If you ask almost any chief audit executive (CAE) whether they have the full support of their audit committee, the answer will almost always be “yes.” But experience tells us that this support is sometimes conditional — firm when the stakes are low, but fragile when the stakes are high.

Audit committees rarely hesitate to back us on the easy issues: approving changes to the audit plan or charter or even supporting resource requests. But when it comes to the toughest conversations — particularly those that involve senior executives — support can become less certain.

If I could ask one question of every audit committee chair today, it would be this: “Do you believe your CAE would feel confident bringing forward a concern about the CEO’s ethics or compliance?” If the honest answer is “no” — or even “I’m not sure” — then your oversight is already compromised.

This isn’t a hypothetical concern. Principle 8 of The IIA’s Global Internal Audit Standards is clear: boards must exercise effective oversight of internal audit to ensure its independence and effectiveness. That responsibility does not disappear when disputes arise between the CAE and senior management. In fact, that is precisely when oversight is most critical.

Audit committees often refer to internal auditors as their “eyes and ears.” But just as with physical eyes and ears, they must be healthy and functioning properly. Ignoring warning signs or looking away when management clashes with internal audit is the governance equivalent of neglecting your own vision or hearing. Sooner or later, the damage will become impossible to ignore.

Corporate scandals — past and present — are reminders that even the most respected leaders can stumble. Brilliant, well-intentioned executives sometimes make poor choices, and good people are capable of bad decisions. To assume “it could never happen here” is to embrace risk rather than mitigate it.

A consistent “trust but verify” approach must apply to everyone, without exception. When internal audit identifies potential noncompliance, favoritism, or misconduct — even at the highest levels — the audit committee must stand firmly with the CAE. Turning a blind eye not only erodes internal audit’s credibility but also exposes the organization to reputational, financial, and legal consequences that could have been avoided.

At the heart of this challenge lies trust. A truly productive relationship between the audit committee chair and the CAE requires mutual confidence. The CAE must trust that raising difficult issues will not lead to retaliation or dismissal. The audit committee must trust that the CAE will surface the most significant risks, even when those risks are politically sensitive.

That trust cannot be forged in the middle of a crisis. It must be built deliberately — through candid dialogue, regular executive sessions, and a shared commitment to transparency. Audit committees must ask themselves: “If our CAE discovered misconduct at the CEO level, would they feel safe and supported in bringing it to us?” If the answer is uncertain, then urgent work remains to be done.

One former CAE once shared with me: “The audit committee always said they were behind me. What I didn’t realize was that when I had a real battle on my hands, they weren’t with me.” That distinction is profound.

Internal audit doesn’t need an audit committee that merely stands behind us when the work is routine. We need audit committees that will stand with us — in the hard conversations, in the moments when courage is tested, and when independence is most under pressure.

Because ultimately, internal audit is one of the most valuable tools in the audit committee’s arsenal. But that tool is only effective if the committee ensures its independence, nurtures its credibility, and stands firmly by its side when the stakes are highest.