The CAE, the CFO, and the Implementation Project
North Valley Health is a five-hospital system with $2.1 billion in net revenue. The chief audit executive (CAE) reports administratively to the CFO and functionally to the audit committee. The CFO's annual incentive is tied to revenue-cycle metrics. In March, the CFO asks internal audit to project-manage the implementation of a new charge-capture module in the ERP and, after go-live, to audit its effectiveness. The audit committee chair supports the request because the IT department lacks project-management capacity. The CAE has one IT auditor and a $1.4 million budget. The audit plan already includes a revenue-cycle audit for the third quarter.
1. Evaluate whether the CAE can accept the CFO's request under the IIA International Standards. Identify the specific independence and objectivity impairments and any safeguards.
Read the worked answer
Accepting the project-management role would violate the IIA International Standards. Organizational independence (Standard 1110) is compromised because the CAE reports administratively to the CFO, whose incentive and operations are within the audit universe. Individual objectivity (Standard 1120) is threatened because the CFO is asking for a service that affects his own metrics. More importantly, project-managing the implementation is a management responsibility; auditing the module afterward creates a self-review threat (Standard 1130). Internal audit may provide advisory or consulting services, but it must not assume management's responsibilities or make management decisions. Safeguards-disclosure to the audit committee, independent project oversight, rotating staff-can reduce but not eliminate the self-review threat if internal audit actually runs the project. The CAE should decline the management role.
2. Draft a response to the CFO and audit committee. Include alternatives and the documentation you would require.
Read the worked answer
Respond in writing to the CFO and audit committee chair. State that internal audit will not serve as project manager because doing so impairs objectivity and would prevent an independent post-implementation audit. Offer alternatives: (1) advisory review of control design, requirements, and testing plans without owning decisions; (2) a post-implementation audit performed by staff not involved in the advisory work, or co-sourced with an independent firm; (3) referral of project management to IT, a PMO, or an external consultant. If the audit committee nevertheless directs acceptance, document the impairment, obtain board acknowledgment, disclose it in the audit report, and arrange independent quality review. The key distinction is advisory versus management: internal audit can challenge controls but cannot approve designs, sign contracts, or direct staff. Document the conversation in the audit file and update the independence policy.
3. What changes to reporting lines and governance should the CAE recommend?
Read the worked answer
Recommend that the CAE report functionally to the audit committee-charter, risk assessment, audit plan, budget, and performance evaluation-and administratively to the CEO or board, not the CFO. The CFO is an audited function and has a compensation incentive in revenue cycle, so administrative reporting to the CFO creates a persistent independence impairment. The audit committee should approve the charter, annual plan, and budget; hold private sessions with the CAE; and confirm unrestricted access to records and personnel. The CAE should provide an annual independence confirmation and disclose any impairments. This structure aligns with IIA Standards 1110 and 1111 and strengthens governance.