Rotation model presents a challenge to internal audit independence

For many reasons, internal audit is a good place to be working these days. The sizes of internal audit staffs and budgets have increased in 2012–13 at rates that haven’t been surpassed in many years, according to a new report by the Institute of Internal Auditors (IIA).

Internal auditors are well-positioned to help enterprises fulfill additional regulatory requirements, and many companies have more resources to devote to internal audit than they did a few years ago.

Nonetheless, internal audit still faces operational challenges with respect to the objectivity and independence necessary to perform the job faithfully.

According to the IIA, a substantial number of chief audit executives (CAEs) are arriving at their positions through participation in high-potential-employee training programmes. These programmes rotate finance employees into the CAE position for three to five years, after which the employees return to finance, the IIA report says. IIA President and Chief Executive Richard Chambers said in the report that some of these employees have been tremendous change agents because of their fresh perspective.

But Chambers worries that CAEs who are temporarily passing through internal audit from the finance function will make a colossal error – whether purposefully or inadvertently – because of their relationship with the CFO, according to the report.

Finance professionals who rotate through the CAE role will have a past and perhaps future role under the CFO’s supervision. Chambers said five governance safeguards could help decrease risks when employees are rotating through internal audit from other functions. According to the IIA:

• The audit committee should understand the risks of the rotational model and participate in the selection and evaluation of the CAE.
• The audit committee should pay particular attention to the risk assessment results and audit coverage of the area where the CAE worked previously and is expected to return.
• If possible, the CAE should have a reporting relationship outside the area from which he or she was recruited and plans to return.
• The terms of the rotation should discourage the employee from returning to the same functional area from which he or she was recruited.
• The rotation should be at least a five-year assignment.

Answering to the CEO

The relationship between the CAE and CFO is one of the reasons Chambers said during a recent interview that he believes it’s ideal to have the head of internal audit report administratively to the CEO rather than the CFO.

CAEs who report to the CFO in essence are responsible for auditing their boss’s area of responsibility, Chambers said. The US Federal Reserve recently issued guidance to encourage US banks with more than $10 billion in total assets to have their internal audit functions report administratively to the chief executive.

The CAE-to-CEO reporting relationship is much more common in other parts of the world than in the United States, according to research from 2010.

“If internal audit is going to work for the CFO,” Chambers said, “there need to be safeguards built in, where the audit committee provides some real assurance that that person is independent, objective, that they are able to call it like it is.”

The data from the IIA’s spring survey show that 33% of 554 internal audit managers in North America said the CAE at their organisation reports administratively to the CEO, while 37% said they report to the CFO.

There was less variety in internal audit’s functional reporting relationship, as 73% of respondents said their functional reporting relationship is with the audit committee.

Despite some concerns about objectivity, internal audit is a promising area of growth in North America, survey data show. Twenty-three per cent of respondents reported increased staff sizes, while 7% reported staffing decreases in 2012–13. For that same period, 37% said their budgets increased, and 12% said their budgets decreased.

The net differentials between increases and decreases of plus-16 percentage points in staff size and plus-25 percentage points in budget size in 2012–13 were the largest in the six-year history of the survey.

Information technology was identified as the top area of increased attention for internal audit, as 38% of respondents said they plan to increase their staff’s focus on IT during audits. Leveraging technology also is a way for internal audit to improve its effectiveness.

“Technology is clearly an opportunity for us to provide significant improvements in how we’re delivering,” PwC partner Michelle Hubble said during a recent webcast discussing the firm’s 2013 report on the state of the internal audit profession. “… We really need to focus on data analytics, [which is] a great opportunity to improve the way we do our audits. We get broader coverage, more efficient coverage through the use of data analytics.”

Related CGMA Magazine content:

“How Audit Committees Can Help Transform Internal Audit”: Audit committees can ask themselves four key questions to help internal audit departments grow into a more significant role, according to a PwC report.

“Budget, Staff Projected to Rise for Internal Audit Departments”: A fall 2012 survey by the IIA shows that most companies planned to maintain or increase staff and budgets for internal audit. The report also listed the top risk categories audit executives planned to focus on in 2013.

“Internal Audit: The Importance of Being ‘Soft’ ”: Companies are increasingly turning to internal auditors to identify operational risks, provide business advice and analyse information at the speed of light. With so much on internal auditors’ plates, effective communication can easily be overlooked.

—Ken Tysiac (ktysiac@aicpa.org) is a CGMA Magazine senior editor.