The internal audit department may report to which of the following?

The internal audit department may report to which of the following?

• A. To the CFO only
• B. To the CEO only
• C. To the board only
• D. To the CFO, CEO, controller or board of directors

Answer: (D)

Internal audit needs to stay objective and have access to governance so it can independently evaluate risk, controls, and governance processes. Because different organizations structure oversight differently, the reporting line for internal audit isn’t fixed to one entity. It can be administratively aligned with senior management—such as the CFO, CEO, or controller—while often maintaining a direct reporting relationship to the board or an audit committee to preserve independence and provide strong governance oversight. Therefore, the internal audit function may report to the CFO, CEO, controller, or board of directors, depending on policy and the balance between management interaction and board-level oversight.

Internal audit needs to stay objective and have access to governance so it can independently evaluate risk, controls, and governance processes. Because different organizations structure oversight differently, the reporting line for internal audit isn’t fixed to one entity. It can be administratively aligned with senior management—such as the CFO, CEO, or controller—while often maintaining a direct reporting relationship to the board or an audit committee to preserve independence and provide strong governance oversight. Therefore, the internal audit function may report to the CFO, CEO, controller, or board of directors, depending on policy and the balance between management interaction and board-level oversight.