Independence: What Does It Really Mean?

Richard Chambers, CIA, CGAP, CCSA, shares his personal reflections and insights on the internal audit profession.

From the very first day I became an internal auditor, the word “independence” took on particular significance. As a young auditor in government, we were taught from the beginning that “independence” was the foundation upon which internal auditing’s credibility and effectiveness was based. Over the years, our audit standards were strengthened to mandate reporting relationships that fostered independence. Yet, even when I first assumed the role of a chief audit executive (CAE) in the late 1980s, I was vaguely uncomfortable with touting “independence” when I was clearly employed by the organization in which I worked. I watched way too many “independent” CAEs meet an untimely professional demise for being a bit too “assertive” to assume that I was totally independent.

A few years later, I had the opportunity to serve on The IIA’s Internal Audit Standards Board during a period in which a major revision to the International Standards for the Professional Practice of Internal Auditing (Standards) was underway. I had the opportunity to participate in a number of remarkable debates/discussions in which members of the board explored what independence really meant. In the end, the Standards defined “independence” as an “organizational attribute,” and “objectivity” as the personal attribute. In other words, internal audit organizations should be independent while the professionals who staff those organizations should strive for objectivity. Ideally, that should have resolved the issue in my mind, but it really did not.

Standard 1110 defines organizational independence as one in which the CAE reports “to a level within the organization that allows the internal audit activity to fulfill its responsibilities.” Over the years, The IIA has gone a step further to indicate that a CAE reporting relationship functionally to the board and administratively to the CEO is one that “facilitates organizational independence.” Even in 2009, however, very few CAEs report administratively to their CEO. The preponderance of CAEs in the U.S. corporate sector continue to work administratively for the chief financial officer (CFO) and functionally for their audit committees. A growing number are even working administratively for the general counsel. The question often posed is, “Are any of these internal audit activities ‘independent?’” The answer is “it depends.”

I have had the opportunity in recent years to examine a great many corporate internal audit activities in the course of completing their external quality assessments. While I readily acknowledge that those where the CAE reports administratively to the CEO are generally more independent, many of the others are also independent as defined by the Standards. In the final analysis, I would offer five litmus tests below in assessing the extent to which an internal audit activity whose CAE reports administratively to a level below the CEO is truly independent:

  • Attitude. The individual to whom the CAE reports administratively takes the independence of internal auditing very seriously, and never interposes his or her judgment in terms of internal audit coverage or results. The strongest message I would typically hear from such an individual is “internal auditing does not really work for me — it works for the audit committee.” 
  • Stature. The individual to whom the CAE reports administratively possesses sufficient authority to promote independence and appropriate action on engagement recommendations.
  • Perception. The CEO and other executives within the company genuinely believe that internal auditing works for the audit committee.
  • The Charter. The internal audit charter is very clear on the significance of the functional reporting relationship to the audit committee and includes specific audit committee responsibilities for internal auditing such as hiring, evaluating, and determining the compensation of the CAE.
  • Actions. The actions of the audit committee reflect that it views internal auditing as reporting directly to it. 

As with all of my blog posts, the litmus tests are not official IIA guidance. Instead, they reflect my personal perspectives on what independence really means in our profession. I invite your views on this important topic.
 

Posted on Jun 23, 2009 by Richard Chambers

Share This Article:    

  1. Richard, you have some excellent points. I suggest consideration as to whether the CAE is in fact and perception free from inappropriate management influence. That phrase, inappropriate management influence, is the key for me.

    Factors to consider include:

    - who sets the compensation of the CAE, including promotions, raises, and variable compensation? Concurrance by the Audit Committee is not sufficient

    - who hires the CAE? Generally, the Audit Committee only see those hand-picked by management

    - if there is a 'personality conflict' between the CAE and one of the top executives, does this create an unacceptably hostile environment? Does the CAE end up leaving within a year or two?

    - are the career prospects of the CAE dependent on top management? This is especially tough when the CAE is expected to move into management after a few years in IA

    - can top management deprive the CAE of the resources (headcount, budget, access, information, etc.) necessary to be effective?

    Part of the trouble is that the Audit Committee will rarely go to battle on behalf of the CAE with a trusted and respected CEO or CFO. The latter have a "bigger business card" and in time the CAE will depart. Just think about how many CAEs have spoken up and been supported about an inappropriate (COSO ERM) internal environment.

    Another part of the problem is that few members of the board really understand what the CAE does day-in and day-out. They empathize with the CEO and CFO, as often that is the position they help themselves.

    So, the CAE may appear to be independent based on a review of the organization chart and the audit charter, while remaining constrained by management influence.

