The Audit That Found Too Much
You chair the audit committee of a charity with £30m annual income. Internal audit reports 'significant' deficiencies in grant-expenditure verification: 12% of sampled grants lacked supporting evidence, and one £250k grant to a partner organisation was disbursed before the partnership agreement was signed. The CEO disputes the findings, says internal audit 'doesn't understand the sector', and asks the committee to soften the wording in the annual report to 'minor improvements identified'. The external auditor has not yet signed off and will rely on the committee's report. The charity's largest funder has a clause requiring 'material control weaknesses' to be disclosed within 30 days. The internal audit contract is up for renewal in two months, and the CEO sits on the panel that scores it.
1. What are the governance and independence issues, and how should the committee handle the CEO's request?
Read the worked answer
Issues:
- Pressure on internal audit. The CEO disputing findings is legitimate; asking the committee to soften disclosed wording is not. The committee's report must reflect the evidence, not the CEO's preferred narrative.
- Independence threat. The CEO scoring the internal audit renewal while disputing its findings is a self-interest/intimidation threat to the function's independence. The panel composition must change.
- Reliance by external auditor. Softening the wording to 'minor improvements' when internal audit says 'significant' would mislead the external auditor, who relies on the committee. That is a potential misstatement in the annual report.
- Funder clause. A £250k grant disbursed before the agreement was signed is a control failure that may meet the 'material' threshold; the 30-day disclosure clock may already be running.
Handling:
- Reject the rewording. The committee's report states the findings as 'significant', with the facts.
- Require management to produce a remediation plan with owners and dates.
- Assess the funder clause now; if triggered, disclose within 30 days and inform the external auditor.
- Remove the CEO from the renewal panel (or add independent members and recuse the CEO from scoring) to protect independence.
Judgement point: the CEO's sector-knowledge argument may be partly right on context but cannot change the facts or the disclosure standard.
2. How should the committee balance the CEO's concerns against the external auditor's reliance and the funder clause?
Read the worked answer
Balance by separating three questions:
- Are the findings accurate? If the CEO has evidence internal audit misread the sector, the committee should ask internal audit to re-perform or clarify - and document the outcome. If the findings stand, they stand.
- What must be disclosed? The external auditor needs the unvarnished position; the annual report must not say 'minor' when the function says 'significant'. The funder clause is a contractual obligation assessed on its own terms - read the definition of 'material' and decide, with legal input, whether it is triggered. Err toward disclosure.
- What is the relationship cost? Managing the CEO is a governance task: explain that an accurate report protects the charity, and that softening it creates a bigger problem (auditor challenge, funder breach, regulator interest).
Practical steps:
- Minute the CEO's objection and the committee's reasoning.
- Ask internal audit for a short factual note on the £250k grant timeline.
- Confirm with the external auditor what they need from the committee.
- Diarise the 30-day funder window.
Judgement point: the committee's loyalty is to the charity's integrity, not to internal harmony. The exam rewards a clear, documented, evidence-led position that protects both the auditor's reliance and the funder relationship.