young auditor in government, we were taught from the beginning that "independence" was the foundation upon which internal auditing's credibility and effectiveness was based. Over the years, our audit standards were strengthened to mandate reporting relationships that fostered independence. Yet, even when I first assumed the role of a chief audit executive (CAE) in the late 1980s, I was vaguely uncomfortable with touting "independence" when I was clearly employed by the organization in which I worked. I watched way too many "independent" CAEs meet an untimely professional demise for being a bit too "assertive" to assume that I was totally independent.
A few years later, I had the opportunity to serve on The IIA's Internal Audit Standards Board during a period in which a major revision to the International Standards for the Professional Practice of Internal Auditing (Standards) was underway. I had the opportunity to participate in a number of remarkable debates/discussions in which members of the board explored what independence really meant. In the end, the Standards defined "independence" as an "organizational attribute," and "objectivity" as the personal attribute. In other words, internal audit organizations should be independent while the professionals who staff those organizations should strive for objectivity. Ideally, that should have resolved the issue in my mind, but it really did not.
Standard 1110 defines organizational independence as one in which the CAE reports "to a level within the organization that allows the internal audit activity to fulfill its responsibilities." Over the years, The IIA has gone a step further to indicate that a CAE reporting relationship functionally to the board and administratively to the CEO is one that "facilitates organizational independence." Even in 2009, however, very few CAEs report administratively to their CEO. The preponderance of CAEs in the U.S. corporate sector continue to work administratively for the chief financial officer (CFO) and functionally for their audit committees. A growing number are even working administratively for the general counsel. The question often posed is, "Are any of these internal audit activities 'independent?'" The answer is "it depends."
I have had the opportunity in recent years to examine a great many corporate internal audit activities in the course of completing their external quality assessments. While I readily acknowledge that those where the CAE reports administratively to the CEO are generally more independent, many of the others are also independent as defined by the Standards. In the final analysis, I would offer five litmus tests below in assessing the extent to which an internal audit activity whose CAE reports administratively to a level below the CEO is truly independent:
Attitude. The individual to whom the CAE reports administratively takes the independence of internal auditing very seriously, and never interposes his or her judgment in terms of internal audit coverage or results. The strongest message I would typically hear from such an individual is "internal auditing does not really work for me — it works for the audit committee."
Stature. The individual to whom the CAE reports administratively possesses sufficient authority to promote independence and appropriate action on engagement recommendations.
Perception. The CEO and other executives within the company genuinely believe that internal auditing works for the audit committee.
The Charter. The internal audit charter is very clear on the significance of the functional reporting relationship to the audit committee and includes specific audit committee responsibilities for internal auditing such as hiring, evaluating, and determining the compensation of the CAE.
Actions. The actions of the audit committee reflect that it views internal auditing as reporting directly to it.
As with all of my blog posts, the litmus tests are not official IIA guidance. Instead, they reflect my personal perspectives on what independence really means in our profession. I invite your views on this important topic.