CAE Relationships and Communication with Senior Management and the Board
5 minutes
5 Questions
For the CIA Challenge Exam, the Chief Audit Executive's (CAE) relationships with senior management and the board determine whether internal audit is independent, properly resourced, and valued. The board, usually through the audit committee, provides oversight. Senior management supports the function and provides access to people, records, and information. Reporting lines: Best practice is a dual reporting structure. The CAE reports functionally to the board, which approves the internal audit charter, the risk-based audit plan, the budget and resource plan, and decisions about appointing, removing, compensating, and evaluating the CAE. Administratively, the CAE reports to a senior executive, typically the CEO, for day-to-day matters such as budgeting, human resources, and internal policies. This structure protects organizational independence while keeping internal audit integrated with operations. Required communications: The CAE must communicate regularly with the board and senior management on several matters: - The internal audit charter, mandate, and any changes to them. - The audit plan, resource requirements, and the impact of resource limitations or significant interim changes. - Performance against the plan and key results. - Significant risk exposures, control issues, fraud risks, and governance concerns. - Conformance with the IIA Standards and results of the Quality Assurance and Improvement Program, including external assessments. - Actual or perceived impairments to independence or objectivity, and any restrictions on scope or access. Risk acceptance: If the CAE concludes that management has accepted a level of risk that may be unacceptable to the organization, the CAE must first discuss the matter with senior management. If it remains unresolved, the CAE must escalate it to the board. Relationship quality: Effective CAEs hold private sessions with the audit committee without management present. They build trust through candid, timely, and objective communication, and they align audit coverage with organizational strategy and stakeholder expectations. Exam tip: Questions often test which matters require board approval rather than management approval, and the correct escalation sequence: management first, then the board.
CAE Relationships and Communication with Senior Management and the Board: A Complete CIA Challenge Exam Guide
Introduction
The Chief Audit Executive (CAE) is the bridge between the internal audit function and the people who govern and run the organization. How the CAE builds relationships with, reports to, and communicates with senior management and the board (usually through the audit committee) largely decides whether internal audit is independent, credible, properly resourced, and able to add value. The CIA Challenge Exam tests this area heavily because it sits at the center of the IIA's governance model. This guide covers why the topic matters, what it is, how it works in practice, and how to answer exam questions on it.
1. Why CAE Relationships and Communication Matter
Independence: Internal audit can only be objective if the CAE has direct, unrestricted access to the board. A reporting line that runs only through management lets management filter, delay, or suppress findings.
Authority and mandate: The board, supported by senior management, gives internal audit its mandate through the charter. Without that support, auditors cannot get the access to records, people, and property they need.
Effective governance: The board relies on the CAE for independent assurance on governance, risk management, and control. Senior management relies on the CAE for insight and recommendations. Poor communication leaves both groups uninformed about significant risks.
Resources and planning: The internal audit plan, budget, and staffing are approved and overseen through these relationships. If they are weak, internal audit may be under-resourced or misdirected.
Escalation: When management accepts a level of risk that may be unacceptable to the organization, the CAE's relationship with the board is the only reliable escalation path.
Exam relevance: Many CIA questions present a scenario of conflict, pressure, or a reporting issue. They ask what the CAE should do, to whom the CAE should report, or who approves something.
2. What It Is: Key Concepts and Standards
Global Internal Audit Standards (effective January 2025)
Domain III, Governing the Internal Audit Function, sets out the essential conditions that the board and senior management must provide:
- Principle 6, Authorized by the Board: Standard 6.1 Internal Audit Mandate, 6.2 Internal Audit Charter, 6.3 Board and Senior Management Support.
- Principle 7, Positioned Independently: Standard 7.1 Organizational Independence, 7.2 CAE Qualifications.
- Principle 8, Overseen by the Board: Standard 8.1 Board Interaction, 8.2 Resources, 8.3 Quality, 8.4 External Quality Assessment.
Domain IV, Managing the Internal Audit Function, adds the following:
- 9.2 Internal Audit Strategy.
- 9.4 Internal Audit Plan.
- 9.5 Coordination and Reliance.
- 11.1 Building Relationships and Communicating with Stakeholders.
- 11.3 Communicating Results.
