Chief Audit Executive Roles Beyond Internal Auditing

Introduction

The Chief Audit Executive (CAE) is the senior leader responsible for the internal audit activity. In many organizations, especially smaller ones or those undergoing transformation, the CAE is asked to take on additional responsibilities outside internal auditing, such as risk management, compliance, ethics, or even operational roles. This topic is a core part of the IIA Certification in Risk Management Assurance (CRMA) syllabus under Internal Audit Roles and Responsibilities. It tests your understanding of how independence and objectivity can be preserved when a CAE wears more than one hat.

Why This Topic Is Important

The value of internal audit rests on two pillars: independence (organizational positioning) and objectivity (an unbiased mental attitude). When the CAE assumes roles beyond internal auditing, both pillars are placed under pressure. If the CAE manages the enterprise risk management (ERM) function and then audits that same function, the CAE is effectively auditing his or her own work, a classic impairment.

At the same time, boards and executives value the CAE's broad knowledge of governance, risk, and control. Asking the CAE to lead a compliance program or oversee risk management can be efficient and pragmatic. The IIA recognizes this reality and, rather than prohibiting such arrangements, sets out safeguards that must be in place. Understanding these safeguards is essential for CRMA candidates because exam questions frequently present a scenario where the CAE has, or is offered, a non-audit role and ask what the appropriate response is.

What It Is: Defining Roles Beyond Internal Auditing

Roles beyond internal auditing are any responsibilities that fall outside the provision of independent assurance and advisory services. Common examples include:

• Risk Management Leadership: Acting as Chief Risk Officer (CRO) or owning the ERM framework.
• Compliance Oversight: Serving as Chief Compliance Officer or running regulatory compliance programs.
• Ethics and Investigations: Managing the ethics hotline, whistleblower program, or fraud investigation unit as the process owner.
• Control Self-Assessment Ownership: Owning (not just facilitating) the organization's control framework or SOX compliance program.
• Operational or Project Roles: Leading a system implementation, serving on a steering committee with decision-making authority, or temporarily heading a business unit.
• Security or Business Continuity: Managing information security or business continuity planning.

The key distinction is between assurance and advisory (appropriate for internal audit) and management responsibility (which belongs to the first and second lines).

The IIA Framework and Relevant Standards

The IIA's Global Internal Audit Standards (and the earlier IPPF Standard 1112 and 1130 series) directly address this issue. The core requirements can be summarized as follows:

1. The Board Must Approve and Oversee
Where the CAE has or is expected to have roles beyond internal auditing, safeguards must be in place to limit impairments to independence and objectivity. The board (typically the audit committee) must approve the arrangement, understand the potential impairments, and periodically evaluate whether the safeguards remain effective.

2. Documentation in the Charter
The internal audit charter should disclose the nature of the additional roles and the safeguards in place. Transparency is the first line of defense.

3. Independent Assurance on the Non-Audit Function
Any assurance engagement over a function for which the CAE has responsibility must be overseen by a party outside the internal audit activity. This may mean the board engages an external provider or assigns oversight to another executive who reports directly to the board.

4. The One-Year Cooling-Off Rule
Internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an auditor provides assurance over an activity for which they had responsibility within the previous year. This applies to the CAE as well.

5. Periodic Reassessment
The arrangement should be temporary where possible and reviewed regularly. A long-term dual role should trigger discussion about whether the organization should establish a separate function.

The Three Lines Model Perspective

The IIA's Three Lines Model provides a useful lens:

• First Line: Management owns and manages risk.
• Second Line: Risk management, compliance, and control functions support and challenge the first line.
• Third Line: Internal audit provides independent assurance to the board.

When a CAE takes on a second-line role (such as CRO), the third line's independence is compromised with respect to that area. The model explicitly notes that blending roles is possible but requires that the board be aware of the blending and that safeguards exist to protect the integrity of independent assurance.

Internal Audit's Role in Risk Management: The Fan Diagram

The IIA Position Paper on the role of internal auditing in ERM is heavily tested in CRMA. It divides activities into three categories:

Core Internal Audit Roles (Assurance)
• Giving assurance on risk management processes.
• Giving assurance that risks are correctly evaluated.
• Evaluating risk management processes.
• Evaluating the reporting of key risks.
• Reviewing the management of key risks.

Legitimate Roles With Safeguards (Advisory/Consulting)
• Facilitating identification and evaluation of risks.
• Coaching management in responding to risk.
• Coordinating ERM activities.
• Consolidating reporting on risks.
• Maintaining and developing the ERM framework.
• Championing establishment of ERM.
• Developing risk management strategy for board approval.

Roles Internal Audit Should NOT Undertake
• Setting the risk appetite.
• Imposing risk management processes.
• Providing management assurance on risks (i.e., being the source of assurance that management relies on as if it were its own).
• Taking decisions on risk responses.
• Implementing risk responses on management's behalf.
• Taking accountability for risk management.

