On "functional" matters (general direction and policy-making), about half of the internal audit executives report directly to audit committees, according to a recent survey conducted by the IIA. But in more than a quarter of the 42 companies that responded to the question, top internal auditors report to either the CEO or the CFO on functional matters.
When it comes to more-routine tasks, chief audit executives (CAEs) most often report to senior finance executives. At almost half of the 74 companies responding to another question on the IIA survey, the CFO (42 percent) or the controller (5 percent) signs off on the budget and performance of the CAE. Just 2 percent of the respondents said they report to the board on budget and performance matters.
Some reformers believe internal auditors should report to the board more often. They argue that otherwise CFOs and controllers can exert pressure on internal auditors to rubber-stamp finance-department numbers.
They Walk the Line
Then again, some internal auditing chiefs like reporting to CFOs, as long as they have complete, private access to the audit committee. For one thing, finance chiefs tend to be more accessible than CEOs. For another, they are generally more savvy about auditing minutiae, says David Richards.
Although Richards preaches the institute's gospel of separation of finance and internal auditing at FirstEnergy, he reports to Richard Marsh, the company's finance chief. Both Richards and Marsh say they have a collaborative relationship, working hand-in-hand to bring major internal audit issues to the audit committee.
Richards says he has easy access to FirstEnergy's audit committee, which is responsible for hiring and firing the top internal audit executive and approving the department's annual plan. Marsh and members of the audit committee have encouraged him to call committee members if anything questionable crops up, adds Richards.
A Waste of Resources?
Beyond a change in the reporting lines for CAEs, observers say a move to more-intense checking of company financials would be a substantial shift in duties for many audit teams. For years, those teams have focused just on keeping information systems and operations running smoothly, says the IIA's Bishop.
After all, most internal auditors aren't CPAs. Before the current accounting scandals, internal auditors largely steered clear of such complicated financial maneuverings as off-balance-sheet accounting, third-party investment vehicles, and derivatives accounting. Some internal auditing executives still feel they shouldn't get involved in auditing those processes. "Should the internal auditing function be plowing the same ground [as independent auditors]?" asks Richards. "My own view is that it's a waste of corporate resources."
Togetherness
Still, internal audit teams at a number of big companies are working much more closely with their independent audit firms. In that regard, Howard Johnson, Penney's chief internal auditing executive, took it as a vote of confidence when Allen Questrom, the company's chairman, said at a meeting of the company's senior managers early this year that the retailer was counting on its internal auditors to make sure its numbers are right.
Until recently, Penney's internal auditors had given KPMG, the company's external auditor, a wide berth. "We didn't spend a lot of time with them," grants Johnson. "We're doing more of that now, however."
One for-instance: Penney's internal auditors are providing their external counterparts with timelier operations data than the accountants normally work with, says Johnson. His 80-member internal audit team now supplies KPMG with up-to-date figures on the markdown of company inventory as soon as it gets them.
"KPMG would have the prior history, but we are out there auditing the stores," adds Johnson. Penney's internal auditors are also taking a closer look at company disclosures of special-purpose entities and travel expenses.
Reporting on day-to-day department matters to Charles Lotter, Penney's general counsel, secretary, and executive vice president, Johnson takes his general direction from the audit committee. But he also works for the committee itself, writing the agendas for its meetings after consulting with members and company officials. Although he says he has "a great relationship" with the company's CFO, Robert Cavanaugh, Johnson notes that it is not a reporting relationship.
Then again, that's just fine with the Penney internal audit chief. These days, he says, "being separate from the finance organization is a very good thing."
David M. Katz is assistant managing editor at CFO.com.
WorldCom: The View from Inside
Ask Glyn Smith who internal audit should report to, and the answer is clear: the audit committee. "In the post-Enron, post-Andersen environment," he says, "internal audit really needs to function independently of either the CEO or the CFO."
Smith should know. As a senior manager in WorldCom's internal audit department, he worked closely with Cynthia Cooper, the vice president of audit, in the investigation that unearthed an alleged fraud involving almost $4 billion in overstated revenues, later revised to $7.1 billion.
That internal audit team seems to have demonstrated why such a reporting setup may be preferable. According to sworn public documents filed by WorldCom, on June 11, after Cooper discussed her investigation with then-CFO Scott Sullivan, Sullivan asked for a delay in the review. The next day, however, Smith and Cooper called audit-committee chairman Max Bobbitt to discuss "questionable transfers" made during 2001 and the first quarter of 2002. Their concerns apparently centered on the company's accounting for its line costs (payments for network services and the use of third-party facilities) as capital expenditures — and not as expenses. That treatment was out of whack with industry practice. It also didn't jibe with generally accepted accounting principles.
Reader Comments» Post a comment