All chief audit executives (CAEs) want to maintain a strong working relationship with the audit committee. We believe the relationship is crucial, but far too often it is not as effective as we might hope. What makes the difference? I had the opportunity to talk with several audit committee chairs and with several chief audit executives recently, and they had quite a bit of advice on the subject. (Also read What's Up with COSO?)
See Also: 2016 Social Engineering Report
The foundation of the working relationship between internal audit and the board is direct communication. If we are to be truly effective, CAEs must regularly attend and participate in board meetings that relate to auditing, financial reporting, organizational governance and control. Our active participation at these meetings helps ensure that we are apprised of strategic business and operational developments, and it provides an opportunity to raise high-level risk, systems, procedures, or control issues at an early stage. At these meetings, we can exchange information concerning the internal audit plans and activities, and we can keep each other informed on any other matters of mutual interest.
It's internal audit's job to bother the audit committee.
Direct communication between the audit committee and internal audit is a basic necessity for a strong working relationship, but it is unrealistic to expect that direct communication alone can guarantee a successful working relationship, any more than direct communication between a teacher and a student can guarantee learning. To truly optimize the relationship with the audit committee, a few additional steps are necessary:
- If you are ever in doubt as to whether you need to talk to your audit committee chair... you do. As one audit committee chairman put it, "Audit committees and internal auditors have interlocking goals, so you should never worry about whether you might be bothering your committee members. It's internal audit's job to bother the audit committee. It's only when internal audit does not come to us that we start to worry."
- Get to know your audit committee chairperson in both formal and informal settings. If you don't have a warm and open relationship with the committee chair, you need to work on developing the relationship. You might try inviting the committee chair to lunch or dinner if you are fortunate enough to live in the same city. If you are separated by distance, a person-to-person meeting might be more difficult, but it is still essential to get to know each other well.
- Help assure the audit committee understands and fulfills its oversight responsibilities for internal audit. The independence and clout of the internal audit function can be improved when it is clear that internal audit reports to the committee, so both senior management and the committee should receive performance reports regarding accomplishment of the approved audit plan, key performance indicators, staffing plans and financial budgets. The CAE should also discuss the internal audit group's ability to complete the audit plan, including whether or not internal auditing has appropriate resources and whether management has imposed any scope limitations internal audit.
- If internal audit is not regularly on the agenda at audit committee meetings and at executive sessions, it is time to change the agenda. Communications channels are only effective when they are used. Time should be set aside at each regularly scheduled audit committee meeting to communicate information in both directions about significant risks and controls, discuss emerging issues and follow up on unresolved issues.
- Become the "go-to" person for the audit committee. One of the best ways to strengthen the working relationship with the audit committee is to assist in activities such as agenda setting, preparation of meeting materials or identifying board education opportunities. Undertaking this role has several advantages for CAEs: In addition to strengthening working relationships, it can help assure that important issues receive the attention they need from the committee and that duties such as reviewing internal audit's risk assessments, status reports or charter are not overlooked.
- Make the most of committee meeting time. Our goal should be to communicate well and often - but not to waste words. Audit committees have limited meeting time and increasing responsibilities, so CAEs should prepare in advance to make the most of the time available. Verbal communications, handouts and reports should be risk-focused and to the point, without unnecessary technical language and with significant and relevant information in context so that informed decision-making can take place.
Ideally, internal audit serves as the eyes and ears of the audit committee, an essential component in the system of checks and balances. We can only fulfill this role effectively when we have developed strong working relationships and when significant information is communicated effectively and timely. If you have not yet developed an effective working relationship with your audit committee, it's time to get started. It may be the single most important relationship a CAE can establish for ensuring internal audit success.
Chambers is the global president and chief executive officer of The Institute of Internal Auditors.