Chief audit executives (CAEs) are expected to have a keen sense of what is and isn't risky business behavior. They are a key part of the corporate team, focused on, among other topics, providing assurance on the effectiveness of an organization's risk management practices.
One risk that CAEs might be unprepared to mitigate: planned rotation of the CAE's role.
The specifics of the practice vary according to a company's size, structure, and culture, observers of trends in internal audit say. And both sides of the decision to rotate or not rotate present their own set of challenges. On one hand, a desire to groom a developing leader through exposure to internal audit can be helpful to the individual and beneficial to the organization. On the other hand, rotation into and out of internal audit on a set calendar could hurt the internal audit function's independence and objectivity.
The key is to ensure that certain guardrails — such as making sure a CAE isn't auditing the department for which he or she most recently worked — are in place.
Richard Chambers, the president of The Institute of Internal Auditors, has seen a trend emerge of assigning a budding leader, even one with no experience in auditing, to the CAE role and telling that person, "You'll be in the job for three years, gain some experience, then go back into the business." That practice is troubling to him, but not because leaders shouldn't be groomed and not because executives shouldn't get exposure to other functions of an organization.
Telling the CAE that the stint will be short and measured can make it difficult for internal audit to run smoothly, independently, and objectively.
"It's the anticipation that the individual will rotate back into the business where I think you start to run into some potential impairment issues, or the appearance of impairment," Chambers said. "How objective will they be or can they be? How objective can they be if they know that they are fully dependent upon the people they audit for their next assignment?"
Plenty of CAEs have followed that path and had no difficulties doing their jobs well. But some CAEs might be tempted to tread lightly near the end of a planned rotation. "If you know that your tenure in internal audit is short-term and dependent upon those that you potentially are going to be auditing, for your ability to go back into the business, does that allow you to carry out your work free of interference?" Chambers said. "And can you be as objective as you need to be?"
AN IMAGE OF COZINESS
Bonnie Hancock, the executive director of North Carolina State University's Enterprise Risk Management Initiative, sees at least three possible risks or scenarios in assigning a candidate with little to no audit experience to the role of CAE.
First, the internal audit function might not be using best practices because of its leader's lack of experience.
Second, the CAE might think more about his or her next role and as a result may resist objectively digging into an audit, especially if the rotation is for a predetermined amount of time. "They might 'check out' if they're close to the end of their scheduled rotation," Hancock said.
The third possibility is that the new CAE, in an attempt to make an instant impact, makes a big deal out of an audit issue that doesn't deserve that much attention. In the interest of furthering his or her career, the CAE might be trying to impress the audit committee, in particular, or the board of directors.
Hancock said she has seen that third scenario play out more than the second one.
One issue of using a rotation for an executive position is that it can create the impression that a company doesn't place a high value on the internal audit function. The appearance of having a revolving door, where the CAE is designated to go from one department, into internal audit, and then back to that same department, creates an image of coziness.
"If someone rolls out of the CFO's organization into the CAE role and back to the CFO's organization, it undermines the appearance of objectivity of the individual," Chambers said.
COMPANY INSIGHT HELPS
Hancock and others see some positives to the CAE rotation model.
First, a CAE who comes from another part of the business can have far deeper company and industry knowledge, said Bailey Jordan, CPA, a Grant Thornton partner whose focus is business risk services. That person often has developed credibility and relationships across the company. "They know the culture, and it's very likely they've had visibility into the company's strategy and key business objectives," Jordan said. Their credibility can help bring about change in an organization after an audit finds deficiencies.
"Some credibility from understanding the business can be very helpful in pushing through improvement efforts and getting buy-in into audit results," Hancock said. "They can provide some unique insight into weaknesses or potential operational improvements."
Additionally, a CAE who has been a division vice president, for instance, can bring the perspective of what it's like to go through an audit, Jordan said. That type of experience can be invaluable in knowing what to expect from an audit, even if it's from "the other side."
And from a talent development standpoint, there are obvious pluses. CAEs get more interaction with the board, with the audit committee, and with external auditors. They are presenting to a new group of stakeholders and sharpening a new set of skills, such as making board presentations.
Jordan, like Hancock and Chambers, cautions against establishing short rotations for CAEs who don't have previous audit experience. "If they don't have that experience, a three-year rotation would be too quick," Jordan said.
At the same time, Jordan has seen a CAE without previous audit experience thrive, and he's heard from contacts that the practice can be successful elsewhere. One of his clients is a large manufacturing company with more than $16 billion in annual revenue. The company "took one of its business unit leaders with no prior experience and put him in the role," Jordan said. "He's been in it four or five years, and he's done quite well."
Best practices
The expectations and standards set by a company's audit committee can go a long way toward helping any chief audit executive (CAE), on a rotation or otherwise. Here are some considerations for companies in ensuring the success of a CAE who might come from another part of the organization, according to Richard Chambers, the president of The Institute of Internal Auditors (IIA); Bonnie Hancock, the executive director of North Carolina State University's Enterprise Risk Management Initiative; and Bailey Jordan, CPA, a Grant Thornton partner whose focus is risk, governance, and compliance:
- Consider several candidates, especially if the company is thinking about naming a CAE from inside the organization. It's impossible to make an objective choice if management offers just one candidate.
- Make sure the CAE isn't in a position to "self-audit." While this seems obvious, it's important to set procedures that ensure there is not a conflict of interest. A one-year cooling-off period can help: The department for which the CAE recently worked can, of course, be audited, but the CAE must not be part of that audit.
- Ensure a proper reporting structure. The IIA and other organizations recommend that the CAE not report to the CFO because that relationship calls into question the CAE's objectivity and independence in reporting on finance matters. Ideally, experts say, the CAE would report to the audit committee. CAEs must also adjust to having two bosses — the audit committee and the C-suite — so they understand the expectations and priorities of both groups.
- Don't set an end date for the CAE's time in the role. Instead of saying, "In three years, you're moving on," tell the CAE: "You probably will move somewhere else in the company, but we don't know when or if that will happen." In other words, make no guarantees.
- Make sure the team behind the CAE is strong. The internal audit team must have solid expertise to support the less-experienced leader. "Having broad audit expertise would serve to address the risk of the head auditor not having as much experience," Hancock said. Additionally, Jordan said, new CAEs should receive education on items such as the IIA's International Standards for the Professional Practice of Internal Auditing. The company should have members of internal audit already using that and other guidelines.
About the author
Neil Amato is a JofA senior editor. To comment on this article or to suggest an idea for another article, contact him at Neil.Amato@aicpa-cima.com or 919-402-2187.
AICPA resources
Articles
- "How to Lead an Effective Internal Audit Function," March 8, 2016
- "'Pervasive' Pressure Challenges Internal Audit's Objectivity," March 17, 2015
CPE self-study
- Internal Control and Risk Assessment: Key Factors in a Successful Audit (#746302, text; #164222, online access; #GT-ICRA, group pricing)
- Internal Control: How Does It Impact an Audit? (#165800, online access)
For more information or to make a purchase, go to aicpastore.com or call the Institute at 888-777-7077.
