I have spent decades serving on and for boards and their audit committees around the world. I believe most directors want to do the right thing. They ask questions. They challenge management. They protect stakeholders.

But I have also seen the opposite. I have witnessed boards where members are far more interested in complementing than contemplating. When board members resist asking tough questions a lack of independence is often the root cause.

As The Corporate Governance Institute has observed, “Few concepts are as crucial to the modern board as board independence. A truly independent board can challenge leadership, ensure accountability, and safeguard shareholder interests. But achieving and maintaining independence is easier said than done…. A lack of board independence can erode trust among shareholders and regulators. Some of the most high-profile corporate failures in recent years have been attributed, at least in part, to boards that were too close to management.”

When a board loses independence, governance weakens quickly. Risks grow quietly. Internal auditors, risk managers and others often sense it early. If you know what to watch for, you can recognize the warning signs long before a scandal, restatement, or regulatory action.

Conversations about a lack of board independence often surface when the board chairman is also the CEO. Given the glaring independence risks in such cases, boards must work harder to remain objective. There are several safeguards that bolster board independence when the chair is the CEO. In such instances, board members should:

• Appoint a strong Lead Independent Director from among their ranks
• Insist on mandatory executive sessions
• Ensure board committee chairs are independent
• Ensure board agendas are not controlled exclusively by the Chairman/CEO
• Undertake formal CEO evaluation and succession processes
• Engage external board assessments periodically

It is tempting to assume that boards not led by the CEO are inherently more independent. But that isn’t always the case. Here are five “red flags” that even a board with an “independent” chair may not be operating independently of management.

1. The CEO or Others in Management Control the Agenda

An independent board sets its own priorities. A dependent board simply reviews what’s put in front of it.

I have reviewed thousands of pages of board and audit committee materials over the years. One pattern has always concerned me: agendas dominated by management briefings, operational updates, and marketing narratives. In such instances, critical topics such as the risk outlook receive little or no time.

Watch for these indicators:

• Board materials prepared unilaterally by management with no director inquiry/input
• Last minute distribution of information that doesn’t afford adequate time for board member review
• Little time reserved for executive sessions
• Strategy discussions framed only by management’s assumptions

A board cannot provide oversight if it only reacts. Directors must decide what they want to discuss, not simply what management chooses to present.

Internal audit should quietly observe how agendas are built. If management is the gatekeeper of information, independence is already compromised.

2. Executive Sessions Rarely Occur

Independent directors need time alone.

Executive sessions without management present are not a formality. They are a necessity. This is when directors compare impressions, challenge narratives, and surface concerns.

When these meetings do not occur, or occur only briefly, something is wrong.

I once observed a board that ended every meeting the same way. The CEO remained in the room. The board never met privately. Not surprisingly, serious culture and control problems existed that directors did not fully appreciate.

Healthy boards or their audit committees routinely hold private sessions with:

• The chief audit executive
• External auditors
• Compliance leadership
• Independent directors only

Executive sessions are particularly critical for audit committees. If internal audit rarely meets privately with the audit committee chair, the board may be relying on management for its understanding of risk.

3. Directors Show Unusual Deference to the CEO

Strong CEOs are valuable. Dominant CEOs are a risk.

You can often sense board independence by watching a meeting. Independent directors challenge assumptions. Dependent directors defer.

Warning signs include:

• Directors rarely asking follow-up questions
• The CEO interrupting and answering questions directed to others
• Directors praising management excessively during meetings
• Decisions made quickly with little debate

I have attended meetings where directors avoided disagreeing with the CEO even on obvious issues. Later those same organizations faced regulatory findings and operational failures, and board members professed shock and dismay.

Oversight requires constructive tension. Without it, governance becomes ceremonial.

4. Director Tenure and Relationships Are Too Comfortable

Independence is not only structural. It is behavioral.

Long tenure alone does not destroy independence. But long tenure combined with close relationships can.

As PwC’s 2025 Annual Corporate Directors Survey disclosed, more than half of directors surveyed think someone on their board should be replaced. Yet, thanks to the cozy nature of board memberships, it’s highly unlikely that will be said out loud.

PwC’s report observed that “When directors say that a peer is failing to contribute meaningfully, the critique often goes beyond attendance or technical qualifications, reflecting a broader concern about alignment, engagement and boardroom dynamics. In many cases, they believe that long tenure can lead to diminished performance, with directors becoming less engaged or falling behind evolving governance expectations.”

Concerns increase when:

• Many directors have served for decades
• Multiple directors previously worked with the CEO
• Social relationships between management and directors are unusually close
• Directors depend heavily on management for information and guidance

Familiarity can weaken skepticism. Directors may begin to trust management’s judgment instead of verifying it.

Effective governance requires professional distance. Respect is good. Dependence is not.

5. The Board Reacts to Crises Instead of Anticipating Risks

The clearest signal of independence is forward looking oversight.

Independent boards ask about emerging risks. Dependent boards ask what happened after the problem occurs.

I often review meeting minutes. The difference is obvious.

Dependent boards focus on:

• Past quarter performance
• Operational updates
• Public relations issues

Independent boards focus on:

• Strategic risk
• Cybersecurity preparedness
• Culture and ethics
• Emerging regulatory expectations

When directors rarely ask about future risks, they are being led by management rather than overseeing it.

Internal audit plays a crucial role here. If the audit plan centers only on historical compliance testing, the board may not be demanding forward looking assurance.

Why All This Matters to Internal Auditors

Internal auditors work for the organization, but we report to the board for a reason.

A non-independent board weakens the entire governance structure. It affects risk management, ethics, financial reporting, and ultimately stakeholder trust.

You may not be able to change the board. But you can protect its independence by:

• Maintaining direct communication with the audit committee chair
• Being ready to address the full board if asked by the audit committee
• Reporting emerging risks early
• Avoiding allowing management to filter your message
• Documenting unresolved issues clearly

I have learned a simple truth. Most governance failures do not begin with fraud. They begin with silence. When a board is not independent, people stop speaking candidly. Internal audit must not be one of them.

Your credibility, and your organization’s resilience, depend on it.