Articles on Internal Auditing
Reflections on Independence and Objectivity
Total Quality Management, re-engineering, and control self assessment, together with a shift in emphasis from process management to management of business risk, have created a need to re-define the purpose and role of internal auditing for the business environment of the future. As a result, the IIA is proposing changes to the Standards for the Professional Practice of Internal Auditing (SPPIA) that places significant emphasis on "objectivity", and less on the concept of "independence". In the minds of some practitioners, this undermines a cornerstone of the profession. The purpose of this article is to examine to what degree, if any, independence and objectivity might be compromised; and the importance of independence, and to whom, when weighed against other factors influencing internal audit’s ability to add value.
The Purpose of Internal Auditing
Any discussion of an internal auditor’s independence and objectivity should begin with a review of the reason internal auditing exists in the first place.
In a small entity, the proprietor/manager knows each employee by name, has a hands-on knowledge of the operation, and plays a direct role in overseeing all facets of the operation. If an employee has a problem, the proprietor/manager can help identify the core issues, and help the employee develop workable solutions. The proprietor/manager's direct knowledge and involvement allows for continuous assessment of the state of control, and there is little need for an internal auditor.
In a larger entity, the board, and an executive management team comprised typically of the officers of the entity, are responsible to shareholders and other outside parties for operational outcomes and corporate governance. The board and executive management require reasonable assurance that business objectives a can be achieved. The required reasonable assurance is provided by a system of internal control often developed, implemented and managed by others. On behalf of the board and executive management, the internal auditor in a larger entity performs the on-going assessment of internal control. The internal auditor may also provide advisory services in operational matters, and perform special assignments at the request of executive managers and the board.
The key point is that the internal auditor is an agent of the board members and entity executives having primary responsibility for corporate governance and operational outcomes.
Internal Auditing’s Place in the Audit Profession
Under the SPPIA, internal auditing is a subset - a specialty, if you will - of the audit profession. It is distinguished from other types of professional auditing by its primary focus on assessment of the state of control on behalf of the board and executive management. The distinguishing characteristic of "internal" auditing focuses on the ability to provide the board and executive management with appraisals, analyses, recommendations, counsel and information as a source that is independent of line management responsibility or influence.
Other types of auditing (financial statement attestation, performance auditing, forensic auditing, A-133 compliance auditing, etc.) are governed by professional standards or criteria other than those of the IIA; are most often conducted by outside auditors who are not employees of the entity under review; and are performed primarily on behalf of third party stakeholders outside of the entity. Carried out by CPAs, as well as by government audit groups such as the GAO and the NYS Comptroller, these audits rely heavily upon independence and objectivity to establish their bona fides, and have a different focus that sets them apart from the unique characteristics of "internal" auditing.
Guidance Provided by Professional Internal Audit Standards
The SPPIA provides the following guidance in regard to independence and objectivity in carrying out internal audit activities:
(1) The board and executive management require reasonable assurance the entity’s mission and objectives can be achieved. To that end, they are responsible for monitoring the actions subordinate line managers take to design and implement a sound control system capable of providing the required reasonable assurance.
(2) Under the general direction of executive management, it is the subordinate line manager's responsibility to manage the operation and achieve the objectives and desired outcomes established by the board and the members of executive management.
(3) Internal auditing under the SPPIA is performed on behalf of the board and management. The internal auditor is an integral part of the entity whose primary role is to form an opinion about the state of control, report that opinion to the board and executive management, and offer advice and counsel to members of the entity.
(4) Under the SPPIA, the internal auditor can advise on, but not design, implement or operate, systems of control. The internal auditor may choose to make recommendations. It is the line manager's responsibility to take corrective action, or accept the related risk. The responsible line manager thus is free to accept, reject, or propose alternative courses of action in accordance with the wishes of the board and executive management.
(5) The internal auditor is independent if s/he reports to a level of governance sufficient to permit: adequate consideration of audit reports; appropriate consideration of audit recommendations; and accomplishment of audit responsibilities free from interference. The internal auditor is objective when s/he does not subordinate professional judgment to the judgment of others on audit matters, when s/he has an honest belief in the audit work product, and when no significant compromises are made in audit quality.
