Recently, I was told the story of a chief audit executive (CAE) with a problem. Unfortunately, the story is not uncommon, and I am not aware of an easy solution to the CAE's situation.
The CAE returned from an overseas trip involving the investigation of a potential fraud reported through the hotline. Even before he had a chance to open his e-mail, the chief executive officer (CEO) called him into his office for a briefing on the results. The CAE of course obeyed and told the CEO that there had indeed been a fraud involving the loss of a few million dollars. The fraud involved some of the local management team, and a breakdown in the financial controls had prevented discovery.
After the CAE left, the CEO had an angry conversation with the chief financial officer (CFO), blaming him for the poor controls and the loss. The CAE found out when the CFO called him into his office for a yelling session. The CFO told him he should not have said anything to the CEO without talking to the CFO first. More upsetting, the CFO said he thought the CAE had exaggerated the situation.