Building Relationships with Senior Management and the Board: A Complete CIA Part 3 Guide
Building Relationships with Senior Management and the Board
CIA Part 3: Internal Audit Operations
1. Introduction
This topic covers how the Chief Audit Executive (CAE) and the internal audit activity build and maintain effective, trusted relationships with two key stakeholder groups:
• Senior management: the CEO, CFO and other executives.
• The board: usually acting through the audit committee.
The CIA exam tests whether you understand how these relationships support:
• Independence and objectivity
• Strategic alignment
• Effective communication
• Ultimately, the value internal audit adds to the organization
Under the IIA's Global Internal Audit Standards (2024), this topic sits mainly in Domain III: Governing the Internal Audit Function and Domain IV: Managing the Internal Audit Function. Relevant Principles include:
• Principle 6: Authorized by the Board
• Principle 7: Positioned Independently
• Principle 8: Overseen by the Board
• Principle 11: Communicate Effectively
2. Why It Is Important
a) Independence and organizational positioning. The CAE should report functionally to the board and administratively to senior management (usually the CEO). This dual reporting line only works when both relationships are healthy. Strong board ties protect internal audit from undue management influence. Constructive management ties give internal audit the access, resources and cooperation it needs.
b) Access to information and people. The internal audit charter, approved by the board, grants unrestricted access to records, personnel and physical properties. Good working relationships turn that formal right into real, practical cooperation.
c) Strategic alignment and value. Internal audit adds value when its plan addresses the organization's most significant risks and objectives. Regular dialogue with senior management and the board helps the CAE understand strategy, emerging risks and stakeholder expectations. This produces a relevant, risk-based audit plan.
d) Credibility and influence. Recommendations are acted on when stakeholders trust the auditors. A CAE seen as a trusted advisor is more likely to see corrective action implemented on time.
e) Governance effectiveness. The board relies on internal audit for objective assurance on governance, risk management and control. A strong relationship means the board receives timely, candid information, including private (executive) sessions where sensitive matters can be raised without management present.
f) Escalation of risk acceptance. If management accepts a level of risk the CAE believes may be unacceptable, the CAE must first discuss it with senior management. If unresolved, the CAE escalates to the board. This escalation path depends on established trust and clear protocols.
3. What It Is: Key Concepts and Definitions
The Board
• The highest-level body charged with governance, such as a board of directors or audit committee.
• May be a governing body or similar where no formal board exists.
• Its role is oversight: approving the charter, the audit plan, the budget and resource plan, and decisions on appointing, removing and compensating the CAE.
Senior Management
• The executives accountable for running the organization.
• They own risks and controls (first and second lines).
• They are also key consumers of internal audit's assurance and advisory services.
Functional vs. Administrative Reporting
• Functional reporting (to the board): covers the charter, the risk-based plan, budget, performance, communications on results, and CAE appointment, removal and remuneration.
• Administrative reporting (to senior management): covers budgeting and accounting, HR administration, internal communications, and day-to-day policies and procedures.
Essential Conditions (Global Internal Audit Standards)
The 2024 Standards set out Essential Conditions that the board and senior management must provide for internal audit to be effective. The CAE is responsible for discussing these conditions with the board and senior management. Examples:
• The board approves the charter.
• The board meets privately with the CAE.
• Senior management supports internal audit's unrestricted access.
• The board champions internal audit's mandate.
Internal Audit Mandate and Charter
• The mandate sets out internal audit's authority, role and responsibilities.
• The charter is the formal document, approved by the board, that captures the mandate, purpose and reporting relationships.
• Relationship-building begins with jointly understanding and agreeing these documents.
4. How It Works: Practical Mechanisms
a) Formal communication channels
• Regular audit committee meetings: the CAE presents the audit plan, progress against the plan, significant findings, resource adequacy, QAIP results and conformance with the Standards.
• Private/executive sessions: the CAE meets the board or audit committee without management present. Best practice is at every regular meeting, or at least annually.
• Periodic reports to senior management: engagement results, status of action plans and emerging themes.
b) Informal communication channels
• Regular one-on-one meetings between the CAE and the audit committee chair, often between formal meetings.
• Ongoing meetings with the CEO, CFO, CRO, General Counsel and business unit leaders.
• Attending management committee or executive meetings as an observer, to stay informed without taking on management responsibility.
c) Understanding stakeholder expectations
• Conducting stakeholder surveys and interviews.
• Discussing what the board and management want from internal audit, such as assurance, advisory work or a focus on emerging risks.
• Agreeing on communication preferences: format, frequency and level of detail.
d) Developing the internal audit strategy and plan collaboratively
• Gathering input from senior management and the board when identifying key risks.
• Presenting the risk-based plan for board approval, after discussing it with senior management.
