One of the issues on my mind is whether the emphasis on independence should be increased or diminished.
I can see both sides of the argument.
-
While many parts of the world have recognized the need for the internal audit function to report directly to the board (or committee of the board), with administrative reporting to the CEO or perhaps chief financial officer, that is not always the case.
-
A number of internal audit functions, especially in smaller firms or in emerging economies, have the CAE reporting directly to management, with limited (if any) private communication to the board or audit committee.
-
As a result, the scope of work is often limited to topics that are approved by management, and the results of audit engagements may be filtered before they reach the board.
-
That is unacceptable, and The IIA should make it clear that internal audit must be free of inappropriate influence from management that prevents it from providing the board with an honest assessment of management's processes and controls for managing risks to the achievement of objectives.
-
In addition, the independence of internal audit from senior and operating management is what separates and distinguishes us from other assurance providers within the organization.
|
-
Let's get real! Internal audit is never really independent. The CAE and staff are employees of the company and their livelihood (career, compensation, and so on) is linked to the company.
-
Do we want the CAE and team to stop receiving bonuses when the company does well? Should they continue to receive pay raises when the company does poorly and is laying people off?
-
What is important is not
independence, it is
objectivity.
-
Can the internal audit team provide objective assurance on management's ability to manage risks to the achievement of organizational objectives?
-
Instead of talking about independence, we should be talking about objectivity and threats to objectivity.
-
In fact, even the board and external auditors are not truly independent, as they are paid by the company.
|
So, I can argue both sides of the coin.
My view is that internal audit needs to be independent of
undue management influence. I think we can explain what is meant by that: No limitations by management acting alone, without audit committee approval, on staffing, budget, scope of work, or reporting.
What do you think? I welcome your comments.