A new chief audit executive has about ninety days in which everything is forgivable. Questions that would sound naive from an incumbent are expected from a newcomer; changes that would look like criticism of a predecessor are read as fresh eyes; and the audit committee, which chose you, wants to be shown that it chose well. After ninety days the window closes: you own the plan, the findings, the team and the relationships, and every problem becomes yours whether you inherited it or not. This guide is a plan for using the window. It covers what to read and negotiate before day one, a listening tour that produces something other than notes, a health check of the function against the Global Internal Audit Standards, the decisions that must be made early and the ones that must not, the report to the committee at day ninety, the mistakes new CAEs make in the same order every time, and a worked example of a first-time CAE taking over a co-sourced function.
The Standards run through the guide because they give a new CAE something predecessors did not have: a published list of what the board and senior management must provide for the function to work, the essential conditions in Domain III, and a standard-by-standard description of what the CAE must do to manage it in Domain IV. Both are covered in detail in GIAS Domain III and GIAS Domain IV; this guide uses them as the checklist for the first ninety days rather than restating them.
In this guide
- Before day one: what to read and what to negotiate
- Days 1 to 30: the listening tour
- Days 15 to 45: the health check against the Standards
- Days 30 to 60: the early decisions, and the ones to defer
- Day 90: the report to the audit committee
- The classic mistakes, in the order they happen
- Worked example: a first CAE takes over a co-sourced function
- Related guides
Before day one: what to read and what to negotiate
The most consequential decisions of the first ninety days are made before they start, in the offer conversation, because a reporting line or a charter is far easier to fix as a condition of joining than as a request from an employee. Domain III of the Standards gives you the list. The board must approve the mandate and the charter (Standards 6.1 and 6.2), establish the CAE’s functional reporting to the board and administrative reporting to a senior manager who does not compromise independence (7.1), approve the CAE’s appointment, remuneration and removal and evaluate the CAE’s performance (8.3 and the essential conditions), and provide the resources the plan needs (8.2). If any of those is not in place, the time to raise it is when the committee chair still wants you to say yes.
| Read or ask for | What to look for | What it tells you |
|---|---|---|
| The charter and the mandate as approved | Date of last approval, the reporting lines, access rights, scope exclusions, whether it references the 2024 Standards or the 2017 elements | Whether the function’s authority is current and whether the board has done the Domain III work; a 2019 charter usually means it has not |
| The last three audit committee packs and minutes | What the committee is told, how often, what it asked, which findings recur, what the committee does with past-due actions | The committee’s real expectations, which differ from the job description, and the tone of the relationship you inherit |
| The last internal and external quality assessment | The rating, the improvement plan, which actions were completed, when the next external assessment is due (Standard 8.4 requires one at least every five years) | The function’s honest standing; an assessment older than five years or an improvement plan nobody finished is your first finding about yourself |
| The current plan, the risk assessment behind it, and last year’s plan-to-actual | Coverage of the universe, hours by engagement, in-year changes and who approved them, engagements that slipped or were cancelled | Whether the plan is a plan or a list; the method in how to build the audit plan is the yardstick |
| The open issues and actions population | Count by rating and age, past-due actions, repeat findings, anything open for more than two years | Management’s real attitude to internal audit, which is measured in actions completed rather than in welcome speeches |
| The budget, the headcount and the co-source contracts | Vacancies, turnover in the last two years, hours purchased externally and for what, the budget’s trend against the organization’s growth | What you can actually deliver in year one, and whether resources are a conversation you must open at day ninety |
| The team’s CVs and last appraisals | Certifications, tenure, the mix of financial, operational and technology skills, who was passed over for your job | Who can lead an engagement unsupervised, where the skills gaps are, and who needs a conversation in week one |
| The organization’s own disclosures | Annual report, risk factors, regulatory correspondence, the strategy, recent acquisitions and system changes | The risks the plan should be covering; a plan that does not mention the acquisition in the annual report is the second finding about yourself |
Two things to negotiate explicitly if they are absent: a direct line to the committee chair, meaning a standing private session at every meeting and the chair’s phone number, and the ability to change the plan in-year with the committee’s approval rather than management’s. A third, if the function is small, is a co-source budget you control; the guide on co-sourcing vs outsourcing covers how to structure it. Everything else can wait for the report at day ninety.
