Ineffective Boards and Internal Audit Independence

GUEST BLOG POST
For several years following the start of the COVID pandemic, the Institute of Internal Auditors’ “North American Pulse of Internal Audit” reported that internal audit department budgets were dropping. While the 2024 survey reported improving internal audit budgets, the 2025 survey once again raised concerns that internal audit budgets are still underfunded, negatively impacting strategy alignment and internal audit’s work towards effective oversight.

Half of the chief audit executives polled in the 2025 report, said that their functions receive insufficient funds and that more funding is needed to be able to align with company strategy. A full 90 percent of the CAEs surveyed said that their functions need to do more, covering non-traditional internal audit work, and they are behind in data analytics and automation.

Add to this conundrum the continued concern about internal audit’s lack of independence and reports that some corporate boards may not be fully independent, and we have a recipe for disaster.

Internal audit functions operate in an environment of risks never seen before such as geopolitical instability, the rise of GenAI, and cyber-wars.

I am a firm believer that corporate boards must be independent to oversee an independent internal audit function; that management must provide internal audit adequate funding and support. These are requisite ingredients to help unleash the power of internal audit, to enable it to deliver quality service and to provide effective governance oversight.

When Corporate Boards Lack Independence

 A public company’s governing body is its board of directors. Its members are elected by the shareholders to oversee the company’s management (including the CEO), help set strategy, and protect the interests of shareholders and stakeholders.

Reports and editorials highlight concerns that some public company board members may not be fully independent. Often board members are handpicked by the CEO who may have close relationships and friendships. This is significant because when governance is broken at the highest level, the entire governance system will be broken.

There are several examples of public company boards with known close relationships.

• Meta’s board includes Sheryl Sandberg. Mark Zuckerberg has a very close professional relationship with her.
• Larry Page and Sergey Brin who co-founded Google have a very long professional relationship and are on Google’s board.
• Tesla’s board includes Elon Musk’s brother, Kimball.
• In 2024, the SEC charged the ex-CEO of Church & Dwight who during 2020 and 2023 had maintained a close personal relationship with a member of Church & Dwight’s executive team and had violated proxy disclosure rules, which caused Church & Dwight’s proxy statements to contain materially misleading statements.
• Also in 2024, the SEC charged 23 individuals for failures to timely report information about their holdings and transactions in public company stock. These failures raise oversight and independence concerns.
• A May 2023 Forbes article, “How Independent Are the ‘Independent’ Directors of Public Companies?” lists the example of “a director of a public company named to the board of a prestigious non-profit organization where the CEO of the director’s public company served as chair and likely gatekeeper of such non-profit organization’s board.”
• Harvard’s “Survey of Non-Independent Directors at S&P 500 Companies” reports that “15 out of 161 companies had at least one family member on the board, and six companies had multiple family members on the board.”

In 2024 I conducted a non-scientific LinkedIn survey asking readers: “Do you believe that independent directors appointed at publicly traded U.S. corporate boards are independent of their company or the CEO?”

• 20 percent of the respondents said: “not at all.”
• 57 percent replied: “some have material conflicts.”

While it is beneficial to have board members with good working relationships, aligned strategy and goals, close relationships raise concerns about whether the corporate governance system is effective and how it affects internal audit’s independence.

How Ineffective Boards Affect Internal Audit

I hear from colleagues that some corporate boards are just ineffective, period. They say that, except for the required financial expert, most independent directors simply do not have financial expertise and experience. They say board members do not have the time or appetite to engage with internal audit, dig deep, ask the right questions, or even manage the internal audit activity. They leave this entirely to management. When they do though, internal audit stops being independent.

If the boards of WorldCom, Enron, Wirecard, Volkswagen, Theranos, and many others had done their job, would the scandals have been prevented?

Drawing CAE Reporting Lines

Internal Audit must be truly independent to be able to do its job. It starts with its organizational standing in the company.

Principle 7 of IIA’s Global Internal Audit Standards calls for company boards to enable internal audit independence. This means that the board is responsible for asking senior management to position the CAE at an organizational level where he or she can discharge their responsibilities without interference.

It has been long debated and there are many different views about whether Principle 7 goes far enough to help internal audit with independence. My view is that it does not go far enough. The standard should be clarifying the preferred organizational reporting standing.

In a best-in-class scenario, internal audit reports functionally to the chair of the audit committee and administratively to the CEO. No other organizational configuration will afford internal audit independence. When internal audit reports administratively to the CFO, there are conflicts. Think of all the scenarios where the auditor performs audits touching the CFO’s span of authority.

Adequate Internal Audit Funding Required

Companies should provide adequate funding to enable internal audit to organize itself, hire suitable audit staff, and invest in education, technology, travel, and emerging technology. Corporate boards and CEOs must realize that an underfunded internal audit function is as good as an ineffective internal audit function.

CAEs experience adverse conditions routinely as internal audit ranks low in the corporate “pecking order” being a non-revenue producing function or for some, a function that is “nice to have” but not needed.

Often, while management provides financial resources, it uses various levers to directly influence the function and affect its independence. Management can reduce funding to hire staff, to travel, to invest in technology, and to educate and upskill auditors.

It’s not All Bad!

While these scenarios happen, it is not all doom and gloom. Most public companies support and nurture their internal audit function. They empower, support, and help the team grow. They embrace internal audit’s value and contributions.

Every day at organizations, many internal audit “wins” are celebrated by the CAE and staff. Wins may look like stopping fraud in its tracks, correcting financial statements for improper accounting, implementing effective automated controls, preventing cyber intrusion or data loss, issuing company policies that deter employee misconduct and many more! The public does not get to know of those wins because they are confidential and not shared with the public. But those working in the back offices of internal audit know what I am talking about.

For those of you who are new or planning to enter into the internal audit profession, know that it is a noble profession. Most internal auditors put their heads down and do their job despite time constraints, travel demands, or even some executives’ negative or spiteful feedback. Internal audit is still the place where professionals learn continuously, where they stretch, grow, and add value! 

Chris Dogas, CPA, CFE, CRMA is the founder of AS GRC Consultants, which provides corporate governance services. Contact him at cdogascpa@gmail.com.