A change was implemented requiring the IAA to report administratively to the organization's chief legal counsel rather than the board.

Responsibility for risk management processes were removed from the IAA and placed under a newly created chief risk officer.

The IAA was denied access to expenditure and budget requirement reports because the reports were considered to be financial administrative matters.

An internal auditor was informed by the chief financial officer that client survey results would be unfavorable unless the auditor changed a finding in the report.

Impose risk management processes.

Coordinate risk management activities.

Implement risk responses on management's behalf.

Review the management of key risks.

Delegate final approval of the risk-based internal audit plan to the chief audit executive (CAE).

Approve the annual budget and resource plan for the internal audit activity.

Assist the CAE with hiring objective and competent internal audit staff.

Encourage the CAE to communicate and coordinate with the external auditor.