A Draft Report the CEO Wants Softened

The CEO's request would convert an assurance finding into a negotiated position. The rating must follow the evidence: nine of 40 contracts with side letters, three in the last quarter, and a possible $2.8 million overstatement are significant. Removing the estimate would strip the committee of the magnitude of the risk; changing the rating without remediation would misrepresent the control environment. The fact that the external auditor reviewed the matter does not relieve internal audit of its own conclusion; it may be relevant corroboration or a coordination point, but it is not a basis for suppression. Delaying until after financing closes would deny the audit committee timely information and could expose the CAE to a pressure threat. The CAE should decline the changes, explain the evidentiary basis in writing, and offer legitimate alternatives: include management's response, label the estimate as a range with assumptions, and correct any factual errors. If the CEO persists, escalate to the audit committee chair before the meeting and document the pressure. Confidentiality does not justify withholding a material control issue from the committee.

The communication should be a concise report to the audit committee with: an executive summary stating the purpose and the rating; scope and criteria, including the revenue recognition policy and contract approval controls; the finding in condition-criteria-cause-effect form; the quantified estimate and its assumptions; the prior-year finding and the fact that management closed it without audit retesting, which is itself a remediation-assurance gap; management's response and any disagreement; recommendations with owners and dates; and a request for committee direction. Attach or reference the detailed testing of the nine contracts and the side-letter analysis. Explain the rating rationale so the committee can see why it is not satisfactory. Note the upcoming financing only as context, not as a reason to delay. The report should be distributed under the charter's confidentiality rules, and the CAE should keep a record of the CEO's requested changes and the reasons for rejecting them.

After issuance, track each recommendation with an owner and due date, and retest rather than accept management's assertion of closure. Because the prior-year finding was closed without retesting, the follow-up should specifically verify that the contract approval control now operates, using a fresh sample that includes side letters and amendments. Report remediation status to the audit committee quarterly and escalate any overdue or ineffective action. The financing close does not change the follow-up; if anything, it raises the stakes because the control environment will be examined by investors. The CAE should also reassess revenue risk in the next annual plan and consider whether other contracts or entities have similar side letters. If management repeats the same response without action, the CAE should report that pattern as a governance issue, not just an audit issue.