- 11.5 Communicating the Acceptance of Risks.
- 12.2 Performance Measurement.
Legacy IPPF Standards (still common in study material)
- 1110 Organizational Independence (report functionally to the board).
- 1111 Direct Interaction with the Board.
- 1112 CAE Roles Beyond Internal Auditing.
- 1130 Impairment to Independence or Objectivity.
- 1320 Reporting on the QAIP.
- 2020 Communication and Approval of the plan.
- 2060 Reporting to Senior Management and the Board.
- 2600 Communicating the Acceptance of Risks.
Functional vs. Administrative Reporting
This is the most tested concept in the area.
Functional reporting (to the board or audit committee) covers the following:
- Approving the internal audit charter.
- Approving the risk-based internal audit plan.
- Approving the internal audit budget and resource plan.
- Receiving communications on internal audit performance against the plan.
- Approving decisions on appointing and removing the CAE.
- Approving or providing input on the CAE's performance evaluation and remuneration.
- Asking management and the CAE whether there are inappropriate scope or resource limitations.
Administrative reporting (usually to the CEO or another senior executive with enough authority) covers day-to-day matters:
- Budgeting and management accounting.
- Human resource administration.
- Internal communications and information flows.
- Administration of policies and procedures.
Ideal structure: The CAE reports functionally to the board and administratively to the CEO. Reporting to the CFO or controller is seen as weaker, because internal audit regularly audits those areas.
Key Stakeholder Expectations
The board:
- Approves the mandate and charter.
- Champions independence.
- Meets the CAE privately (in executive sessions without management present).
- Sets expectations for internal audit.
- Oversees quality and performance.
Senior management:
- Supports the mandate.
- Gives input on risks and the plan.
- Provides access and cooperation.
- Responds to findings and owns corrective action plans.
- Owns risk management and controls.
The CAE:
- Develops the strategy and plan.
- Communicates results, significant risks, and resource needs.
- Discloses impairments to independence.
- Reports on conformance with the Standards.
- Escalates issues when necessary.
3. How It Works in Practice
Step 1, Establishing the mandate and charter: The CAE drafts the charter after discussions with the board and senior management. The board approves it. The charter defines purpose, authority, reporting lines, access, and scope. The CAE reviews it periodically and discusses changes with the board.
Step 2, Building the risk-based plan: The CAE considers input from senior management and the board, the organization's strategy, and risk assessments. The CAE then communicates the plan and resource requirements, including significant interim changes, to both groups. The board approves the plan. Senior management reviews it but does not approve it.
Step 3, Resource communication: If resources are not enough to deliver the plan, the CAE must tell the board about the impact of the shortfall. Typically this means risks that will go unaudited or coverage that will be reduced.
Step 4, Ongoing interaction: The CAE attends audit committee meetings, holds private sessions with the board, and meets regularly with senior executives. The CAE also coordinates with other assurance providers, such as compliance, risk management, and external auditors.
Step 5, Communicating results: Engagement results go to the appropriate parties. The CAE also reports periodically to senior management and the board on these topics:
- Internal audit's purpose, authority, and performance against the plan.
- Significant risk exposures and control issues, including fraud risks and governance issues.
- Conformance with the Standards and the results of quality assessments.
- Themes and overall conclusions.
Step 6, Independence and conformance disclosures: Impairments to independence or objectivity must be disclosed to the appropriate parties, normally including the board. Examples include scope limitations, restricted access, resource limits, and the CAE holding non-audit roles. Nonconformance with the Standards that affects the overall scope or operation of internal audit must also be disclosed to senior management and the board.
Step 7, Risk acceptance escalation: If the CAE concludes that management has accepted a risk beyond the organization's risk appetite, the sequence is as follows:
- First, discuss the matter with senior management.
- If it remains unresolved, communicate it to the board.
The CAE does not resolve the risk personally. The board decides.
Step 8, Quality and performance reporting: The CAE reports the results of the quality assurance and improvement program to the board. The CAE also discusses the qualifications and independence of external assessors with the board.
4. Common Scenarios Tested
- A CEO or CFO pressures the CAE to remove a finding or limit scope. Communicate with the board (audit committee).
- Management refuses to implement a recommendation on a significant risk. Discuss with senior management first, then escalate to the board.
