But the SEC also found that the company did not have “an adequate accounting system to bill [school] districts,” and that its inability to address the system’s weaknesses stemmed from its lack of an internal auditor. “We found the lack of an effective audit function to be a problem [at Edison],” says the SEC’s Heyl.
Edison does have a CFO, Adam Feild, as well as a fairly famous chairman, Benno Schmidt Jr., the former president of Yale University. But company management adhered to the SEC’s request to hire an internal audit director by June 14.
The company hired an Edison employee to direct the newly created internal audit department before the deadline, according to Adam Tucker, vice president of communications and advocacy for the company. “To maintain the independence of the internal auditing role, the Edison internal audit director reports directly to the audit committee of the board of directors of Edison Schools, and not to senior management,” says Tucker.
Function at the Junction
At most large public companies, however, the issue isn’t whether there is an internal auditor, but who the auditor’s boss should be. It’s one thing for regulators and investors to say the internal audit department should get its general marching orders from the board audit committee, but internal auditors usually report to the CFO.
The most popular solution, according to the IIA, is to provide auditing executives with two masters: the audit committee for policy-making and a senior corporate executive — usually the CEO — for more-routine work.
On “functional” matters (general direction and policy-making), about half of the internal audit executives report directly to audit committees, according to a recent survey conducted by the IIA. But in more than a quarter of the 42 companies that responded to the question, top internal auditors report to either the CEO or the CFO on functional matters.
When it comes to more-routine tasks, chief audit executives (CAEs) most often report to senior finance executives. At almost half of the 74 companies responding to another question on the IIA survey, the CFO (42 percent) or the controller (5 percent) signs off on the budget and performance of the CAE. Just 2 percent of the respondents said they report to the board on budget and performance matters.
Some reformers believe internal auditors should report to the board more often. They argue that otherwise CFOs and controllers can exert pressure on internal auditors to rubber-stamp finance-department numbers.
They Walk the Line
Then again, some internal auditing chiefs like reporting to CFOs, as long as they have complete, private access to the audit committee. For one thing, finance chiefs tend to be more accessible than CEOs. For another, they are generally more savvy about auditing minutiae, says David Richards.
Although Richards preaches the institute’s gospel of separation of finance and internal auditing at FirstEnergy, he reports to Richard Marsh, the company’s finance chief. Both Richards and Marsh say they have a collaborative relationship, working hand-in-hand to bring major internal audit issues to the audit committee.