"You are fired": some (good) reasons for letting a Chief Auditor go

A few days ago, the President of the United States announced the dismissal of several Inspectors General. I will not get into this case. Rather, under which circumstances can firing a Chief Audit Executive (CAE) justified? I believe that there are several cases. First when the CAE fails to meet obligations that apply equally to all executives. And being a CAE can be an aggravating factor. Second there are cases of failure that are more specific to the audit function and can justify the removal of a CAE. Then there are elements that are more ambiguous, such as the evaluation of the performance of a CAE, where there is room for interpretation and judgement.

Reasons that apply to any employee and executive in a firm

A CAE is not exempt from fulfilling all ethical and compliance duties applicable to all employees to the firm. For example:

- Legal or criminal offenses, such as the CAE involvement in illegal or fraudulent activities. Subsequent criminal charges undermine the credibility and suitability for the CAE role. The bar for suitability is even higher in certain sectors, like in Financial Services. In the EU for example, most regulators check whether a candidate for a CAE role is “fit and proper” and require a confirmation from the company that due verifications and background checks have been performed. Any subsequent improper action from a CAE could trigger his removal.

- Poor leadership and team management. Like any executive, a CAE is expected to create a positive and productive work environment, with engaged audit teams, aligned with the firm objectives and priorities. Misconduct, toxic behaviors are “no go’s” for CAEs like for any manager.

- The breach of confidentiality or misuse of sensitive information. These are potentially a cause for breaking a working contract. But it is an aggravating factor for a CAE. Again, in the case of Financial Services in the EU, the CAE is normally in the list of “sensitive personal” or “insiders”, together with the CEO, CFO, CRO etc. the CAE has a privileged access to sensitive and confidential information

Incompetence. Like in any position, there are incompetent CAEs. The article “the 7 habits of highly ineffective CAEs” by @Chidambaram a few days ago brilliantly describes the traits of an incompetent auditor (alas, I have seen a few). I would add that, in the context of the new Standards @GIAS, the voluntary, but also unvoluntary failure to ensure compliance with external regulatory requirements, and with professional standards, can lead to legal or financial consequences for the organization. As such they can be the cause for dismissal of a CAE.

In the same spirit, I believe that the resistance to adapt and respond to major business risks and industry trends can lead to changing the CAE.

The specific red flags for a Chief Auditor

- The failure to report significant irregularities or fraud detected during audits or withholding critical audit information from the audit committee. Such breach of fiduciary responsibility is often associated with conflict of interest. A CAE whose compensation is significantly linked to the firm financial performance for example, can be tempted to omit reporting an issue that may affect the profitability of the firm. We have seen the case recently with Wells Fargo. Such negligence often results in financial or reputational harm.

- Complacency, or loss of independence and objectivity. There is the easy case of a CAE who alters audit findings under pressure without proper justification. Then there is a tricker situation when the audit function is under undue influence from management or other stakeholders: this is more difficult to assess and objectivize. I have expressed before that over time, irrespective of the standing and quality of the CAE, independence and objectivity erode with time. Being for too long in the CAE position of the same organization makes it difficult over the years to keep the necessary distance.

- The breach of trust. Persistent complaints from the Audit Committee, the Board of Directors, or regulators are strong signals of the erosion of trust and confidence in the internal audit function. It might be time for the CAE to go. The case of the relationship with the CEO, to whom a CAE should normally report (in my view), is tricky. The CAE should act as a Trusted Advisor of the CEO. But unless there is tangible evidence for a breach of Trust, to what extent is the loss of Trust more than a pretext for a CEO to get rid of a CAE that might just be telling unpleasant truths?

The performance trap: when the CAE is a scapegoat

When – to a certain extent - incompetence can be demonstrated, the case of performance is more complicated. Performance measurement is easy based on classic KPIs such as “fulfillment of the Audit Plan”. The problem is that such KPIs are largely irrelevant or at least fail to describe what is true audit performance, such as the impact and added value of the audit function on the firm. This matter is much discussed in the community.

My point here is that, especially in organizations with a poor control and ethical culture, with little care for checks and balances, the audit function and the CAE can be finger pointed when a problem arises. Blaming internal audit is an easy – and common – smoke screen to hinder leadership and first lines responsibilities.

So before proceeding with the CAE termination based on poor performance, there must be clarity on the initial objectives and criteria taken to assess the performance of the CAE.

When terminating a Chief Audit Executive, it is crucial for an Audit Committee Chair to ensure that due process is followed, including:

- conducting a thorough investigation (ideally externally)

- providing an opportunity for the auditor to respond: an “exit interview” is a “must” in my view,

- and documenting all relevant findings to evidence and support the decision.