- The CAE is asked to oversee compliance or risk management. This is acceptable only with safeguards, board awareness, and periodic evaluation. Assurance over those areas should be provided by an independent party.
- A budget cut prevents coverage of high-risk areas. Inform the board of the impact.
- Fraud involving senior management. Report to the board, not just to the involved management.
- Who appoints or removes the CAE? The board approves this.
- Who approves the audit plan and charter? The board approves both.
5. Exam Tips: Answering Questions on CAE Relationships and Communication with Senior Management and the Board
Tip 1, Think 'board approves, management inputs': The charter, the plan, the budget, and the CAE's appointment and removal are approved by the board. Senior management is consulted and provides support. Answers saying the CEO or CFO 'approves' the audit plan are usually wrong.
Tip 2, Know the reporting split: The best answer is functional reporting to the audit committee and administrative reporting to the CEO. Be suspicious of answers where the CAE reports functionally to the CFO, controller, or external auditor.
Tip 3, Follow the escalation sequence: For risk acceptance or disagreements, the CAE discusses with senior management first and goes to the board only if the matter is unresolved. Skipping straight to the board, or going to regulators or external parties first, is rarely correct unless law or the charter requires it.
Tip 4, Independence threats always go to the board: Disclose any impairment to independence to the board. Examples include pressure, scope limits, restricted access, inadequate resources, and conflicting roles. Remember that 'the CAE should resign' or 'ignore and proceed' are almost never the best answer.
Tip 5, Senior-management wrongdoing bypasses management: If fraud or misconduct involves senior executives, the communication goes to the board or audit committee.
Tip 6, Look for words signalling governance: Phrases such as 'most appropriate,' 'best demonstrates independence,' and 'primary responsibility' point you to the governance-based answer. That answer is usually the board, the charter, or the Standards.
Tip 7, Distinguish ownership from assurance: Management owns risk and controls. The board provides oversight. Internal audit provides assurance and advice. Reject answers where internal audit 'accepts risk,' 'implements controls,' or 'makes management decisions.'
Tip 8, Private sessions are a positive sign: Regular executive sessions between the CAE and the audit committee without management present support independence. Choose these when asked how to strengthen the relationship.
Tip 9, Communicate impact, not just facts: On resource shortfalls or plan changes, the correct answer communicates the impact on coverage and risk, not merely the change itself.
Tip 10, Know both versions of the Standards: Map legacy numbers to the new Global Internal Audit Standards:
- 1110/1111 map to Principles 7 and 8.
- 2020 maps to Standard 9.4.
- 2060 maps to Standard 11.3 and Domain III.
- 2600 maps to Standard 11.5.
The concepts are largely the same. The 2024 Standards add clearer 'essential conditions' that the board and senior management must provide.
Tip 11, Use elimination: Remove answers that do any of the following:
- Compromise independence.
- Give approval authority to management.
- Involve internal audit taking on management responsibilities.
- Involve unnecessary external disclosure.
- Ignore the issue.
From what remains, choose the answer that involves appropriate communication through the proper governance channel.
Tip 12, Read the role carefully: Check whether the question asks about the CAE, an internal auditor, the board, or senior management. Responsibilities differ, and a correct action for the wrong party is a common distractor.
6. Sample Practice Question
Question: The CAE believes senior management has accepted a level of cybersecurity risk that exceeds the organization's risk appetite. After discussion, management refuses to change its position. What should the CAE do next?
A. Implement compensating controls directly.
B. Communicate the matter to the board.
C. Report the matter to the external regulator.
D. Document the disagreement and close the issue.
Answer: B. The matter has already been discussed with senior management and remains unresolved, so the CAE escalates to the board.
Why the others are wrong:
- A would impair objectivity by having internal audit take on a management responsibility.
- C is premature, because the internal governance channel has not been used.
- D fails the CAE's communication responsibility.
Summary
The CAE's relationships with the board and senior management protect internal audit's independence, authority, resourcing, and relevance. The essentials are:
- Functional reporting to the board and administrative reporting to the CEO.
- Board approval of the charter, plan, budget, and CAE appointment.
- Regular communication of performance, significant risks, conformance, and impairments.
