A Charter Written by the People It Audits

Ranked, most severe first:

1. The charter is not approved by the board. The charter must be approved by the board (or a committee empowered by it) and must define the activity's purpose, authority, and responsibility - including the CAE's reporting lines. A CEO-approved charter with the CFO as plan approver fails the purpose-and-authority requirement outright (Standard 1000).
2. The CAE's appointment and removal sit with the CFO. Functional reporting to the board, and the board's involvement in appointing and removing the CAE, are the architecture of independence. This arrangement makes the CAE terminable by the person whose area is most frequently audited.
3. The audit committee is not independent - it includes the CEO, the senior executive from management. It cannot objectively oversee internal audit or mediate between the CFO and the CAE.
4. The audit plan is approved by management, not the board. The plan must be risk-based and board-approved (Standard 2010); CFO approval makes it a work plan for the CFO.
5. Consulting work has swamped assurance - 1,900 hours of management-requested consulting against 350 hours of assurance, with requests flowing in from individual managers rather than through a governed process. This is a scope and independence problem, not a workload problem.
6. Charter staleness - five years without review; the activity's mandate no longer describes what it actually does.

Order matters: 1–3 are structural. Fixing consulting intake while the CAE serves at the CFO's pleasure corrects nothing.

It is consulting - designing and installing is implementation, which is management's responsibility.

Assessment:

• The request comes from the manager whose area produced the finding. Designing the replacement procedure means internal audit would later be in a position to audit its own design - a textbook self-review threat.
• Nine prior engagements totaling 1,900 hours suggest the activity has become an internal consultancy with an audit sideline.

Before accepting, the CAE must:

1. Determine whether the engagement is within the charter - and here the charter is defective, so the answer must be no until it is rewritten.
2. Assess whether the activity has the skills and resources, and whether the work displaces committed assurance coverage.
3. Obtain audit committee (or board-level) approval or at least notification of the consulting engagement, its scope, and the impairment it creates.
4. Confirm in writing that management retains responsibility - managers must evaluate and implement, and internal audit will not install the procedure. Redesign the engagement accordingly: advise on control design options, review management's drafted procedure, do not build it.
5. Segregate personnel - staff on the advisory work must not carry out the follow-up assurance on inventory.

Then disclose the impairment to the board and reflect the engagement in the plan.

First action: raise the structural issues with the board, in writing, before changing anything internal.

Sequence:

1. Document the current state - charter status, reporting lines, plan approval, consulting versus assurance hours, and the specific impairments. A one-page factual memo, not an opinion.
2. Report to the board or audit committee the nonconformance with the charter approval, independence, and planning standards, and request a resolution requiring a board-approved charter, board approval of the risk-based plan, functional reporting to the committee, and committee involvement in the CAE's appointment and removal. If the committee as currently composed cannot act (the CEO sits on it), the report goes to the full board.
3. Escalate carefully and simultaneously to the CEO and the committee - the CAE should not be seen as going around the CEO, but must not be filtered by the CFO either.
4. Freeze the intake of new management consulting requests pending a governed approval path, and disclose that freeze. Existing engagements should be reviewed for whether they create impairments.
5. Hold the inventory request in an advisory-only form, or decline it, until the charter and governance are fixed.

What must be reported, at minimum: each nonconformance, the impairment it creates, who approved the arrangement, and what remedy is requested. The CAE's own position is the riskiest part of this - the report must be factual, benchmarked to the Standards, and free of any suggestion of personality conflict.