After the audit committee, the chief financial officer is the most consequential relationship an internal audit function has, and the least clearly defined. In most organisations the CFO is the function’s administrative reporting line, controls its budget, owns half the processes it audits, signs the certifications its SOX work supports, and sits in the room when its reports are discussed. That is a lot of roles for one person, and the ambiguity produces two predictable failure modes: CFOs who treat internal audit as a finance department and CAEs who treat the CFO as an adversary. This guide is written for both sides. It sets out the CFO’s legitimate asks of the function and the lines that protect its independence, how administrative reporting works when it works well, the budget conversation, the specific tensions around SOX and the close, and the partnership patterns visible at companies where the relationship is good.
In this guide
- The CFO’s five roles toward internal audit
- The CFO’s legitimate asks
- The lines that protect independence
- Administrative reporting done right
- The budget conversation
- SOX, the close and the CFO’s own processes
- What a CFO should expect from a good function
- A working rhythm for both sides
- When the relationship breaks: four scenarios
- Partnership patterns at high-functioning companies
- Worked example: Halberd Software after the IPO
- Frequently asked questions
- Related guides
The CFO’s five roles toward internal audit
Most friction between CFOs and audit functions comes from one party acting in one of these roles while the other assumes a different one. Naming them is half the fix.
| Role | What the CFO does in it | What it entitles the CFO to | What it does not |
|---|---|---|---|
| Administrative reporting line | Approves the CAE’s expenses, pay administration, HR matters; provides the function’s infrastructure | Information about the function’s operations; input to the CAE’s performance evaluation | Direction of the audit plan, scope, findings or ratings; sole authority over the CAE’s appointment, removal or pay |
| Budget owner | Houses the function’s budget in the finance cost base | A business case for the function’s resourcing; efficiency | A veto over coverage the committee has approved |
| Auditee | Owns finance, treasury, tax, the close, often procurement and payroll | The same fair process as any other auditee: no surprises, agreed facts, a say on remediation | Editing of findings about finance; preferential ratings |
| Certifying officer | Signs SOX 302 and 906 certifications; owns the 404(a) assessment | Timely information about deficiencies in ICFR; coordination of SOX testing | Internal audit as the SOX program owner by default; see who does what |
| Executive peer | Sits with the CAE in management meetings; shares the committee room | A candid, early conversation about what audit is seeing | Pre-clearance of what the committee hears |
The Standards place the CAE’s functional reporting with the board and allow administrative reporting to management, with the board responsible for the CAE’s appointment, removal, remuneration and performance evaluation (Domain III, Standard 7.1 and the essential conditions). Most charters say so. The practical question is what a CFO who is the administrative line can and cannot do on Tuesday afternoon, and the table is the answer. The independence and objectivity guide covers the principles; the rest of this guide covers Tuesday afternoon.
The CFO’s legitimate asks
CAEs sometimes treat every CFO request as an incursion. Most are not. A CFO who asks the function for the following is doing their job, and a CAE who refuses is misreading independence as isolation.
| Ask | Why it is legitimate | How the function meets it | The boundary |
|---|---|---|---|
| Input to the audit plan | The CFO knows where finance is weak and what is changing | A structured conversation during planning; the CFO’s risks recorded in the risk assessment | Input, not approval; the committee approves |
| No surprises | The CFO will be asked about every finding in finance by the committee and the external auditor | Findings discussed with the control owner, then the CFO, before the draft; High findings by phone the day they are confirmed | Early notice, not editing rights |
| Efficiency empathy | Audit requests cost finance time at the worst moments (close, year-end) | Fieldwork scheduled around the close; one PBC list; reliance on work already done where the function’s reliance standard allows | Convenience does not reduce scope |
| Coordination with the external auditor and SOX | Duplicate testing of the same controls wastes finance’s time twice | A shared controls calendar; agreed reliance; one evidence request where possible | Internal audit’s conclusions remain its own |
| A view before decisions | The CFO wants to know how a new system or process will test before building it | Advisory input on criteria and tests, per the trusted advisor guide | Advice on the test, not design of the control |
| Timely reports | A finding about finance that arrives three months after fieldwork is stale by the time the CFO can act | Report timeliness as a function KPI | Speed does not change the rating |
| Fair ratings | Finance is audited more than any other area; a biased scale would show up there first | The rating rule, applied the same way to finance as to operations | Fair means consistent, not lenient |
The no-surprises ask is the one that matters most to CFOs and the one CAEs most often under-deliver. A CFO who learns of a Medium finding about the close from the committee pack has been embarrassed in front of their own board, and will treat the function as hostile thereafter, with some justification. The rule costs the function nothing: findings about the CFO’s own processes reach the CFO before the draft, with the facts and the proposed rating, and the CFO’s response is in the report alongside. The closing meeting playbook describes the same discipline at engagement level.