- Structured escalation: senior management first, then the board.
On the exam, choose the answer that strengthens independence, uses the proper governance channel, and keeps management responsible for risk and controls.
The Chief Audit Executive (CAE) is the bridge between the internal audit function and the people who govern and run the organization. How the CAE builds relationships with, reports to, and communicates with senior management and the board (usually through the audit committee) largely decides whether internal audit is independent, credible, properly resourced, and able to add value. The CIA Challenge Exam tests this area heavily because it sits at the center of the IIA's governance model. This guide covers why the topic matters, what it is, how it works in practice, and how to answer exam questions on it.
1. Why CAE Relationships and Communication Matter
Independence: Internal audit can only be objective if the CAE has direct, unrestricted access to the board. A reporting line that runs only through management lets management filter, delay, or suppress findings.
Authority and mandate: The board, supported by senior management, gives internal audit its mandate through the charter. Without that support, auditors cannot get the access to records, people, and property they need.
Effective governance: The board relies on the CAE for independent assurance on governance, risk management, and control. Senior management relies on the CAE for insight and recommendations. Poor communication leaves both groups uninformed about significant risks.
Resources and planning: The internal audit plan, budget, and staffing are approved and overseen through these relationships. If they are weak, internal audit may be under-resourced or misdirected.
Escalation: When management accepts a level of risk that may be unacceptable to the organization, the CAE's relationship with the board is the only reliable escalation path.
Exam relevance: Many CIA questions present a scenario of conflict, pressure, or a reporting issue. They ask what the CAE should do, to whom the CAE should report, or who approves something.
2. What It Is: Key Concepts and Standards
Global Internal Audit Standards (effective January 2025)
Domain III, Governing the Internal Audit Function, sets out the essential conditions that the board and senior management must provide:
- Principle 6, Authorized by the Board: Standard 6.1 Internal Audit Mandate, 6.2 Internal Audit Charter, 6.3 Board and Senior Management Support.
- Principle 7, Positioned Independently: Standard 7.1 Organizational Independence, 7.2 CAE Qualifications.
- Principle 8, Overseen by the Board: Standard 8.1 Board Interaction, 8.2 Resources, 8.3 Quality, 8.4 External Quality Assessment.
Domain IV, Managing the Internal Audit Function, adds the following:
- 9.2 Internal Audit Strategy.
- 9.4 Internal Audit Plan.
- 9.5 Coordination and Reliance.
- 11.1 Building Relationships and Communicating with Stakeholders.
- 11.3 Communicating Results.
- 11.5 Communicating the Acceptance of Risks.
- 12.2 Performance Measurement.
Legacy IPPF Standards (still common in study material)
- 1110 Organizational Independence (report functionally to the board).
- 1111 Direct Interaction with the Board.
- 1112 CAE Roles Beyond Internal Auditing.
- 1130 Impairment to Independence or Objectivity.
- 1320 Reporting on the QAIP.
- 2020 Communication and Approval of the plan.
- 2060 Reporting to Senior Management and the Board.
- 2600 Communicating the Acceptance of Risks.
Functional vs. Administrative Reporting
This is the most tested concept in the area.
Functional reporting (to the board or audit committee) covers the following:
- Approving the internal audit charter.
- Approving the risk-based internal audit plan.
- Approving the internal audit budget and resource plan.
- Receiving communications on internal audit performance against the plan.
- Approving decisions on appointing and removing the CAE.
- Approving or providing input on the CAE's performance evaluation and remuneration.
- Asking management and the CAE whether there are inappropriate scope or resource limitations.
Administrative reporting (usually to the CEO or another senior executive with enough authority) covers day-to-day matters:
- Budgeting and management accounting.
- Human resource administration.
- Internal communications and information flows.
- Administration of policies and procedures.
Ideal structure: The CAE reports functionally to the board and administratively to the CEO. Reporting to the CFO or controller is seen as weaker, because internal audit regularly audits those areas.
Key Stakeholder Expectations
The board:
- Approves the mandate and charter.
- Champions independence.
- Meets the CAE privately (in executive sessions without management present).
- Sets expectations for internal audit.
- Oversees quality and performance.
Senior management:
- Supports the mandate.
- Gives input on risks and the plan.
