Internal Audit's Identity Crisis: Why Reporting to the CFO Undermines Strategic Value

The Misunderstood Mandate of Internal Audit

Internal audit professionals frequently face a case of mistaken identity, being mislabeled as accountants, tax auditors, or even 'the police.' This pervasive misunderstanding, the author argues, stems largely from the common organizational structure where the Chief Audit Executive (CAE) administratively reports to the Chief Financial Officer (CFO). Despite internal audit's broad enterprise-wide scope, this reporting line often confines its perception and activities to finance-centric compliance, such as Sarbanes-Oxley (SOX) and external auditor support. This narrow view not only undervalues internal audit's potential but also hinders its ability to address emerging, strategic risks across the organization.

The CFO Reporting Trap: A Barrier to Strategic Value

The article highlights that a significant majority of CAEs in publicly traded companies report to the CFO, a trend that is unfortunately increasing. This structure creates an inherent 'gravity' towards financial risks, often at the expense of broader enterprise threats. For instance, a substantial portion of audit plans in these organizations is dedicated to SOX compliance and financial areas, diverting resources from more strategic engagements like AI governance or cybersecurity maturity assessments. This reliance model, where internal audit supports external auditors, often squanders internal audit's strategic capabilities without quantifiable benefits, as many organizations cannot even measure the fee savings from such reliance. Furthermore, the CFO's influence over the CAE's performance reviews and compensation can subtly compromise internal audit's independence, even if direct reporting to the audit committee exists.

Elevating Internal Audit's Position and Talent

The author criticizes the practice of CFOs treating internal audit as a temporary assignment for finance professionals, often placing individuals without internal audit expertise into CAE roles. This not only demoralizes internal audit teams but also signals a lack of understanding and respect for the profession's specialized skills. Such 'amateur CAEs' may struggle with the transition to an independent governance role, potentially compromising critical audit findings due to peer pressure or a lack of professional standing. To counter these challenges, internal audit leaders are urged to advocate for reporting lines that position internal audit as an enterprise function, ideally reporting to the CEO. This shift would elevate internal audit's remit, improve the flow of risk information to the board, and align with best practices for independence and authority as outlined by the IIA Standards.

A Call to Action for Modern Internal Audit

To address these systemic issues, the article proposes several actionable steps for internal audit leaders:

• Call out internal audit's expanding remit: Clearly articulate non-internal audit activities in the audit charter and socialize this with senior executives and the audit committee.
• Execute a high-quality risk assessment: Develop a risk-based audit plan that highlights the opportunity costs of non-strategic work and unaddressed high-risk areas.
• Position the CEO reporting line as a governance upgrade: Present the benefits of this structure to the audit committee, emphasizing enhanced independence, broader risk oversight, and alignment with modern standards.
• Recommend updating the audit committee charter: Ensure the charter explicitly states the committee's responsibility for all CAE appointment, removal, and remuneration decisions.

By taking these steps, internal audit can move beyond its current mischaracterization and fulfill its crucial role in providing strategic risk insights and foresight across the entire enterprise, truly abiding by its evolving mandate.