The supervisory committee should receive the findings—not just the findings management is comfortable sharing.
In Part 1 of this series, we explored compliance’s challenge: working within management while maintaining the freedom to question its decisions. Part 2 turns to internal audit, where the reporting relationship is different. Internal audit reports directly to the supervisory committee—not to management. That relationship provides both a destination for audit results and an escalation point when concerns remain unresolved.
Here is the tension: management should have an opportunity to question a finding, but it should not control whether a supported finding reaches the committee. At the same time, auditors must understand the processes and evidence well enough to ensure they are reporting an actual weakness—not their own misunderstanding.
Protecting independence requires both boundaries to hold.
The supervisory committee is not an optional audience
Management’s participation in an audit is important. It provides records, explains processes, responds to preliminary findings, and develops corrective actions. That involvement helps make the review accurate and useful. It does not make management the final authority over audit’s conclusions.
The supervisory committee is the direct reporting destination for internal audit and the escalation point for unresolved audit concerns. Administrative coordination with management should not displace that relationship.
If a supported finding is uncomfortable, management can explain its position. It can challenge the evidence, disagree with the assessment, or propose a different response. But the auditor should not be pressured to soften or remove the finding simply to keep it off the committee’s desk.
A management response belongs alongside the finding—not in place of it.
Independence does not excuse an unsupported finding
The reporting relationship also places a responsibility on the auditor: know what you are reporting.
Suppose an auditor concludes that employees approved transactions beyond their authority. Before reporting that finding, the auditor needs to understand what the core report actually shows. Does it identify the employee who entered the transaction, the person who approved it, or both? Is approval recorded elsewhere? What authority limits applied at the time?
If operations provides evidence that the auditor misread the report, the conclusion should change. That is not management interference. It is a necessary correction.
But if the evidence confirms that employees exceeded their authority, the conversation changes. Staffing shortages, an inconvenient fix, or the absence of a loss may inform the assessment and response. They do not justify withholding a supported finding from the supervisory committee.
Independence protects an evidence-based conclusion. It does not protect a conclusion from scrutiny.
What the supervisory committee needs to do
The committee’s role is neither to automatically side with audit nor to make management comfortable. It oversees the audit work and monitors the control environment, while management remains responsible for operating the credit union and implementing corrective actions.
To make that oversight meaningful, the committee should ask:
Is the finding supported? Understand the evidence, the applicable expectation, and the process or control being evaluated.
Has management’s explanation been considered? Distinguish evidence that changes the finding from context that informs the response.
What remains unresolved? Receive the finding, management’s response, and any remaining disagreement without requiring the parties to manufacture consensus.
Who owns the correction? Expect a responsible person, a realistic deadline, and a clear description of the corrective action.
Did the correction work? Look beyond a “completed” status, especially when the same issue keeps returning.
The committee does not need to perform the audit or manage the fix. It needs reliable information to oversee both the review and the follow-through.
Negotiate the solution, not the facts
Each party has a distinct responsibility:
Internal audit: Understand the process, verify the evidence, and consider management’s explanation. Correct unsupported conclusions and report supported findings directly to the supervisory committee.
Management: Provide context, challenge inaccuracies, and own corrective action. Do not pressure audit to change a supported finding to prevent committee visibility.
Supervisory committee: Protect direct access, evaluate unresolved concerns, and monitor follow-through. Do not make management agreement a condition for hearing an audit issue.
All three: Keep the record clear. Distinguish the finding, management’s response, corrective action, and any unresolved disagreement.
Keep the goal in view
Internal audit needs the freedom to report supported findings—and the discipline to get them right. Management needs room to respond, not control over what reaches the supervisory committee. And the committee needs to stay engaged, ask informed questions, and monitor corrective action.
The goal is accountability, not agreement. A supported finding should not stay off the committee’s desk simply because it is uncomfortable—and reaching that desk should be the start of oversight, not the end of the conversation.
