Introduction
Internal audit is valuable because it can examine governance, risk management, and controls without owning the activities it evaluates. Its conclusions help the board and management understand whether important arrangements are working as intended. That value depends on more than technical skill: internal audit needs authority to obtain evidence, freedom to evaluate it objectively, and a reporting route that protects its ability to communicate candidly.
The boundary is important. Internal audit may explain risks, assess a proposed control, and recommend improvements. Management, however, remains responsible for choosing and implementing its response. If internal audit makes that decision or operates the control, it may later be asked to assure the quality of its own work.
What Independence Requires
Independence has an organizational dimension and a personal dimension. Organizational independence means internal audit has an appropriate status, access, and reporting authority to carry out its mandate without undue interference. Individual objectivity means auditors evaluate evidence impartially and disclose relevant conflicts or limitations. A reporting chart alone cannot ensure either: a chief audit executive who reports formally to a committee but cannot access records or communicate findings freely may not be independent in practice.
A sound governance arrangement gives the board, often acting through its audit committee, functional oversight of the chief audit executive. Functional oversight commonly includes approving or reviewing the internal audit charter, the risk-based audit plan, and the internal audit budget; participating in appointment, removal, and performance evaluation of the chief audit executive; and receiving significant findings directly. The chief audit executive should also be able to meet privately with the committee.
Administrative reporting to the chief executive or another senior executive can support day-to-day operations. For example, management may coordinate office space, payroll processing, and routine scheduling. Administrative support should not give that executive power to narrow audit scope, veto findings, or prevent direct communication with the committee. The reporting arrangements should be explicit in the charter and work in practice.
| Arrangement | Appropriate purpose | Independence safeguard |
|---|---|---|
| Functional access to the audit committee | Oversight of mandate, plan, resources, and significant results | Direct communication and private access when needed |
| Administrative connection to senior management | Routine organizational support | No authority to restrict scope, evidence, or reporting |
| Risk-based audit plan | Direct limited audit resources toward significant exposures | Committee review and a process for communicating proposed changes |
| Audit findings and follow-up | Inform responsible managers and oversight of weaknesses and responses | Report unresolved material matters through an appropriate route |
A risk-based plan should state what will be examined, why the work is relevant, and what resources are available. Changes may be necessary as circumstances evolve, but a senior manager should not be able to remove an uncomfortable review without an appropriate explanation and oversight. Internal audit also needs timely access to relevant people, records, systems, and premises, subject to applicable law and confidentiality requirements.
Assurance Is Bounded by Scope and Evidence
An assurance conclusion is a reasoned judgment about the subject examined, not a promise that the subject is flawless. Its strength depends on whether the scope addresses the question, whether evidence is sufficient and appropriate, and whether the auditor can evaluate that evidence objectively. If the review excludes a business unit, period, or key data source, the conclusion must not imply that those areas were examined.
A simple probability model illustrates why evidence cannot establish certainty. Suppose each item in a large population independently has probability \(p\) of containing a particular exception, and a sample of \(n\) items is selected randomly. Assume each exception in the sample would be detected. The probability of finding at least one exception is one minus the probability of finding none. Each item has probability \(1-p\) of being clear, so the probability that all \(n\) sampled items are clear is \((1-p)^n\). Therefore:
This model requires independent selections with the same exception probability and perfect detection of an exception in a sampled item. Actual audit sampling may involve different designs, dependence, imperfect detection, or a finite population sampled without replacement. The expression is an illustration of how a sample can miss exceptions; it is not a universal audit-confidence formula and should not be presented as an assurance rating.
Worked Example: Interpreting a Sample Without Overstating Assurance
A hypothetical insurer has a large population of override transactions. For planning illustration, assume each transaction independently has a 15% probability of containing a specified documentation exception. An auditor randomly selects 12 transactions and, for this calculation, assume any exception in a selected transaction is detected. What is the probability the sample detects at least one exception, and what can the result support?
Method. Use the complement: calculate the chance that all 12 selected transactions have no exception, then subtract it from 1. The assumptions are a large population, independent selections with a constant exception probability, and perfect detection within the sample.
The probability an individual selected transaction has no exception is \(1-0.15=0.85\). The probability all 12 have no exception is:
Thus the probability of detecting at least one exception is:
Rounded to four decimal places, the probability is 0.8578. This calculation indicates that the sample has a substantial chance of detecting an exception under the stated model. It does not establish that the remaining transactions are clear, prove that the true exception probability is exactly 15%, or justify a conclusion about controls beyond the defined scope. The common mistake is to treat an 85.78% detection probability as 85.78% assurance that the whole control system is effective; the calculation only concerns detection of at least one exception under its assumptions.
Advice Without Taking Over Management
Internal audit can provide advice that improves decisions while preserving management accountability. It may explain control principles, identify risks in a proposed process, facilitate a discussion, or recommend alternatives. Management must decide which alternative to adopt, accept responsibility for the resulting risk, and assign people to implement and operate controls. The exact boundary depends on the nature and extent of the auditor’s involvement.
A useful test is to ask whether internal audit is merely providing insight or is exercising authority that belongs to a manager. Advice becomes problematic when auditors approve a business decision, select a control on management’s behalf, own a risk, supervise implementation, or perform a recurring control activity. Those actions threaten objectivity and may prevent a credible later review of the work.
