Newsletter Sign-up

If we are all honest, not too many of us could say we can do this consistently. It's a tall order. Yet this is what we expect of key players in our risk management offices, our internal auditors. We want them to be completely independent and totally objective when they review our firms with no preconceived biases of any kind.

The Institute of Internal Auditors has established Standards for the Professional Practice of Internal Auditing. An auditor's independence is the cornerstone of the profession. In fact, the key audit lead must confirm to the board, at least annually, the organizational independence of the internal audit activity.

Internal auditors require full organizational independence from management to conduct unrestricted evaluation of management activities and personnel to perform their roles effectively. They also must be free from interference in determining the scope of internal audits.

Yet internal auditors are appointed by management. As an employee, they are dependent on management for raises, development and promotions. How can our auditors remain unbiased in favor of management? Doesn't this arrangement put auditor independence or the appearance of independence at risk?

Some companies have chosen to fix this issue by outsourcing their entire internal audit function. Interestingly enough, some board members were uncomfortable with such decisions. Board members felt that by virtue of paying routine engagement fees to these external firms, their organizations were at risk of losing impartiality. This notion confused me.

What's the difference? In my view, internal auditors on a company's payroll are in a much more difficult predicament when it comes to managing issues and problems surrounding auditor objectivity. In addition to compensation pressures, there are emotional factors that can affect them too. An employee who acts as an internal auditor is encouraged to work closely with colleagues in an effort to get audits completed year after year. This includes time spent sharing a table at lunch or at the company holiday party. There is bound to be a certain degree of "bonding" between them. It's just natural. These relationships must make giving bad news to their fellow colleagues a very difficult task further down the road.

If a company uses outside services for an internal audit, they can help assure audit independence by rotating firms or external talent. This way, these outsiders are less likely to forge friendships with staff, which can lead to awkward audit-related conversations in the future.

Also, the understood temporary engagements would likely produce superior audit reports. Knowing that a new external audit team will be serving right after you, great efforts would likely be made to avoid having any shortcomings exposed by the new audit team.

Maintaining independence and objectivity will likely remain a sticky issue as long as internal auditors are paid by the entity being audited. I am not suggesting that employee auditors cannot or do not display independence, I am suggesting that organizations must truly recognize this issue and lend true support to their audit teams.

JOANNA MAKOMASKI is a specialist in innovative enterprise risk management methods and implementation techniques. She can be reached at riskletters@lrp.com.

February 21, 2012

Copyright 2012© LRP Publications