Whether you believe the Murdochs, Rupert and James, knew about the alleged bribes and hacking or not, it seems clear that News Corporation would have benefited from a strong, independent internal audit function that assessed and reported on the corporate culture to the board.
But can internal audit effectively assess the culture of the organization, including the tone at the top of the executive tree, in its current state?
At the IIA International Conference in Kuala Lumpur, Lord Smith (of the U.K. Smith report on corporate governance) suggested that internal audit should be able to stand up and tell the board that there was a risk to the company because the CEO was a "bully." I agree that an ineffective CEO can be a tremendous threat to effective performance. But how many CAEs have the ability to say something without dire consequences, even if given credibility by the board? In the words of a former audit committee chairman I worked with, the CEO has a "bigger business card." It takes a lot to criticize either the CEO or chief financial officer (CFO) in your report to the audit committee and the board is always reluctant to go against its top executives.
Professor Andrew Chambers strongly believes that internal audit should not only report to an independent chairman of the board, or lead independent director if the CEO chairs the board, but be funded as part of board operations. The compensation of the CAE should be set by the board, not by management.
While a handful of companies (apparently including Novartis) have internal auditing reporting to the board, most CAEs report administratively to the CFO and functionally to the audit committee.
Is it time to make a change and have the CAE report both functionally and administratively to the independent members of the board, with funding set by the board? In other words, should the board hire the CAE and his team as their "independent experts"?
I think this can be done and it is time to give it strong consideration. What do you think?