To whom does head on internal audit report to?

The big question is to whom should the internal audit report to? The reporting line of internal audit is a dynamic issue today, especially considering recent corporate scandals and continued financial restatements, the emergence of regulations such as Sarbanes-Oxley and new listing standards of the stock exchanges. All these have substantially increased the responsibilities of the audit committee.

The IIA Practice Advisory 1110-2, Chief Audit Executive (CAE) Reporting Lines, states, “The chief audit executive should report to a level within the organization that allows the internal audit activity to accomplish its responsibilities.”

The Practice Advisory goes on to state: “The Institute (IIA) believes strongly that to achieve necessary independence, the CAE should report functionally to the audit committee or its equivalent. For administrative purposes, in most circumstances, the CAE should report directly to the chief executive (CEO) of the organization.”

Unlike the company’s external audit firm, which by regulation must be hired by, report to and be compensated by the audit committee, internal audit has a broader role to play through serving as a resource for both the audit committee and company management.

Though this “dual reporting” is a somewhat sensitive arrangement and can be tricky in practice, it nevertheless provides important benefits to the company as a whole, including its overall corporate governance objectives as well as management’s objectives for reliable financial reporting, compliance with applicable laws and regulations, and efficiency and effectiveness of operations (the COSO objectives of internal control).

Until regulations or standards change, internal audit is considered a part of the internal control system of a com-pany, yet must also remain an independent, objective assurance and consulting activity that supports and reports to a company’s CEO and audit committee. To whom the internal audit report, is critical in order to maintain high audit independence.