Richard Chambers' blog

In his blog, IIA President and CEO Richard Chambers shares his personal reflections and insights on the internal audit profession.

I Still Believe Internal Audit Shouldn't Report to the CFO

​Readers of my blog know there are a few things I have harped on over the years. One of them is what I consider to be the outdated practice of having internal audit report administratively to the chief financial officer (CFO).

For years, The IIA has conducted research on internal audit reporting relationships. The good news is our surveys have found a consistently high percentage of chief audit executives (CAEs) who say they report functionally to the audit committee. In fact, more than 80% of North American CAEs surveyed for The IIA's upcoming 2021 North American Pulse of Internal Audit report say they report functionally to the "audit committee, board, or equivalent." We see a similar trend globally.

But if an internal audit department suffers from even the appearance of an independence or objectivity impairment, it is not from the functional reporting relationship. Instead, the problem emanates from where it reports administratively. And the most controversial reporting relationship remains to the CFO. It is stunning how often CAEs in North America respond to IIA surveys that they report administratively to the CFO. In the soon-to-be-released Pulse report, we show 73% of internal audit departments with this reporting line.

Critics of this reporting relationship often contend internal audit could be steered away from auditing the CFO's area because the "boss" doesn't want the scrutiny. I actually haven't found that to be the biggest problem. Instead, statistics I have seen over the years indicate that CFOs are more likely to use internal audit to address key risks in their areas of responsibility at the potential exclusion of non-CFO risks in the organization.

Read the whole blog I Still Believe Internal Audit Shouldn't Report to the CFO