- Provides access and cooperation.
- Responds to findings and owns corrective action plans.
- Owns risk management and controls.
The CAE:
- Develops the strategy and plan.
- Communicates results, significant risks, and resource needs.
- Discloses impairments to independence.
- Reports on conformance with the Standards.
- Escalates issues when necessary.
3. How It Works in Practice
Step 1, Establishing the mandate and charter: The CAE drafts the charter after discussions with the board and senior management. The board approves it. The charter defines purpose, authority, reporting lines, access, and scope. The CAE reviews it periodically and discusses changes with the board.
Step 2, Building the risk-based plan: The CAE considers input from senior management and the board, the organization's strategy, and risk assessments. The CAE then communicates the plan and resource requirements, including significant interim changes, to both groups. The board approves the plan. Senior management reviews it but does not approve it.
Step 3, Resource communication: If resources are not enough to deliver the plan, the CAE must tell the board about the impact of the shortfall. Typically this means risks that will go unaudited or coverage that will be reduced.
Step 4, Ongoing interaction: The CAE attends audit committee meetings, holds private sessions with the board, and meets regularly with senior executives. The CAE also coordinates with other assurance providers, such as compliance, risk management, and external auditors.
Step 5, Communicating results: Engagement results go to the appropriate parties. The CAE also reports periodically to senior management and the board on these topics:
- Internal audit's purpose, authority, and performance against the plan.
- Significant risk exposures and control issues, including fraud risks and governance issues.
- Conformance with the Standards and the results of quality assessments.
- Themes and overall conclusions.
Step 6, Independence and conformance disclosures: Impairments to independence or objectivity must be disclosed to the appropriate parties, normally including the board. Examples include scope limitations, restricted access, resource limits, and the CAE holding non-audit roles. Nonconformance with the Standards that affects the overall scope or operation of internal audit must also be disclosed to senior management and the board.
Step 7, Risk acceptance escalation: If the CAE concludes that management has accepted a risk beyond the organization's risk appetite, the sequence is as follows:
- First, discuss the matter with senior management.
- If it remains unresolved, communicate it to the board.
The CAE does not resolve the risk personally. The board decides.
Step 8, Quality and performance reporting: The CAE reports the results of the quality assurance and improvement program to the board. The CAE also discusses the qualifications and independence of external assessors with the board.
4. Common Scenarios Tested
- A CEO or CFO pressures the CAE to remove a finding or limit scope. Communicate with the board (audit committee).
- Management refuses to implement a recommendation on a significant risk. Discuss with senior management first, then escalate to the board.
- The CAE is asked to oversee compliance or risk management. This is acceptable only with safeguards, board awareness, and periodic evaluation. Assurance over those areas should be provided by an independent party.
- A budget cut prevents coverage of high-risk areas. Inform the board of the impact.
- Fraud involving senior management. Report to the board, not just to the involved management.
- Who appoints or removes the CAE? The board approves this.
- Who approves the audit plan and charter? The board approves both.
5. Exam Tips: Answering Questions on CAE Relationships and Communication with Senior Management and the Board
Tip 1, Think 'board approves, management inputs': The charter, the plan, the budget, and the CAE's appointment and removal are approved by the board. Senior management is consulted and provides support. Answers saying the CEO or CFO 'approves' the audit plan are usually wrong.
Tip 2, Know the reporting split: The best answer is functional reporting to the audit committee and administrative reporting to the CEO. Be suspicious of answers where the CAE reports functionally to the CFO, controller, or external auditor.
Tip 3, Follow the escalation sequence: For risk acceptance or disagreements, the CAE discusses with senior management first and goes to the board only if the matter is unresolved. Skipping straight to the board, or going to regulators or external parties first, is rarely correct unless law or the charter requires it.
Tip 4, Independence threats always go to the board: Disclose any impairment to independence to the board. Examples include pressure, scope limits, restricted access, inadequate resources, and conflicting roles. Remember that 'the CAE should resign' or 'ignore and proceed' are almost never the best answer.
Tip 5, Senior-management wrongdoing bypasses management: If fraud or misconduct involves senior executives, the communication goes to the board or audit committee.
