Reporting Impairments to the Board and Management

Why This Topic Matters

Internal audit exists to provide independent, objective assurance to the board and management about governance, risk management, and control. The value of that assurance rests entirely on the credibility of the internal audit function. If independence or objectivity is compromised and no one is told, the board may rely on conclusions that are biased, incomplete, or restricted in scope without knowing it. For the CRMA (Certification in Risk Management Assurance) exam, this topic sits inside the Internal Audit Roles and Responsibilities domain because it tests whether you understand the boundary between what internal audit may do in relation to risk management and how it must communicate when that boundary is strained or crossed.

Put simply: an impairment that is disclosed is a manageable governance issue; an impairment that is hidden is a governance failure. The exam wants you to demonstrate that you know who must disclose, to whom, when, and how.

What Is an Impairment?

An impairment is any condition that compromises, or appears to compromise, the ability of the internal audit function (independence) or an individual internal auditor (objectivity) to perform work in an unbiased manner.

Independence is an organizational attribute. It concerns the positioning of the internal audit function, principally the functional reporting line of the Chief Audit Executive (CAE) to the board and the freedom from interference in determining scope, performing work, and communicating results.

Objectivity is an individual attribute. It is the unbiased mental attitude that allows auditors to perform engagements so that they believe in their work product and make no quality compromises.

The IIA Standards make clear that impairments can exist in fact or in appearance. Both must be addressed and disclosed. The reasonable third-party perception is as important as the actual state of mind of the auditor.

Common Sources of Impairment

1. Scope limitations: management or others restricting the areas, processes, or time periods internal audit may examine.
2. Resource limitations: insufficient budget, staff, or expertise to complete the approved plan or an engagement adequately.
3. Restrictions on access: denial of access to records, personnel, physical properties, or systems.
4. Personal conflicts of interest: financial interests, family relationships, close friendships with auditees, or acceptance of gifts.
5. Self-review: auditing operations for which the auditor had responsibility within the previous year, or auditing a risk management process the auditor helped design.
6. Familiarity: long association with the same auditee leading to loss of professional skepticism.
7. Undue influence: pressure from management to alter findings, soften ratings, or remove observations from a report.
8. CAE additional roles: when the CAE also heads risk management, compliance, or another operational function, creating a structural conflict.
9. Prior consulting work: providing assurance on an area where internal audit previously advised, particularly where the auditor effectively made management decisions.

The Relevant IIA Standards

Under the 2017 International Standards for the Professional Practice of Internal Auditing:

Standard 1110 Organizational Independence: the CAE must confirm to the board, at least annually, the organizational independence of the internal audit activity.
Standard 1111 Direct Interaction with the Board: the CAE must communicate and interact directly with the board.
Standard 1112 CAE Roles Beyond Internal Auditing: where the CAE has or is expected to have roles outside internal auditing, safeguards must be in place to limit impairments.
Standard 1130 Impairment to Independence or Objectivity: if independence or objectivity is impaired in fact or appearance, the details must be disclosed to appropriate parties. The nature of the disclosure depends on the impairment.
Standard 1130.A1: auditors must refrain from assessing specific operations for which they were previously responsible; objectivity is presumed impaired if an auditor provides assurance over an activity for which they had responsibility within the previous year.
Standard 1130.A2: assurance engagements over functions for which the CAE has responsibility must be overseen by a party outside the internal audit activity.
Standard 1130.A3: internal audit may provide assurance where it previously performed consulting, provided the nature of the consulting did not impair objectivity and individual objectivity is managed when assigning resources.
Standard 1130.C1 and C2: internal auditors may perform consulting relating to prior responsibilities, but potential impairments must be disclosed to the engagement client before accepting the engagement.
Standard 2431 Engagement Disclosure of Nonconformance: when nonconformance with the Code of Ethics or Standards impacts a specific engagement, the final communication must disclose the principle or rule not conformed with, the reasons, and the impact on the engagement and results.

Under the 2024 Global Internal Audit Standards, the same concepts are reorganized:

Principle 2 Maintain Objectivity with Standard 2.1 Individual Objectivity, Standard 2.2 Safeguarding Objectivity, and Standard 2.3 Disclosing Impairments to Objectivity. Standard 2.3 requires auditors to disclose impairments to the CAE, and the CAE to disclose to appropriate parties; if the impairment affects the CAE or the function as a whole, disclosure goes to the board.
Principle 7 Positioned Independently with Standard 7.1 Organizational Independence and Standard 7.2 Safeguarding Independence. The CAE must report impairments to independence to the board, and the board must take action to address them.
Standard 8.1 Board Interaction and Standard 8.2 Resources: the CAE must inform the board when resources are insufficient and of the impact of the limitation.
Standard 15.1 Final Engagement Communication: engagement-level scope limitations and impairments must be disclosed in the final communication.

How the Reporting Process Works

Step 1: Identify. Every internal auditor is responsible for recognizing and promptly reporting to the CAE any situation that may impair objectivity, including personal relationships, prior responsibilities, and pressure experienced during engagements. Many functions use annual and engagement-level independence declarations to formalize this.

Step 2: Assess. The CAE evaluates whether the impairment is actual or perceived, whether it affects a single engagement or the function overall, and how significant it is to the reliability of results.

Step 3: Apply safeguards. Where possible, the impairment is mitigated before work proceeds. Typical safeguards include reassigning the engagement to another auditor, adding supervisory review, obtaining oversight from a party outside internal audit (for example, the audit committee engaging an external provider), rotating assignments, and recusing the conflicted individual from decision making.

