An IA expert says reporting to the CFO may divert IA resources disproportionally to finance vs other areas.
More than three-quarters of US publicly traded companies’ internal audit (IA) functions report administratively to the CFO, although a similar percentage of IA professionals see reporting to the CEO as ideal.
- Presenting to a meeting of NeuGroup for Internal Audit Executives, Richard Chambers, a former head of the Institute of Internal Auditors (IIA) and a longtime IA practitioner, noted that seeming disconnect as one of several alarm bells IA professionals should consider.
- IA reporting to the CFO does not violate audit standards, but it may hinder it from carrying out its function fully, or at least foster that perception.
- “When IA reports to the CFO, there tends to be a much higher incidence of it doing work in financial reporting and finance-related risks,” Mr. Chambers said.
The numbers. According to the IIA’s 2022 North American Pulse of Internal Audit report , 76% of chief audit executives (CAEs) say they work administratively for their CFOs. In response, Mr. Chambers launched a poll on LinkedIn that drew 1,700 responses.
- “My question was, ‘Ideally, where should IA report administratively within the organization?’ It wasn’t even a contest,” Mr. Chambers said, with 74% citing the CEO, 11% the CRO and the CFO at 9%.
Supporting the CFO line. One member said IA would be way down the list of priorities of his company’s CEO, who is effectively the head of sales and dealing with a host of macro business issues.
- As is often the case, the company’s CFO once worked in IA and so understands it better than the CEO, he said. So while Mr. Chambers’ poll may reflect what’s best theoretically, in practical terms reporting to the CFO is a more practical model.
- “The skill set of the CFO is better aligned with what IA is trying to do, and having an informed sponsor or stakeholder is much more effective than having someone at the CEO level,” the executive said.
Other perspectives. Each company is different. IA reporting to the CFO may be most appropriate in many cases, Mr. Chambers said, and IA’s tendency to retain responsibility for Sarbanes-Oxley (SOX) reporting can channel it toward the CFO. However, there are issues to consider.
- Mr. Chamber’s biggest concern is that CFOs, who typically view themselves as the function’s caretaker, may unintentionally interfere with IA or be perceived as interfering within the organization.
- And reporting to the CFO may also disproportionally steer IA resources to financial issues, when risks and the need for controls abound in areas ranging from supply chains to climate and cyber.
Enlightening the CEO. Mr. Chambers recalled working for a four-star command in the Army and similar criticism arising about generals, like CEOs, not having time to listen to audit.
- “We had no choice, we had to do it, and lo and behold these generals found it was very enlightening to have audit working directly for them,” he said.