  1. Very important issue.I am a strong advocate of auditor independence.I just want to add one comment., I believe Independence starts in the mind set of the auditor.

  1. I agree with Richard's instrumental and conceptual coverage on the independence topic.  Furthermore, I echo what Norman commented here.

    I have not been an internal auditor for a long time but I know this is the key attribute that any auditor should have and maintain in this profession.  One probable challenge could be whether an auditor can still maintain true independence (and for how long?) when the support structure is not there and the expectations (from the top) differ from the audit objectivity, especially during the tough time.

  1. Norman, I think you summed up the situation superbly.  I don't know how to really achieve good governance, but I know you described today's reality exceedingly well.

  1. This is a really well summarized article.  For me, independence is both a personal and an organizational attribute. 

    From a personal perspective there are many behaviors I must avoid to maintain my independence.  These include things like having too much ownership (stock) in a company, having close relatives that are major audit clients, performing contracting back to the organization, or performing personal services (such as preparing income tax returns) for team mates at work.  These actions all diminish my personal independence as an auditor.

    From an organization perspective, you've hit all the right points.  I especially like the point of the attitude of your direct supervisor.  If they are at an appropriate level (I'd submit a CFO is not) and understand your function, then you usually have good independence.  If you suffer too much political pressure from your direct supervisor then you suffer an impairment. 

  1. With all the turmoil and contradictions in the market place I believe we are moving towards true independence for the internal auditing with the CAE reporting administratively and functionally to the audit committee. It is the only true solution.

  1. That dual reporting structure is what I think causes problems for the audit organization. Administrative reporting to the CEO gives an impression that the CAE works for the CEO. Thus even if words of independence may be expressed at meetings and in hallways, there will always be a latent force driving the CEO's influence upon the CAE, one way or another.

    More independence can be created by making the audit organization a stand alone entity in the company or agency, making it a quasi external audit organization. The only reporting the CAE should do must be to the audit committee. He/she must never depend on the CEO on anything, regardless of the CEO's views on audit activity independence.

  1. How can anyone be considered independent of their employer when their livelihood is dpendent upon that same employer? This includes both the audit staff as well as the CAE. I understand how the independence standard for those auditors in public accounting can be achieved and monitored. I truly believe that the standard most relevant for internal auditors is to remain objective in their engagements.

     

  1. I struggle with the lack of independence on a daily basis at my job. I am an auditor for Califorina local government. Our CAE reports administratively to the Auditor/Controller-Recorder, who reports to the CAO.  Furthermore, the Auditor/Controller-Recorder is an elected official.  There is always an "inappropriate management influence" based on some political aspect. However, in California we are mandated by law to combine the Auditor function with the Controller function.  Almost every transaction within our organization come through the Controller's office in one way or another; yet, the Auditor/Controller-Recorder has the power to block any audit report. 

  1. We all agree and understand the importance of independence for both external and internal auditors.  However, it is almost impossible to be independent when management directly controls the budget, performance review and compensation of the internal audit department, including the CAE.

    True independence for the CAE is attained only when the Audit Committee directly oversees the operation of the internal audit department.  Unfortunately this is not the case in most business organizations and in reality, the CAE must harmonize his/her relationship with management and sometimes this will lead to compromising internal audit's independence.

  1. A very timely article given the assult on the independence of Inspectors General in government.  The IGs  at the Federal and State levels serve a very similar function to the CAE.  To be more independent I agree with Stephen M, these positions need to be much more aligned with the audit committee or some similar committee outside management.  The committee needs to do the hiring, firing, budget setting all related functions.  Otherwise there is an appearance of independence but not true independence. 

  1. Changing IAD reporting relationships is hard.  What reason could a CAE give to distance IAD from an ineffective CFO without creating difficult politics? Organizational independence angles may help eliminate some possibilities that will hopefully endure:

    1. Practice Advisory: IAD should report to the position that makes the IAD most effective. What is the worst internal reporting line? Why?

    2. From the IIA QA Lead Reviewer who trained me: "The CFO exhibits every IAD-positive attribute. The whole organization represents it's a healthy relationship. IAD has respect and access as a result. But, what if the next CFO isn't? Or the CAE naive? Roles have longer lives than individuals. Consider the long term."

    3. The Code of Ethics: independence is "in fact and appearance" for trust. Without trust, there's no credibility for IAD's work. Which alignments would impact credibility?

    4. The Standards state fraud is considered at all stages of auditing. What reporting role would help accomplish what is expected?

