View from the top: The CAE and the audit committee – engage, engage, engage

The relationship between the chair of the audit committee and the chief audit executive (CAE) is vital to the success of internal audit in any organisation. It has to be a two-way street. We are a key tool to help them understand the risks to the business and the effectiveness of its control environment and, therefore, fulfil their statutory duties. They are responsible for supervising the internal audit function and must agree our plans, budgets and remuneration.

I am lucky to have worked with two audit committee chairs, both of whom understood and fully supported our work. However, I wonder what I would have done if this had not been the case. How would I have built a positive and constructive relationship with an audit committee chair who had low expectations and understanding of the value of a strong, independent internal audit team?

The starting point would have to be to engage, engage and then engage some more. A good initial connection would be
to discuss the audit charter with them since, not only does the
audit committee have to approve this, but it is also an important tool to demonstrate what internal audit can do and the value it can offer as an independent provider of assurance.

Once someone understands how you can add value to them, they are more likely to use your services well. Internal audit cannot overstate the importance of our unique position as a source of independent assurance and we should not be shy about telling audit committees about new areas that we can audit, or can offer assurance on, that they may not previously have considered – for example, emerging risks and climate change threats.

Conversely, however, we also need to be honest if we cannot do something that we see as important or that stakeholders require. False assurance is worse than no assurance at all. Most internal auditors are keen to offer all the help they can when asked, and may find it hard to be upfront about their limitations when a request would overstretch their resources or skills.

I was in this position some time ago when I was asked to undertake an IT controls audit and had to tell the chair of the audit committee that neither I nor my team had the specialist IT skills we would need to do this effectively. Nobody likes to appear negative, but it is as important for the CAE to be brave about assessing resource limitations, as it is to expose a negative audit finding. In this case, we agreed additional funding to obtain
co-source support to deliver the audit.

Continuous and effective communication is a vital part of engaging the audit committee chair and building up the kind of relationship and trust that is necessary when you need to have a difficult conversation on an audit finding, or in relation to resourcing, for example. The audit committee’s concerns and interests are not always the same as those of the executive board so, although your overall message will be the same, you sometimes need to communicate it differently to each audience.

A strong understanding with the audit committee chair is particularly important if you have to report a finding that may reflect poorly on a process or individual, or may necessitate action that executives do not wish to take. The chair of the audit committee is unlikely to have the same sensitivities to the issue as the executive management, and a CAE may therefore find it helpful to discuss details of the finding and to express their opinion on potential remedial action with them in advance. They will be an important ally.

It’s therefore vital that the CAE and the chair of the audit committee know that they can pick up the phone to each other at any time and that there will be no huge surprises at scheduled audit committee meetings. I always talk to our audit committee chair a week or so before meetings to discuss any concerns, the issues I will be raising and which reports they should pay closest attention to. Similarly, this gives the chair of the audit committee an opportunity to ask any questions or obtain any necessary clarifications ahead of the meeting.

For me, one of the most important contact points in the year is the annual private meeting with the audit committee, when we discuss internal audit performance, resources and independence. This is when we can focus on the operations of the internal audit team and ensure that both sides are confident about internal audit’s work, as well as highlighting the value we are adding and potential areas where we can do more.

It is also important to engage the audit committee early on in discussions about an external quality assessment (EQA). They need to understand what the EQA does and why it is important. The audit committee will normally be involved in reviewing the tender process as well as talking to the assessors and receiving the report at the end. Again, this is a great opportunity to help the audit committee chair to appreciate the value internal audit offers and the best ways to use the team to support their work.

It’s always useful to have external sources to help CAEs build and develop understanding of internal audit’s role and potential, so the Chartered IIA’s new Audit Committee Service should prove a useful tool for guidance and information. I hope that it will also be helpful for internal auditors who aspire to move into a non-executive role in future, since this is a clear option for career progression.

A good relationship is built on solid foundations of understanding and mutual trust and appreciation. Audit committees that have the resources they need to stay up to date with evolving corporate governance and controls frameworks are more likely to make full use of internal audit and establish the most constructive relationship with the CAE, which, in the end, benefits everyone. 

This article was first published in May 2022.