The Borrowed Controller and the Inventory Audit
Golden Harvest Foods' internal audit activity has six auditors. The CAE reports functionally to the audit committee but administratively to the CFO, who sets the budget and approves travel. Twelve months ago, the CFO assigned a senior financial analyst, Priya, to internal audit for a "rotation." Priya had designed and configured the inventory-costing module in the new ERP and still holds system-administrator access. Last quarter, she led the assurance engagement over inventory valuation, including the costing module, and signed the final report. The audit committee approved the annual plan, which includes inventory, but was not told about Priya's prior role. The CFO now asks internal audit to "give a quick opinion" on the same module before the external audit, with a deadline of five business days. The CAE has two other auditors available; neither has ERP costing expertise. The CFO suggests Priya "can handle it because she knows where the bodies are buried." The audit committee meets in three weeks.
1. Evaluate the independence and objectivity threats in this request. Can the CAE accept the five-day opinion engagement as scoped, and what safeguards, if any, could make it acceptable?
Read the worked answer
Separate the two levels of threat. Organizational independence is supported by functional reporting to the audit committee, but administrative reporting to the CFO is risky when the CFO controls the budget, travel, and possibly the CAE's evaluation. The audit committee should approve the internal audit budget and have a direct role in the CAE's appointment and removal. Otherwise, the CFO can exert undue influence even without saying so.
Individual objectivity is clearly impaired for Priya. She designed and configured the costing module, retained administrator access, and then led an assurance engagement over her own design. That is a self-review threat, compounded by familiarity and the pressure created by the CFO's request. Her prior operational responsibility is not automatically a permanent bar, but the cooling-off period must be long enough, her system access must be removed, and she must not audit work she designed or implemented. Here, none of those conditions is present.
The five-day 'quick opinion' should not be accepted as proposed. A quick opinion on the same module, using the person who built the module, is not independent assurance. Acceptable safeguards would include an independent ERP specialist, a review of Priya's prior work by someone with no involvement, removal of her administrator access, documented restrictions on her role, and audit committee awareness and concurrence. Priya could at most provide a technical briefing, not make audit judgments or sign a report. If independent expertise cannot be obtained, the CAE should defer the work, narrow it to a consulting engagement clearly labeled as such, or report a scope limitation rather than issue an assurance conclusion.
2. What should the CAE communicate to the CFO and audit committee about the reporting lines and Priya's assignment, and when? Include the consequences of waiting until the audit committee's next meeting.
Read the worked answer
Communicate before accepting the work, not after. The CAE should tell the CFO that the request cannot be accepted as scoped because it would use an auditor with a self-review threat and because the activity's administrative reporting relationship needs audit committee oversight. The tone should be factual: the concern is the appearance and reality of objectivity, not an accusation against Priya or the CFO.
The audit committee should be informed immediately, even if a full meeting is three weeks away. Waiting until the next scheduled meeting would mean accepting or declining a five-day engagement without the body that provides functional oversight. The CAE should contact the audit committee chair, explain the prior role, the administrator access, the prior signed report, the CFO's request, and the deadline pressure, and ask for direction. A short interim briefing or written summary is sufficient; the full discussion can occur later.
Disclose the reporting-line issue as well. The CAE should explain that administrative dependence on the CFO, including budget and travel approval, can impair organizational independence unless the audit committee approves the budget and protects the CAE's position. The committee should also be told that the earlier inventory report was signed by an auditor who had designed the controls, so it may need independent re-review.
Consequences of delay are practical and reputational. If the CAE waits, the engagement may proceed under an impairment, the audit committee may learn about it after the fact, and the external auditor may question the reliability of the work. Early escalation protects the activity and gives the committee time to authorize an independent resource or a deadline extension.
3. The CFO insists Priya is the only person who can meet the deadline. What alternatives and documentation should the CAE consider, and how should the final report describe the limitation if the work proceeds?
Read the worked answer
Test the premise. The CAE should ask what specifically requires Priya's knowledge: system configuration history, data extraction, or interpretation of costing logic. Some of that can be transferred through a documented briefing, system documentation, or a walkthrough with IT. The CAE should also ask whether the five-day deadline is regulatory, external-audit-driven, or simply convenient. Only the first is difficult to move.
Alternatives to consider: extend the deadline; co-source an independent ERP auditor; use a qualified external specialist under the CAE's direction; limit the scope to areas that do not require Priya's self-review; or perform a consulting review with no assurance opinion. Priya could be used as a technical resource only if she does not make judgments, does not review her own design, and her work is independently validated. Her administrator access should be removed regardless.
Document the analysis. The file should record the threat, the safeguards considered, the audit committee's direction, the rationale for the chosen scope, and who performed and reviewed the work. If the work proceeds with a limitation, the report should say so plainly: the engagement could not obtain independent evidence over the costing module because the only available specialist had prior design responsibility; the conclusion is limited accordingly; and no assurance is expressed over that area.
Do not let the deadline dictate the conclusion. A fast, compromised opinion creates more risk than a delayed, properly resourced one. The CAE should give the CFO a realistic date and explain that an independent resource is a condition of issuing assurance, not an optional nicety.