The 1,200-Hour Implementation Assignment
Meridian Regional Bank ($8.4 billion in assets) has a six-person internal audit activity. The chief audit executive (CAE) reports administratively to the CFO and functionally to the audit committee, which meets quarterly. In March the CFO asks internal audit to take ownership of implementing a new loan-origination platform: chairing the steering committee, approving design decisions, and certifying go-live readiness - an estimated 1,200 hours over nine months. The approved audit plan includes an assurance review of loan-origination credit controls in the fourth quarter. Two of the six auditors have IT audit experience, and the activity has no spare capacity. The external auditor has offered to lend a manager for 300 hours. The board has not been consulted, and the CFO says the request is 'a formality the committee will rubber-stamp in July.'
1. Is accepting this assignment an independence or objectivity impairment? Analyze the factors that drive your conclusion.
Read the worked answer
Conclusion: yes - it is a self-review impairment, not merely an appearance problem.
Test it against the two dimensions:
- Independence in fact - not automatically destroyed simply because the CFO proposes it. What matters is whether internal audit assumes management responsibility.
- Objectivity / self-review threat - decisive here. Chairing the steering committee and approving design decisions means internal audit makes the very judgments it would later have to evaluate. Certifying go-live readiness is management's assertion, not an auditor's conclusion. Auditing loan-origination credit controls in Q4 would mean auditing its own decisions (IPPF Standard 1130, impairment of independence or objectivity; the implementation role is explicitly a management responsibility described in the Standards' interpretation of objectivity).
The administrative reporting line to the CFO does not itself create an impairment, but it does create a pressure that increases risk when the CFO is the requester and the board has not been engaged.
What would not be an impairment: advising on the control design, facilitating risk workshops, or reviewing the project's control framework while management retains every decision right and the auditors act in an advisory capacity with no implementation authority.
2. If the audit committee directs internal audit to take the full implementation role, what conditions and safeguards are available, and what must happen to the fourth-quarter assurance engagement?
Read the worked answer
Safeguards can reduce the threat but cannot fully cure a self-review impairment of this size.
Conditions and safeguards the CAE should insist on:
- Written acknowledgment by the audit committee that internal audit is performing a non-assurance (consulting) service and that management remains accountable for the platform and for go-live.
- No approval or certification authority. Internal audit may facilitate, advise, and monitor; management signs design approvals and go-live certification.
- Separate teams - the staff on the implementation must not subsequently audit the same area.
- Independent oversight of the implementation work by a party outside the activity (e.g., the external auditor or an independent project reviewer), and disclosure of the arrangement to the external auditor.
- Continued functional reporting to the audit committee and direct, unrestricted access to it, so the CFO cannot filter bad news.
- Board-level disclosure in writing of the impairment and its scope, not a verbal assurance that approval is a formality.
For the fourth-quarter review: internal audit must not perform that assurance engagement on an area it implemented. Options are (a) remove it from the plan, (b) reassign it to an independent party - an external provider or a co-sourced team with no involvement in the implementation, or (c) defer it until the self-review threat has sufficiently lapsed. Whichever is chosen, the impairment and its resolution must be disclosed to the audit committee and to the external auditor.
3. The CFO narrows the ask: internal audit would facilitate risk assessment workshops, comment on draft design specifications, and sit on the steering committee without a vote. Does this change the analysis?
Read the worked answer
Yes - this lands in an acceptable advisory role, conditional on detail.
Why the analysis changes:
- No decision rights. A non-voting seat plus comment-only reviews means the auditors influence but do not decide. Objectivity is preserved because there is no management assertion to later self-review.
- Facilitation is a classic consulting service. The risk workshop content belongs to management; internal audit supplies process, not conclusions.
- Commenting on draft specs is control advice, which the Standards contemplate and encourage, provided the CAE confirms management understands it must evaluate and implement the advice.
Conditions still required:
- The CAE documents the assessment of the assignment and the safeguards, since the risk does not drop to zero.
- Staff who serve in the advisory role should not be the same staff who later deliver the assurance opinion on the platform - segregation is cheap and removes the residual threat.
- The consulting engagement is included in the audit plan (or otherwise communicated to the audit committee), not accepted as a private side arrangement with the CFO.
Key discriminator for the exam: the dividing line is making management decisions and certifying on management's behalf, not the number of hours or whether a report is called 'consulting.'