The audit committee chair learns about a $4.2 million unremediated access-control exposure from the external auditor, not from internal audit. Nothing was hidden. Informal communication carried it: the chief audit executive mentioned it in a hallway conversation with the chief financial officer four months earlier and never put it in a board paper. That is a communication failure, and the exam tests it as one.
The chief audit executive (CAE) reports functionally to the board (usually the audit committee) and administratively to senior management. Functional reporting carries everything that protects independence: charter approval, plan approval, resources, the CAE's appointment, removal, and compensation, and the results of engagements. Administrative reporting carries day-to-day facilitation: office logistics, human resources administration, expense approvals, and internal policy compliance.
KEY: When a stem asks who approves something that affects internal audit's independence or scope, the answer is the board. When it asks who supports execution, the answer is senior management.
Formal communication is documented, scheduled, and part of the record: the approved plan, periodic status reports, engagement reports, the annual independence confirmation, and quality program results.
Common mistakes
- Sending independence matters up the administrative line. Scope limitations, access denials, and impairments go to the board through the functional line. Telling only the chief financial officer leaves no record and no remedy.
- Letting informal briefings substitute for formal reporting. A hallway mention of a $4.2 million exposure is not communication to the board. Informal channels precede formal reporting; they never replace it.
- Reporting the plan as a calendar. A plan communication without the link to strategic objectives, the risk assessment basis, and the coverage lost to resource limits is incomplete and gets marked wrong.
Bottom line
- Reporting lines: functional to the board covers charter, plan, resources, results, and independence; administrative to senior management covers budget administration, human resources, facilities, and policy.
- Formal communication carries decisions and creates the record; informal communication builds trust and gives early warning but never substitutes for the formal channel.
- Private sessions with the board without management present are a standard channel for matters involving senior management.
- Plan communication must show the link to organizational strategy, the risk assessment basis, resource needs, and the specific high-risk coverage lost if resources are limited.
Exam shortcut
Sort every stem by channel first. Words like charter, plan approval, resources, independence, impairment, or removal of the CAE point to the board. Words like office budget, staffing administration, or expense policy point to senior management.
The full lesson (about 2,442 words, 16 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 4
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.