Memorize this distinction. The exam will give you a specific activity and ask which category it falls into.

How It Works in Practice: A Scenario Walkthrough

Consider a mid-sized company where the CEO asks the CAE to also serve as the head of ERM because the company cannot afford a separate CRO. The appropriate sequence of actions is:

1. The CAE discusses the proposal with the audit committee chair before accepting.
2. The audit committee formally approves the dual role and documents it in minutes.
3. The internal audit charter is updated to disclose the ERM responsibility and the safeguards.
4. The audit committee arranges for independent assurance over ERM (for example, an external quality review of ERM or a co-sourced engagement reporting to the committee).
5. The CAE ensures internal audit staff do not perform assurance over ERM design decisions the CAE made, or that such work is reviewed by someone outside the activity.
6. The arrangement is reviewed annually, with a plan to transition ERM leadership to a dedicated role when resources allow.

This is the model answer pattern: disclose, obtain board approval, implement safeguards, obtain independent oversight, reassess periodically.

Distinguishing Facilitation From Ownership

A frequent trap is confusing facilitation with ownership. Internal audit may facilitate a risk workshop, help management articulate risks, and even draft a risk register for management's review. That is advisory work and is acceptable as long as management makes the decisions and owns the output. Internal audit crosses the line when it decides which risks matter, selects the responses, or is held accountable for whether the risks are managed. Ask yourself: Who makes the decision and who is accountable? If the answer is internal audit, the role is inappropriate.

Impairments and Required Disclosures

If independence or objectivity is impaired in fact or appearance, the details must be disclosed to appropriate parties. The nature of the disclosure depends on the impairment. Where the CAE's non-audit role creates an impairment regarding a specific engagement, the engagement report should disclose this, and the board should be informed. Candidates should recognize that the Standards do not say the work cannot be done; they say the impairment must be disclosed and managed.

Exam Tips: Answering Questions on Chief Audit Executive Roles Beyond Internal Auditing

Tip 1: Look for the word "board" in the answer options.
Nearly every correct answer involving CAE non-audit roles includes board (audit committee) approval and oversight. If one option mentions board approval and others mention only CEO approval or CAE discretion, the board option is almost always correct.

Tip 2: "Decline" is rarely the best answer.
The IIA does not require the CAE to refuse all non-audit roles. Options that say the CAE must refuse outright are usually distractors. The correct answer typically involves accepting with safeguards or escalating to the board.

Tip 3: Apply the one-year rule precisely.
If a question states the CAE managed a function eleven months ago, objectivity is presumed impaired. If it was two years ago, the presumption does not apply, though the CAE should still consider whether objectivity is affected in fact or appearance.

Tip 4: Identify who owns the decision.
For ERM-related questions, classify the activity. Facilitating, coaching, coordinating, and championing are acceptable with safeguards. Setting risk appetite, deciding responses, and being accountable for risk management are never acceptable for internal audit.

Tip 5: Remember that assurance over the CAE's non-audit area must come from outside internal audit.
If the CAE runs compliance, internal audit staff reporting to the CAE cannot provide objective assurance over compliance without external oversight. The answer will involve the board arranging independent review.

Tip 6: Watch for "in fact or in appearance."
The Standards care about perception as much as reality. An option that addresses only actual impairment while ignoring perceived impairment is incomplete.

Tip 7: Prioritize disclosure.
When in doubt between two reasonable actions, the one that involves transparent disclosure to the board and in the charter is preferred.

Tip 8: Distinguish the CAE's situation from that of staff auditors.
Questions may test whether the CAE can reassign an auditor who previously worked in the area being audited. For staff, the solution is reassignment within the team. For the CAE, reassignment is not possible, so external oversight is needed.

Tip 9: Favor temporary arrangements.
If an option mentions that the dual role is temporary with a transition plan, it generally reflects best practice better than a permanent arrangement.

Tip 10: Read the stem for the role being described.
Exam writers sometimes describe a role vaguely ("the CAE helps the risk committee"). Determine whether the help is advisory (acceptable) or decisional (not acceptable) before selecting an answer.

Common Distractors to Avoid

• Options suggesting the CEO alone can approve the CAE's additional role.
• Options suggesting internal audit staff can audit the CAE's function as long as the CAE does not review the report.
• Options claiming that consulting work automatically impairs independence (it does not, provided management owns decisions).
• Options stating the CAE may set risk appetite because of superior risk knowledge.
• Options implying that the cooling-off period is six months or two years (it is one year).

Summary

The CAE may take on roles beyond internal auditing, but only with safeguards: board approval, charter disclosure, independent oversight of assurance over the non-audit area, adherence to the one-year cooling-off presumption, and periodic reassessment. For risk management specifically, internal audit may assure, facilitate, coach, and coordinate, but must never own risk appetite, make risk response decisions, or be accountable for risk management. In the exam, favor answers that emphasize board oversight, transparency, safeguards, and the distinction between advising and deciding. Master these principles and you will handle any question on this topic with confidence.