The lines that protect independence
Against the legitimate asks sit a small number of lines that, once crossed, convert the function into a finance department with an audit label. They are rarely crossed by a CFO who means harm; they are crossed by a CFO who does not know where they are and a CAE who does not say.
| Line | What crossing it looks like | Why it matters | How the CAE holds it |
|---|---|---|---|
| No plan veto | “Take the treasury audit out this year; we are mid-migration” | Coverage the committee approved is being removed by an auditee | Deferrals go to the committee as plan changes with the CFO’s reason stated; the CAE recommends |
| No finding editing | Redlines on the draft that change facts, causes or ratings rather than wording | The report is no longer the function’s opinion | Facts corrected on evidence; wording negotiated; causes and ratings held per the rule; the CFO’s disagreement recorded in the report |
| No pre-clearance of the committee pack | “Run the pack past me before it goes” | The committee hears what management has approved | The CFO sees the sections about finance in advance as an auditee; the pack goes to the chair from the CAE |
| No sole authority over the CAE’s position | Pay, appraisal or removal decided by the CFO alone | The CAE’s livelihood depends on the person they audit | Charter language; the committee chair owns the appraisal with CFO input |
| No reassignment of audit staff to finance tasks | “Can your team help with the close this quarter?” | Auditors who performed the close cannot audit it (one-year impairment) | Decline with the impairment explained; offer advisory input on the close design instead |
| No restriction of access | A system, a data set or a person placed off limits | A charter breach | Charter cited; the ladder to the chair if not resolved |
| No SOX program ownership by default | The function is made the 404 program owner because it is “already testing” | The function ends up assessing its own program | The SOX for control owners and operating models guides set out the alternatives; the committee decides the model |
The lines are held with the charter in one hand and the committee chair in the other, and almost never with confrontation. A CAE who says “I cannot take treasury out of the plan myself, but I can take your reasons to the chair with my recommendation” has held the line, kept the relationship and done exactly what the Standards expect. A CAE who says “you cannot tell me what to audit” has held the line and lost the relationship, which will cost the function in a hundred small ways for years.
Administrative reporting done right
The administrative line is where the ambiguity concentrates, because it is a real reporting relationship with real content. Functions where it works have usually written down what it covers.
| Matter | Owner | CFO’s role | Committee’s role |
|---|---|---|---|
| Audit charter | Committee | Consulted | Approves |
| Audit plan and budget | CAE proposes | Consulted; houses the budget; can object with reasons | Approves the plan; approves or notes the budget |
| CAE appointment and removal | Committee | Consulted | Decides |
| CAE remuneration | Committee | Provides market data; administers | Decides or approves |
| CAE performance evaluation | Committee chair | Provides input as an executive peer and as administrative line | Conducts |
| Day-to-day administration (expenses, leave, HR policy, systems) | CFO | Approves | Not involved |
| Audit staff hiring within budget | CAE | Administers through HR | Not involved |
| Scope, findings, ratings, reports | CAE | Auditee and no-surprises recipient | Receives |
| Access to the committee | CAE | None; the CAE meets the chair without the CFO | Unrestricted |
The table is a one-page document that belongs in the charter’s appendix or in a short memo signed by the committee chair, the CFO and the CAE. Its value is prophylactic: when a new CFO arrives and asks why the audit budget cannot be cut by a third to fund a systems project, the answer is on the page, and the conversation is about taking a proposal to the committee rather than about authority. The audit charter guide covers the GIAS requirements the table implements; the audit committee charter guide covers the committee’s side.
Two further points about the administrative line. First, the CFO as administrative line should still receive the function’s reports, as every executive whose area is covered does; what changes is only that the CFO cannot direct their content. Second, functions in regulated industries often find that examiners read the administrative line closely, asking whether the CAE’s pay, appraisal and plan are visibly owned by the committee; a one-page allocation like the table above is the quickest answer to that question as well.
