The CAE as the SuperAuditor

While most internal audit engagements are performed by the CAE’s staff, the CAE himself (I’ll go with ‘he’ to make this post easier to write) should be addressing many if not most of the top enterprise risks.

In fact, much of the valuable assurance, advice, and insight provided by the internal audit function is by the CAE in discussions with management and the board – not in formal, written, audit reports!

Here are a few examples from my personal experience as CAE.

• In 1999, I was one of the many CAEs that urged our management team to check their computer systems. Y2K was upon us. Would they have a problem when the date changed to 2000? While it turned out for most of us to be a hyped issue, management needed to check rather than assume all would be OK.
• Within weeks of joining Maxtor Corporation, I reported to the Audit Committee that there was a serious issue with their system of internal control over financial reporting. Not a single member of the financial reporting team at HQ was a CPA or equivalent. There were two root causes: (a) the CEO, who had been the CFO, disliked CPAs; and, (b) they had historically placed too much reliance on the external auditors for financial accounting interpretations and…