I have written about the importance of the CAE’s reporting lines, but this can be a meaningless structure if not supported with substance. While a strong functional reporting relationship with the board or audit committee is critical to protect heads of internal audit from undue management influences, this arrangement is only as strong as their will to be involved.

I noted in an earlier blog that many boards are not involved in the hiring and firing process, which can lead to management having a hand-picked – and potentially malleable – CAE running the audit function. The same holds true for boards and audit committees that abdicate their responsibility regarding CAE performance and compensation.

Data from the 2015 Common Body of Knowledge (CBOK) Global Practitioners Survey shows that while more than 70 percent of respondents report having separate administrative and functional reporting lines, in less than half the cases are boards or audit committees responsible for the CAE’s performance evaluation.

Specifically, the survey found that 48 percent of audit committees, boards, or their respective chairs are ultimately responsible for evaluating CAE performance. This leaves the evaluation and compensation of about half of the CAEs subject to the whims of management. This arrangement places incredible pressure on the CAE to keep management mollified, eroding the internal audit function’s independence and objectivity – if not in fact, then certainly in appearance.

This provides another leverage point that management can use to influence CAEs — compensation. At the end of the day, you work for the person who sets your compensation. If the audit committee doesn’t take an active role in the CAE’s salary, who is he or she really working for?

I’ve written in the past that management at times purposely lowballs CAE salaries. As I said in a blog last year, I believe this action is frequently a disguised attempt to recruit weaker talent. In these instances management seeks to weaken internal audit in order to avoid accountability.

When this underhanded manipulation goes on, I blame boards and their audit committees who are asleep at the wheel and allow it to happen.

To be fair, there are many organizations doing it right, but it is unacceptable for those that aren’t. In those instances, CAEs must show the courage to work directly with the audit committee or board to get the process changed. This will include candid discussions about the duty of the board and audit committee to protect their investment in internal audit and good governance.

Compensation is not just base pay. It also includes bonuses, stock programs, and even job titles. Additional protections, such as generous severance payouts should the CAE be fired, should also be customary as a hedge against arbitrary or retaliatory action by management.

The key message to impart is that all hiring, firing, performance evaluations, and decisions on compensation are the responsibility of the board or audit committee if the CAE is to functionally report to them.

Anything less threatens a key reason the internal audit function exists – objectivity.

I welcome your comments and observations, as always.