Concerns of the Board, Executive Management, and the Internal Auditor
For the board, executive management and the internal auditor, the issue of independence and objectivity is fundamentally one of corporate governance and division of work.
In regard to independence, internal auditing is one more form of internal control exercised by the board and executive management in carrying out their corporate responsibilities. The board and executive management require a reporting structure that places the internal auditor at a level of governance sufficient to permit adequate consideration of audit reports; appropriate consideration of audit recommendations; and accomplishment of audit responsibilities free from interference by line management. The level of corporate governance that is "sufficient" is situational, but generally refers to the chief executive officer, or another officer of the entity (such as a vice president), with "dotted-line" direct communication with the board.
The manner in which the internal auditor goes about actually doing "internal audit" work on a day-to-day basis is an issue of objectivity. The SPPIA defines objectivity as "an independent mental attitude such that the internal auditor does not subordinate his/her judgment to others on audit related matters; and has an honest belief in his/her work product such that no significant quality compromises are made". In regard to objectivity, a hands-on implementation approach to improving the system of control becomes extremely relevant to the primary function of internal auditing. Such an approach weakens the degree to which the board and executive management can rely on the internal auditor's future opinions. In the context of the SPPIA, there is an inherent bias (conflict of interest) when the internal auditor audits that which s/he has designed, implemented or operated. Whenever there is a muddying of the division of work/responsibility, the value of the internal control (check and balance) weakens.
The need for division of work drives the IIA Standard on independence and objectivity and the clear distinction the IIA makes between consulting/advising vs telling/doing. The SPPIA standard on objectivity also requires the internal auditor to be free of unprofessional actions, such as personal or political bias or beliefs in carrying out the duties of the position.
Under the SPPIA, independence from line management and operational responsibility, and objectivity in the review of the state of control, afford the board and executive management a high degree of comfort with the integrity of the internal audit process. When these criteria have been met, the board and executive management can place a high degree of reliance on the internal auditor’s opinions and work product.
Concerns of The External Auditor and Outside Stakeholders
The internal audit function is itself an internal control. Therefore, the external auditor and outside stakeholders may place significant weight on the internal auditor's physical placement within the entity. Independence and objectivity may impact significantly the degree to which, for their purposes, the external auditor and outside stakeholders can rely on internal auditing as a form of internal control. However, the internal auditor’s role, obligation and duty is not to these outside parties.
Independence vs. Objectivity
The SPPIA implicitly defines independence in terms of freedom from the control and direct influence of line management, not that of executive management. Independence, as defined in the SPPIA, is important to the extent that it enhances internal audit’s objectivity and integrity, which is of paramount importance, particularly when the CSA/Consultative internal auditing approach is employed. The board, executive management, and even the internal auditor may not be concerned if the internal auditor reports directly to the vice president for finance (a corporate officer and member of executive management) instead of the chief executive officer. As one of my highly respected colleagues has observed, the specific executive manager to whom the internal auditor reports may be of secondary, and perhaps even tertiary, importance. Furthermore, absolute independence of the internal audit function is neither the goal nor intent of the SPPIA. Making it so would ignore the overall purpose of our existence as a profession, and limit severely our ability to contribute to the success of our organizations.
Conclusions
The proposed changes to the Standards for the Professional Practice of Internal Auditing clarify and reinforce the present wording in regard to objectivity and independence. The proposed changes will not compromise our independence and objectivity as internal auditors, but rather, place them in perspective in regard to other factors influencing internal audit’s ability to add value, such as involvement with control self assessment and consultative auditing.
Copyright © 1999 Mark R. Simmons, All rights reservedHome | Bio | Internal Auditing | Fraud Investigation | Request to Reprint | Privacy | Site Map
© 1996-2012 Mark R Simmons, CIA, CFE. All rights reserved. Updated 29-Apr-2012