Independence and Objectivity
Two different things
Independence is a characteristic of the internal audit activity as a whole: freedom from conditions that threaten its ability to carry out responsibilities objectively. Objectivity is a characteristic of the individual auditor: an unbiased mental attitude. Questions routinely mix the two, so label the issue before choosing an answer.
Independence at the organizational level
Look for a chief audit executive who reports functionally to the board and administratively to senior management. The board approves the charter, the risk-based plan, the budget and resource plan, and the appointment or removal of the CAE. Internal audit needs unrestricted access to records, personnel and property. It must carry no operational responsibilities: designing and implementing controls and then auditing them is not acceptable. If the CAE reports to a CFO whose area is audited, independence is impaired even when direct access to the board exists.
Objectivity at the individual level
Threats include auditing an area the auditor previously managed or operated, personal relationships, gifts or favours, and pressure to suppress findings. If an auditor has assumed operational responsibility, assurance work for that function should be supervised by someone else, and customary practice is to wait roughly a year before auditing that area again. Conflicts of interest and impairments must be disclosed to the CAE or the board.
Worked example
A senior auditor is seconded for eight months to run a payroll system implementation, then is assigned the payroll audit. This is an objectivity impairment: reassign the engagement and disclose the situation. If instead the entire audit activity had been placed under the payroll director, the remedy would have to be organizational, because reassignment cannot cure a structural problem.