Step 4: Disclose to the appropriate parties. This is the heart of the exam topic. The appropriate party depends on the nature and level of the impairment:
- Engagement-level objectivity issues (for example, an auditor with a relationship to the auditee) are disclosed to engagement stakeholders and documented, typically after the CAE has applied safeguards.
- Scope limitations imposed by management, denial of access, and inadequate resources are disclosed to senior management and the board, preferably in writing, together with the impact on the ability to deliver the audit plan or engagement.
- Impairments affecting the CAE personally, or the structural independence of the function, must go to the board because management cannot be the judge of its own influence over internal audit.
- Management pressure to alter findings must be escalated to the board; the board, not management, has authority to resolve interference with internal audit.

Step 5: Disclose in the engagement communication. If the impairment affected a specific engagement, the final report must state the limitation and its effect on the conclusions so readers can calibrate their reliance.

Step 6: Document and follow up. Disclosures, safeguards, and board decisions are documented in working papers and governance minutes. The annual confirmation of organizational independence to the board summarizes any impairments that arose during the year.

The Risk Management Context (CRMA Specific)

The CRMA exam frequently frames impairments through internal audit's role in enterprise risk management. The IIA position paper on the role of internal auditing in enterprise-wide risk management distinguishes three groups of roles:

Core assurance roles: giving assurance on risk management processes, on the evaluation of risks, on the reporting of key risks, and reviewing the management of key risks. These present no inherent impairment.

Legitimate roles with safeguards: facilitating risk identification and evaluation, coaching management on responding to risks, coordinating ERM activities, consolidating risk reporting, maintaining and developing the ERM framework, championing ERM, and developing an ERM strategy for board approval. These are consulting roles. Safeguards include making clear that management remains responsible for risk management, having the board approve the nature of the role, avoiding management of any risks, and disclosing to the board the role undertaken and any resulting constraints on subsequent assurance.

Roles internal audit should not undertake: setting the risk appetite, imposing risk management processes, providing management assurance on risks, taking decisions on risk responses, implementing risk responses on management's behalf, and holding accountability for risk management. Accepting any of these creates an impairment that must be reported to the board, and ideally the role should be declined or transferred.

When the CAE is asked to lead risk management or compliance in addition to internal audit, the exam expects you to know that this is permitted only with safeguards: the board approves and periodically reviews the arrangement, the board is informed of the dual role, and assurance over those areas is overseen by a party outside internal audit.

Worked Example

Scenario: During a review of the treasury risk management process, the Chief Financial Officer informs the CAE that the derivatives portfolio is excluded from scope because the matter is commercially sensitive. The audit committee approved the engagement with derivatives included.

Correct handling: the CAE documents the limitation, discusses it with the CFO, and if the restriction stands, reports the scope limitation in writing to the audit committee, explaining the effect on the conclusions that can be reached. The final report discloses the limitation. The CAE does not quietly narrow the scope, does not accept the CFO's rationale as final, and does not report only to the CFO.

Exam Tips: Answering Questions on Reporting Impairments to the Board and Management

1. Look for the word appropriate. The Standards require disclosure to appropriate parties, and the exam expects you to identify who that is. If the impairment involves management interference, scope limitation, resource shortfall, or the CAE personally, the appropriate party is the board (audit committee). If it is an individual auditor's engagement-level conflict, the CAE handles it first through reassignment and documentation.

2. Fact or appearance both count. Any answer suggesting that no disclosure is needed because the auditor feels unbiased is wrong. Perceived impairments must be disclosed.

3. Remember the one-year rule. Objectivity is presumed impaired when an auditor provides assurance over an activity for which they had responsibility within the previous year. Questions often test whether a transferred manager can audit their former department; the answer is no, not for twelve months.

4. Consulting is different from assurance. For consulting engagements over areas of prior responsibility, the requirement is disclosure to the engagement client before accepting the engagement, not automatic refusal.

5. The CAE owns the escalation. Individual auditors report to the CAE; the CAE reports to the board and senior management. An answer that has a staff auditor going directly to the audit committee as a first step is usually a distractor unless the CAE is the source of the impairment.

6. Prefer written communication for significant matters. Scope limitations and resource limitations should be communicated to the board in writing with the impact explained.

7. Disclose in the final report. If an impairment affected a specific engagement, the final communication must state it. Answers that omit this when the engagement was affected are incomplete.

8. Watch for extreme distractors. Options such as immediately resign, refuse all future work with the client, report to external regulators, or withdraw the entire report are rarely the best first response. The Standards favor identify, safeguard, disclose, document.

9. Management cannot cure its own interference. If management imposes a restriction or pressures internal audit, accepting a management explanation without informing the board is never the best answer.

10. Apply the risk management role model. When a scenario places internal audit in a risk management role, classify it: core assurance (no issue), legitimate with safeguards (disclose to board, confirm management ownership), or prohibited (decline and inform the board). Then choose the answer consistent with that classification.

11. Know the annual confirmation. The CAE must confirm organizational independence to the board at least annually. Questions about frequency of confirmation want the answer annually, not on each engagement and not only when problems arise.

12. Read for the most complete answer. CRMA questions often include one option that disclosed to the right party but not in the report, and another that did both. Choose the option that identifies, safeguards, discloses to the board or appropriate party, and reflects the limitation in the engagement communication.

Summary

Reporting impairments is the mechanism that keeps internal audit's assurance trustworthy. Independence belongs to the function and is protected by the board; objectivity belongs to the individual and is protected by the CAE. Any impairment, whether real or perceived, must be managed with safeguards and disclosed to the parties who can act on it: management for operational matters, and the board for anything touching scope, resources, interference, the CAE, or the function's positioning. Master the Standards references, the one-year rule, the appropriate-party logic, and the risk management role boundaries, and you will handle this topic confidently on the CRMA exam.