The auditor who used to own the plan
You are a senior internal auditor at a regional insurer (1,100 staff, three offices). Fourteen months ago the chief audit executive assigned you to audit the business continuity programme. Until nine months before that assignment you were the organisation's BCM coordinator: you wrote four of the six plans in scope, chaired the last two exercise debriefs, and signed the 2023 business impact analysis. The two remaining plans cover claims processing and the contact centre. The CAE says the engagement is already in the audit committee-approved plan, that no one else has your technical depth, and that the report will be 'reviewed by someone else'. Separately, management has asked that the audit exclude the third-party print vendor because 'the contract renewal is in flight'.
1. Can you perform this engagement? Set out your assessment and what you would put to the chief audit executive.
Read the worked answer
Assessment: objectivity is impaired. The engagement should not proceed with me as lead, on these terms.
Reasoning:
- I held operational responsibility for the activity under review until nine months before the engagement. The long-standing IIA position - retained in the current Global Internal Audit Standards - is that objectivity is presumed impaired where an internal auditor provides assurance over an activity for which they had responsibility within the previous year. Nine months is inside that window.
- The impairment is not only temporal. I authored four of the six plans in scope and signed the BIA, so I would be evaluating my own design decisions and my own risk judgements. That is self-review, and no amount of review-level sign-off cures it.
- 'Technical depth' is a competence argument, not an objectivity argument. Competence can be bought in (co-source BCM specialist, peer audit team). Objectivity cannot.
Options to put to the CAE, in preference order:
- Reassign the lead; procure BCM subject-matter support for criteria and test design; I act as observer only.
- If I must be involved, scope me out of the four plans I authored and the programme-level BIA. Another auditor tests those; I test claims processing and the contact centre. Record the restriction and the reason in the engagement plan and disclose to the audit committee.
- Deferral - partly helps (three more months reaches the twelve-month mark) but does not fix self-review of the 2023 BIA.
On the vendor: management does not set audit scope. If policy-issuance continuity depends on the print vendor, it is in scope. The request is a scope limitation, and unresolved scope limitations are disclosed to those charged with governance, not silently accepted.
2. The CAE proposes that a colleague with no continuity background 'reviews the workpapers' and the report is issued as drafted. Evaluate that proposal.
Read the worked answer
A review signature does not convert self-review into independent assurance.
Three problems:
- It does not restore objectivity. Objectivity attaches to the person who designed the tests and formed the conclusions. For a reviewer to supply genuine independence they would have to re-perform the work and reach their own conclusions - a re-do, not a review.
- The reviewer lacks the competence to challenge. Without continuity background, the review becomes a check that workpapers are complete and internally consistent, not a test of whether the conclusions are right. My reasoning would go unchallenged by construction.
- The output would mislead the audit committee. The report would look like independent assurance when the substance is a self-assessment. That is a disclosure failure as much as an objectivity failure, and it damages the credibility of the function beyond this one engagement.
What I would actually do:
- Ask the CAE to disclose the impairment to the audit committee if the engagement proceeds in modified form, and record the discussion.
- Ensure a reviewer with genuine BCM competence and independence from the plans I wrote performs the challenge function.
- Keep consulting help (advice on criteria, coaching management) clearly separate from assurance work, since shifting between them on the same activity compounds the problem rather than solving it.