Internal Audit – A Question of Independence

“Internal Audit should not use Independence as an excuse to avoid helping the business but look to push the Independence barrier as much as possible to help the business.”

Coming back into Internal Audit fresh out of two-year stint running Business Transformation, that is what I stated on stage in 2017 in the IAAIA Conference in Casablanca to a room full of airline internal auditors. I was expecting it to be contested and challenged (as I knew I was courting controversy) but it wasn’t. And I have found discussions on this point quite positive and receptive.

There is now a growing recognition that a conventional and traditional Internal Audit approach is no longer considered enough. Internal Audit has to not only live up to its promise of being a trusted advisor, but has to step forward and be a business partner that not just finds fault, but supports the development of practical solutions.

I began my career in Internal Audit with a mandate to add value and to pay for myself. That wasn’t what Internal Audit was ever supposed to do at the time, but that is what the stakeholders wanted. So I developed a function that focused on adding measurable value along with assessing internal controls, process and governance. And while I was pushing the boundaries of Independence with it, the function was carrying its own weight in the business. And that foundation stayed with me, and I have always remained sceptical of how the Independence card is played.

Here is how I see it: If Internal Audit was fully independent, then there wouldn’t be External Audit. You could create an in-house team with the same skillsets and get the required level of independent assurance. So that is already a question mark – what does Internal Audit’s Independence really mean and why does it exist?

Independence allows Internal Audit to analyse risks, controls and processes with objectivity to give an unbiased view on the current state of affairs to the Audit Committee (ideally). It is a grey area and that’s where an individual person’s mindset and interpretation of Independence comes into play. Imagine you have a critical audit finding which needs addressing immediately. Once you find it, what do you do? Do you play your Independence card, report it and leave it to the business to fix. Or do you collaborate with the business to develop a recommendation that is as close as a possible to a practical solution, putting your Independence to audit the process later in doubt. Both are extreme ends of the Independence scale, but I prefer to lean more towards the latter side and support the business with knowledge and expertise that Internal Audit inherently has, while staying within the absolute outer edges of Independence.

There are pitfalls of this approach, which one must always be mindful of. I am questioning how Independence is used, not the concept of Independence itself as it is a fundamental requirement. You always have to be mindful where you draw a line on how far you push the boundary, but you don’t willingly break it. You do not want to end up being in a position where you are seen as gullible or a function that can be manipulated by the business. And there will be times when the old fashioned 'police officer' approach will have to be used.

Independence is a state of mind, and not something cast in stone. There are guidelines and individuals can interpret them differently. But there is no doubt that the business and stakeholders demand more from Internal Audit. And if COVID-19 has taught us one thing, it’s the need to change and adapt. Internal Audit has to step forward and become more relevant. Be that trusted advisor and business partner, step out of the shadows and make your knowledge and experience count. Support the business rather than just find fault. Be objective, sceptical and independent, but also be realistic and know everyone is in the same boat working towards the same goal of making the business successful.

Personally, I would rather risk being questioned about pushing the independence barrier too far in order to support the business than be a text-book independent audit function that is seen as a disconnected and non-value adding necessity. Because to me, becoming irrelevant as an Internal Auditor is an even greater risk.

This article represents my personal opinion only. I would be happy to know your views and thoughts on this matter.