I was reading an interview with the WorldCom whistle blower, once the vice president in charge of internal audit at WorldCom. She made a comment that every CEO whose company has an internal audit function should read. She said having that function report to the CFO, a common situation because of the kind of work internal auditors do, is an inherent conflict of interest for the CFO. The conflict is that much of the work done by internal auditors involves reviewing the work performed by people who work for the CFO. The likelihood of internal auditors reporting problems in their boss's organization seems somewhat problematic, if you think about it.
Her point was that the internal audit team should report to the audit committee of the board of directors, and I agree. Lacking that, such as in a privately owned company that doesn't have an audit committee, that reporting relationship should be to the CEO. The problem: the CEO probably doesn't want the direct responsibility of managing a function whose activities are so foreign to what he/she feels comfortable with. My message to the CEO: get over it! These people can keep you out of trouble and make your company run better.
.
If you don't like the sound of "internal controls" then how about "integrity and efficiency controls?" Learn what it takes to oversee these mechanisms in your company, and that includes internal audit. And if your company is over $50 million or so in sales and you don't have a separate internal audit function, you should be worried. If you don't know why you should be worried, call me to talk about a coaching relationship.
I welcome your comments.
