Every requirement discussed so far in this series — the strategy, the methodology, the quality programme, the conformance evidence — rests on a single structural question: to whom does internal audit actually answer? Get that question wrong and the rest is decoration. A brilliantly documented function that reports, in substance, to the executives it audits will produce findings shaped by that dependence, whatever its charter says. This is why the Global Internal Audit Standards devote an entire domain to the board’s governance of internal audit — and why this fifth article in The Internal Audit Imperative™ addresses the relationship itself: what the Standards require, what the two reporting lines mean in practice, and how to make independence real in the ownership structures that actually dominate the Caribbean economy.

What the Standards Require of the Board

Under Domain III of the Standards, the board — in practice, usually its audit committee — carries specific, personal responsibilities it cannot delegate to management. The board approves the internal audit mandate and charter; it approves the audit plan and budget; it appoints, evaluates the performance of, sets the remuneration of, and where necessary removes the chief audit executive; it receives engagement results and the CAE’s conformance and resource-sufficiency reporting directly; and it safeguards the function’s independence, including meeting the CAE without management present. Directors should notice the drafting: these are board duties, written to the board. When an external quality assessment or a regulator finds them unmet, the finding does not attach only to the audit function — it attaches to the board’s own governance.

Two Lines, One Principle

The Standards resolve a long-standing ambiguity with a simple structure: internal audit carries two reporting lines with different purposes. The functional line runs to the board and carries everything that determines the function’s power: mandate, plan, budget, results, and the CAE’s appointment and tenure. The administrative line runs to management — typically the CEO — and carries the day-to-day logistics: payroll, facilities, HR administration, internal communications. The principle behind the split is easily stated: management may administer the function; it must not be able to influence what the function examines, concludes, or reports. The most common Caribbean deviation — a functional line into the CFO — fails this principle at the first test, because the CFO’s domain is precisely where many of the highest-stakes findings arise.

The Caribbean Reality: Three Structures, Three Challenges

Global guidance tends to assume a widely-held public company with a large independent board. Most Caribbean organizations are not that. Independence has to be engineered inside three quite different structures:

1. Family-controlled and founder-led groups

In much of the regional private sector, the controlling shareholder chairs the board, family members hold executive roles, and the distinction between ownership, board, and management is thin. Internal audit in these groups faces a delicate truth: the person the findings may embarrass is often the person who approved the budget. The workable safeguards are structural, not heroic: an audit committee with a majority of genuinely independent directors and an independent chair; the CAE’s appointment and removal reserved to that committee; private sessions between committee and CAE at every meeting, held as routine so their occurrence signals nothing; and, where the function is small, co-sourcing with an external provider whose own independence and professional obligations reinforce the internal team’s. Families that adopt these safeguards are not diluting their control — they are protecting the enterprise value that control represents, and reassuring the lenders, minority investors, and successors who will one day rely on it.

2. State-owned enterprises and public bodies

In public bodies, the challenge is less family gravity than political cycle: boards turn over with administrations, chairs may be appointed for reasons unrelated to governance experience, and the accountability line runs upward to a ministry as well as inward to a board. Here the Standards’ requirements align squarely with the region’s public accountability frameworks, which already presuppose audit committees and functioning internal audit. The practical priorities: continuity arrangements so the internal audit charter, plan, and CAE tenure survive board transitions; committee induction so new directors understand duties they may be assuming for the first time; and disciplined minuting, because in the public sector the record of what the committee received and decided is itself an accountability document.

3. Financial institutions and credit unions

Deposit-taking institutions, insurers, securities dealers, and credit unions carry the most explicit external expectations: supervisors increasingly examine the internal audit function’s independence, reporting lines, and board interaction as a matter of course, and the Twin Peaks transition is sharpening those examinations. Credit unions add a particular Caribbean wrinkle — volunteer boards of members who bring commitment but not always audit-committee experience, overseeing functions of one or two people. For these institutions, the combination of structured committee training and outsourced or co-sourced internal audit delivered to the Standards is frequently the only realistic route to conformance — and it is the route supervisors themselves increasingly suggest.

Seven Warning Signs the Relationship Is Broken

Directors rarely need an assessment to know the relationship has failed; the signs are visible from the boardroom if one looks:

1. The CAE learns of major transactions, restructurings, or system changes after they are executed.
2. Internal audit’s budget or headcount is cut by management without the audit committee’s decision.
3. Findings are “discussed” with management and arrive at the committee softened, delayed, or not at all.
4. There are no private sessions between committee and CAE — or they occur only when something is already wrong.
5. CAE turnover is high, or the role sits vacant or “acting” for extended periods.
6. The audit plan is assembled from management’s requests rather than the function’s own risk assessment.
7. The committee cannot say, without checking, when the charter was last reviewed or whether the function has ever been externally assessed.

Independence is not a personality trait of the chief audit executive. It is a property of the structure the board builds around the role — and structures are a board’s choice.

Making It Work: The Relationship Calendar

A healthy board–internal audit relationship can be reduced to a calendar the committee simply keeps. Every meeting: a private session with the CAE, however brief, with no standing agenda required. Quarterly: results reporting against the plan, the status of management’s remediation of findings, and any impairment of independence or resources. Annually: the CAE’s performance evaluation led by the committee; approval of the plan, budget, and resource-sufficiency statement; review of the charter and the strategy; and a report on the quality programme, including progress toward or results of external assessment. On occurrence: direct, immediate access for the CAE to the committee chair — a channel that exists before it is needed. None of this is burdensome; all of it, minuted, constitutes most of the conformance evidence Domain III requires.

What Independence Is Not

A final calibration, because the point is often overcorrected. Independence does not mean hostility to management, exclusion from the management table, or an audit function that learns about the business only through fieldwork. The Standards expect the CAE to sit close to the organization’s decision-making — attending executive forums, seeing strategy early, understanding transformation plans as they form — precisely so assurance can be timely. The discipline lies in combining that closeness with structural accountability to the board alone. Proximity for insight; independence for judgement. Boards should insist on both and accept neither as a substitute for the other.

The Dawgen Perspective

Across fifteen-plus Caribbean territories, we have seen no better single predictor of internal audit’s value than the quality of its relationship with the board. Functions with real functional reporting, routine private sessions, and committee-controlled tenure surface the uncomfortable findings early — which is the entire point. Functions without those structures produce tidy reports and unpleasant surprises. The new Standards have, for the first time, made the difference between the two a matter of explicit, assessable requirement rather than governance folklore.

Dawgen Global advises boards and audit committees on precisely this architecture: charter and reporting-line design, audit committee effectiveness reviews, committee induction and training for family groups, public bodies, and credit unions, and co-sourced internal audit delivery under D·ASSURE™ that reinforces independence where in-house structures are thin.

Next in the series: “When Controls Fail in Public: Lessons for Internal Audit from Recent JSE Restatements and Write-Offs” — the through-line from the region’s recent market headlines to the assurance gaps behind them.

 

Is Your Audit Committee Set Up to Govern Assurance? Dawgen Global’s Audit Committee Effectiveness Review assesses your committee’s composition, charter, reporting lines, private-session practice, and internal audit oversight against the Global Internal Audit Standards and regional regulatory expectations — with a practical uplift plan for family-controlled groups, public bodies, and financial institutions. The relationship is the control. Make it a strong one. Email us   | [email protected]  |  dawgen.global  | Big Firm Capabilities. Caribbean Understanding.