Identify whether management is asking for analysis and recommendations or asking internal audit to make or carry out a decision.
State that management retains authority for risk acceptance, control design choices, implementation, and operation.
Record the advisory role and assess whether later assurance work can be performed objectively. If not, arrange suitable independent assurance or another safeguard.
Worked Example: Advising on a Claims Escalation Control
A hypothetical insurer is revising its process for escalating large bodily-injury claims. The claims director asks the chief audit executive to choose the escalation threshold, approve the new workflow, and then audit compliance with it after six months. Determine what internal audit may do and how the later review should be handled.
Step 1: Separate advice from authority. Internal audit may describe risks in the proposed process, explain criteria for a sound control, identify options, and point out consequences of different thresholds. The claims director must choose and approve the threshold and workflow because those are management decisions.
Step 2: Reject control ownership. Internal audit should not authorize the workflow, assign employees to operate it, or run the escalation process. Management should name the responsible control owner and ensure that the control is implemented and operated.
Step 3: Preserve credible assurance. If internal audit provided limited advice but did not make or operate the decision, it should disclose the nature of that involvement and assess whether it can still evaluate the process objectively. If its involvement was substantial enough to impair objectivity, the later assurance should be assigned to suitably independent personnel or another qualified provider. The common mistake is to assume that a later date automatically removes a self-review concern; separation in time does not undo responsibility for a decision or control.
Conclusion. Internal audit can advise on design considerations, but management must decide, approve, and operate the control. Any later assurance must account for the actual advisory role and protect objective evaluation.
Reporting Findings and Managing Disagreement
Internal audit should communicate findings to managers who can respond and to the appropriate oversight recipients, particularly when a matter is significant, unresolved, or subject to interference. A useful finding identifies the condition observed, the relevant criterion or expected practice, the supporting evidence, and the risk or consequence. The responsible manager’s response and planned action should be recorded, but management disagreement should not be converted into an unsupported audit conclusion.
Management generally owns corrective action and decides how to respond, including whether to accept a risk within its authority. Internal audit can evaluate whether the response addresses the finding and can monitor agreed actions. It should not implement those actions for management. Where an issue is not resolved, internal audit communicates the facts, the relevant views, and the remaining exposure to the appropriate level for consideration.
Worked Example: A Request to Delay a Significant Finding
In a hypothetical audit of access to a pricing system, internal audit finds that a group of former employees’ accounts remained active after termination. The evidence is verified, and the affected system supports material pricing decisions. The technology executive asks the chief audit executive to omit the finding from the committee report until the accounts have been disabled. What should the chief audit executive do?
Step 1: Verify and describe the evidence. Confirm the accounts, the period during which they remained active, the source records, and any limits on the review. State the observed condition and why it matters without claiming that unauthorized changes occurred unless evidence supports that claim.
Step 2: Separate correction from communication. The technology executive should disable the accounts and determine whether additional action is needed. Completing that corrective action does not erase the condition that existed during the period examined.
Step 3: Report accurately. Communicate the finding, its status, and management’s response through the appropriate reporting channels. If the executive continues to seek suppression, escalate the unresolved interference to the audit committee. The common mistake is to omit a material finding because management has begun remediation; the correction is to report both the original condition and the action taken, with timing made clear.
Conclusion. Management owns remediation, while internal audit owns the integrity of its evidence-based communication and must preserve an appropriate route to oversight.
Common Mistakes and Practical Safeguards
- Treating administrative reporting as functional control. Routine support from management does not justify management veto over audit scope, conclusions, or access to the committee.
- Equating a clean sample with an effective control. A sample provides evidence about selected items; conclusions must reflect the population, sampling design, detection limits, and scope.
- Confusing recommendation with decision. Internal audit may recommend a response, but management accepts responsibility for choosing and implementing it.
- Assuming advice never affects objectivity. The nature and extent of involvement matter. Significant participation in design or operation may require safeguards or a different assurance provider.
- Suppressing a finding after remediation. Report the observed condition and separately describe management’s corrective action and its status.
Check Your Understanding
For each situation, identify the independence or assurance issue and the appropriate response.
- A chief executive provides the internal audit department’s administrative support but proposes to remove a review of a major underwriting process from the plan without notifying the audit committee. What safeguard is needed? (Answer: The chief audit executive should communicate the proposed scope change and its rationale to the audit committee; administrative support should not give the executive unilateral control over audit scope.)
- Internal audit reviews a sample of 10 independent transactions. Under an illustrative model, each has a 20% exception probability and exceptions are detected perfectly. Calculate the probability of at least one detected exception. (Answer: \(1-(0.80)^{10}=0.8926\), or 89.26%.)
- A business leader asks an auditor to recommend a control and then personally operate it for the first month. What should the auditor do? (Answer: Provide advice without taking ownership or operating the control; management must assign an operator, and later assurance must be protected from self-review.)
- A manager corrects a control weakness before the final audit report and asks that the finding be removed. What should the report communicate? (Answer: Describe the evidenced weakness and its relevant period, and separately report the corrective action and its status.)
- The audit committee receives a report stating that a control is effective, but the review excluded one business unit where the control also operates. What is the central reporting defect? (Answer: The conclusion exceeds the scope; the exclusion and its effect on the conclusion must be disclosed, or the scope must be expanded.)