Auditor Independence and Objectivity

Why it matters

An audit opinion is only valuable if the auditor was free to say what they found. If the auditor works for the person they’re auditing, or is checking their own work, nobody can be sure the opinion is honest, even if it actually is.

That’s why ITAF has two separate standards: one about the independence of the audit function, and one about the objectivity of each auditor.

Two related ideas

	Independence	Objectivity
Applies to	The audit function	The individual auditor
About	Where audit sits, and who can influence it	An unbiased mind on a specific job
Threatened by	Bad reporting lines, operational duties, scope or budget controlled by auditees	Conflicts of interest, auditing your own work, personal relationships
Typical fix	Change the reporting line; remove operational duties	Disclose; reassign the work

Both must exist in fact (they’re really unbiased) and in appearance (an outsider would agree). An exam answer that says “the auditor is confident they can remain objective” doesn’t fix a problem that’s visible to others.

Who audit reports to

The standard arrangement has two reporting lines:

• Functional reporting to the audit committee (or board). This covers everything that affects audit’s freedom: approving the charter, the audit plan and the budget, and appointing or removing the head of audit.
• Administrative reporting to senior management, usually the CEO. This covers day-to-day matters such as leave, expenses and office space.

Independence is impaired when audit:

• reports to someone whose area it audits, such as the CIO or CFO
• has operational jobs, such as running security administration or approving changes
• has its scope, budget or reports controlled by the people it audits

Example. The IS audit team reports to the CIO, who also sets its budget. Next year’s plan quietly leaves out the CIO’s big ERP project. The fix isn’t “be braver”. It’s changing the reporting line so the audit committee approves the plan.

Threats to an individual auditor’s objectivity

Threat	Everyday example	What to do
Self-review	Auditing a system you designed, or a team you recently worked in	Someone else audits it; allow a cooling-off period, often a year
Self-interest	Owning shares in a vendor you’re reviewing	Disclose; step off the audit
Familiarity	Auditing your best friend’s department, or the same area for many years	Rotate assignments
Intimidation	A manager hinting your career will suffer if a finding stays in	Escalate to audit management or the audit committee
Management participation	Approving transactions or making decisions for the auditee	Stop: audit doesn’t do management’s job

Auditors on projects

Auditors are encouraged to get involved early in system projects, because fixing a missing control at the design stage is far cheaper than finding it after go-live. The line is between advising and doing:

• Fine: reviewing designs, recommending controls, commenting on test plans, attending steering meetings as an observer.
• Not fine: designing or building controls, approving the system for go-live, performing user acceptance testing, having a vote on project decisions.

If an auditor did cross that line, they shouldn’t later audit the system, or the conflict must be disclosed and the work reviewed by someone else.

Non-audit work

Audit sometimes helps with consulting work, such as running a control self-assessment workshop. That’s acceptable when management keeps ownership of the decisions and audit only facilitates and advises.

When objectivity is at risk

1. Spot it, ideally before the audit starts.
2. Disclose it to audit management, and to the audit committee if needed.
3. Resolve it: reassign the work, use another team, or decline.
4. Report it: if it couldn’t be avoided and affected the work, say so in the report.

How the exam asks about it

If the question asks…	The answer is usually…
Best way to ensure the audit function’s independence	Functional reporting to the audit committee
The auditor previously designed the system being audited	Disclose; another auditor should do the review
An auditor joins a development project	Fine as an adviser; not in design, implementation or approval
Greatest threat to independence	Audit reporting to, or being controlled by, the area it audits
The auditee offers gifts or hospitality	Decline or disclose: it threatens objectivity in appearance

In short

• Independence is about the audit FUNCTION: where it sits and who controls it. Objectivity is about the individual AUDITOR's state of mind on a job.
• Both must exist in fact and in appearance. If an outsider would doubt it, there's a problem.
• Audit reports functionally to the audit committee (charter, plan, budget, hiring) and administratively to senior management (day-to-day admin).
• An auditor must not audit work they designed, built or ran, or an area they recently worked in.
• Advising a project on controls is fine. Designing, approving or running the controls is not.
• When objectivity or independence is at risk: disclose it, and normally reassign the work.

Exam traps

• 'I'm sure I can stay objective' doesn't solve anything if it doesn't LOOK objective.
• Audit reporting to the CIO or CFO is an independence problem when it audits their areas.
• Rotating auditors helps with familiarity. It doesn't fix a bad reporting line.
• The fix for an impaired auditor is disclosure and reassignment, not 'being extra careful'.
• An auditor on a project steering committee should be an adviser or observer, not a voting member.

Slides

Click the slide and use the arrow keys. F toggles full screen.