What the Chief Audit Executive Must Report to the Board: Standard 8.1 and Audit Committee Packages

An audit committee meets a handful of times a year and sees internal audit for a fraction of each meeting. Standard 8.1 of the IIA Global Internal Audit Standards says what the chief audit executive must put in front of the board in that time. It reads like an agenda, and building the committee package from it removes guesswork.

The standard

The CAE must give the board the information it needs to conduct its oversight, whether the board requested it or the CAE judges it valuable. The CAE must report to the board and senior management:

1. The internal audit plan and budget, and significant revisions to them.
2. Changes potentially affecting the mandate or charter.
3. Potential impairments to independence.
4. Results of internal audit services, including conclusions, themes, assurance, advice, insights and monitoring results.
5. Results from the quality assurance and improvement program.

The standard adds a rule for disagreement. When the CAE disagrees with senior management or other stakeholders on scope, findings or other aspects of an engagement in a way that may affect the function's ability to execute its responsibilities, the CAE must give the board the facts and circumstances so the board can consider whether to intervene.

Package structure

Map each category to a section of the package.

A package of six to ten pages with this skeleton gives the committee everything the standard lists. The detail goes in an appendix.

What "themes" means

Standard 11.3 requires the CAE to communicate results periodically and for each engagement as appropriate, and to communicate themes, which it describes as patterns or trends, such as root causes, that may be revealed when the findings and conclusions of multiple engagements are viewed holistically. When the CAE identifies themes, they must be communicated timely, along with insights, advice or conclusions, to the board and senior management.

Example theme statement (hypothetical): "Across five engagements in the fiscal year, four high findings trace to access that was granted through a manual ticket and never removed. The root cause is the lack of an automated link between the HR system and the ERP. Management has funded the integration for the next fiscal year."

That statement tells the committee more than five separate findings would, and it is the kind of insight the standard asks for.

Worked example: one meeting

In this hypothetical, a company's audit committee meets in November. The CAE's package includes:

• Plan status. Five of seven engagements complete, one in fieldwork, one deferred. Hours used: 2,380 of 2,820 planned. The deferral was caused by the ERP upgrade freezing access during October. The CAE asks the committee to approve moving that engagement to the first quarter and to approve use of 240 contingency hours.
• Independence. No incidents. The annual confirmation is attached.
• Results. Two engagements concluded controls were effective, two effective with exceptions, one not effective (vendor master changes). Open findings: 19, of which 4 are high and 1 is overdue. One accepted risk is carried at the committee's direction.
• Theme. The access theme above.
• Quality. Internal assessment found two nonconformances (work program approvals after fieldwork began; one report issued without documented CAE sign-off). Action plans due next quarter. The external assessment plan is scheduled for the following year.

Notice that the package names items for decision, not only for information. Standard 9.4 requires board approval of the plan and significant changes, so the deferral needs a decision.

Private sessions

Standard 8.1 says the CAE must provide the information the board needs, whether requested or not. Standard 7.1's essential conditions for the board include giving the CAE opportunities to discuss significant and sensitive matters, including in meetings without senior management present. Use such a session for items such as management pushback on scope or access, a disagreement under 8.1, or concerns about resources. The requirement in 8.1 to give the board the facts about a disagreement gives the CAE the basis for raising it.

Reporting to senior management too

The standard requires reporting to the board and senior management. Senior management sees the same material first. Aim for no surprises: the CFO should see every high finding before the committee does, and management responses are included in the package.

Where the SEC's rules touch the same ground

For companies subject to SEC requirements, audit committee oversight is a legal responsibility. Rule 10A-3 requires each listed issuer's audit committee to be directly responsible for the appointment, compensation, retention and oversight of the registered public accounting firm and to establish procedures for complaints about accounting, internal accounting controls or auditing matters. The internal audit package is often where the committee sees how that complaint process is operating. See /us/blog/audit-committee-complaint-procedures-rule-10a-3-and-whistleblower-intake.

Pitfalls

• Reporting activity (reports issued) without conclusions or themes.
• Burying overdue high findings in an appendix.
• Giving the committee the final report only after management has edited out the conclusion.
• No agenda item for items needing a decision.

For the follow-up and acceptance mechanics behind the results section, see /us/blog/internal-audit-follow-up-and-action-plan-tracking-standard-15-2.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• The IIA, Global Internal Audit Standards (2024), Standards 6.1, 6.2, 7.1, 8.1, 8.4, 9.4, 11.3, 12.1, 12.2, 14.5, 15.1, 15.2: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
• SEC, 17 CFR 240.10A-3, Listing standards relating to audit committees: https://www.ecfr.gov/current/title-17/section-240.10A-3

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error