Inside audit reporting to the CFO: 5 safeguards to independence

After greater than 10 years of sounding alarms in regards to the risks of getting inner audit report administratively to the chief monetary officer, I need to grudgingly concede my warnings have fallen on deaf ears. 

My firmly held perception is that inner audit ought to report administratively to the CEO and functionally to the audit committee of the board. However 12 months after 12 months, the Pulse of Inside Audit survey displays that the distinct majority of publicly traded firms within the U.S. place their audit capabilities administratively underneath the CFO. The newest annual Pulse survey and report — the flagship report from the Institute of Inside Auditors  — discovered 79% of publicly traded firms have this association.

Whereas most privately held firms additionally fall into this class (72%), my concern is with firms whose danger administration practices most instantly impression traders and the higher market. For individuals who have not learn my earlier cautionary missives on this matter, this is a quick synopsis of why I imagine this follow is basically harmful and more and more so within the trendy danger panorama.

The commonest critique of this reporting association is that CFOs might steer inner audit scrutiny away from their areas of duty. However I have never discovered that to be the largest downside. As an alternative, statistics I’ve seen over time point out that CFOs are extra seemingly to make use of inner audits to deal with key dangers of their areas of duty, on the potential exclusion of non-CFO dangers within the group. Beneath, I share 5 safeguards for making certain that reporting relationships to the CFO do not compromise inner audit’s independence. However first, a quick historical past lesson would possibly assist shed extra gentle on why this must be of grave concern for any group.

Within the U.S., inner audit got here into its personal as a occupation after passage of landmark laws within the wake of the 1929 inventory market crash, together with the Securities Acts of 1933 and 1934. These acts created trendy regulatory ideas for inner controls over monetary reporting, and so they fueled the necessity for efficient assurance over ICFR that inner audit offers. Seven many years later, a collection of monetary scandals, most notably the collapse of WorldCom and Enron, led to passage of the Sarbanes-Oxley Act of 2002. The brand new laws created even higher reporting necessities together with mandates for annual assessments of ICFR effectiveness and unbiased exterior auditor attestations. From the CFO’s perspective, it will appear apparent that efficient ICFR and compliance with associated reporting rules must be a prime precedence for publicly traded firms and that unbiased and unbiased assurance from inner audit must be a part of the method. Anybody studying that may moderately ask, “So what’s the issue, Richard?”

The reply is that, whereas monetary controls and associated reporting rules signify a major danger space for a lot of organizations, right this moment’s complicated and risky danger atmosphere accommodates substantial nonfinancial dangers, together with cybersecurity and digital disruptions corresponding to AI, provide chain,  enterprise resilience, local weather change and others. Merely acknowledged, underneath the CFO’s management, there may be inherent danger in overemphasizing the necessity for inner audit providers on ICFR whereas minimizing its worth in combating nonfinancial dangers.

To be clear, I’m not accusing any CFO of intentionally ignoring nonfinancial dangers. Quite the opposite, I imagine CFOs typically are well-informed and well-intentioned danger administration companions. However I additionally imagine unconscious bias and blind spots are a part of human nature.

5 safeguards to make sure a minimum of the looks of inner audit’s independence

As a result of I see little probability of fixing the CFO/inner audit paradigm on the horizon, I might like to supply 5 safeguards to assist guarantee inner audit providers aren’t swayed to the detriment of nonfinancial danger.

1. Inside audit’s constitution should reference the executive reporting line to the CFO. There must be no ambiguity within the constitution’s language, corresponding to saying inner audit reviews to a member of administration. 
2. Company minutes ought to doc that the reporting relationship was mentioned with and accredited by the board and/or audit committee. Whereas I will not go so far as saying the audit committee should doc its decision-making course of, documenting the dialogue acts as a safeguard to make sure the audit committee understands the reporting relationship and has explored its dangers and benefits earlier than approving the constitution.
3. The CEO ought to evaluation and approve any proposed audit plan earlier than submitting it to the audit committee for approval. This ensures the CEO’s involvement and displays that the CEO agrees with the priorities established within the audit plan. This mitigates any notion that the CEO is unaware of inner audit’s focus.
4. The audit committee must be knowledgeable of any deviation between the chance evaluation and the place the audit plan addresses the CFO’s areas of protection. This can make the committee conscious of any decrease CFO danger areas which can be within the audit plan or any increased non-CFO danger areas that aren’t. 
5. Audit committees ought to insist on being knowledgeable about disagreements between the CFO and inner audit over audit suggestions. This offers an extra safeguard that will alert the audit committee to any developments in disagreements that may replicate undue affect or bias from the CFO.

I ought to point out that the IIA’s new International Inside Audit Requirements additionally replicate this actuality. Normal 7.1 Organizational Independence Necessities requires the chief audit govt to yearly affirm to the board the inner audit operate’s organizational independence, together with any incidents the place its independence may need been impaired. It additionally requires the CAE to doc inside the inner audit constitution inner audit’s reporting relationships and organizational positioning.

In its Concerns for Implementations, Normal 7.1 notes, “Whereas the chief audit govt reviews functionally to the board, the executive reporting relationship is usually to a member of administration. This permits entry to senior administration and the authority to problem administration’s views. To attain this authority, it’s main follow for the chief audit govt to report administratively to the chief govt officer or equal, though reporting to a different senior officer could obtain the identical goal if acceptable safeguards are applied.”

The precautions outlined above shouldn’t be taken as me altering my views about inner audit’s reporting relationship. As an alternative, it’s an acknowledgement that I can learn the writing on the wall. I nonetheless imagine it advantages the group total for the CEO to have inner audit as a direct report, regardless of the reluctance of U.S. publicly traded firms to affix the remainder of the world in having inner audit report back to the CEO. The most recent international knowledge on the subject, from the Inside Audit Basis’s 2022 International View Report, discovered that globally 65% of publicly traded firms have inner audit reporting on to the CEO.

I can solely surmise there should be some legacy holdover to that long-ago time when inner auditing was seen as a finance-related operate as an alternative of a key danger administration participant. However that was the period of the bean counter, after we had been primarily focused on monetary controls and the general accuracy of monetary info. Inside audit capabilities started to interact extra in operational dangers way back to the Sixties. By the Seventies and Eighties, it was fairly frequent for inner audit to be taking a look at extra than simply monetary dangers. Certainly, we’re greater than a half century past the time when inner auditors lastly took off their inexperienced eye shades. That necessary evolution must be mirrored in a direct reporting line between the CEO and the CAE.