Balancing relationships: achieving symmetry among the internal audit function, board, and management is more important than ever

Internal Auditor, Feb, 2004 by J. Graham Joscelyne

ON PAPER, IT LOOKS EASY. IN practice, however, achieving and sustaining a true balance among management, the internal audit function, and the board is a delicate and difficult task. And yet, this is what good corporate governance increasingly requires and assumes.

New York Stock Exchange Chairman Richard Grasso's resignation prompted a New York Times editorial that intoned: "The recent corporate scandals have taught us ... that when reckless chief executives are able to raid their institutions' treasuries at will and enrich themselves beyond reason ... corporate governance has been corrupted to an alarming degree."

But this story is not new. Substandard corporate governance has been an underlying concern worldwide for the past two decades. In the last two years, with the incidence of malfeasance having grown exponentially, the spotlight has focused on how to reverse the trend and rebuild investor trust by setting new standards of governance and adhering to them.

Reality for the internal audit function is that, too often, it can be beholden to management, which funds it and often regards it as merely part of the overall risk management operation or another routine management function within corporate finance--not as an independent entity. If the internal auditor is opposed or ignored by the chief financial officer (CFO), the traditional next step is to approach the chief executive officer (CEO). But, because the CFO's voice is usually more powerful than the internal auditor's--and there is a cultural tendency to believe the line function's story first--CEOs often lack the inclination or time to listen to the internal auditor, creating an imbalance or threatening the existing equilibrium among the groups.

Should the internal auditor deem the issue in question critical to the well-being of the organization, it is then customary to report the situation to the board's audit committee. However, that route can put the internal auditor's effectiveness at risk, because boards have been known to suffer from blind spots--including believing management over the auditor--as well as the inability to comprehend specific problems involving risk management or operational controls. When that happens, internal auditing is stripped of its true value. Because of the new demands for accountability and transparency, such weakened oversight can be treacherous for an organization.

The United States responded to the Enron and WorldCom scandals with the Sarbanes-Oxley Act of 2002, which is designed to hold senior management and the board of directors accountable for the integrity of their institutions' financial reporting and governance practices. And, because investors have begun to put corporate governance on a par with financial indicators when evaluating investment decisions, the reliability of an organization's risk management and control framework and adherence to ethical standards have become significant shareholder and boardroom issues--and these concerns will only grow.

It is important to remember that even if an organization has done everything correctly, it has become crucial to foster and maintain a culture that integrates all components of good governance and carefully balances the challenging, complex interrelationship among the board of directors' audit committee, senior management--the CEO and CFO--and the internal audit function.

The board is responsible for setting corporate strategy, and management designs internal systems and control processes to implement that strategy. Internal auditors are charged with assessing how well these wide-ranging processes function. To this end--through reviews and focused studies, formal reports, recommendations, and follow-up--the internal auditor examines and appraises the reliability and integrity of information available for management decisions; verifies the existence and safeguarding of assets; ensures compliance with policies, procedures, laws, and regulations; and evaluates the efficient use of resources.

Good corporate governance principles state that the internal audit function must have a stronger reporting relationship to the board than to management. This arrangement is intended to give the internal auditor independence, objectivity, and the capability of evaluating--without interference--the organization's system of internal control and risk management processes. The goal is to guarantee that both board and management are kept aware of important issues identified for management to correct, and to ensure that the board knows about any failure by management to take corrective action.

As these principles become accepted--even regulated--on an international basis, boards must allow internal auditing to function fully and effectively without pressure to see things in a particular way. In short, to ensure that the balancing act among the internal auditor, management, and the audit committee is sustained:

* The consistency of ethical behavior among all parties should be ascertained and evaluated.