Assessment of Internal Auditing by Audit Committees

Article excerpt

INTRODUCTION

Many companies have made large investments in internal auditing in recent years and they want to ensure that the internal audit function is adding value to their organizations. Corporate audit committees often have the main responsibility to determine whether internal audit is doing an effective job. One of the roles incumbent on audit committees in serving their company board of directors is to provide oversight of the internal audit function. For companies listed on the New York Stock Exchange, audit committees are required to assist the board of directors in its oversight of the performance of the company's internal audit function (NYSE 2004, [section] 303A.07(c)(i)(A)(4)). This oversight role entails, among other duties, assessing internal audit independence and the work performance of internal auditing. In assessing internal auditing, audit committees should be familiar with assessment criteria, sources of information, and assessment procedures. The objective of this paper is to assist audit committee members with these assessments by discussing applicable professional audit standards, corporate audit charters, and relevant research findings.

ASSESSING INTERNAL AUDIT INDEPENDENCE

Independence is a critical aspect of the internal audit function. Standards set forth by the Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing, define internal auditing as an independent assurance function and require internal auditors to be independent from activities they audit (IIA 2003, Introduction, [section] 1130.A1). Because internal auditors are employed by the organizations they audit, they cannot have the same level of independence as external auditors who, while paid by the organizations they audit, are not employed by them.

For internal auditors, independence is generally determined by who hires and fires the internal auditors, to whom the internal auditors report, and whether or not they provide assurance services for areas in which they have had, or will have, operational responsibility. For example, independence is enhanced when employment decisions involving the chief internal auditor are made by the audit committee rather than the controller and when internal auditors report to the audit committee rather than the controller. Independence is impaired when internal auditors audit an activity for which they recently had decision-making responsibility. This has been a particular concern since the enactment of Section 404 of the Sarbanes-Oxley Act of 2002, which has resulted in internal audit functions devoting more resources to evaluating and improving internal controls. A study by PricewaterhouseCoopers (2006) reveals that 56% of the 402 companies in their survey reported that during the first year of Sarbanes-Oxley compliance, internal audit staffs had overall responsibility of Section 404 project management. This decision-making responsibility can potentially impair the objectivity of those internal auditors.

A study of 150 companies by Carcello, Hermanson, & Neal (2002) revealed that 18% of audit committee charters discussed the audit committee's duty to assess the independence of the internal audit function. If that is an indication of the proportion of audit committees that actually do assess their internal audit department's independence, then it begs the question of why such a low rate. Perhaps most audit committees just rely on their external auditors to provide them with assessments of the internal audit department's independence. The following excerpt from Walt Disney Company's audit committee charter illustrates the committee's responsibility to assess internal audit independence:

"The Committee shall have responsibility for determining that the Management Audit department is effectively discharging its responsibilities. In carrying out this responsibility, the Committee shall:

review the appropriateness of the. …