528 Making Key Strategic Decisions
Internal Control
In addition to its opinion on the financial statements, the outside auditing firm
writes a “management letter.” This letter lists possible weaknesses in the com-
pany’s control system that have come to the auditor ’s attention, together with
recommendations for correcting them. (In the boilerplate preceding this list,
the auditor disclaims responsibility for a complete analysis of the system. The
listed items are only those that the firm happened to uncover.) Internal audi-
tors also write reports on the subject.
Audit committees follow up on these reports by asking management to
respond to the criticisms. If management disagrees with the recommended
course of action, its rationale is considered and is either accepted or rejected.
If action is required, the committee keeps the item on its agenda until it is sat-
isfied that the matter has been addressed.
If an especially serious problem is uncovered, the committee may engage
its public accounting firm or another firm to make a special study. If the prob-
lem involves ethical or legal improprieties, the committee may engage an out-
side law firm. As soon as material problems are identified, they must be
reported promptly to the SEC on Form 8-K.
The audit committee has a difficult problem with internal audit reports.
In the course of a year, a moderate size staff may write 100 or more reports.
Many of them are too trivial to warrant the committee’s attention. (One of the
authors participated in an audit committee meeting of a multibillion dollar
company in which 15 minutes were spent discussing a recommendation to
improve the computer system that was expected to save $24,000 annually.)
Drawing a line between important reports and trivial ones is difficult, how-
ever. A rule of thumb, such as, “Tell us about the dozen most important mat-
ters,” may be used, but what if the thirteenth matter also warrants the
committee’s attention?
In its private meeting with the head of internal audit, the audit commit-
tee assures itself that the CEO has given the internal audit staff complete free-
dom to do its work. The committee also makes it clear that the head of internal
audit has direct access to the audit committee chair if a situation that warrants
immediate board attention is uncovered. The internal auditor normally would
report the matter in question to his or her superior first, but the auditor ’s
primary obligation is to the audit committee. The committee, in turn, should
guarantee, as well as it can, that the internal auditor will be fully protected
against possible retaliation.
Internal Audit Organization
The audit committee also considers the adequacy of the internal audit organi-
zation. Is it large enough? Does it have the proper level of competence? For ex-
ample, do the auditors know how to audit the latest computer systems? In many
companies, the internal audit organization is a training ground where promising