A symbiotic relationship: when the audit committee includes best practices for internal auditing in its charter, both groups can benefit

Internal Auditor, April, 2007 by James A. Bailey

AS ONE OF THE CORNERSTONES OF GOOD CORPORATE GOVERNANCE, internal auditing is responsible for helping the audit committee with its oversight duties. In return, it is up to the audit committee to ensure internal auditing has the organizational structure and necessary resources to fulfill this mission. The audit committee charter should define the scope of the committee's relationship with internal auditing. By adopting best practices in these charters, audit committees can improve their oversight ability and strengthen the internal audit function.

Internal auditors can be an important resource for audit committees in their review of audit committee charters. They can help strengthen internal auditing's role in the charters by understanding and communicating to the audit committee recommendations from respected organizations regarding best internal audit practices.

BEST PRACTICES

There are many resources to which audit committees can turn to ensure they are exercising best practices when addressing internal auditing in their charters. The recommendations herein are based on standards, practice advisories, guidance, and position papers on improving corporate governance issued by The IIA, The Conference Board, and The National Association of Corporate Directors (NACD). Additionally, internal audit practices found in the audit committee charters of the 100 largest revenue generating U.S. publicly listed companies are summarized.

MEET SEPARATELY WITH INTERNAL AUDITORS Meetings between the audit committee and internal auditing, without the presence of management, can help improve communication between the two groups. In 2002, The IIA made a recommendation to the New York Stock Exchange (NYSE) to require audit committees to meet with chief audit executives (CAEs) privately. The NYSE responded by requiring audit committees of listed companies to meet privately with the internal auditors on a periodic basis. In addition to the NYSE rule, IIA Practice Advisory 2060-2, Relationship With the Audit Committee, recommends private meetings between the CAE and the audit committee to discuss sensitive issues. Of the 100 audit committee charters analyzed, 99 require the audit committee to meet with internal auditing separately from management and the independent auditor.

REVIEW AND APPROVE THE INTERNAL AUDIT CHARTER Internal audit charters describe the structure and operations of internal auditing. For example, the charters may describe processes for internal audit planning, budgeting, and reporting. The charter also may contain a summary of internal auditing's organizational structure, staffing, and auditor qualifications. The charter should provide internal auditors the authority to access all company employees and to examine all company records and physical assets. Internal audit charters should reiterate internal auditing's responsibilities pertaining to audit committees as contained in audit committee charters.

According to IIA Practice Advisory 1000-1, Internal Audit Charter, the charter defines the role of the internal audit function, and it provides formal, written agreements with the board and management about internal auditing's responsibilities and roles. The internal audit charter also is a useful tool for the board and management in their performance evaluation of the internal audit function.

The Conference Board recommends audit committee review of the internal audit charter, and the NACD recommends review and approval of the charter. The International Standards for the Professional Practice of Internal Auditing (Standards) recommends defining internal audit purpose, authority, and responsibility in a charter that is approved by the board. Practice Advisory 2060-2 recommends audit committee review and approval of the internal audit charter on an annual basis. Of the 100 audit committee charters examined, 17 require audit committee review of the internal audit charter and four of those require audit committee approval.

REVIEW AND APPROVE THE INTERNAL AUDIT PLAN A well-developed and implemented internal audit plan aids audit committees with their oversight responsibilities. Audit committee members can provide valuable insight during the development of the plan. Committee members also can determine whether or not the internal audit plan addresses areas of risk they have identified. IIA Practice Advisory 2020-1, Communication and Approval, recommends that the planning information contain sufficient information to allow board members to assess whether internal auditing's plans support the board and the organization.

NACD states that audit committees should review the scope and recommend changes to internal audit activities. Practice Advisory 2020-1 recommends board review and approval of internal auditing's plans. Seventy-five of the audit committee charters analyzed require the committee to review the internal audit plan, and another nine committees actually approve internal audit plans.

REVIEW AND APPROVE INTERNAL AUDITING'S ORGANIZATIONAL STRUCTURE AND STAFFING Audit committees should ensure the independence of the internal audit function, as the auditors may provide more complete information to the committee when they are free from management's influence. To accomplish this, the audit committee can approve the appointments, reassignment, dismissal, and compensation of the CAE. The CAE should report functionally to the audit committee and may report administratively to the chief executive officer. The audit committee also should periodically assess internal auditing's organizational structure and ensure that the function has sufficient staff to implement the internal audit plan.