The budget conversation
The function’s budget usually sits in the finance cost base, which means the CFO is asked to defend it in the same breath as the tax team and the treasury system licence. CAEs who treat the budget as an entitlement lose it slowly; CAEs who treat it as a business case keep it. The conversation has a shape that works for both sides.
- Start from coverage, not headcount. The plan the committee approved requires N hours; here is how they were derived (the plan and capacity model); here is the cost of each engagement; here is what drops if the budget falls by 10, 20 or 30 percent, and which risks go uncovered.
- Show efficiency before being asked. Hours per engagement by type, analytics that replaced sampling, reliance that removed duplicate testing; the KPIs guide has the measures.
- Separate the mandated from the discretionary. SOX support, regulatory expectations and committee-requested coverage are not negotiable without the committee; the discretionary engagements are where a CFO can legitimately push.
- Offer the trade, not the fight. “We can absorb a 10 percent cut by co-sourcing the IT audits instead of hiring; a 20 percent cut removes two process audits and I would take that to the committee as a coverage reduction.”
- Take the outcome to the committee either way. The committee approves the plan; a budget that cannot deliver it is the committee’s decision to make, with the CFO’s reasons and the CAE’s recommendation both on the page.
Benchmarks help the conversation but do not decide it. Audit budgets vary enormously with industry, regulation and the function’s remit, and a CFO who hears “we are below the median” will ask which median. The stronger argument is always the coverage one: this is what the committee asked for, this is what it costs, this is what you lose. The cost of an internal audit guide gives the per-engagement economics that make the argument concrete.
SOX, the close and the CFO’s own processes
The CFO owns the processes internal audit examines most: the close, revenue, payables, payroll, treasury, tax, and the ICFR program that supports the CFO’s own certification. Three tensions recur.
| Tension | The CFO’s position | The function’s position | The resolution that works |
|---|---|---|---|
| Who owns SOX testing | “Audit already tests controls; make them the program” | A function that owns the 404 program cannot independently assess it | The committee chooses an operating model; where the function tests, management owns the assessment and remediation; the dual role is time-limited and disclosed (see the pre-IPO SOX guide for a transition pattern) |
| Deficiency evaluation | “That is a deficiency, not a significant one” | The evaluation framework applies regardless of who performed the test | Joint evaluation session with the external auditor present; the function’s view recorded if it differs |
| Timing around the close | “Not in close week” | Year-end controls can only be tested at year-end | Interim testing where the certification cycle allows; year-end fieldwork pre-scheduled with finance in the planning memo |
| Findings about the CFO’s own team | Sensitivity; the CFO’s reputation with the committee | Finance is audited like any other area | No surprises and the rating rule, applied visibly; the CFO’s response alongside; the chair briefed by the CAE, not ambushed |
| Management review controls | “My review is the control” | A review nobody can evidence is not a control the function can rely on | The management review controls standard: precision, evidence, follow-up, agreed in advance |
| Reliance on finance’s own testing | “Use our first-line results” | Reliance requires evaluating the tester’s independence and competence | A documented reliance assessment; reperformance of a sample; reliance reduced, not eliminated |
The SOX ownership question is the most consequential and the most often decided by default. Where the function performs the testing and the controller’s office owns the program, the arrangement works if it is written down, time-limited where the function is young, and visible to the committee. Where the function owns the program outright, the committee should know that its independent assurance over ICFR is coming from somewhere else, usually the external auditor, and should be comfortable with that. The SOX 404 guide and the control owners’ guide describe the program from both sides.
What a CFO should expect from a good function
The guide so far has mostly told the CAE how to behave. CFOs are entitled to expectations too, and a CFO who holds the function to the list below is helping it rather than threatening it.
1. I hear about every finding in finance before the draft report, with the facts and the proposed rating, and my response appears alongside.
2. The audit plan reflects a structured conversation with me about where finance is changing and where I think it is weak.
3. Fieldwork in finance is scheduled around the close and year-end unless the control can only be tested then, and I know the dates a quarter ahead.
4. Evidence is requested once, in one list, with the reason for each item.
5. Ratings in finance are set by the same rule as everywhere else, and I can see the rule.
6. Reports about finance arrive within thirty days of fieldwork ending.
7. When I ask for a view on a design, I get one within the time the decision allows, with the boundary stated once rather than a scope memo.
8. Internal audit coordinates with the external auditor so that my team is not asked for the same evidence twice.
9. When internal audit and I disagree, both views go to the committee on the same page, and I am not surprised by anything in the pack.