Tip 6, Look for words signalling governance: Phrases such as 'most appropriate,' 'best demonstrates independence,' and 'primary responsibility' point you to the governance-based answer. That answer is usually the board, the charter, or the Standards.
Tip 7, Distinguish ownership from assurance: Management owns risk and controls. The board provides oversight. Internal audit provides assurance and advice. Reject answers where internal audit 'accepts risk,' 'implements controls,' or 'makes management decisions.'
Tip 8, Private sessions are a positive sign: Regular executive sessions between the CAE and the audit committee without management present support independence. Choose these when asked how to strengthen the relationship.
Tip 9, Communicate impact, not just facts: On resource shortfalls or plan changes, the correct answer communicates the impact on coverage and risk, not merely the change itself.
Tip 10, Know both versions of the Standards: Map legacy numbers to the new Global Internal Audit Standards:
- 1110/1111 map to Principles 7 and 8.
- 2020 maps to Standard 9.4.
- 2060 maps to Standard 11.3 and Domain III.
- 2600 maps to Standard 11.5.
The concepts are largely the same. The 2024 Standards add clearer 'essential conditions' that the board and senior management must provide.
Tip 11, Use elimination: Remove answers that do any of the following:
- Compromise independence.
- Give approval authority to management.
- Involve internal audit taking on management responsibilities.
- Involve unnecessary external disclosure.
- Ignore the issue.
From what remains, choose the answer that involves appropriate communication through the proper governance channel.
Tip 12, Read the role carefully: Check whether the question asks about the CAE, an internal auditor, the board, or senior management. Responsibilities differ, and a correct action for the wrong party is a common distractor.
6. Sample Practice Question
Question: The CAE believes senior management has accepted a level of cybersecurity risk that exceeds the organization's risk appetite. After discussion, management refuses to change its position. What should the CAE do next?
A. Implement compensating controls directly.
B. Communicate the matter to the board.
C. Report the matter to the external regulator.
D. Document the disagreement and close the issue.
Answer: B. The matter has already been discussed with senior management and remains unresolved, so the CAE escalates to the board.
Why the others are wrong:
- A would impair objectivity by having internal audit take on a management responsibility.
- C is premature, because the internal governance channel has not been used.
- D fails the CAE's communication responsibility.
Summary
The CAE's relationships with the board and senior management protect internal audit's independence, authority, resourcing, and relevance. The essentials are:
- Functional reporting to the board and administrative reporting to the CEO.
- Board approval of the charter, plan, budget, and CAE appointment.
- Regular communication of performance, significant risks, conformance, and impairments.
- Structured escalation: senior management first, then the board.
On the exam, choose the answer that strengthens independence, uses the proper governance channel, and keeps management responsible for risk and controls.
Test mode:
CIA Challenge - CAE Relationships and Communication with Senior Management and the Board Example Questions
Test your knowledge of CAE Relationships and Communication with Senior Management and the Board
Question 1
While identifying themes for the periodic board report, the chief audit executive notes that three assurance engagements and two advisory engagements each observed weaknesses in change management practices across different business units. How should the chief audit executive treat the advisory engagement observations when developing this theme?
Question 2
A new audit committee chair is appointed just as the chief audit executive begins updating the internal audit strategy. The chief audit executive has never worked with this chair and wants to start a productive working relationship. Which action should the chief audit executive take first?
Question 3
While the risk-based internal audit plan is being prepared, a senior executive tells the chief audit executive to remove a high-risk process under that executive's responsibility, citing operational workload. The chief audit executive concludes that the request limits coverage and threatens the internal audit function's independence. Which action best applies the required communication protocol?
Unlock Premium Access
Certified Internal Auditor Challenge Exam
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2865 Superior-grade Certified Internal Auditor Challenge Exam practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CIA Challenge: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More CAE Relationships and Communication with Senior Management and the Board questions
63 questions (total)
Other Internal Audit Operations and Audit Plan concepts
Aligning Internal Audit Strategy with Stakeholder ExpectationsCoordinating with and Relying on Other Assurance ProvidersDeveloping a Risk-Based Audit PlanManaging Financial, Human and IT ResourcesPlanning, Organizing, Directing and Monitoring Internal Audit OperationsSources of Potential Engagements and the Audit Universe