Days 1 to 30: the listening tour
The listening tour has a reputation for producing goodwill and notebooks and nothing else, because it is usually run as a series of introductions. Run it as fieldwork instead: the same questions to every stakeholder, answers recorded the same day, and a synthesis at the end that becomes the first section of the ninety-day report. Thirty conversations in thirty days is a reasonable load alongside the reading; the table gives the groups and the questions that get past the welcome speech. The most useful single question, for everyone, is the last one: what would you change about internal audit if you could change one thing. The answers cluster, and the clusters are your agenda.
| Who | Questions that get real answers | What you are listening for |
|---|---|---|
| Audit committee chair and members, individually | What made you decide to change the CAE, or what do you want to be different? What do you worry about that nobody audits? What do you want to see in the pack that you do not? How do you want to hear bad news? | The unwritten job description; the risks the committee carries privately; the format and cadence of the relationship |
| Chief executive and chief financial officer | Where has internal audit helped, and where has it wasted your time? What is changing in the business in the next two years? Which findings did you disagree with, and why? | Where the function has credibility and where it has none; the strategy the plan must follow; the accepted risks that should be on the record under Standard 11.5 |
| The rest of senior management, one by one | The same questions, plus: when internal audit last audited your area, what happened afterwards? | How findings land, whether actions are real, who treats the function as a partner and who as a nuisance |
| External auditors | What do you rely on internal audit for, and what would you like to? Where do you see control weaknesses that internal audit has not reported? | Reliance under Standard 9.5, and a second opinion on the function’s quality from people who have seen its work |
| Second-line functions: risk, compliance, information security | What do you do that internal audit duplicates? What do you wish it covered? How do you share results? | Coordination gaps and overlaps; the reliance map described in internal audit vs compliance |
| Every member of the audit team, individually | What are you proud of in the last year? What would you stop doing tomorrow? What do you need from me? Where do you want to be in three years? | The team’s honest view of its own quality, the retention risks, and who is ready for more |
| Two or three recent auditees below senior management | What was the audit like to go through? Was the report fair? Did anything change? | The function’s reputation at the level where audits actually happen, which senior management may not know |
Say almost nothing about what you intend to do. The temptation to announce is strong in week two, and everything announced in week two is either obvious or wrong. Take the notes, thank people, and let the synthesis wait for the health check to sit beside it, so that the ninety-day report can say what stakeholders want and what the function can deliver in the same breath.
Days 15 to 45: the health check against the Standards
The health check is a quick internal assessment of the function against the Standards, done by you and, if the function has one, the person who runs its quality program, in about three weeks of part-time effort. It is not the full self-assessment the quality program requires under Standard 12.1, and it should not pretend to be; it is a triage that tells you which of the function’s foundations are sound, which are cracked and which are missing, in time for the ninety-day report. Work through the table with evidence in hand, not assurances, and rate each row on three levels: in place and working, in place but weak, or absent. The rows follow the Standards’ own order so that the results map straight onto the full assessment later, using the method in the QAIP playbook.
| Area | Standards | Evidence to examine | Red flag |
|---|---|---|---|
| Mandate, charter and board support | 6.1, 6.2, 6.3; Domain III essential conditions | Charter approval date and content; minutes showing the board’s discussion of the essential conditions; access rights exercised in practice | A charter that predates the 2024 Standards, or one that no auditee has ever been shown |
| Independence and CAE role | 7.1, 7.2, 8.3 | Reporting lines in the organization chart, not the charter; the CAE role profile; who set the previous CAE’s objectives and pay | Administrative reporting to a function the plan audits heavily; CAE objectives set by the CFO alone |
| Board interaction and resources | 8.1, 8.2 | Committee calendar and private sessions; the resource statement in the last plan and whether the committee approved a plan it was told was under-resourced | No private session in the last year; a plan approved without a statement of its limitations under Standard 9.4 |
| Quality program | 8.3, 8.4, 12.1, 12.2 | The internal assessment file; the last external assessment and its date; performance measures reported to the committee | No external assessment within five years, or measures that count activity but never quality |
| Understanding the organization and strategy | 9.1, 9.2 | The audit universe and how it was built; an internal audit strategy with objectives, or the absence of one | A universe last rebuilt before the current chief executive arrived; no strategy at all, which is common and easy to fix in year one |
| Methodology | 9.3 | The manual, its date, its citations, and whether the workpapers on file follow it | A manual citing the 2017 elements; workpapers from different teams that look like different functions |
| Plan and coordination | 9.4, 9.5 | The risk assessment behind the plan, in-year changes and their approval, the reliance map with second-line and external assurance providers | A plan that is the previous plan rolled forward; reliance on second-line work that has never been evaluated |
| Resources: people, money, technology | 10.1, 10.2, 10.3 | Budget versus plan hours, vacancies, skills inventory, the tools the team actually uses | Technology risk in the top five of the risk register and nobody on the team who can audit it |
| Communication and results | 11.1 to 11.5 | A sample of reports for clarity and severity discipline; the accepted-risk record; the committee pack against the template in the audit committee presentation template | Ratings that vary by auditor rather than by evidence; risks accepted by management with no record and no escalation |
| Engagement performance and follow-up | 12.3, 15.2 | Review evidence on a sample of workpapers; the issue log for validation evidence and past-due escalation | Actions closed on management’s say-so; past-due actions that never reached the committee |
Write the results up on one page, in the three levels, with the evidence reference beside each rating. The page is the second section of the ninety-day report and it is also the first draft of your own accountability: every row rated absent is something the committee will expect to see in place by the next external assessment, on your watch. Rate honestly. A new CAE who rates the inherited function harshly is not blamed for the state of it; a CAE who rates it generously and is contradicted by an external assessor two years later is.
