From the very first day I became an internal auditor, the word “independence” took on particular significance. As a young auditor in government, we were taught from the beginning that “independence” was the foun​dation upon which internal auditing’s credibility and effectiveness was based. Over the years, our audit standards were strengthened to mandate reporting relationships that fostered independence. Yet, even when I first assumed the role of a chief audit executive (CAE) in the late 1980s, I was vaguely uncomfortable with touting “independence” when I was clearly employed by the organization in which I worked. I watched way too many “independent” CAEs meet an untimely professional demise for being a bit too “assertive” to assume that I was totally independent.​

A few years later, I had the opportunity to serve on The IIA’s Internal Audit Standards Board during a period in which a major revision to the International Standards for the Professional Practice of Internal Auditing (Standards) was underway. I had the opportunity to participate in a number of remarkable debates/discussions in which members of the board explored what independence really meant. In the end, the Standards defined “independence” as an “organizational attribute,” and “objectivity” as the personal attribute. In other words, internal audit organizations should be independent while the professionals who staff those organizations should strive for objectivity. Ideally, that should have resolved the issue in my mind, but it really did not.

Standard 1110 defines organizational independence as one in which the CAE reports “to a level within the organization that allows the internal audit activity to fulfill its responsibilities.” Over the years, The IIA has gone a step further to indicate that a CAE reporting relationship functionally to the board and administratively to the CEO is one that “facilitates organizational independence.” Even in 2009, however, very few CAEs report administratively to their CEO. The preponderance of CAEs in the U.S. corporate sector continue to work administratively for the chief financial officer (CFO) and functionally for their audit committees. A growing number are even working administratively for the general counsel. The question often posed is, “Are any of these internal audit activities ‘independent?'” The answer is “it depends.”

I have had the opportunity in recent years to examine a great many corporate internal audit activities in the course of completing their external quality assessments. While I readily acknowledge that those where the CAE reports administratively to the CEO are generally more independent, many of the others are also independent as defined by the Standards. In the final analysis, I would offer five litmus tests below in assessing the extent to which an internal audit activity whose CAE reports administratively to a level below the CEO is truly independent: