A one-auditor programme after a merger and a whistleblower complaint
An audit committee reviews the internal audit programme of a 2,500-employee insurer. The compliance manager, who is also the only person qualified as an internal auditor, has scheduled one audit per year for three years, each covering all ISO 37301 clauses at head office. No branch audits are planned. After a merger added a 300-employee broker with high-risk commissions, and a whistleblower complaint alleged that complaints to the regulator were suppressed, the compliance manager added the broker to next year's plan but kept the same one-audit-per-year schedule. The audit committee asks whether the programme is adequate and whether the compliance manager can lead the audits. The programme has no risk assessment, no follow-up audit and no reporting line to the audit committee.
1. Evaluate the audit programme against ISO 37301 clause 9.2.
Read the worked answer
The programme is not adequately risk-based. Clause 9.2 requires the organisation to plan audit programmes considering the importance of processes, changes affecting the organisation, previous audit results and risks. A single annual audit covering all clauses at head office is a coverage schedule, not a risk-based programme. It omits branches, the newly merged broker and the complaints process, even though the merger and the whistleblower allegation are significant changes and risks. Three years without a follow-up audit also means findings may remain open without verification. The programme should define frequency, methods, responsibilities, planning requirements and reporting for each audit, and should be revised when risks change. Adding the broker to next year's plan without changing the schedule or resources does not address the risk.
2. Can the compliance manager lead these audits? Discuss impartiality and competence.
Read the worked answer
No, not for audits of the compliance function. The compliance manager manages the area being audited, so independence is compromised. Clause 9.2 requires auditors to be objective and impartial, and the organisation must ensure audit results are reported to relevant management. The compliance manager may audit other functions if independence can be demonstrated, but should not audit the compliance programme, the complaints process she controls, or the merged broker if she is responsible for its integration. Competence also needs review: one qualified auditor covering all clauses across a larger, riskier organisation is unlikely to have sufficient time or subject-matter depth. The organisation should use an independent auditor or co-source, provide competence in insurance distribution and complaints handling, and establish a reporting line to the audit committee.
3. What changes would you recommend to the audit committee?
Read the worked answer
I would recommend a risk-based programme with the following elements:
- A documented risk assessment that ranks processes, branches, the merged broker and the complaints process.
- More frequent audits of high-risk areas, with a dedicated audit of the whistleblower allegation and the regulator complaints process.
- A follow-up audit to verify corrective actions from prior findings.
- An independent lead auditor with access to specialist competence, and a reporting line to the audit committee.
- Defined audit objectives, criteria, scope and reporting for each audit, plus resource estimates.
- A review trigger so the programme is updated after mergers, regulatory action or significant complaints.
The committee should approve the revised programme and monitor completion and follow-up, not just receive an annual summary.