The Two Dimensions of Independence
Independence in internal audit has two distinct dimensions that must both be present. Organisational independence refers to the structural conditions that allow the internal audit function to operate without undue influence from the activities it audits — primarily determined by reporting lines, charter provisions, and access to the governing body. Individual objectivity refers to the unbiased mental attitude of individual auditors, including their ability to make professional judgements without being influenced by personal relationships, self-interest, or external pressure.
Both dimensions are necessary. An audit function with strong organisational independence but individual auditors whose objectivity is compromised by close relationships with auditees will still produce biased results. And an audit function staffed by highly objective professionals whose organisational position is compromised — who report to a CFO who can influence their budget and staffing — cannot fully exercise their objectivity in practice.
Structural Independence: What It Requires
The IIA Standards establish the minimum structural requirements for organisational independence: the CAE must report functionally to the board or audit committee, and the board or audit committee must approve the CAE's appointment and removal, approve the internal audit budget and resource plan, and receive direct communication from the CAE without management intermediation.
In practice, these requirements are not always fully implemented — and where they are implemented on paper, the substance sometimes falls short. A CAE who technically reports to the audit committee but whose annual performance review is conducted by the CFO, whose budget requests require CFO endorsement before reaching the audit committee, and who never meets with audit committee members outside of quarterly reporting meetings has formal independence without functional independence.
The key indicators of genuine functional independence include:
- The CAE has unrestricted access to the audit committee chair and can request meetings directly without management intermediation
- The audit committee approves the audit plan and budget directly, not merely endorses a management-approved plan
- The CAE can hire, develop, and retain audit staff without management approval of individual appointments
- Audit findings can be reported to the audit committee without prior management review or editing
- The CAE's performance evaluation is conducted by the audit committee, with management input but not management control
Impairments to Independence
Several conditions commonly impair independence in practice. Scope limitations — situations where the CAE is instructed not to audit specific areas or not to include specific findings in reports — are the most direct form of independence impairment and must be disclosed to the audit committee. Conflicts of interest arising from the CAE's own prior operational roles, personal relationships with senior management, or financial interests in areas under audit must be disclosed and managed. And the audit function's advisory work — providing consulting and guidance to the business — must be carefully bounded to avoid creating situations where auditors are later assessing controls they helped design.
Independence is not a binary condition — it exists on a spectrum, and most real-world audit functions operate with some impairments. The professional obligation is to identify, disclose, and manage those impairments, not to pretend they do not exist.
The Audit Committee's Responsibility
The audit committee bears primary responsibility for protecting the internal audit function's independence. This means actively monitoring for signs that management is limiting audit access or influencing audit outcomes, ensuring that the CAE has the resources and structural position necessary to function independently, and creating an environment in which the CAE feels genuinely safe to report difficult findings to the board. When audit committees treat independence protection as a governance priority rather than a compliance exercise, the internal audit function operates in an environment where its value can be fully realised.