A few days ago, the President of the United States announced the dismissal of several Inspectors General. There are few details available and I anyway will not get into this particular case.
Rather, this is an opportunity to share some views on the circumstances that can justify the firing a Chief Audit Executive (CAE). I believe that there are several reasons for this to happen. First when the CAE fails to meet obligations that apply equally to all executives. And being a CAE can be an aggravating factor. Second there are cases of failure that are more specific to the audit function and can justify the removal of a CAE. Then there are elements that are more ambiguous, such as the evaluation of the performance of a CAE, where there is room for interpretation and judgement.
Reasons that apply to any employee and executive in a firm
A CAE is not exempt from fulfilling all ethical and compliance duties applicable to all employees to the firm. For example:
- Legal or criminal offenses, such as the CAE involvement in illegal or fraudulent activities. Subsequent criminal charges undermine the credibility and suitability for the CAE role. The bar for suitability is even higher in certain sectors, like in Financial Services. In the EU for example, most regulators check whether a candidate for a CAE role is “fit and proper” and require a confirmation from the company that due verifications and background checks have been performed. Any subsequent improper action from a CAE could trigger his removal.
- Poor leadership and team management. Like any executive, a CAE is expected to create a positive and productive work environment, with engaged audit teams, aligned with the firm objectives and priorities. Misconduct, toxic behaviors are “no go’s” for CAEs like for any manager.
- The breach of confidentiality or misuse of sensitive information. These are potentially a cause for breaking a working contract. But it is an aggravating factor for a CAE. Again, in the case of Financial Services in the EU, the CAE is normally in the list of “sensitive personal” or “insiders”, together with the CEO, CFO, CRO etc. the CAE has a privileged access to sensitive and confidential information
- Incompetence. Like in any position, there are incompetent CAEs. The article “the 7 habits of highly ineffective CAEs” by
Chidambaram Karthik Narayanan
a few days ago brilliantly describes the traits of an incompetent auditor (alas, I have seen a few). I would add that, in the context of the new Standards @GIAS, the voluntary, but also unvoluntary failure to ensure compliance with external regulatory requirements, and with professional standards, can lead to legal or financial consequences for the organization. As such they can be the cause for dismissal of a CAE. In the same spirit, I believe that the resistance to adapt and respond to major business risks and industry trends can lead to changing the CAE.
The specific red flags for a Chief Auditor
- The failure to report significant irregularities or fraud detected during audits or withholding critical audit information from the audit committee. Such breach of fiduciary responsibility is often associated with conflict of interest. A CAE whose compensation is significantly linked to the firm financial performance for example, can be tempted to omit reporting an issue that may affect the profitability of the firm. We have seen the case recently with Wells Fargo. Such negligence often results in financial or reputational harm.
- Complacency, or loss of independence and objectivity. There is the easy case of a CAE who alters audit findings under pressure without proper justification. Then there is a tricker situation when the audit function is under undue influence from management or other stakeholders: this is more difficult to assess and objectivize. I have expressed before that over time, irrespective of the standing and quality of the CAE, independence and objectivity erode with time. Being for too long in the CAE position of the same organization makes it difficult over the years to keep the necessary distance.
- The breach of trust. Persistent complaints from the Audit Committee, the Board of Directors, or regulators are strong signals of the erosion of trust and confidence in the internal audit function. It might be time for the CAE to go. The case of the relationship with the CEO, to whom a CAE should normally report (in my view), is tricky. The CAE should act as a Trusted Advisor of the CEO. But unless there is tangible evidence for a breach of Trust, to what extent is the loss of Trust more than a pretext for a CEO to get rid of a CAE that might just be telling unpleasant truths?
The performance trap: when the CAE is a scapegoat
When – to a certain extent - incompetence can be demonstrated, the case of performance is more complicated. Performance measurement is easy based on classic KPIs such as “fulfilment of the Audit Plan”. The problem is that such KPIs are largely irrelevant or at least fail to describe what is true audit performance, such as the impact and added value of the audit function on the firm. This matter is much discussed in the community.
My point here is that, especially in organizations with a poor control and ethical culture, with little care for checks and balances, the audit function and the CAE can be finger pointed when a problem arises. Blaming internal audit is an easy – and common – smoke screen to hinder leadership and first lines responsibilities.
So before proceeding with the CAE termination based on poor performance, there must be clarity on the initial objectives and criteria taken to assess the performance of the CAE.
When terminating a Chief Audit Executive, it is crucial for an Audit Committee Chair to ensure that due process is followed, including:
- conducting a thorough investigation (ideally externally),
- providing an opportunity for the auditor to respond: an “exit interview” is a “must”,
- and documenting all relevant findings to evidence and support the decision.
#internalauditing #independence #risk #HR
CMIIA, QIAL, CIA Cifas Advisory Board member
1 个月I think like any professional, there should be accountability. ??
Internal Audit / Risk Management / Governance Leader / CIA, CISA, MBA, cCAE, cAAP / 5 time Global Internal Audit Thought Leader award recipient (2019-2023)
1 个月Technically, organizational leadership should not fire a CAE. That is a duty and obligation reserved for an Audit Committee. The firing may come at the recommendation of organizational leadership, but the actual dismissal is the jurisdiction of the Audit Committee.
Interesante perspectiva, hay elementos grises en el despido de un CAE que se constituyen en se?ales de advertencia para quienes están relacionados con esa empresa. Para quien esta observando a la organización siempre puede quedar una línea gris de fue hecha por buenas razones ... o..., pero como tu dices hay ciertas razones que definitivamente justifican su despido..
Audit, Compliance and Risk advisor, with global Leadership and Board experience. Former Allianz Group CAE and CCO: I share my experience of leading hundreds of audit and compliance experts Doctorate student (SDA Bocconi)
1 个月https://www.dhirubhai.net/posts/chidambaram-narayanan_auditdudecn-internalauditing-auditing-activity-7285479634220044289-daEy?utm_medium=ios_app&utm_source=social_share_send&utm_campaign=copy_link