• Communicating the impact of resource limitations and any significant interim changes to the plan.
e) Demonstrating value and professionalism
• Delivering high-quality, timely and relevant reports.
• Providing insight and foresight, not just hindsight.
• Maintaining confidentiality, integrity and objectivity.
• Following up on findings and reporting on the status of management action plans.
f) Onboarding and education
• Briefing new board members on internal audit's role, the charter and the Standards.
• Educating management on the three lines model and the value of internal audit.
g) Managing conflict and disagreement
• Discussing disagreements over findings openly and documenting management's response.
• Escalating unresolved significant issues, including unacceptable risk acceptance, to the board.
• Remaining objective while staying constructive and professional.
h) Performance measurement and feedback
• Seeking feedback from the board and senior management, such as post-engagement surveys and annual evaluations of internal audit.
• Reporting on performance measures and the quality assurance and improvement program (QAIP).
5. Balancing Relationship and Independence
A central exam theme is that closeness must not compromise independence. Internal auditors should:
• Be approachable but not captured. Familiarity threats arise when auditors become too close to management.
• Avoid assuming management responsibilities, such as designing or operating controls, or making decisions.
• Disclose impairments to independence or objectivity to the appropriate parties, including the board.
• Remember that the board, not management, has final authority over the CAE's appointment and removal.
6. Common Exam Scenarios
Scenario 1: The CEO asks the CAE to remove a finding from a report before it goes to the audit committee.
Best response: Discuss the finding with the CEO and include management's response, but do not suppress it. If pressure continues, raise the matter with the audit committee, possibly in a private session.
Scenario 2: A new audit committee chair is appointed.
Best response: The CAE schedules an introductory meeting to explain the charter, mandate, plan and key risks, and to learn the chair's expectations.
Scenario 3: Management accepts a risk the CAE believes is beyond the organization's risk appetite.
Best response: First discuss it with senior management. If unresolved, communicate it to the board.
Scenario 4: Which activity BEST strengthens internal audit's relationship with the board?
Best response: Regular private meetings with the board or audit committee, plus clear, risk-focused reporting.
Scenario 5: The CFO controls the internal audit budget and has cut it sharply.
Best response: The CAE communicates the impact of resource limitations to the board. The board should approve the internal audit budget and resource plan.
7. Exam Tips: Answering Questions on Building Relationships with Senior Management and the Board
Tip 1: Know who does what. Memorize the split between functional reporting (board) and administrative reporting (senior management). Any question about the charter, plan approval, CAE hiring or firing, or CAE compensation points to the board.
Tip 2: Independence beats convenience. When an option builds rapport at the expense of independence, such as accepting management's edits to findings or taking on operational roles, it is almost always wrong.
Tip 3: Follow the escalation sequence. The usual order is:
• Discuss with the engagement client or management first.
• Then senior management.
• Then the board.
Pick answers that follow this sequence rather than jumping straight to the board, unless the scenario involves senior management itself, such as fraud by the CEO.
Tip 4: Look for the proactive, communicative option. Correct answers often involve the CAE initiating dialogue, seeking input, educating stakeholders or meeting privately with the board.
Tip 5: Watch qualifier words. BEST, MOST, PRIMARY and FIRST matter.
• FIRST step: usually understand expectations or discuss with management.
• MOST effective way to protect independence: usually functional reporting to the board, or board approval of key matters.
Tip 6: Link to the risk-based plan. The plan should reflect input from both the board and senior management. The board approves it, and any significant changes are communicated to the board.
Tip 7: Private sessions are a key safeguard. If asked how the board can obtain candid information from internal audit, choose private or executive sessions without management.
Tip 8: Remember the Essential Conditions. Under the 2024 Standards, the board and senior management have responsibilities that support internal audit. The CAE should discuss these with them and communicate the impact if they are not met.
Tip 9: Value, not just compliance. Answers framing internal audit as a trusted advisor that provides insight, foresight and assurance aligned with strategy are usually preferred over narrow, compliance-only views.
Tip 10: Eliminate extreme answers. Discard options that are too passive ("wait for the board to ask") or too aggressive ("report management to regulators immediately") unless the scenario clearly calls for them.
8. Quick Revision Summary
• The CAE reports functionally to the board and administratively to senior management.
• The board approves the charter, plan, budget and CAE appointment, removal and compensation.
• Use formal channels (meetings, reports) and informal channels (one-on-ones, ongoing dialogue).
• Hold private sessions with the board to support candid communication.
• Understand stakeholder expectations and align the audit plan with strategy and risk.
• Escalate unresolved significant risk acceptance to the board.
• Build trust while protecting independence and objectivity.
• Seek feedback, report performance and demonstrate value continuously.
Master these principles and apply the escalation logic to answer most exam questions on this topic with confidence.
