Home > Risk > Internal Audit Independence and Objectivity

Internal Audit Independence and Objectivity

Internal auditors are afraid of crossing the line and impairing their independence and objectivity.

That’s fair enough, as long as judgement is used as to what those terms really mean and where the line lies.

My friend Mike Jacka has written eloquently about this and I agree with everything he has to say in NOT a Declaration of Independence.

Some of the examples he shares are right on point. I have seen similar situations where internal auditors acted in a way that I call downright silly!

  • I remember one CAE saying he had to use his own analytics software, not the company’s, to preserve his independence.
  • Another refused to accept a Vice President title because it made him sound like he was part of the management team.
  • Several over the years have told me that their job is to find problems and make recommendations for management response. Independence prevents them from sitting down with management, figuring out and then reporting agreed action items instead of recommendations.
  • Some have even told me that independence prevents them for relying on management’s risk assessment – to any degree.

Objectivity, the leaders of the profession will tell you, is the more important of the two words. But independence is still necessary – as long as we are clear what it means. It doesn’t mean that we can’t report administratively to a top executive, have a vice president title, or accept bonuses based on corporate performance.

The IIA tackled Independence when the Core Principles for the Professional Practice of Internal Auditing were written. (Yes, I know there are related Standards and Implementation Guides.)

I will pat myself on the back for coming up with the phrase used in the Principles: “free from undue influence.” The words “from management” didn’t make it into the final language, but they are certainly implied.

The Principles use the single word Objective, without expansion, but it’s not always as simple as a single word suggests.

Some examples to think about:

  • Your boss, the CAE, has told you to find more deficiencies to report. Is he or she being objective? Are you objective if you obey and report something that really isn’t important so that the audit report looks more substantial (I would call that ‘padding’ the report)?
  • The manager of the department responsible for the controls you are testing has questioned your business understanding. You are angry. Will you be objective?
  • The CAE has told you that he has concerns over the integrity of the department head whose area you are auditing. Will you be objective?
  • The process you are auditing has had multiple serious deficiencies in prior years. Will this affect your objectivity?
  • The department head is somebody that you like personally and admire. Will that affect your objectivity? Will you have an unconscious bias?
  • The employees responsible for the controls are difficult to work with. Will that affect you?
  • The department you are auditing has a reputation for excellence and there were no deficiencies, only best practices in the last audit three years ago. You performed that audit. Will you be totally free of bias and unarguably objective?
  • You audited the area last year and they haven’t agreed to implement any of your recommendations. Will that affect you?
  • Your spouse is nagging you to cut your offshore audit engagement short so you can help look after an ailing child. Will that affect your objectivity?

OK, let’s have a look at the Standards:

Standard 1100 – Independence and Objectivity

The internal audit activity must be independent, and internal auditors must be objective in performing their work.


Independence is the freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit responsibilities in an unbiased manner. To achieve the degree of independence necessary to effectively carry out the responsibilities of the internal audit activity, the chief audit executive has direct and unrestricted access to senior management and the board. This can be achieved through a dual-reporting relationship. Threats to independence must be managed at the individual auditor, engagement, functional, and organizational levels.

Objectivity is an unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they believe in their work product and that no quality compromises are made. Objectivity requires that internal auditors do not subordinate their judgment on audit matters to others. Threats to objectivity must be managed at the individual auditor, engagement, functional, and organizational levels.

Revised Standards, effective 1 January 2017

Frankly, I prefer the phrase in the Principles for independence: free from undue influence. I think the language of the Standards confuses the independence and objectivity, but that’s just hypercritical me.

Some suggest that our independence and objectivity are threatened if the CAE takes on additional responsibilities, participates in executive management discussions, and so on.

I say to that: phooey!

Doing what is right for the organization comes first. Anything questionable should be discussed with and agreed with the audit committee of the board.

But any assurance, advice, and insight we share should be free from bias (conscious or not, positive or not) and as objective as possible.

We are professionals.

Professionals are willing to share their professional opinions and ideas. They come from a place of, yes, independence and objectivity, and when we share them my experience is that they – and we – are treated appropriately.

I welcome your professional opinions.

  1. Anonymous
    July 13, 2020 at 2:28 AM

    Totally agree with you Mr. Norman, I learned & management this matter according to my experience gained from the years of interfacing with the board and delivering the assigned tasks by senior management.
    The phrase “free from undue influence” is great, accurate, concise & clear and only when IA is free from any undue influence IA could deal with impairment of the independence and objectivity appropriately.

  2. July 13, 2020 at 3:33 AM

    Norman, I’m not totally happy with Standard 1100. It bases independence on a reporting relationship, whereas I consider it more a state of mind – which the standards include under objectivity. To me, objectivity is the basing of opinions only on verifiable facts.

  3. July 13, 2020 at 10:06 AM

    I think of independence as “organizational independence” meaning the Chief Auditor pay and employment decisions are directed or approved by the Audit Committee. Independence means the Chief Auditor is in a position to defend his team against overzealous management intent on suppressing findings or scope of work.

    I think of objectivity as the mindset of the personnel involved. Are they willing to let the evidence (facts) guide their conclusions and recommendations? People by nature bring biases to the table in what they do, so is the audit process strong enough to overcome that (e.g., training/awareness of cognitive biases, layers of review, peer reviews, rotation of personnel, QA to verify department policies followed, etc.)?

    We aren’t the only profession wrestling with this. Journalism is also facing an objectivity crisis these days, as they struggle with how to evaluate a President that isn’t a credible source of information. I follow journalism professor Jay Rosen on Twitter to keep up on this.

    The intelligence community also struggles with cognitive biases in their analysis and overrides by politicians (e.g., high-profile intelligence failures throughout the 20th century with Pearl Harbor, 9/11, and Iraq WMD notable examples). A book “Psychology of Intelligence Analysis” by Richards Heuer is a fascinating, free download from the CIA.

    We can learn from the struggles of both of these other professions.

  4. Roy
    July 15, 2020 at 3:53 AM

    Norman, Talking about downright silly, i was in a conference last year where auditors where discussing if they should give recommendations to findings in an audit report or not. They claimed, giving recommendations would impair their independence. In my view, this is not only silly, but also shows a complete lack of the much needed courage an auditor should have.

  5. September 6, 2020 at 2:54 PM

    Great article Norman. Understanding “independence” and confusing it with “objectivity” can be an obstacle for those in the internal audit profession but your explanation clarifies the meaning of both. When I was studying for the CIA exam, that is when I truly felt like I understood the meaning of independence and objectivity. Too often professionals (both within internal audit and outside of audit) confuse independence with objectivity. As auditors we need to be organizationally independent so that we can be free from any “undue influence.” Freedom from undue influence will help facilitate our objectivity. When we perform an audit, it is only natural to make recommendations based upon what we determine from our observations and testing. As auditors our function is more than just testing controls and verifying information but to add value and improve our organization and we do so through our recommendations and follow-ups.

    • Norman Marks
      September 6, 2020 at 4:31 PM

      if you add “our insights” at the end of your post and delete “follow-ups”, I agree entirely

      • melmartone
        September 6, 2020 at 5:48 PM

        Thank you for your response Norman. Yes. “Insights” is the word I should have used.

  1. July 12, 2020 at 2:31 PM
  2. July 15, 2020 at 6:11 AM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: