The internal audit department ______.

The internal audit department ______.

• A. Reports to either the CEO or the board of directors
• B. Always reports to the CFO
• C. Must always report to the board of directors because of Sarbanes-Oxley
• D. May report to the CFO, CEO, controller or board of directors

Answer: (D)

Internal audit needs independence in its work, and the reporting line should support objectivity while still ensuring governance gets timely, accurate information. In practice, the internal audit function can report administratively to senior management (often the CFO or CEO) for day-to-day operations, while its functional reporting to the board or an audit committee preserves independence and provides direct access to governance. This flexibility—being able to report to the CFO, CEO, controller, or the board—best reflects how organizations balance operational support with objective assurance. Other options are too rigid or prescriptive. Reporting only to the CFO can compromise independence, and requiring a board-only report ignores the common administrative arrangements that help a department operate effectively. The Sz or SOX emphasis on board-level independence is important, but it does not mandate a single fixed reporting line in all organizations.

Internal audit needs independence in its work, and the reporting line should support objectivity while still ensuring governance gets timely, accurate information. In practice, the internal audit function can report administratively to senior management (often the CFO or CEO) for day-to-day operations, while its functional reporting to the board or an audit committee preserves independence and provides direct access to governance. This flexibility—being able to report to the CFO, CEO, controller, or the board—best reflects how organizations balance operational support with objective assurance.

Other options are too rigid or prescriptive. Reporting only to the CFO can compromise independence, and requiring a board-only report ignores the common administrative arrangements that help a department operate effectively. The Sz or SOX emphasis on board-level independence is important, but it does not mandate a single fixed reporting line in all organizations.