Days 30 to 60: the early decisions, and the ones to defer
Some decisions cannot wait for the ninety-day report because their absence does damage every week, and some decisions must wait because making them early, on partial understanding, does more damage than delay. The distinction is the most important judgment of the period, and the table records where we would draw it. The test for “decide now” is that the decision is reversible, urgent or both; the test for “defer” is that it depends on the plan, the strategy or the team’s capability, none of which you yet know well enough.
| Decision | Now or later | Reasoning |
|---|---|---|
| Stop or continue any engagement in progress that has lost its purpose | Now | Hours spent on a redundant engagement are gone; a short note to the committee explaining the change costs nothing |
| Escalate past-due actions on High findings to the committee | Now | Standard 15.2 requires it, the committee will welcome it, and it establishes in month one that the function’s follow-up has teeth |
| Fix the private session and the direct line to the chair | Now | Reversible, cheap, and the foundation of everything in the ninety-day report |
| Address an obvious independence conflict in the reporting line | Now, raised; resolved at day 90 | Raise it with the chair in month one so that nobody is surprised by the report’s recommendation |
| Retain or release a co-source partner mid-contract | Now if the work is poor; otherwise defer | Poor external work damages the function’s name; adequate work should continue until the plan tells you what you need |
| Restructure the team | Defer | You do not yet know who is good under pressure; the plan and the strategy decide the structure, not the other way round |
| Rewrite the methodology | Defer, but start the mapping | The manual must be written against the plan and the quality program; the mapping to the 2024 Standards can begin now as a team exercise |
| Change the rating scale or report format | Defer to the next plan year | Changing the ratings mid-year breaks the committee’s trend data and invites relitigation of every open finding |
| Rebuild the audit universe and risk assessment | Start now, finish by day 90 | It is the input to every deferred decision, and the method in the internal audit risk assessment guide can be run in six weeks with the team’s help |
| Buy or replace an audit management system | Defer | The system encodes the methodology; decide the method first, then follow the selection method in selecting an audit management system |
| Draft an internal audit strategy | Draft by day 90, approve later | Standard 9.2 requires one; a draft in the report gives the committee something to shape and shows you have read the organization’s strategy |
One category needs its own rule: personnel. The person who was passed over for your role, the long-serving manager whose work is weak, the star who will leave if not promoted, all of these will present themselves in the first month, and the temptation to act is strong. Have the conversations early, honestly and privately; make the decisions after the plan is set, when you know what the function needs to deliver and can explain each decision in those terms. The exception is misconduct, which is decided the day it is found, under the ethics principles in GIAS Domain II.
Day 90: the report to the audit committee
The ninety-day report is the first document the committee will judge you by, and it should be short, evidenced and unafraid. Eight to twelve pages, presented in person with a private session afterwards, in the structure below. Its job is to tell the committee what you found, what you intend to do about it, what you need from them, and how they will know it worked. It is not a plan for the function’s transformation; it is the honest baseline from which the committee will measure one.
1. What stakeholders told me (one page). The listening tour synthesis: the three to five themes that recurred, attributed to groups rather than individuals, with the one change most people would make. Include what the committee itself said, so the members see that they were heard.
2. The state of the function (two pages). The health check table, rated in three levels with evidence references, and a plain statement of the function’s standing against the Standards: what conforms, what is weak, what is absent, and when the next external assessment falls due.
