Forgotten password?

Independence and objectivity

With coronavirus dominating every aspect of life, organisations are quickly adapting how they operate. Internal audit functions are of course no exception.

This piece of guidance addresses the question of maintaining independence and objectivity. Internal audit combines a broad understanding of the organisation with specialist skills and expertise in many diverse areas, including IT, risk management, actuarial science, operations and accountancy.

It is therefore not surprising if a resource-hungry first line calls upon internal audit for help. Internal auditors themselves will want to do their bit to assist the organisation in a more direct way in its hour of need. How can we be of most use to the organisation, without compromising our independence and objectivity?

Consider first what the Standards say about independence and objectivity. These reside in both the chief audit executive’s (CAE’s) access to senior management and the board, and in internal audit’s unbiased attitude. Above all, ‘Objectivity requires that internal auditors do not subordinate their judgment on audit matters to others’ and ‘the internal audit activity must be free from interference in determining the scope of internal auditing, performing work, and communicating results.’

This means that if internal audit directly helps the first and second lines during this crisis, it should ensure that this activity does not influence any future engagements. Internal audit staff can do this through being mindful of how work they may do alongside first-line staff could give rise to future conflicts of interest. If this happens, awareness and full disclosure are the solutions.

If the CAE is ‘asked to take on additional roles and responsibilities outside of internal auditing, such as responsibility for compliance or risk management activities’, sensible safeguards must be established. These include reviewing reporting lines and finding ways of obtaining additional assurance if appropriate. As internal auditors, you know which controls you would look for when reviewing potential conflicts of interest, or other factors that could impair judgement and objectivity.

Yet there are significant advantages to the situation. First, internal audit has long sought to position itself as a collaborative, constructive element in the organisation. This is the perfect opportunity to demonstrate that. Many CAEs have already given examples of the most practical kind of help – catering and cleaning, for instance. The Institute’s own Liz Sandwith, for example, helped put sandbags in place several years ago, when the organisation where she was CAE faced flooding!

However, much of what internal audit can provide will be not too dissimilar from consultancy engagements – simply in real time. If your assurance engagements have concluded that your organisation’s risk and control framework is sound, this is a real-life test of which controls work under pressure, which need improvement and which can be temporarily suspended.

Some CAEs and their teams are sitting alongside senior managers and helping them design or revise processes as the crisis evolves. Updated emergency procedures and additional risk assessments are necessary right now, as is greater vigilance about fraud.

These examples slot neatly into much of what an internal audit function does anyway - assessing the organisation’s risks and controls. The main difference is that this is not a test, and yet it’s the truest test of how sound the controls really are.

So, what do you think you are expected to do – either as CAE, or as an entire team? What would be most useful to do? The two may not be the same. Use your judgement and expert knowledge of the organisation and sector to decide where your resources will help most.

There are many other practical ways in which internal auditors, especially those with specialist skills, can help the first line:

IT auditors can help IT staff in dealing with unusually high requests for support, as staff normally based in the office try to work from home.
They can also help IT security specialists analyses incoming ‘flagged’ cyber-activity, as fraudsters do love a crisis.
Staff with finance and accountancy skills can help first-line staff grappling with new payroll and other complexities.
Actuaries in internal audit can help develop updated underwriting models, and train staff in applying them, as the situation evolves.
Internal auditors with reasonably recent first-line experience can help the areas in which they are subject matter experts. (And, as the auditors shouldn’t be reviewing areas they have recently worked in anyway, this shouldn’t create additional conflicts of interest.)

For many internal auditors, this is a chance to enhance relationships with the first and second lines. It will increase understanding of how they operate, especially under pressure, without hindering judgement in future engagements.

However, for other teams, the help and support internal audit provides cannot extend to working alongside the first line. Perhaps this is because of internal conflicts, or a lack of trust that would make internal audit vulnerable to accusations of interference. If you assess that it will not help the organisation or your relationship with the first and second lines, then it would be wise to find other ways to provide additional support.

Whatever you do to help your organisation through this crisis, make sure you let the audit committee know how internal audit is contributing. There will be more guidance soon on how and what you communicate to the audit committee during this time. In the meantime, though, do what you think serves the organisation best. That’s what internal audit is there for.

Independence and objectivity

Further reading