Independence When the CAE Is Asked to Lead a Vendor Selection
Westbrook University's internal audit function has nine staff and reports functionally to the audit committee and administratively to the CFO. The CFO sponsors a $14 million replacement of the student information system and has asked the chief audit executive (CAE) to chair the vendor evaluation committee, score proposals, and negotiate the contract. The CAE was an ERP implementation manager at one of the three shortlisted vendors until four years ago and still holds vested stock there worth about $85,000. The new audit committee chair has not yet reviewed the charter and told the CAE privately that whatever gets the system delivered fastest is fine. The procurement director wants internal audit to perform the post-implementation review in 18 months. The code of conduct requires annual conflict-of-interest disclosures; the CAE's last disclosure, filed 14 months ago, did not mention the stock. The CFO says the arrangement is temporary and that no one else understands the contract terms.
1. Assess whether accepting the committee chair role impairs independence or objectivity. Identify the specific threats and explain which safeguards, if any, could preserve the CAE's ability to perform the role.
Read the worked answer
Independence is not the only question; objectivity is the operative threat. Under the IPPF, internal audit may perform consulting engagements, but it must not assume management responsibilities. Chairing the committee, scoring proposals, and negotiating the contract are management decisions, not assurance or advisory work. Accepting them would create a self-review threat because the CAE would later be reviewing a selection he or she controlled, and a self-interest threat because of the $85,000 stock and prior employment. The administrative reporting line to the CFO, who is the sponsor, adds a familiarity and pressure threat. The stock is a direct financial interest in a shortlisted vendor; even if vested, a reasonable informed third party would question objectivity. The 14-month-old disclosure also breaches the university's code. Safeguards cannot reduce the management-responsibility threat to an acceptable level for the committee chair role. The CAE could instead advise on control criteria, facilitate risk assessment, or act as an independent observer, with no scoring or negotiation role, and must disclose the stock and prior employment in writing. The post-implementation review should be assigned to someone else or co-sourced.
2. Recommend how the CAE should respond to the CFO and the audit committee chair, including documentation and escalation steps.
Read the worked answer
Respond in writing, not verbally, and keep it factual. The CAE should: (1) decline the chair, scoring, and negotiation roles and explain the management-responsibility and self-review issues; (2) offer a defined advisory role limited to control criteria and process risk; (3) update the conflict-of-interest disclosure immediately, including the stock and prior employment; (4) ask the audit committee chair to confirm the decision in the committee minutes and to approve any advisory scope; and (5) copy the CFO and retain the correspondence in the engagement file. The chair's comment about speed should be treated as pressure, not authorization. If the CFO insists, the CAE should escalate to the full audit committee in writing and state that proceeding would impair objectivity. The CAE should avoid negotiating a compromise that keeps a scoring role. If the committee directs the CAE to proceed, the CAE must weigh whether the instruction is consistent with the charter and the code, document the dissent, and consider whether the engagement can be accepted at all. Management instruction cannot override the standards.
3. What should the CAE do about the procurement director's request that internal audit perform the post-implementation review in 18 months?
Read the worked answer
The 18-month review is a self-review trap if the CAE or anyone involved in selection performs it. The CAE should plan now to separate the roles: assign the review to auditors with no selection involvement, co-source it to a firm with no conflict, or have the audit committee commission an independent review. If internal audit retains the review, the team must be independent of the selection committee, and the CAE should document the rationale and any residual threat. The review scope should cover contract benefits realization, control design, data migration, and vendor performance, not re-litigate the selection. The CAE should also confirm that any consulting engagement is defined in a written agreement with clear scope, deliverables, and no management authority. This protects both objectivity and the credibility of the later assurance work. Committing now to an open-ended review would compound the independence problem rather than resolve it.