3. What the plan does and does not cover (one to two pages). The rebuilt universe and risk assessment in summary; the coverage the current plan provides against it; the gaps, with the risks in them named; and the in-year changes you propose, with hours.
4. Open findings and actions (one page). The population by rating and age; the past-due actions and what has been done about them since you arrived; the repeat findings; any risk management has accepted that the committee has not seen, recorded under Standard 11.5.
5. Decisions taken and decisions deferred (one page). What you have already changed, with reasons; what you have deliberately left until the plan year, with reasons; what you will bring to the next meeting.
6. What I need from the committee and management (one page). The essential conditions not yet in place, stated as requests with the standard beside each: charter approval, reporting line, resources, access, the private session. Be specific about money and headcount if the plan cannot be delivered without them, and state what will not be covered if the answer is no.
7. Draft internal audit strategy (one to two pages). Three to five objectives for three years, each tied to the organization’s strategy or the committee’s stated concerns, with the measures under Standard 12.2 that will show progress. Presented as a draft for the committee to shape.
8. How you will know (half a page). The five or six measures you propose to report at every meeting from now on, with this report as the baseline, and the date of the first full self-assessment.
Send the report a week ahead, brief the chair before that, and pre-wire nothing else. Management will see the report at the same time as the committee, or after, depending on the charter’s provisions; a CAE who negotiates the report’s contents with the chief financial officer before the committee sees it has, in the first ninety days, given up the independence the reporting line was meant to protect. If a section will embarrass a manager, tell them in person the day before, with the evidence, and change nothing.
The classic mistakes, in the order they happen
New CAEs make the same mistakes in roughly the same sequence, which makes them avoidable. The first, in week one, is arriving with the plan. A CAE who announces a new methodology, a new report format and a new rating scale before the listening tour has told the organization that its views were never going to matter, and the announcement is usually a copy of the previous employer’s approach applied to a business it does not fit. The second, in weeks two to four, is over-promising to the committee. The chair asks what you will do about the past-due actions, the thin technology coverage or the report that upset the CFO, and the honest answer at week three is that you do not yet know; the wrong answer is a commitment you will be measured against at day ninety.
The third mistake, in month two, is auditing the predecessor. Every weak workpaper, every soft finding and every unescalated action is evidence about the function, and it is tempting to lay it all before the committee as the case for change. Do not. Report the state of the function in the health check’s neutral language, take ownership of it, and let the committee draw its own conclusions about the past; a CAE who spends the ninety-day report blaming the last CAE has told the committee what the next one will say. The fourth, also in month two, is the silent restructure: moving people, changing reporting lines within the team or releasing a co-source partner before the plan exists, on the strength of first impressions. Some of those impressions will be right. The ones that are wrong cost you the team’s trust in the period when you most need it.
The fifth mistake, near day ninety, is the report that asks for nothing. A new CAE who has found the essential conditions missing and does not say so, out of a wish to appear on top of things, has spent the forgiveness window on looking competent rather than on getting the function what it needs. The sixth is the mirror image, the report that asks for everything, with a resource request the committee cannot fund and a strategy with twelve objectives. And the last, which arrives after the ninety days but is decided during them, is neglecting the team for the stakeholders. The listening tour is outward-facing by design; the health check is about process; the report goes to the committee. The auditors who will deliver all of it are watching to see whether you are the CAE who talks to them or the one who talks about them, and they decide in the same ninety days you do. The picture of a function that works, in inside the internal audit department, is a useful reminder of where the work actually happens.
Worked example: a first CAE takes over a co-sourced function
Brightwater Foods is a 180-million-dollar food manufacturer with 600 staff across three plants. For several years its internal audit was a co-sourced arrangement sponsored by the finance director: an external firm delivered a handful of engagements a year to a plan the finance director approved, and the results went to the board through him. The arrangement produced good work, including the first procurement analytics run over eighteen months of invoices and a first assessment against the NIST Cybersecurity Framework that scored 76 of 106 subcategories and found flat networks on the plant floor, followed by a ransomware readiness review that found no immutable backup copy and an ERP restore that took 41 hours against a 24-hour objective. What it did not produce was a function. When the board formed an audit committee and the committee decided it wanted a chief audit executive of its own, it hired a senior manager from a larger manufacturer’s audit team, a first-time CAE, and gave her the co-source contract, a desk and no charter.
