Internal Audit Independence

Norman Marks November 19, 2014 Comments Views

One of the issues on my mind is whether the emphasis on independence should be increased or diminished.

I can see both sides of the argument.

We need more emphasis on independence	We need less emphasis on independence
While many parts of the world have recognized the need for the internal audit function to report directly to the board (or committee of the board), with administrative reporting to the CEO or perhaps chief financial officer, that is not always the case. A number of internal audit functions, especially in smaller firms or in emerging economies, have the CAE reporting directly to management, with limited (if any) private communication to the board or audit committee. As a result, the scope of work is often limited to topics that are approved by management, and the results of audit engagements may be filtered before they reach the board. That is unacceptable, and The IIA should make it clear that internal audit must be free of inappropriate influence from management that prevents it from providing the board with an honest assessment of management's processes and controls for managing risks to the achievement of objectives. In addition, the independence of internal audit from senior and operating management is what separates and distinguishes us from other assurance providers within the organization.	Let's get real! Internal audit is never really independent. The CAE and staff are employees of the company and their livelihood (career, compensation, and so on) is linked to the company. Do we want the CAE and team to stop receiving bonuses when the company does well? Should they continue to receive pay raises when the company does poorly and is laying people off? What is important is not independence, it is objectivity. Can the internal audit team provide objective assurance on management's ability to manage risks to the achievement of organizational objectives? Instead of talking about independence, we should be talking about objectivity and threats to objectivity. In fact, even the board and external auditors are not truly independent, as they are paid by the company.

We need more emphasis on independence

We need less emphasis on independence

While many parts of the world have recognized the need for the internal audit function to report directly to the board (or committee of the board), with administrative reporting to the CEO or perhaps chief financial officer, that is not always the case.
A number of internal audit functions, especially in smaller firms or in emerging economies, have the CAE reporting directly to management, with limited (if any) private communication to the board or audit committee.
As a result, the scope of work is often limited to topics that are approved by management, and the results of audit engagements may be filtered before they reach the board.
That is unacceptable, and The IIA should make it clear that internal audit must be free of inappropriate influence from management that prevents it from providing the board with an honest assessment of management's processes and controls for managing risks to the achievement of objectives.
In addition, the independence of internal audit from senior and operating management is what separates and distinguishes us from other assurance providers within the organization.

Let's get real! Internal audit is never really independent. The CAE and staff are employees of the company and their livelihood (career, compensation, and so on) is linked to the company.
Do we want the CAE and team to stop receiving bonuses when the company does well? Should they continue to receive pay raises when the company does poorly and is laying people off?
What is important is not independence, it is objectivity.
Can the internal audit team provide objective assurance on management's ability to manage risks to the achievement of organizational objectives?
Instead of talking about independence, we should be talking about objectivity and threats to objectivity.
In fact, even the board and external auditors are not truly independent, as they are paid by the company.

So, I can argue both sides of the coin.

My view is that internal audit needs to be independent of undue management influence. I think we can explain what is meant by that: No limitations by management acting alone, without audit committee approval, on staffing, budget, scope of work, or reporting.

What do you think? I welcome your comments.

The opinions expressed by Internal Auditor's bloggers may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers' employers or the editors of Internal Auditor. The magazine is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.

Internal Audit Independence

Comment on this article

HELPFUL LINKS

MAGAZINE

ABOUT US

JOIN OUR COMMUNITY