A Dashboard That Cannot See Itself
A municipal water utility with 1,200 employees is regulated by a state environmental agency and a public utility commission. Its compliance dashboard reports 96% of controls 'in place' and zero overdue corrective actions. The three-person internal audit function reports administratively to the CFO, who also sponsors the compliance program; the CFO approves the audit plan. The board audit committee receives a two-page summary each quarter. Over the past 18 months the regulator issued four notices for late filings, and an external quality review found 12 repeat findings from prior audits; nine had been closed without evidence. Management says the issues were 'fixed.' You have been engaged as an independent advisor to the audit committee.
1. Evaluate whether the Review component is functioning effectively. Identify specific weaknesses in monitoring, assurance, and improvement.
Read the worked answer
The Review component is not functioning effectively, even though the dashboard looks healthy. Monitoring is measuring self-reported 'in place' status rather than whether controls are operating. A 96% in-place rate is compatible with four regulatory notices because the metric does not test performance. Zero overdue corrective actions is contradicted by nine findings closed without evidence and 12 repeat findings, which suggests the closure process is recording administrative closure rather than verified remediation.
Assurance is compromised by structure. Internal audit reports to the CFO, who also sponsors compliance and approves the audit plan. That arrangement may not be intentionally captured, but it creates a conflict: audit is assessing a program sponsored by its administrative superior. The board receives only a two-page summary, which is unlikely to surface repeat findings or the absence of evidence.
The improvement loop is the weakest element. Repeat findings indicate that root causes were not addressed, and closure without evidence means the organization cannot distinguish fixed from declared fixed. Management's statement that issues were 'fixed' is not assurance. Review must include independent evaluation and verified improvement, not just issue tracking.
2. Recommend changes to structure, evidence standards, and board reporting, and explain how you would prioritize them.
Read the worked answer
I would prioritize independence first because it determines whether the other changes can be trusted. Internal audit should report functionally to the audit committee, which should approve the audit plan and receive audit results directly. The compliance program should not be sponsored by the same executive who oversees audit. This structural change may require governing-body action and should be presented as a governance risk, not a personnel complaint.
Second, set evidence standards for closure. A finding should close only when the corrective action is implemented, evidence is reviewed by someone independent of the action owner, and a defined period of operation has been tested. Repeat findings should trigger root-cause analysis and reporting to the audit committee. A closure without evidence should be reopened.
Third, redesign board reporting around risk and assurance rather than activity. The quarterly pack should include open findings by age and severity, repeat findings, regulator notices, closure evidence status, and management's risk acceptances. I would sequence independence before evidence standards because an audit function that cannot report freely will struggle to enforce closure discipline, and evidence standards before dashboard expansion because better reporting cannot compensate for unverified data.