Functional Reporting and a Vendor's Request for Draft Findings
In a 4,200-employee social services agency, the chief audit executive (CAE) reports administratively to the Deputy Minister for Program Delivery, who also chairs the steering committee for a program redesign. The audit committee is advisory, meets twice a year, and its charter says it reviews but does not approve audit plans. The CAE is asked to lead a review of the redesign's CAD 6.8 million case-management system procurement. The Deputy Minister says, 'Keep this informal; no need to involve the committee until we have good news.' Two of the six audit staff previously held consulting contracts with the system vendor, although neither worked on the redesign. The CAE documents the threats but proceeds, calling the work a health check. Midway, the vendor asks to see the draft findings before the Deputy Minister does. The CAE is deciding whether to continue, disclose the impairment, or withdraw, and has not yet told the audit committee about the request.
1. Identify the independence and objectivity threats in this situation, and explain which are most serious. Distinguish organizational independence from individual objectivity.
Read the worked answer
Organizational independence is about the audit activity's reporting lines and freedom from management control. Here the CAE reports administratively to the Deputy Minister who owns the program and chairs its steering committee. The audit committee is only advisory and does not approve the plan. That structure creates a serious threat: the CAE depends on the auditee for resources, performance evaluation, and access, and the committee cannot protect the audit activity.
Individual objectivity is about the auditor's state of mind. The two staff members' prior vendor contracts create a self-interest or self-review threat, even if they did not work on the redesign, because they may be seen as protecting a former client. The vendor's request to see draft findings creates undue influence and confidentiality pressure. The 'health check' label does not remove the threat.
The most serious issue is the reporting structure because it affects every engagement, not just this one. The staff and vendor issues can be mitigated by reassignment, disclosure, and controlled report distribution, but only if the CAE can report freely.
2. Recommend immediate actions before fieldwork continues, including communication with the audit committee and the vendor.
Read the worked answer
Before fieldwork continues, the CAE should pause the review, avoid sending any draft to the vendor, and document the request and the Deputy Minister's instruction. The CAE should confirm the engagement's reporting protocol in writing: draft reports go only to designated auditee officials for factual validation, not to vendors, and final reports go to the audit committee.
The two staff with vendor relationships should be removed from the engagement and the reason documented. The CAE should brief the audit committee chair immediately, even if the committee is advisory, and ask for a meeting with the full committee. The Deputy Minister should be told, factually and without accusation, that the CAE cannot accept a condition that limits committee access.
If the committee chair will not act, the CAE should escalate to the head of the agency or the board secretary, depending on the charter, and seek legal advice on procurement confidentiality. The CAE should reassess whether the engagement can be performed objectively; if not, declining or withdrawing may be safer than issuing a report that the committee never sees.
3. If the audit committee will not act and the reporting line remains unchanged, what options does the CAE have under the Standards and professional ethics?
Read the worked answer
Under the IIA Standards and Code of Ethics, the CAE must disclose impairments of independence or objectivity to the board and, where relevant, in engagement communications. The CAE cannot simply document the problem and proceed as if it were cured.
If the audit committee will not act and the reporting line remains unchanged, the CAE should formally report the impairment to the committee and the head of the entity, state the effect on the engagement, and recommend a structural remedy. The CAE should consider whether to decline the engagement or withdraw from it if the impairment is significant and no safeguard is effective. Withdrawal should be communicated in writing with reasons, not used as a threat.
The CAE may also consider whether remaining in the role is consistent with professional obligations and, in extreme cases, resign while preserving confidential communications to the board. External reporting is generally not permitted unless law or regulation requires it. Throughout, the CAE must avoid retaliation, maintain confidentiality, and document all decisions.