The easy way is to show full confidence in the executive and agree to terminate the risk officer (CRO) or internal auditor (CAE).

The difficult way is to be objective and demonstrate independence from management, understand what is really happening, and then make a decision that is in the best interests of the organization.

(Note that I didn’t say that the board should decide who is right and discipline the other: sometimes the board needs to educate and mentor one or both. Sometimes, the sad truth is that the CRO or CAE is right but can no longer be effective because of the damage the dispute has done to relationships with the management team: damage that cannot be repaired by the board. In which case, he should be treated generously and moved into a new role, probably outside the organization.)

It is not easy for the board to set aside the natural inclination of directors to align with the executives, because:
- They generally share the same background, with the directors being active or former executives themselves
- The directors appointed the executives and are invested in them
- They play golf together and otherwise have built trusted relationships
- The executives know how to “work” the board. They are charismatic and persuasive. They have the ears of the board, spend many hours with the board in person and on the phone, and are able to make their case – sometimes through subtle repetition and hints
- The risk officer and internal auditor lack these strengths

A harsh truth, which board members need to recognize, is that executives are fully aware of the fact that it not easy to dismiss the CAE (because they report to the audit committee chair in most cases) or the CRO (because of the perception they might be hiding unpleasant truths). When they decide they want one of these people “gone”, they act carefully.

Research has shown that when a CAE has a conflict with an executive, typically because they report something the executive doesn’t like, they are able to obtain the support of the board and retain their position. But, most are forced to leave within a year (18 months at most).

Another harsh truth is that boards find it very difficult to tell a CEO or CFO they are in the wrong.

Finally, recognize that it is very hard for a CAE or CRO to discuss a lack of support or other problem (such as inappropriate expense reports – see the second situation, below) with you.

My advice:

1. Board members should remember their oversight responsibility and be ready to set aside friendships with the CEO and top executives. When one of them raises a concern with the performance of the CAE or CRO, be objective and impartial
2. Don’t shy away from the task. Even if the CEO or CFO says they have the matter in hand – maybe especially if they say that – make sure you have a full understanding of the matter. Be sure to give both sides an opportunity to explain, answer your questions, and help you figure out what is going on
3. Recognize that when the CEO or CFO says something to you that shows concern with the CAE or CRO’s performance, even when they say it is not important, it is important.
4. Be especially alert to repetition of subtle side comments or quiet indications of lack of support, such as when the CAE/CRO is delivering their report to the board
5. When you talk to the CAE/CRO, don’t be vague about the concern. They can’t answer questions that are not asked (see the first situation discussed below)
6. Sometimes, if not most of the time, the situation can be resolved with coaching and mentoring on both sides. The executive needs to understand that the CAE and CRO have jobs that cannot be discharged without sometimes having to be the messenger with bad news. The CAE or CRO may need coaching on how to deliver that bad news
7. When the CEO and/or CFO appear to be trying to “suppress” the CAE or CRO, dig deeper and understand whether the executive is just trying to exert their authority and understanding or has less than worthy objectives. For example, is he trying to control what the board hears? Or is he trying to control somebody who may look in places he doesn’t want looked at?
8. Finally, try to make it easier and less ‘intimidating’ for the CAE or CRO to share how they are being treated by executive management. While it is neither necessary nor appropriate to tell that person you are always on their side, give them the time and opportunity to be heard and make sure you actively listen. This may be the best way for you to find out how the executives really run the organization and treat employees. Coach and mentor the CAE and CRO so they can be effective in their dealings with you and with the organization’s leaders

Now, three true life situations that I am familiar with. All involved conflicts between a top executive and the CAE.

- In the first, the CAE and his team investigated and proved (with confessions) several accounting frauds by unit accounting staffs. Each was individually immaterial to the company as a whole, but material to the performance of the individual units. The motivation was less personal gain than it was either to help the company achieve its performance goals or to protect the unit from being targeted for closure as an unprofitable entity.

The CAE reported each investigation to the audit committee of the board, which reports continued for nearly a year as additional issues came to light. The CAE also reported, after the majority had been closed, that there was a pattern that concerned him. The CAE had discussed this with both the CFO and the chair of the audit committee prior to the meeting. Without saying it was deliberate, he said that each of the unit accountants said they had been told to “make their number” by corporate finance leaders. In addition, some of the accounting involved “rainy day” accounts where those involved felt pressured to use the accounts to help make corporate numbers. There was even an email from a top executive suggesting such a practice!

When the CAE reported the ‘pattern’ to the audit committee, the CFO was noticeably quiet and showed no support for the CAE, even when the CAE said that there was no evidence that the CFO or any of his direct reports had directed such behavior.

After the meeting, the CAE discussed the situation with the chair of the audit committee, in particular his concern that the CFO had not been supportive. The chair told the CAE to be careful, because the CFO had “a bigger business card”.

Within a few months the CFO was letting the audit committee know that he was receiving complaints from management about the internal audit team. However, none of the directors approached the CAE to hear the “other side”. When one director asked the CAE in an audit committee meeting how he got on with one of the top executives, the other directors quickly moved to tell him to stop.

About 6 months after the CAE reported the ‘pattern’ he resigned and left the company.

- The second situation was in some ways more complex. During a routine audit of executive expenses, the internal audit team identified inappropriate and excessive charges by the CFO. The CFO blamed the situation on his executive assistant and agreed that the excess was in the six figures.

The CAE felt obliged to report the situation to the audit committee, who directed the CFO to repay the company but took no further action.

The corporate controller then came to the CAE and attempted to negotiate down the repayment, offering that the CFO would repay about half of what had been demonstrated and agreed as excessive. The CAE declined.

Within a couple of months, the CAE accepted a new position within the company and a new CAE was appointed from within the ranks of the Finance team. The audit committee did not question the move. Ironically, the new CAE insisted on and was able to recoup all monies due.

- Finally, as in the first example, the internal audit team investigated and proved a series of frauds. However, the way in which the investigations were performed led to the loss of more than the individuals performed. They appeared more of a “witch hunt” than was appropriate: people were treated as suspects regardless of their position or relationship to the events, and interviews were conducted without empathy or respect. Many key managers left rather than remain in an investigation-ravaged environment.

Both the CFO and General Counsel were careful to show support for the investigations, but were concerned about the ‘collateral damage’. They shared with the audit committee that the CAE seemed to be obsessed with the investigations, approached everybody with what appeared to be suspicion, and was unable to work constructively with management.

The audit committee listened but took no action. In time, the CAE recognized that advancement would require leaving and took a CAE position at another company.

Were these situations handled well? I don’t think so.

Have you seen similar situations, where there is conflict between the CAE/CRO and CEO/CFO? Were they handled well or poorly?

Norman Marks, CPA, is vice president, governance, risk, and compliance for SAP's BusinessObjects division, and has been a chief audit executive of major global corporations for more than 15 years. He is the contributing editor to Internal Auditor’s “Governance Perspectives” column.
normanmarks.wordpress.com/