Who is responsible to the audit committee?;

              reviewing the work of the committee.
It is also desirable that these audit
committee members be independent
directors, not part of the management
team. The audit committee is going to
be dependent on the internal auditor,
in any event, for much of the informa­tion
it seeks. The internal auditor
should report to the committee as well
as to the CEO. The external auditor will
The primary responsibility for devel­oping,
implementing, and monitoring
a system of internal controls lies with
management. Many companies have
formed an internal audit function to
act as a management surrogate in mon­itoring
compliance. In other words,
they have created a vehicle to see if
their rules are being followed.
That is looking at it from the man­agement
level. When you are looking
at it from the board level, in the
broadest corporate sense, the internal
audit function becomes part of the
internal control system. Then, who
should be the surrogate of the audit
committee or the board? Mr. Sommer
would say primarily the internal audi­tor,
and I think we might have a small
disagreement on that particular point.
We at Touche Ross say the principal
surrogate for the audit committee
should be the external auditor. He
should be the one that gathers and
evaluates evidence of what the com­pany
and the company's internal audi­tor
have done. And the external audi­tor
should be the one to present this
evidence to the audit committee-with
an evaluation and appropriate recom­mendations.
also assist the audit committee in
overseeing internal controls.
The last major point is that an audit
committee report should be present­ed
at every board meeting. Its chair­man
should report the current status of
internal controls. If nothing meaning­ful
has come to the committee's at­tention
since the last board meeting, it
may have no report. In this fashion,
I like to draw the analogy that the
external auditor serves as the diagnos­tician.
You go to a doctor, who per­forms
an examination, and he says, I
think you should come in for some
elective surgery. And he offers the
reasons for it. But it is you who evalu­ate
the reasons—you may even get a
different opinion—and it is you who
make the decision. In the area of inter­nal
control, it is the board which makes
the final decision.
At Touche Ross, we also believe that
the external auditor has a responsibili­ty
to play more than a passive role in
evaluating internal controls. That is,
when the external auditor comes be­fore
the audit committee, he needs to
do more than simply respond to ques­tions:
yes, no, maybe, never. The ex­ternal
auditor has the responsibility to
assess whether or not the audit com­mittee
is evaluating the basic systems
and has been informed about the pri­mary
areas of risk and what the basic
controls are to protect against those
risks.
Now, the fact that the audit commit­tee
should look to the external auditor
as the primary surrogate does not pre­clude
it from also looking to the inter-board
members not on the audit com­mittee
can carry out their monitoring
responsibilities required by the Foreign
Corrupt Practices Act. &
A. A. Sommer, Jr., a partner in the
Washington, D.C. law firm of Wilmer,
Cutler & Pickering, was Commissioner
of the Securities and Exchange Com­mission
from 1973 to 7976.
nal auditor—or any other source that
the committee believes can provide
facts that would help in making its
evaluation. The same analogy holds
true for the external auditor. Although
he is primarily responsible to the audit
committee, he should also have a
working relationship with manage­ment
on a day-to-day basis.
I make these points in response to
the furor over some of the remarks by
SEC Chairman Harold Williams, in
which he discussed to whom the in­ternal
auditor should be responsible. I
think that, in substance, I am in accord
with what Mr. Sommer has discussed
here.
To review, the internal auditor is
primarily responsible to management;
it is the vehicle management uses to
evaluate systems and check for com­pliance.
Whereas the external auditor
is primarily responsible to the board or
to the audit committee. In the final
analysis, however, this distinction isn't
really that important, since the audit
committee should have access to in­ternal
audit whenever it desires, and
management should always have free
and open contact with the external
auditor. &
Who Is Responsible to the Audit Committee?
by W. DONALD GEORGEN/Vice Chairman, Board of Directors, Touche Ross
17