We examine trends in reporting lines for chief audit executives, as more report to CEOs and board directors
In the past, when they have reported to the chief financial officer or chief legal officer, conflicts of interest could arise as internal audit scrutinized the finances. Internal audit directors could easily find themselves at odds with their own bosses.
Now, more internal audit leaders report to the CEO, but as internal audit looks to audit such areas as culture or "tone at the top," those conflicts haven't gone away. And there is always the possibility that internal audit finds impropriety at the highest levels during an audit. For now, the solution in many cases has been for the CAE to have duel reporting lines, administratively to the CEO and functionally to the chair of the board's audit committee.
In the latest edition of our video series "MISTI on Audit," Joel F. Kramer, vice president of audit curriculum at MIS Training Institute, talks about the pros and cons of having audit department leaders report to more senior executives such as the CEO or audit committee chair.
"Reporting lines have changed radically. Probably the biggest impetus for the change was the passage of Sarbanes-Oxley in 2002," when regulators pushed for more oversight of the internal audit function, says Kramer. "But also many astute audit committees have been wanting more of a presence from their internal audit function and this has all added together for a much broader exposure and more important reporting lines," he says.
A recent study, released last month by the Internal Audit Foundation—the research unit of the Institute of Internal Auditors—finds that reporting structures for chief audit executives still vary widely from company to company and region to region. Nearly half (49 percent) of the CAEs surveyed said they report to the CEO on an administrative basis; more than a quarter (26 percent) report directly to the audit committee chair or in some way to the board of directors; another 15 percent report to the chief financial officer; and 10 percent to the lead counsel or other executive.
Kramer also talked about the important of duel reporting lines. "The audit committee isn't geared or established to do everyday administrative duties. What they really do best is guide, lead, and approve. So the chief audit executive will always bring their audit plan, how they assess risk, and what they are going to be doing, and the audit committee will support that," says Kramer. "But as far as the budget, as far as the administrative responsibilities, going to someone like the CEO is prevalent."
Of course some audit leaders still report to executives below the CEO level. In fact, the IIA survey found that nearly 25 percent of CAEs still report to CFOs, CLOs, or other non-CEO executives. "The problem with reporting to the CFO is that you could be auditing your own boss. And that is the biggest problem with the CFO area, says Kramer."