On my first audit engagement, I asked my manager during an annual HIPPA compliance audit for a client; “who does the director of the internal audit department of our client report to?” his answer was; “the CFO”. “That means the internal audit team is not independent”, I responded. That answer was an indication that if there were conflicts relating to any finding or audit issue, there is no direct communication with the audit committee.
As we further discussed the issue, my manager pointed out the fact that there are compensating controls in place at the client’s company to address conflicts of material impact.
To inspire public confidence, an auditor must be not only independent (intellectually honest) but also recognized as independent (free of any obligation to, or interest in, the client, management, or owners). This requirement stems from the professional ethics committee of the AICPA. The above requirement is a strict rule applied to AICPA members in public practice when performing professional services. In other words, this is more strictly applied to external auditors and highly monitored and scrutinized by the PCAOB.
The idea or principle of independence increases the confidence conveyed by the work of an auditor (external or internal auditors). The purpose of an auditor being independent is to reduce influences that might compromise professional judgement to enhance the auditor’s ability to act with integrity and exercise professional skepticism. The idea is that the auditor should not be influenced or controlled by others in matters of opinion or conduct; but should be able to think and act for him/herself.
I was under the assumption that if an internal audit team reports partially to the audit committee; they are therefore free from the influence or control of others. I discovered two main reasons why internal auditors might not be independent:
- Budget and Compensation: The Budget of the audit department as well as the compensation of the audit team is controlled by the management and not the audit committee, so we can say the management could still pull some strings about audit issues (like audit scope and areas to audit, audit issues and findings to address, etc.). Most people would prefer not to have conflict with someone who could decide on such issues.
- Hiring decisions: In case a member of the audit decides to take up roles in other department (such as the ones being audited), the knowledge of past conflicts with audit issues might work against such an internal applicant.
So, if internal auditors are not independent, how can they avoid being influenced or controlled by others in matters of opinion or conduct? Can we really think and act for ourselves in our capacity as internal auditors?
There are indeed compensating controls which helps the internal audit teams to be objective even though they might not be independent. They could report unresolved conflicts to the audit committee with an expectation of the committee’s protection. Also, with regards to hiring decisions for internal candidates, while past conflict with the team could have some impact on such decisions, the direct manager of the applicant as well as colleagues should be consulted to make the decision.
In conclusion, even though internal auditors may not be independent, they could still be objective in their role. The focus is on how they contribute value to the organization while being unbiased in their opinion and conduct.