She negotiated two things before accepting: functional reporting to the committee chair with administrative reporting to the chief executive rather than the finance director, and a private session at every committee meeting. The finance director, who had sponsored the arrangement in good faith, was told by the chair rather than by her, which she counted as the chair’s first act of support under Standard 6.3. Her reading before day one was short because there was little to read: the co-source firm’s engagement letter, which was serving as a mandate; four reports; an issue list kept by the firm; and the board papers. The CSF assessment’s nine findings and the ransomware review’s actions were all open, and the action to establish an immutable backup copy was sixty days past its date with no record of anyone having asked why.
The listening tour ran to twenty-six conversations in the first month, and the synthesis had three themes. The committee wanted to know whether the plants were controlled, not only the head office, and it wanted to hear bad news early. Plant managers had never been audited and were, in two cases out of three, curious rather than defensive. And the IT manager, who had lived through the CSF assessment, wanted the ransomware actions funded and saw internal audit as the route to the board for that. The health check rated eight of the ten areas absent, which she reported without softening: no charter, no strategy, no methodology of the function’s own, no quality program, a plan built by the firm, a universe that did not exist as a document, no performance measures, and follow-up that depended on the firm’s issue list. The two areas in place were independence, which she had fixed as a condition of joining, and the quality of the engagement work, which the workpapers on file supported.
Her early decisions followed the table above. She escalated the past-due backup action to the chair in week five, with the IT manager’s cost estimate attached, and it was funded at the next meeting. She continued the co-source contract, because the firm’s technology work was good and she could not replace it, but changed its reporting line so that the firm’s reports came to her, and she asked the firm to map its methodology to the 2024 Standards as the starting point for the function’s own. She deferred everything about structure, since the function’s structure was one person. And she rebuilt the audit universe in six weeks with the plant managers’ help, producing a document with three plants, the head office functions, the ERP and the operational technology as auditable entities, risk-scored on four factors, which nobody at Brightwater had seen before.
The ninety-day report ran to eleven pages. It asked the committee for four things, each with the standard beside it: approval of a charter she had drafted from the model in the Standards; a second in-house auditor in the following year’s budget, with the coverage the plan would lose without one stated in hours; the private session written into the committee’s terms of reference; and a resolution recording that the committee, not the finance director, approved the plan. It proposed three in-year changes to the plan: a first controls audit at the plant the risk assessment ranked highest, a follow-up of the ransomware actions in the second half of the year, and the withdrawal of a head-office expense review the firm had scheduled that the procurement analytics had largely superseded. Its draft strategy had three objectives for three years, plant-level coverage, technology and resilience assurance through the co-source partner, and a quality program capable of an external assessment by year three, each with two measures. The committee approved the charter at that meeting, funded the second auditor at the budget round, and asked for the measures in every pack from then on. The finance director, who was not in the private session, told the chair afterwards that he thought the report was fair, which the chair passed on and which she counted as the ninety days’ most useful sentence.
Related guides
- GIAS Domain III: Governing the Internal Audit Function
- GIAS Domain IV: Managing the Internal Audit Function
- The Global Internal Audit Standards: The Complete Guide
- The QAIP Playbook
- How to Build the Internal Audit Plan
- The Internal Audit Risk Assessment
- Audit Committee Presentation Template
- How to Establish an Internal Audit Function in a Small Company
- Co-Sourcing vs Outsourcing
- Selecting an Audit Management System
- Inside the Internal Audit Department
- Internal Auditor Salaries: How to Read the Market
- CAE and Audit Leadership (category)
- Establishing and Structuring Internal Audit (category)
- Your first 90 days as a staff internal auditor
- What Is a Chief Audit Executive (CAE)? Role and Reporting — the role, the reporting lines and the first year.
- Audit Committee Annual Agenda: Quarter-by-Quarter Calendar — the quarter-by-quarter calendar.
- Your First Audit Committee Meeting as CAE: How to Prepare — pre-meeting one-on-ones, the content arc, candor on inherited problems and the rituals to propose.
- CAE compensation — how chief audit executive pay is structured, set and negotiated.
- Portfolio heads and divisional chief auditors — the MD-grade seat below the CAE.
- The CFO and internal audit — the relationship, the friction points and the shared ground.
- World-Class Internal Audit by Norman Marks: Summary and Lessons for Audit Leaders — one chief audit executive’s stories, and the judgement in them.
- Agents of Change by Richard Chambers: Summary and Lessons for Internal Auditors — internal auditors as catalysts for change.
Leave a Reply