    5. IAD reports to the board to allow an unobscured avenue for uncomfortable facts if concerns happen at the highest levels. What could happen to obscure board communications? Which alignments would halt or obscure those facts the worst?

    6. Some officers like to keep Audit Committees in the dark, and AC's who don't even know they can direct the IAD. What alignment communicates well with the board?

    7. Where would IAD have the least information access?

    The best long term solution considers the risk of losing credibility, and the likelihood of benefit by harming the IAD's responsibilities.

  1. I am pleased to see this conversation going on in the IA community. In my opinion, the issue of true independence (or lack thereof) is a significant one.

    I was in the IA field for 17 years before moving to management about four years ago. Norman's comments above resonated with me: "if there is a 'personality conflict' between the CAE and one of the top executives, does this create an unacceptably hostile environment? Does the CAE end up leaving within a year or two?"

    This is exactly what happened to me - a reorganization resulted in me reporting to a new boss (the General Counsel) and we did not see eye-to-eye. Within a year, I resigned, after over 7 years as the CAE. The Audit Committee did not contact me for an exit interview, even though, on paper, I reported to them functionally. Of ffurther note is that there were situations where in-camera discussions that I had with the Audit Committee were repeated to management (this might be a further topic for discussion) so I didn't have a lot of trust to discuss what was happening with the Audit Committee.

    At that time, I was on an International IIA Committee and I was surprised to find the IA community somewhat hesitant to talk about this type of situation. I don't have any further solutions to add to what has been stated above but I do encourage the community to keep talking about this - the more discussion and acknowledgement around a problem, the greater likelihood that it will be resolved..

    Thanks for the opportunity to share....

  1. I believe that independence lies squarely with the CAE.  Regardless of organizational reporting lines it remains the responsibility and obligation of the CAE to determine whether he/she is truly exhibiting independence.  The profession expects and demands that we as CAEs exhibit the highest level of ethics regardless of the repercussions on our careers.  Whether this expectation is realistic is certainly a debatable topic, however, it does not relieve us of our responsibility to report the results or our audits objectively to the Audit Committee.  If anyone within the organization tries to deny us that responsibility, then we should know immediately that our independence has just been impacted.  However, that same event should give us all the more reason to execute our responsibility.  I realize it may cost us our jobs but, we should have accepted that risk when we accepted the position.

    Having said all this, it is imperative that one should insist on interviewing with the Audit Committee before accepting the position of CAE to determine whether the Committee recognizes its responsibilities and clearly states that it supports the CAE position and expects full and open reporting.  If you do not get that from the Audit Committee, then you should probably keep looking.

  1. If an internal audit organization is not organizationally independent according to standards (IIA's and also GAO Yellow Book as in comment re: California, above) how can the CPA firm auditing the organization not comment on it in their letter of recommendations after performing  their internal control review?

  1. The distinction between organizational and personal attributes is helpful.  I have worked in the field of Environmental / Sustainability auditing for 30 yrs.  Independence is challenging for small and medium-size businesses, where they may not have sufficient resources to fund an internal auditor - or where the only internal staff person with a modicum of knowledge of the subject area is also responsible for management.

    In helping upgrade the internal (Environmental) auditing activities of a client, we tried an innovative approach to co-sourcing.  We developed guidelines, and created the role of an [external] "auditing governance resource."  The governance resource must approve risk criteria, annual audit plan, departures from annual audit plan.  S/he must lead or shadow a specified number of audits, and must approve variances from the standard timeframe for closing corrective actions.  S/he has the authority (and pre-designated budget) to perform trend analysis on audit findings.  S/he is expected to provide an annual report to senior management, including General Counsel. 

    While this approach is not perfect, it is considerably more robust than historic activities at the company.  It injects independent perspectives at key decision points.  It provides independent perspective at a fraction of the cost of a full-time internal resource.  We likened it to a "continuous QAR." 

    In first year of operation, the Client agrees it has improved the rigor of the process, the identification of compliance gaps and risks, and the timeliness in implementing corrective actions. 

     

  1. I agree with Richard's blog in the companywide perspective.  However, Gene sees the elephant in the room about having our livelihood on the line.  In my opinion, true independence can't be achieved by internal audit.  However, a  degree of independence can be.  Again, Gene hits the nail on the head with "objectivity" being a better measurement from the auditor's perspective.  

  1. While objectivity may be a sufficient attribute for an Internal Auditor who is not a CAE, I believe that a CAE must be ready to put his or her job on the line to be truly independent. Audit Committees would be doing the right thing if they include this attribute while appointing a CAE.

    For those of us who do not intend to go all the way can always move to management after achieving the progression upto CAE-1 level.

Leave a Reply