Independence and objectivity for internal auditors

• Distinguish organizational independence from individual objectivity
• Apply the 12-month presumption in Standard 2.2 to staffing decisions
• Design safeguards when the chief audit executive holds roles beyond internal audit
• Determine when and to whom an impairment must be disclosed

Two different ideas

The Global Internal Audit Standards separate independence, which belongs to the function, from objectivity, which belongs to the individual. Principle 7 (Positioned Independently) is about where internal audit sits and whom it reports to. Principle 2 (Maintain Objectivity) is about the mindset of each auditor on each engagement. A function can be well positioned and still staff an engagement with someone who cannot be objective about it.

Organizational independence (Standard 7.1)

Standard 7.1 requires the chief audit executive (CAE) to:

• confirm to the board the organizational independence of the function at least annually, including incidents where independence may have been impaired and the safeguards used;
• document the reporting relationships and organizational positioning in the internal audit charter, as determined by the board;
• discuss with the board and senior management any current or proposed roles that could impair independence in fact or appearance, and advise them on safeguards.

When the CAE has ongoing roles beyond internal auditing, such as owning enterprise risk management or the SOX program office, the charter must document those responsibilities and the safeguards. If those areas are subject to internal auditing, an alternative assurance process is required, such as an objective, competent external provider that reports independently to the board.

Individual objectivity (Standards 2.1 to 2.3)

Standard 2.1 requires an impartial and unbiased mindset on every engagement. Standard 2.2 is the working rule:

• Internal auditors must not accept gifts, rewards or favors that may impair, or be presumed to impair, objectivity.
• They must refrain from assessing activities for which they were previously responsible. Objectivity is presumed impaired if an internal auditor provides assurance services for an activity for which they had responsibility within the previous 12 months.
• If the function moves from advisory to assurance work on the same area, the CAE must confirm the advisory work does not impair objectivity and assign resources so individual objectivity is managed.
• Assurance engagements over functions for which the CAE has responsibility must be overseen by an independent party outside internal audit.

Standard 2.3 requires that impairments in fact or appearance be disclosed promptly: the auditor tells the CAE or a designated supervisor, and the CAE discusses impairments that affect the work with the management of the activity under review, the board or senior management. An impairment of the CAE’s own objectivity goes to the board. If an impairment comes to light after the engagement is complete and affects the reliability of the results, the CAE must discuss it and decide what to communicate.

Where SOX programs create pressure

SOX work creates three common objectivity traps.

1. Designing then testing. Internal audit drafts narratives and suggests control redesign during readiness, then tests the same controls. Drafting documentation is advisory; owning the control design is a responsibility. Keep design decisions with process owners and record that they approved them.
2. Rotations from finance. A senior accountant who ran the account reconciliation control joins internal audit in March. Under the 12-month presumption, she should not provide assurance over that control until 12 months after she left the role.
3. Fee and time pressure. Management asks internal audit to "pass" a control so the external auditor can rely on it. That is undue influence under Standard 2.2. Escalate to the CAE.

How the external auditor reads this

AS 2605.10 lists objectivity factors the external auditor considers: whether internal audit reports to an officer of sufficient status, whether it has direct access and reports regularly to the board or audit committee, whether the board oversees employment decisions about the head of internal audit, and policies that keep internal auditors away from areas where relatives work or where they were recently assigned. A documented 12-month policy and an annual independence confirmation make that assessment quick. AS 2201.18 applies the same competence and objectivity assessment to anyone whose work the auditor plans to use in an ICFR audit.

Documentation to keep

• The charter showing reporting lines and any CAE dual roles with safeguards.
• The annual independence confirmation to the board.
• An engagement-level objectivity declaration from each team member, including prior roles in the last 12 months.
• A log of disclosed impairments and the action taken.

Staffing the 2026 payroll engagement at Coastal Freight Corp.