Over the years, I’ve had countless conversations with chief audit executives (CAEs) who are navigating the complex terrain of organizational politics and governance. One of the most troubling trends I continue to hear about—despite years of progress in internal audit independence—is the intrusion of management into the CAE’s executive sessions (sometimes referred to as in camera sessions) with the audit committee.

Let me be blunt: executive sessions are not for executives—at least not those whose actions or oversight may be subject to scrutiny. Yet, it’s astonishing how often CEOs, CFOs, and even general counsels seem to misunderstand—or ignore—this boundary. They “crash” the executive session, sometimes with a smile, and sometimes with subtle (or not-so-subtle) intimidation. The result is a compromised space where the CAE may feel unable to speak candidly about critical issues, from resource constraints to ethical concerns involving management itself.

As I first wrote in a 2010 blog post titled “An Executive Session Does Not Mean Every Executive Is Invited,” this is a line that must not be crossed. More than a 15 years later, the message remains as urgent as ever.

Why Executive Sessions Matter

An executive session between the CAE and the audit committee is one of the few protected opportunities for internal audit to communicate with its governing body without the shadow of management looming. These sessions are a widely recognized best practice in corporate governance, even if not always explicitly mandated by standards.

So, why are they important? Because there are some things the CAE simply cannot say with management in the room:

1. Audit Committee Concerns About Management
   Sometimes, audit committee members want to share concerns about the tone at the top, or how management is responding to audit findings. These conversations require discretion and candor—two things that evaporate the moment management enters the room.
2. Ethical Lapses or Whistleblower Reports
   Internal audit may have insights into misconduct or investigations involving members of management. Discussing these issues while those individuals are present isn’t just awkward—it’s inappropriate and potentially dangerous for the CAE.
3. Adequacy of Internal Audit’s Resources
   If the internal audit function is under-resourced, underfunded, or undermined, the CAE should be able to raise these concerns directly with the audit committee. Having the CFO (who holds the purse strings) sitting in the room chills that discussion.
4. Barriers to Independence or Objectivity
   Whether it’s subtle pressure from management or overt interference, CAEs must have the freedom to report threats to their independence. That’s not feasible if those responsible for the interference are seated at the table.

When the Lines Are Blurred

You might think that the concept of executive sessions would be sacrosanct by now. But surprisingly, some organizations still allow or even encourage management to be present during internal audit’s executive session. In recent months alone, I’ve heard from CAEs who described their CEO or CFO walking into the room and simply staying there—unchallenged. In other cases, management insists on being present “just in case questions come up” or to “clarify internal audit’s comments.”

Let me be clear: that is not how executive sessions work. The presence of management in such meetings defeats their very purpose.

A Message to CAEs: Hold the Line

If you are a CAE who’s faced with this challenge, you are not alone—but you must be firm and proactive. Here are some ways to navigate this delicate but crucial issue:

1. Educate the Audit Committee

Many audit committee chairs come from executive backgrounds themselves, and may not fully appreciate the importance of private sessions. Take time outside the boardroom to explain the rationale for holding exclusive executive sessions and how they enhance governance. Point to leading governance practices, and if needed, cite views from The IIA, the NYSE, or other oversight bodies that endorse the practice.

2. Establish Executive Sessions as a Standing Agenda Item

Don’t wait until something sensitive needs to be discussed. Propose that every audit committee meeting include a short executive session with internal audit—whether there’s an urgent matter or not. Normalize the practice, and it won’t seem suspicious when sensitive issues do arise.

3. Use Diplomacy, but Be Resolute

If a member of management tries to sit in, speak up—diplomatically but firmly. You might say:
“Chair, if I may, I believe it would be appropriate to hold this portion of the meeting in executive session, as per our practice. I’d like to have a few minutes with the committee alone.”
Most audit committee chairs will support you—especially if you’ve laid the groundwork in advance.

4. Seek Reinforcement from External Advisors

If your organization has external auditors or consultants attending the meeting, and they are also granted executive sessions, it underscores your right to the same. You might point out that executive sessions with external audit are routine and protected—and internal audit should be treated with equal seriousness.

5. Escalate if Necessary

If you’re continuously blocked from having private discussions with the audit committee, you may need to document the interference as a threat to independence. Standard 9.3.1 of the IIA’s Global Internal Audit Standards requires the CAE to report such threats to the board. It’s potentially a ‘nuclear option” —but it’s one you may have to take if governance lines are being repeatedly crossed.

Some of these suggestions can be risky. A CAE who pushes back on management crashing their executive sessions may find themselves in an uncomfortable standoff with their administrative boss. It could even impact their career. Each of us must decide how much risk we are willing to take to protect this important communication avenue. As I have observed before, courage is never without risk.

A Word to Audit Committees

If you’re a board or audit committee member reading this, let me offer a reminder: You set the tone for governance. If management is always in the room, you may never hear the full truth. The CAE is your eyes and ears across the organization—but only if they are empowered and protected.

Make it clear that executive sessions are your space. Your CAE will thank you—and your organization will be better governed for it.

Final Thoughts

In a world of growing risk and regulatory scrutiny, the role of internal audit has never been more vital. Yet that role can only be fulfilled when the CAE is empowered to speak freely, especially to the audit committee. Executive sessions are not a luxury or a formality. They are a governance imperative.

So, to those in management who assume an executive session is an open invitation: it’s not.

And to every CAE who’s ever felt the air go cold as the CFO pulled up a chair in your executive session, remember this: You have a right—and a duty—to protect the space where truth can be spoken.

Don’t let anyone crash that conversation.