Internal Audit Independence and Dual-Role CAEs: What Standard 7.1 Requires

Small and mid-sized companies often ask a controller, a compliance officer or a finance director to lead internal audit part-time. The IIA Global Internal Audit Standards allow it, with conditions. Standard 7.1 is where those conditions live. For CPA firms that supply outsourced or co-sourced internal audit, it also tells you what assurance a client must obtain for areas the dual-role leader runs.

The requirements

The chief audit executive must confirm to the board the organizational independence of the function at least annually. That includes communicating incidents where independence may have been impaired and the actions or safeguards used to address them. The reporting relationships and organizational position, as determined by the board, must be documented in the internal audit charter.

The CAE must discuss with the board and senior management any current or proposed roles and responsibilities that could impair independence, in fact or in appearance, and advise on the types of safeguards to manage actual, potential or perceived impairments.

When the CAE has one or more ongoing roles beyond internal auditing, the responsibilities, nature of the work and established safeguards must be documented in the charter. If those areas are subject to internal auditing, alternative processes to obtain assurance must be set up, such as contracting with an objective, competent external assurance provider that reports independently to the board.

When the CAE's nonaudit responsibilities are temporary, assurance for those areas must come from an independent third party during the temporary assignment and for the subsequent 12 months. The CAE must also establish a plan to transition those responsibilities to management.

If the governing structure does not support organizational independence, the CAE must document the characteristics of the structure that limit independence and any safeguards used.

Related standards

Standard 6.2 requires the charter to specify organizational position and reporting relationships, and Standard 8.1 lists potential impairments to independence among the items the CAE reports to the board and senior management. The Three Lines Model describes the principle behind it: internal audit's independence from the responsibilities of management is critical to its objectivity, authority and credibility, and is established through accountability to the governing body, unfettered access to people, resources and data, and freedom from bias or interference in planning and delivering audit services. See /us/blog/three-lines-model-roles-for-finance-and-internal-audit-teams.

Worked example

In this hypothetical, a company with $60 million of revenue appoints its controller as chief audit executive for a two-year period because there is no budget for a full-time hire. The controller continues to run the close process and the general ledger.

What Standard 7.1 requires:

1. The charter documents the dual role: the controller's accounting responsibilities, the audit work, and the safeguards (for example, the controller does not approve audit scope for areas the controller manages, and the audit committee chair approves the scope for those areas; the specific safeguards are for the board and CAE to design).
2. Because the financial close is subject to internal auditing and is run by the CAE, the company obtains assurance on the close from an objective external provider that reports independently to the audit committee. A CPA firm can fill that role only if it is objective and competent and reports independently to the audit committee. A firm that also audits the company's financial statements needs its own independence analysis first.
3. Because the controllership is an ongoing role, the external assurance continues for as long as the controller holds both roles. If the nonaudit role were temporary instead, the Standard requires independent third-party assurance during the assignment and for the subsequent 12 months, plus a plan to transition those responsibilities to management.
4. Each year the controller confirms independence to the audit committee, reporting any incidents.

The standard says "alternative processes to obtain assurance must be established." The point is not to forbid the dual role. The point is to make sure no one reviews their own work without a second set of eyes.

What counts as an impairment

The standard speaks of independence "in fact or appearance." Examples of situations to raise with the board:

• The CAE reports administratively to the chief financial officer and the CFO sets the audit budget.
• Internal audit performs advisory work on a process and later provides assurance on it. Standard 2.2 requires the chief audit executive to confirm that the nature of the advisory work does not impair objectivity.
• A member of the function who had responsibility for the area under review within the previous 12 months. Standard 2.2 presumes objectivity is impaired if that person provides assurance on the activity.
• Management limits scope or access, which Standard 13.3 treats as a scope limitation requiring escalation to the board if it cannot be resolved.

Individual objectivity is a separate principle. Standard 2.1 requires internal auditors to maintain professional objectivity, with an impartial and unbiased mindset, and to be aware of and manage potential biases. Standard 2.2 also requires assurance engagements for functions over which the chief audit executive has responsibility to be overseen by an independent party outside the internal audit function.

Documenting the annual confirmation

A one-page memo to the audit committee is enough: date, statement that the function remains independent, list of incidents or potential impairments and the safeguard applied to each, any proposed role changes, and the minute reference. Keep it with the quality program file, since the external assessor under Standard 8.4 will ask for it.

Pitfalls

• A dual role documented only in an email.
• Temporary nonaudit role with external assurance that stops when the assignment ends, instead of continuing for the subsequent 12 months.
• The audit committee never told about management-imposed access limits.
• Advisory services provided by internal audit on a process that is then audited without a documented safeguard.

For nonaudit services and independence on the attest side, see /us/blog/independence-and-nonattest-services-small-firms.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• The IIA, Global Internal Audit Standards (2024), Standards 2.1, 2.2, 6.2, 7.1, 8.1, 8.4, 13.3: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
• The IIA, The IIA's Three Lines Model: An update of the Three Lines of Defense (July 2020), Principle 5: https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error