Independence: What Does It Really Mean?
Richard Chambers, CIA, CGAP, CCSA, shares his personal reflections and insights on the internal audit profession.
From the very first day I became an internal auditor, the word “independence” took on particular significance. As a young auditor in government, we were taught from the beginning that “independence” was the foundation upon which internal auditing’s credibility and effectiveness was based. Over the years, our audit standards were strengthened to mandate reporting relationships that fostered independence. Yet, even when I first assumed the role of a chief audit executive (CAE) in the late 1980s, I was vaguely uncomfortable with touting “independence” when I was clearly employed by the organization in which I worked. I watched way too many “independent” CAEs meet an untimely professional demise for being a bit too “assertive” to assume that I was totally independent.
A few years later, I had the opportunity to serve on The IIA’s Internal Audit Standards Board during a period in which a major revision to the International Standards for the Professional Practice of Internal Auditing (Standards) was underway. I had the opportunity to participate in a number of remarkable debates/discussions in which members of the board explored what independence really meant. In the end, the Standards defined “independence” as an “organizational attribute,” and “objectivity” as the personal attribute. In other words, internal audit organizations should be independent while the professionals who staff those organizations should strive for objectivity. Ideally, that should have resolved the issue in my mind, but it really did not.
Standard 1110 defines organizational independence as one in which the CAE reports “to a level within the organization that allows the internal audit activity to fulfill its responsibilities.” Over the years, The IIA has gone a step further to indicate that a CAE reporting relationship functionally to the board and administratively to the CEO is one that “facilitates organizational independence.” Even in 2009, however, very few CAEs report administratively to their CEO. The preponderance of CAEs in the U.S. corporate sector continue to work administratively for the chief financial officer (CFO) and functionally for their audit committees. A growing number are even working administratively for the general counsel. The question often posed is, “Are any of these internal audit activities ‘independent?’” The answer is “it depends.”
I have had the opportunity in recent years to examine a great many corporate internal audit activities in the course of completing their external quality assessments. While I readily acknowledge that those where the CAE reports administratively to the CEO are generally more independent, many of the others are also independent as defined by the Standards. In the final analysis, I would offer five litmus tests below in assessing the extent to which an internal audit activity whose CAE reports administratively to a level below the CEO is truly independent:
- Attitude. The individual to whom the CAE reports administratively takes the independence of internal auditing very seriously, and never interposes his or her judgment in terms of internal audit coverage or results. The strongest message I would typically hear from such an individual is “internal auditing does not really work for me — it works for the audit committee.”
- Stature. The individual to whom the CAE reports administratively possesses sufficient authority to promote independence and appropriate action on engagement recommendations.
- Perception. The CEO and other executives within the company genuinely believe that internal auditing works for the audit committee.
- The Charter. The internal audit charter is very clear on the significance of the functional reporting relationship to the audit committee and includes specific audit committee responsibilities for internal auditing such as hiring, evaluating, and determining the compensation of the CAE.
- Actions. The actions of the audit committee reflect that it views internal auditing as reporting directly to it.
As with all of my blog posts, the litmus tests are not official IIA guidance. Instead, they reflect my personal perspectives on what independence really means in our profession. I invite your views on this important topic.
Posted on Jun 23, 2009 by Richard Chambers
Share This Article:
Entries
Richard, you have some excellent points. I suggest consideration as to whether the CAE is in fact and perception free from inappropriate management influence. That phrase, inappropriate management influence, is the key for me.
Factors to consider include:
- who sets the compensation of the CAE, including promotions, raises, and variable compensation? Concurrance by the Audit Committee is not sufficient
- who hires the CAE? Generally, the Audit Committee only see those hand-picked by management
- if there is a 'personality conflict' between the CAE and one of the top executives, does this create an unacceptably hostile environment? Does the CAE end up leaving within a year or two?
- are the career prospects of the CAE dependent on top management? This is especially tough when the CAE is expected to move into management after a few years in IA
- can top management deprive the CAE of the resources (headcount, budget, access, information, etc.) necessary to be effective?
Part of the trouble is that the Audit Committee will rarely go to battle on behalf of the CAE with a trusted and respected CEO or CFO. The latter have a "bigger business card" and in time the CAE will depart. Just think about how many CAEs have spoken up and been supported about an inappropriate (COSO ERM) internal environment.
Another part of the problem is that few members of the board really understand what the CAE does day-in and day-out. They empathize with the CEO and CFO, as often that is the position they help themselves.
So, the CAE may appear to be independent based on a review of the organization chart and the audit charter, while remaining constrained by management influence.