When (and Why) the CAE Reporting Structure Breaks Down

GUEST BLOG POST
At well-governed public companies, the decision to remove a chief audit executive (CAE) is ideally made by the audit committee of the board of directors, especially if the removal is “for cause” or performance. In the real world, though, that’s rarely the case. In practice, CAEs are often removed unilaterally by management without audit committee involvement. The audit committee members often become involved only after the fact.

To provide independence, internal audit standards recommend a CAE reporting structure where the internal audit head reports functionally to the board’s audit committee and administratively to the CEO, CFO, or other management executive. Many ask, if that’s that case, why isn’t the audit committee involved upfront in the important decision of whether or not to remove the CAE?

In my experience the following factors contribute to the degradation of the construct:

Management Often Dominates the CAE Relationship

First, many companies do not follow the recommended reporting structure and have the CAE reporting functionally, as well as administratively, to management.

Second, even when the CAE does functionally report to the audit committee, the reporting often lacks authenticity. This could be because the audit committee desires not to be “hands-on” with internal audit. It can also happen when the audit committee lacks the requisite expertise to functionally manage internal audit, or delegates the responsibility to management because it lacks the time or desire to fulfill this responsibility. There are also instances where aggressive senior management (CEO, CFO, general counsel or other management executives) deliberately circumvent the construct, dominate the relationship, and assert control over the CAE.

Third, even when the CAE reports to the audit committee functionally, conflicts can still arise since management manages the CAE administratively, often making decisions about financial resources, staffing decisions, investment decisions, and day-to-day duties. Therefore, management can still dominate the relationship.

Lastly, despite the common rhetoric about how public companies embrace internal audit and compliance, the reality is that many simply do not. Many consider them to be non-value-add functions and a financially burdensome “cost center.” This is not surprising. In tough and highly competitive economic conditions, only value-generating functions are sought and nurtured, particularly at short-sighted organizations.

Does Internal Audit Really Add Value?

Sure, most of the internal audit literature—articles, position papers, press releases, and social media posts from internal audit influencers claim that it creates lots of corporate value and enjoys corporate gravitas, but the reality, at least in my opinion, is that we have not really seen a lot of evidence of internal audit generating value.

When major corporate failures and frauds occur, one often wonders where was internal audit? Bank failures, Theranos, and Wirecard are all recent examples of corporate failures where internal audit missed the boat. In my view, WorldCom’s Cynthia Cooper is the only exception. I can’t think of any other instance where internal audit was at the forefront of uncovering a large-scale fraud.

Sure, there are those who would argue that behind the corporate scenes internal audit does so much great work and adds so much value! That is true, but it’s not enough to convince senior management to invest in internal audit and view it as a true partner in value creation.

Elevating Internal Audit

As I write this, the Institute of Internal Auditors continues to issue standards and white papers that are helping guide the internal audit profession. I wish the IIA would spend as much of its energy working closely with the accounting firms and regulators to elevate the profession; make it a true partner in the annual corporate audit process; help increase awareness of the issues internal auditors and CAEs face; advocate for the exchanges to enact requirements and standards relating to internal audit reporting lines; advocate for more protections for CAEs; and other more useful initiatives.

I also wish that internal audit social media influencers (many of which have never held an internal audit leadership position) would help a little more too. Instead of pushing unrealistic views about internal audit, let’s call things as they are. Let’s bring internal audit issues to the fore, such as: What constructs are needed to provide true internal audit independence; how can we set standards related to the size of internal audit for public companies; how can we make the best use of technology; how to maintain balanced assurance and internal audit consulting, and many other issues.

I am sure that this opinion piece may not be received well by many, but I remain a true believer in the profession. It is a good and rewarding profession. It can grow to become an equal partner to management and add immense value, not just aspirationally, but in reality.  

(Author’s Note: This article was inspired by an article published by Richard Chambers on Audit Beacon, “Where is the Audit Committee when the Head of Internal Audit Is Being Fired?” I agreed with that thought-provoking piece and wanted to add my take on this complex topic. Also, the opinions expressed here are mine and do not necessarily reflect those of Internal Audit 360 or any other entity.)

Chris Dogas, CPA, CFE, CRMA is the founder of AS GRC Consultants LLP, which provides corporate governance services. Contact him at chrisdogas@asmgtc.com.