Internal Audit Independence

Internal audit function marred by "blue-eyed boys"

Unlike external audit, the internal audit function is still very much controlled by the big boss especially when the subordinates hired to do the jobs are the big boss's cronies.

Allow me to relate a similar case - a non-financial audit in the case of Internal Quality Auditors (ISO 9001:2000 requirements to have IQAs). The IQAs are appointed by the CEO and down the line are the CEO's "blue-eyed boys" each given a role to orchestrate. What can the IQAs do? Nothing practically. Even when the IQAs were to carry out their role accordingly, the CEO may not be bothered to respond appropriately. In the end, the IQAs are asked to produce "manipulated" internal audit reports/findings just to satisfy the external assessors inorder to get ISO certified.

Likewise in financial internal audits, no big boss's support for a sensible assignment can mean failure. The big boss must not be influenced by this crony/blue-eyed boys syndrome in order to have a well-run successful organisation.

Independence is a state of mind

Independence is not just a state of fact, but a state of mind. The only true "independent" auditor is an auditor who works for free. All others must accept the risk of losing their job if they get "tough" on the boss. An "independent" auditor has the guts (and the personal financial resources) to take that risk. A good organizational structure helps to create independence, but the mindset is important.

Independence of Internal Audit Function

Although sometimes difficult, a fairly decent level of independence can be established. It is based on several items. The first is an active audit committee of the board of directors who support the internal audit function. The second is obtaining a charter of independence by the Internal Audit Department so that it functionally reports to the Audit Committee and administrativly to management. As might be expected, many times management may not like it. Thirdly is the work of the internal audit department not to find fault but help to find answers to problems. This requires quite a bit of diplomacy and assurance from the audit committee to management that punitive action will not be taken. I was Director of Internal Audit at a private corporation (had CIA designation) and was able to get about 95% of the above. We never used an audit against any member of management. When problems were found, we talked first to the manager involved but always with a proposed solution, not a threat. It usually worked once we established how we were to operate. Internal Audit's best function is to help the company, not find fault. Only on one occasion was my department sent on a witch hunt that I objected to. I was overriden and there were no smoking guns internally as I thought. It also helped that the company was a very clean operation and operated in an honest manner. This is not to say there were some activities that were not up to corporate rules that happened.

An independent Board of Directors is critical

As a former internal auditor, the question is a good one. I left 2 jobs as a result of professional differences regarding certain company operations and judgement of the internal audit management. The best solution in my view is an actively promoted and supported confidential line of communication between all internal audit staff and independent members of the board of directors. You have to eliminate the inherant conflict within the corporate management structure. Even then, the threat of retaliation will deter many from speaking. The whistleblower statutes can provide some protection, but that road is long and arduous.