control, and governance
Jim is the newly appointed chief audit executive (CAE) at a large, global manufacturer. The company is admired as an industry leader and prides itself on strong corporate governance practices. Its board consists of qualified, independent directors from outside the company, and the audit committee has its own charter and a chair with extensive industry experience. Moreover, the committee meets individually with both the CAE and the outside auditor in executive session on a regular basis, and its chair serves as the committee’s designated financial expert.
Jim was hired by, and reports to, the chief financial officer (CFO). The CFO prepares the audit committee agenda and presides over the meetings. During the hiring process, senior management — including the CEO and the CFO — expressed to Jim its support for the internal audit function. The company’s internal audit function is well established and consists of 10 employees.
Shortly after joining the company, Jim received a phone call from the audit committee chair welcoming him aboard and affirming the committee’s full support of him and the internal audit function. The chair suggested they meet to discuss Jim’s vision and intended future direction for the audit function. He also suggested they communicate regularly outside the formal committee meetings to allow for open dialogue.
Jim is preparing for the upcoming audit committee meeting, where he plans to present the next year’s internal audit plan and budget. He has also been reflecting on The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards) as they relate to the CAE’s reporting responsibilities to management and the board. Accordingly, Jim is drafting a proposal and presentation for the CFO, CEO, and audit committee chair that would change his current reporting relationship.
As the company enters its fiscal year-end, the CFO stressed firmly at a recent staff meeting that he wants everyone to focus on completing the company’s annual close process and U.S. Securities and Exchange Commission filings. Furthermore, he announced that he was not interested in making any changes in reporting relationships or to the audit committee agenda at this time.
What are Jim’s reporting responsibilities to the audit committee? How should he proceed with the CFO and the audit committee chair?
Nancy Haig, CIA, CBA, CFE, CCSA, CFSA, CICA
Vice President, Internal Audit
Although the trend of reporting to the CFO is declining, many CAEs continue to have this reporting relationship. Jim should keep in mind that he is working for a reputable company with strong governance practices. He knew the reporting structure when he accepted the position as CAE, and he will have the opportunity to meet individually with the audit committee chair. But discussing a reporting relationship change with his new boss, the CFO, during a year-end close would be unwise.
That said, Jim should accept the audit committee chair’s invitation for open dialogue, in part to cultivate this important relationship. According to The IIA’s Standards Jim, as the CAE, must communicate and interact directly with the board and report periodically to the board and senior management “on the internal audit activity's purpose, authority, responsibility, and performance relative to its plan.” The existing administrative reporting relationship may prove irrelevant if Jim develops an effective working relationship with the audit committee chair and the board and also participates in the committee’s executive sessions. If Jim has any future concerns regarding the CFO’s activities or the integrity of financial reporting, he will have established his credibility and the appropriate channel of communication will be available to him.
Jim finds himself in a dilemma largely of his own making, having accepted a position without gaining clarification from his new manager on a key governance issue related to the CAE reporting structure. He must now decide how to discuss a concept with which his manager may not be comfortable and about which the Standards indicate a preference, but no firm requirement. Although Jim’s reporting structure is not prohibited, it is not preferred.
Jim’s manager, the CFO, controls the audit committee agenda and presides over committee meetings. Ownership of the agenda equals ownership of the information flow. Nonetheless, Jim’s company has adopted many effective practices. Management “takes pride in having strong corporate governance policies”; the audit committee comprises “qualified and independent” members; and structures are in place to ensure effective communication, including an executive session with the CAE. In addition, the audit committee has its own charter, and the committee chair has suggested communicating regularly with Jim outside of formal meetings.
Jim must exercise care to avoid adversely affecting his present relationship with the CFO. The CAE–CFO relationship is critical to sound corporate governance. He should inform the CFO of his invitation to meet the audit committee chair to discuss his departmental vision and explain that it will align with IIA Standards and other governance authorities. Jim should also explain that the meeting will provide an opportunity for him to present a balanced view of the proposed reporting structure, emphasizing the need for — and benefits of — transparency and independence.
Daniel DiTomasso, CPA, CIA, CISA
Jim’s reporting responsibilities to the audit committee are covered in The IIA’s Attribute Standards 1000, 1010, 1100, 1110, and 1111 and in Performance Standard 2060 — he should consult each of these sections before proceeding. Jim should also review the current internal audit and audit committee charters and note any long established company practices. Additionally, he should review the time line and format of past years’ audit committee minutes and companywide presentations.
To help foster a positive working relationship, Jim should first discuss his suggested reporting change with the CFO as a professional courtesy. He should then discuss the same details with the audit committee chair. His proposed changes and rationale should be consistent with The IIA’s Standards, and they should be presented to both individuals well in advance of formal meetings and discussion. Moreover, the CFO’s present focus on successful execution of the company’s annual close process is of paramount importance. If the parties agree on the merit of a reporting change, they could then plan a suitable time line for the transition, ensuring it does not interfere with the close or the execution of the next year’s internal audit plan and budget.
Lastly, Jim should use the audit committee chair’s invitation for open dialog as an opportunity to discuss the draft internal audit plan and budget as well as the current reporting protocol and potential repercussions of any changes. He should also be sure to gauge the current relationship between the audit committee chair and the CFO. Should the chair ask about the future direction and vision of the audit function, Jim should explain that he has not yet discussed it with company management. If the chair is open to continuing the discussion, Jim should present his rationale for the desired changes as part of his functional responsibilities to the audit committee.
How would you handle this scenario? Continue the discussion by sharing your comments below.
COMMENT ON THIS ARTICLE
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.