10. The budget conversation is about coverage and cost, once a year, and ends at the committee if we cannot agree.
The CFO’s ten expectations of internal audit
A CFO who gets all ten has a function worth funding, and a CAE who delivers them has a CFO who will defend the budget, bring the function into decisions and tell new finance leaders what the function is for. The list is also a useful annual conversation: a CAE who asks the CFO to score the function against it, and a CFO who answers candidly, have most of the relationship review they need.
A working rhythm for both sides
Good CFO-CAE relationships are built on a cadence, not on goodwill. The cadence below is common at companies where the relationship works.
| Cadence | Meeting | Content | Rule |
|---|---|---|---|
| Weekly or fortnightly | CAE and CFO, thirty minutes | What audit is seeing; what finance is changing; evidence and scheduling friction; early notice of anything significant | No agenda beyond those four; no pack |
| Monthly | CAE in the CFO’s leadership meeting as an observer | Context: the close, the forecast, the projects | The CAE listens; speaks when asked; is not a member |
| Quarterly | Pre-committee briefing | Every finding about finance in the pack, discussed before the pack goes to the chair | The CFO sees finance sections in advance as an auditee; the CAE sends the pack |
| Annually | Plan input session | The CFO’s view of finance risk; projects coming; where the CFO would like coverage | Input recorded in the risk assessment; the committee approves the plan |
| Annually | Budget conversation | Coverage, cost, efficiency, trades | Outcome goes to the committee either way |
| As needed | Deficiency evaluation session | ICFR deficiencies, with the external auditor | The framework decides; disagreements recorded |
| As needed | Advisory request | A system, a process, a transaction the CFO wants a view on | Advice on criteria and tests; the boundary stated once |
When the relationship breaks: four scenarios
Four situations account for most CFO-CAE breakdowns. Each has a right response that preserves both the function’s independence and the possibility of a working relationship afterwards.
| Scenario | What it looks like | Right response | Wrong response |
|---|---|---|---|
| The CFO wants a finding about finance softened | Redlines that change the cause or the rating; a conversation that starts “I think you have this wrong” | Facts re-examined on evidence; if they hold, the rating holds; the CFO’s view goes in the report; the chair is briefed by the CAE before the pack | Quiet downgrade; or refusal without re-examining the facts |
| The CFO cuts the budget without the committee | A headcount freeze or a budget reduction announced in the finance planning cycle | A one-page coverage impact to the CFO, then to the chair as a plan change requiring the committee’s decision | Absorbing the cut silently; or going to the chair without telling the CFO first |
| The CFO restricts access | A system, a data set or a team placed out of reach “for now” | Charter cited in writing; a short deadline; the ladder to the chair if unresolved | Working around the restriction; or escalating before stating the charter |
| The CAE has surprised the CFO | A finding about finance reaches the committee without the CFO having seen it | The CAE apologises for the process failure (not the finding), fixes the no-surprises mechanism, and tells the chair what happened | Defending the surprise as independence |
The fourth scenario is included because the function is not always the injured party. A CAE who surprises the CFO has broken a legitimate expectation, and a relationship that is going to work requires the CAE to say so. Independence is about conclusions; it is not a licence for bad process.
Partnership patterns at high-functioning companies
At companies where the CFO and the function work well together, the same patterns recur. None of them compromises independence; all of them require the CFO to understand what the function is for and the CAE to understand what the CFO is accountable for.
- The CFO introduces the CAE to new finance leaders as “the person who will tell you the truth about your controls before the regulator does”, and means it.
- The function’s findings about finance are discussed in the CFO’s own leadership meeting, with the CFO holding the owners to the action plans; the adoption architecture is run by the CFO, not by audit.
- The CFO brings the function into system selections and process redesigns at the criteria stage, and the function says what it will test rather than how to build it.
- SOX ownership is written down, time-limited where the function performs the testing, and reviewed by the committee annually.
- The budget conversation is about coverage, happens once a year, and ends at the committee if it cannot be agreed.
- The CFO and the CAE disagree in front of the committee occasionally, civilly, with both views on the page; the committee treats the disagreement as the system working.
- The CAE tells the CFO when finance has done something well, in the report and in the room; the credibility that buys funds the next hard finding.
