GETTING A LEG UP
‡Developing and maintaining the audit
As a competent and objective resource
of the audit committee, internal auditors
can provide these services more effectively than other less involved parties.
AUDI T THE CORPORATE GOVERNANCE PROCESS
Internal auditors can review the activities
of all participants, benchmark performance
with corporate governance process best
practices, and issue a report with recommendations for the audit committee and all
parties. These reviews can be based on the
organization’s corporate governance process
design effectiveness. Benchmarking data
are easily obtainable and can be used to eval-
EVALUATE MANAGEMENT’S SARBANES-OXLEY
EFFORTS As part of their annual engagement,
the external auditors assess management’s
internal control evaluation
efforts and provide their
assessment of these efforts
to the audit committee.
Performing this annual
assessment requires extensive review by the external
auditors. Considering the
number of clients each
external audit firm serves,
continuous monitoring of
the internal control system
by the external auditors will be unwieldy, uate existing corporate governance activi-error prone, and likely impossible. Internal ties. Internal auditors also may conduct
auditors, on the other hand, can observe and effectiveness reviews of the corporate gov-test management’s internal control efforts ernance process. Effectiveness reviews are
continuously and report to audit commit- much more subjective and can call for inter-tees during the year for a fraction of the cost. nal audit tools such as interviews and management self-assessment techniques.
For internal auditors to perform the duties
associated with their leg of the governance
table, they must have a desire to do so and
believe they can make a difference.
MANAGE OR PARTICIPATE IN SPECIAL AUDIT
COMMIT TEE INVESTIGATIONS Section 301 of MAKING IT HAPPEN
Sarbanes-Oxley gives audit committees For internal auditors to perform their gov-the authority to hire independent coun- ernance duties, they must have a desire to
sel and other advisers to perform investi- do so and believe that they can make a dif-gations of management on behalf of the ference. Thus, they must understand how
board of directors. Competent and objec- their expanded role can improve the orga-tive internal auditors can assist audit com- nization’s governance performance. Also,
mittee investigations in two ways. First, they must assess their capabilities and
if they have the experience, they can per- develop them more fully where necessary.
form investigations for the audit com- Finally, they must advocate their expanded
mittee directly, thereby obviating the need duties zealously and exceed the expectations
for outside assistance. Second, internal of the audit committee, management, and
auditors can aid the audit committee in external auditors.
searching for or engaging special counsel It is crucial that internal auditors report
or advisers and can manage the investi- directly to the audit committee. This
gation. Thus, internal auditors can act direct reporting relationship is recom-as the audit committee’s hands-on direc- mended by The IIA’s International Stan-
tor of the consultant’s efforts. At a min- dards for the Professional Practice of Internal
imum, internal auditors can keep the Auditing, is almost universally incorpo-committee apprised of the costs, efforts, rated into internal audit and audit com-and expertise of the contracted party. mittee charters, and is essential to ensure
Given the magnitude of professional fees, internal auditors have the necessary
it is possible that an audit committee could authority, independence, and resources to
engage a professional services firm to per- carry out their responsibilities. However,
form an independent investigation and the reporting relationship often lacks sub-then be surprised at the costs accumulated stance. There are four indicators that a
over a short period. Internal auditors can reporting relationship has substance:
help by keeping tabs on the costs and
1. The audit committee has the sole author-progress of the investigation. ity to hire, fire, and compensate the CAE.
2. The audit committee approves internal auditing’s budget and scope of work.
3. Communication between the audit
committee and internal auditing is frequent and private.
4. The audit committee approves any internal audit department support work
requested by either management or the
The IIA should lead the effort to ensure
all internal auditors have
the capability, support,
credibility, and authority
to perform their new governance roles. The IIA
should examine all the new
opportunities available to
internal auditing due to
Sarbanes-Oxley and mandate those activities that
will make a positive contribution to governance.
The IIA’s position papers and standards are
guiding the profession in the right direction, but practitioners need more help.
Quality assurance reviews should be
used to determine if:
‡Audit departments are holding up their
leg of the corporate governance table.
‡All elements of the direct reporting
relationship with the audit committee have substance.
‡Executive management governance-support assignments impact internal
auditors’ credibility or objectivity.
Time is of the essence. New governance
practices are constantly proposed and
adopted at the urging of investors, regulators, audit committees, law firms, and
external auditors. If internal auditors do
not step up and perform these new duties,
someone else will. It is doubtful that any
other party could perform them as effectively, efficiently, or economically.
Not every internal audit department has
the independence, capability, credibility,
or inclination to perform its unique, new
corporate governance duties. However, in
some cases, CAEs and their departments
are already meeting many, if not all, of their
new governance roles. It is time for internal auditing to seize these new governance
opportunities and to become a stable and
highly valued leg in the corporate governance structure.
To comment on this article, e-mail the
author at firstname.lastname@example.org.
JUNE 2005 INTERNAL AUDITOR