Internal audit functions are essential to effective risk management, control and governance. And vital to that effectiveness is independence of the function and objectivity of its internal auditors.

Independence and objectivity are so important that they respectively comprise the first two IIA Standards. Independence, according to the Standards, “is the freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit responsibilities in an unbiased manner.” Objectivity is an “unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they believe in their work product and that no quality compromises are made.”

Independence and objectivity are not self-serving. Any actions or conditions threatening the independence and objectivity of internal audit can ultimately be catastrophic for organizations overall.

Some impairments to independence are obvious:

• Aligning internal audit under a member of management over whose areas of responsibility they must audit.
• Aligning internal audit under executive management with no reporting relationship to the board/audit committee.
• A CEO/CFO refusing to permit the CAE to report critical findings or observations to the audit committee.
• Firing or retaliating against a CAE for reporting unfavorable audit results.

At the same time, internal auditors clearly have objectivity impairments if they:

• Undertake an audit of an area led by a close relative or friend.
• Undertake an audit of an area for which they were previously responsible.
• Participate in an audit for an area where they have applied for a transfer or promotion.

There are countless other examples of impairments, many of which have been discussed or explored by members of the profession for years. However, there is one potential impairment risk that doesn’t generate a lot of debate, and a skeptic might argue that’s because it’s taboo for members of the profession to question it:

Do incentive performance awards (bonuses) for internal auditors potentially impair independence and objectivity?

To prepare for this blog, I surveyed my followers on LinkedIn about internal auditor bonuses. I clearly hit a nerve: 700 responses came back very swiftly. More than 80 percent of those who responded said they receive bonuses. When asked how the incentives are determined, the results were eye-opening:

• 27% indicated that their bonuses are linked to corporate/enterprise goals.
• 15% said their bonuses are linked to customized internal audit goals.
• 41% reported their goals are linked to a combination of corporate and internal audit goals.
• Only 17% said they are not eligible for bonuses.

So, what are we to make of those responses? First, let me be clear that I believe internal auditors should be eligible for bonuses. To deny any opportunity to earn incentive compensation would be wrong. If the objective is to promote outstanding performance by internal audit professionals, then incentivizing such performance is only natural. Yet, the basis for internal auditors’ incentive compensation must be carefully considered if independence of the internal audit function and objectivity of the internal auditor are to be maintained.

The most troubling statistic to emerge from my survey was that 68% of internal auditors said they are incentivized in whole or part by their companies’ achievement of its goals. That could include corporate goals related to sales, profit, growth, employee or customer satisfaction, or compliance with laws and regulations. I believe that bonuses that are exclusively or heavily tied to corporate performance create risks to internal audit independence and the objectivity of the internal audit team.

Even if the impairments do not exist in fact, they certainly can exist in appearance. I understood that very clearly when, as a federal inspector general, my pay was set by law and I was not eligible to receive any cash award or bonus. The law precludes IGs from receiving bonuses to remove even the perception that their oversight can be influenced.

When bonuses are linked to corporate goals, internal auditors are clearly invested in the achievement of those goals. Yet, many internal audits will identify risks and conditions that could undermine or negate the achievements of corporate goals. For example, an audit finding that the company violated an environmental regulation, potentially resulting in a multimillion-dollar fine, could be perceived as undermining both profitability and goals related to compliance with laws and regulations. To avoid the potential of such a finding, the CAE might intentionally – or unintentionally – navigate away from audits that could undermine achievement of corporate goals. Even if untrue, an objective third party still might draw that conclusion.

A few years ago, a government internal audit department identified misbehavior by the CEO, but did not disclose it. When later challenged, the excuse was that exposure of the misconduct would undermine public confidence in the government agency. Again, impairments can occur in fact or appearance. The credibility of internal audit is predicated on the concept that our objectivity is above reproach.

If performance goals shouldn’t be tied to corporate or enterprise goals, then what should be their basis? I believe the 15% of respondents whose bonuses are based on achievement of customized internal audit goals are performing under the best model. Our bonuses should be dependent on how well we do our jobs – not whether we confirm that other people are doing theirs well.

A solid set of performance goals for internal auditors might include some of the following elements:

• Modeling values of the internal audit function.
• Outcomes from internal audit engagements – the impact the engagement created.
• Communication.
• Critical thinking.
• Risk acumen.
• Business acumen.
• Timeliness.
• Client service.

The CAE should set the goals and evaluate the performance of the internal audit staff. The audit committee should do the same for the CAE.

There is no prescribed approach for determining incentive compensation for internal auditors. However, there are certain approaches that create more risks than others. Any risks to the independence of our departments or our own objectivity should never be taken.

I welcome your thoughts on this delicate topic.