Worked example: Halberd Software after the IPO
Halberd Software, a B2B SaaS company with about $310 million of annual recurring revenue, listed on the NYSE in September 2026 as an emerging growth company. Its first chief audit executive had been hired sixteen months before the listing with a team of four, growing to six by month seven of the post-IPO plan; its SOX program was owned by the controller’s office with a dedicated program manager, and the function performed the testing in year one under a dual-role arrangement scheduled to transition from FY2028. The CFO was the CAE’s administrative reporting line and, as a first-time public-company CFO, was learning the role at the same time.
The first test of the relationship came three months after listing, when the function’s quote-to-cash audit found 2,100 manual revenue adjustments in the period with a $1.9 million annual metering gap and 61 standing production administrators with write access to billing. The CFO’s initial reaction was that the adjustments finding should be a Low because the amounts were “inside the error threshold”. The CAE did two things in the same week: re-examined the facts with the senior auditor (they held), and walked the CFO through the rating rule and the deficiency evaluation framework, showing that the issue was the absence of a precision threshold on the review rather than the amounts themselves. The rating stayed Medium; the CFO’s response, which disagreed on severity and committed to a review redesign within a quarter, went in the report; the committee chair heard both views from the CAE before the pack and asked the CFO one question about the redesign date. The CFO later described the exchange as the moment he understood what the function was for.
The second test was the budget. In the first annual cycle the CFO proposed holding the function at six heads and moving the planned seventh hire into the SOX program office. The CAE brought a one-page coverage impact (the FY28 cyber and revenue recognition co-source would have to be cut, leaving two high-rated universe entities uncovered) and a trade (fund the seventh head from the dual-role hours that would transfer to the program office in FY28). The CFO accepted the trade; the committee saw both the original proposal and the agreed version. The third test was the one the CAE failed: a Medium finding on the FY27 agentic AI audit about a refund agent with no daily cap reached the committee pack a day before the CFO had been told, because the audit manager had assumed the controller would pass it on. The CAE told the CFO and the chair what had gone wrong, fixed the no-surprises step in the reporting checklist, and the relationship absorbed it. By the second year the CFO was bringing the function into the design of the usage-based billing controls at the criteria stage, and the dual-role transition memo for FY2028 was co-signed by both of them for the committee.
Frequently asked questions
Should internal audit report to the CFO?
Administratively, often yes; functionally, no. The Standards place functional reporting with the board (the audit committee), which appoints, removes, pays and evaluates the CAE and approves the plan. The CFO as administrative line handles day-to-day administration and provides input, but has no veto over scope, findings or ratings.
What can a CFO legitimately ask of internal audit?
Input to the audit plan, no surprises on findings about finance, efficiency and scheduling empathy around the close, coordination with the external auditor and SOX testing, timely reports, consistent ratings, and advisory input on criteria before decisions. None of these compromise independence; refusing them is isolation, not independence.
Can the CFO remove an audit from the plan?
No. The committee approves the plan. A CFO can propose a deferral with reasons, and the CAE takes it to the committee with a recommendation. A CAE who defers coverage on the CFO’s instruction alone has crossed the plan-veto line.
Who should own the SOX program: internal audit or finance?
Management owns the 404(a) assessment; the committee chooses who performs the testing. Where internal audit tests, the arrangement should be written down, visible to the committee and time-limited for young functions, because a function that owns the whole program cannot independently assess it.
How should the CAE handle a CFO who wants a finding softened?
Re-examine the facts on the evidence; if they hold, the cause and the rating hold under the rating rule; negotiate wording and remediation; put the CFO’s disagreement in the report; brief the committee chair before the pack. Independence is about the conclusion; the process should still be fair and early.
How should the audit budget conversation with the CFO work?
Start from the coverage the committee approved and what it costs; show efficiency before being asked; separate mandated from discretionary engagements; offer trades rather than fights; and take the outcome to the committee either way, since a budget that cannot deliver the approved plan is the committee’s decision.
Related guides
- Internal audit vs SOX vs compliance vs ERM — who does what in the control ecosystem.
- Independence and objectivity in internal audit — what they mean and how they break.
- The internal audit charter — what GIAS requires, clause by clause.
- SOX for control owners — what testers ask for and how to pass testing.
- Evaluating control deficiencies — from exception to material weakness.
- The trusted advisor path — how stature is earned with executives.
- The escalation ladder — when and how to go over someone’s head, including the CFO.
- Your first audit committee meeting as CAE — preparation, content arc and candour.
- Pre-IPO SOX readiness — the 18-month plan and the dual-role transition.
Leave a Reply