So as we go into the new year and we CAEs think about how our IA departments are positioned with and within our client organisations, I thought it would be helpful to revisit the debate about internal audit independence.
Internal audit’s great strength is both its independence, both actual and perceived, but also its dependence i.e. if provided in-house, the IA function is committed full time to the client. In that sense it has a dependence on the client organisation. It has to ‘live’ with its judgements and decisions.
Yet, for a CAE, despite the standards requiring constant and full independence, a CAE has to consider how it works in practical terms with its client organisations. In other words a CAE has to have some level of client management and organisational orientation. So for a major report, should a CAE pitch it as a grumpy challenge, encouraging questioning of the status quo or as a gentle shot across the bow? All are legitimate positions in different circumstances. A CAE has to decide.
Get this wrong and IA can be poorly placed. If the independent challenge is too high, then internal audit becomes an inspector. Well into the third line of defence in a regulatory and challenge function. This will lose the benefits of a positive, open and cathartic relationship for the promotion of change and improvement. If the independent challenge is too low then you risk taking audit into being either irrelevant or being controlled by your client’s management team.
In an ideal world one would seek to pitch both an independent challenge, but within a client and management oriented manner. This takes you to being a friend. I’ve characterised how this friend relationship would work in a separate blog post here: https://chiefauditexecutive.wordpress.com/2014/10/17/internal-audit-a-critical-friend/
As a CAE I have found that often the relationship with the client organisation and management team varies over time. It is a result of a cumulative outcomes from decisions and ongoing discussions. For despite a CAE’s wish to be pitched in a particular space, the assurance assignments as they are published could, at a point of time, point the CAE into a difficult position. For example, consider where a CAE wishes to be more challenging, but the programme of work at a point in time comes out (correctly) with benign or positive results. The CAE has no timeous reports and outcomes to pitch that challenge with. Consider the converse also. Where a CAE is trying to build a positive, safe, space for discussion, yet assurance results are challenging, then it is difficult to dial back the perception of, or actual, challenge.
As a CAE I firmly believe that assurance results are just that, and should not be distorted or misreported for the short term political benefit of either the CAE or the IA function. As a CAE I should, however, look at the overall diet of assurance and messaging. For individual assignments form part of an overall opinion and storyline, and the CAE must keep an eye on what that is and how it will play out organisationally and in terms of control.
So for all of you auditors out there who see what seem to be odd or strange decisions from your CAE, do please appreciate the ‘higher currents’ the CAE must consider in the IA function’s work. Seek to understand those, for they will help you in your work and your assignment level opinions.
So is the New Year a good time for CAEs to reconsider the overall positioning and message? Yes – I think so. Should this be a purely CAE decision? No – I think it should be something debated with the IA function and team as a whole (or at least a senior subset of the team). For this will ensure that the orientation of all interactions the client organisation and management team has with the internal audit function are more consistent.
So where are you placed on the scale above and will you seek to change it?