Six Years Late and Reviewed by a Friend

The rating is not defensible as issued.

Points of failure:

• The internal assessment is not a real internal assessment. An annual self-assessment must cover both ongoing monitoring and periodic self-assessment of the activity's conformance. Surveying clients measures client satisfaction, not conformance - and surveying three of four clients is not a periodic review. There is no independent challenge of the CAE's own work.
• The two exceptions are conformance failures, not administrative notes. Missing supervisory review evidence engages the supervision requirements and the engagement-level requirement that working papers support conclusions. A late-approved plan engages the requirement that the CAE establish a risk-based plan and obtain board approval. Calling them exceptions and then rating overall 'generally conforms' is internally inconsistent - conformance is assessed standard by standard, and an activity that does not conform to a standard must disclose that fact.

The CAE's conclusion should be restated at the deficient standard level (a 'partially conforms' conclusion on the affected standards) even if the overall determination is 'generally conforms.' The interpretation of the Standards requires the CAE to report the results of the internal assessment at least annually to senior management and the board, including any nonconformance; that disclosure is exactly what this rating suppresses.

Neither criterion is clearly met, and the arrangement as described should be rejected.

Test the proposal:

• Independence of the assessor. The proposed assessor reports to the same group CFO and co-chairs a methodology committee with the CAE under review. Co-authoring the methodology the assessment will evaluate is a direct self-review. Reporting into the same group management chain further compromises independence.
• Qualification. Peer CAEs from within the group are common and can be acceptable - but only if they have no conflicting role and are competent in the relevant standards and industry. The shared methodology committee undermines the 'no real or perceived conflict' condition.

What the CAE should propose instead:

1. An assessor from outside the group (another company's CAE, a qualified external provider, or a professional body's quality reviewer).
2. If a group-internal peer is used, that peer must have no methodological co-ownership, no shared reporting line to the group CFO, and a documented independence declaration reviewed by the audit committee.
3. The audit committee, not the CAE, should approve the assessor.

Also flag the underlying issue: the reason a friendly reviewer is being sought is that the activity is small and thin on independent challenge. The audit committee should be told that directly.

Six years and two months is nonconformance.

The requirement is an external assessment at least once every five years, performed by a qualified, independent assessor or assessment team from outside the organization. The clock runs from completion of the prior assessment, so the activity has been out of conformance for roughly 14 months.

What follows:

1. Disclose - the CAE must report the nonconformance and its cause to senior management and the board. This is not a matter to be corrected quietly before anyone notices.
2. Remediate on a schedule - commit to a completion date and get the audit committee to approve the plan and the selected assessor.
3. Be honest about the cause - if the delay is budget, staff, or the search for a compliant assessor, say which. The board's remedy differs by cause (funding versus sourcing versus neglect).
4. Do not substitute the internal self-assessment. Completed internal assessments do not satisfy the external requirement, no matter how thorough.

A useful judgment point: a one-off slippage with disclosure and a firm date is a governance problem the committee can live with; an undisclosed six-year gap discovered by the external auditor or a regulator is a credibility problem for the entire activity.