SmartSuite for the Chief Audit Executive
The Chief Audit Executive leads the internal audit function and reports functionally to the audit committee. They own the risk-based audit plan, the audit methodology and the function's independence, and give the board objective assurance over governance, risk management and control.
What you own
The Chief Audit Executive leads the internal audit function and reports functionally to the audit committee.
- Develop and maintain the risk-based annual audit plan
- Report functionally to the audit committee and administratively to executive management
- Safeguard the independence and objectivity of the internal audit function
- Set the audit methodology and the quality assurance and improvement program
- Oversee engagement execution, reporting and follow-up of management actions
- Coordinate assurance with the second line and the external auditor
- Report to the board on assurance coverage, significant findings and remediation
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defense set the frame; the chain shows where each process hands off to the next. Colors follow the role: navy is owned, blue is touched, gray is depended on.
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Direct reports
Works closely with
How SmartSuite supports this role
Lead
Internal audit. Gives the CAE complete visibility across the audit lifecycle: coverage against the audit universe, engagement status, key risk indicators and open issues, in one view.
Risk management. Links the annual audit plan to enterprise risks and strategic objectives so coverage is demonstrably risk-based.
Issues and actions. Tracks every finding to closure with owners and due dates, and flags aging actions before the committee asks.
Compliance management. Connects audit results to compliance testing and SOX evidence so the three lines report from the same records.
Reporting. Generates audit committee and executive reports summarizing assurance activity and remediation progress without manual compilation.
Products this role uses most
Industry reference
The IIA's Global Internal Audit Standards (2024, effective January 2025) define the role: a chief audit executive who reports functionally to the board, owns a risk-based plan and runs a quality assurance and improvement program with an external assessment at least every five years. NYSE listing rule 303A.07 requires listed companies to maintain an internal audit function.
Banking supervisors go further. The Basel Committee's The internal audit function in banks (2012) and the OCC's heightened standards (12 CFR 30, Appendix D) expect an independent audit function reporting to the audit committee. Public sector audit functions follow GAO's Government Auditing Standards (the Yellow Book) alongside the IIA Standards; healthcare systems reference the OIG's compliance guidance for audit coverage.
Related roles
Explore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
What is the Chief Audit Executive accountable for?
The Chief Audit Executive leads the internal audit function and is accountable for the risk-based annual audit plan, the audit methodology and quality assurance program, the function's independence and objectivity, and the assurance given to the board over governance, risk management and control. They report functionally to the audit committee and administratively to executive management, oversee engagement execution and follow-up and coordinate assurance with the second line and the external auditor.
How does SmartSuite give a Chief Audit Executive visibility across the audit lifecycle?
SmartSuite gives the CAE complete visibility across the audit lifecycle in Internal Audit Management: coverage against the audit universe, the status of every engagement, key risk indicators and open issues in one view. The CAE can see which parts of the universe the plan has reached, which engagements are in fieldwork or review and where findings are accumulating, without waiting for the Audit Director's summary.
How does the CAE show that the audit plan is risk-based?
The annual audit plan is linked to enterprise risks and strategic objectives in Enterprise Risk Management (ERM), so coverage is demonstrably risk-based rather than asserted to be. For any top risk the CAE can show which engagements address it and when; for any engagement, which risks and objectives justify it. That is the evidence the audit committee and regulators ask for when they test whether the plan follows risk.
How does SmartSuite track findings so nothing ages unnoticed?
Every finding is tracked to closure in Issues Management with an owner and a due date, and aging actions are flagged before the committee asks about them. The CAE sees overdue and repeatedly deferred actions across all engagements, which is the basis for escalation to executive management and for the remediation picture presented to the audit committee. Management's progress is read from the record, not reported by management.
How do the three lines report from the same records?
Audit results are connected to compliance testing and SOX evidence, so internal audit, the compliance function and the controls team report from the same records rather than three reconciled versions. SOX Compliance and Compliance Assessments & Testing hold the second line's testing; when internal audit relies on or re-performs that work, the relationship is recorded. That coordination with the Chief Compliance Officer and Chief Risk Officer is part of the CAE's remit.
How does the Chief Audit Executive report to the audit committee?
SmartSuite generates audit committee and executive reports summarizing assurance activity and remediation progress without manual compilation. The CAE reports to the Audit Committee Chair on coverage, significant findings and remediation from the same records the committee can read directly, and to the Chief Executive Officer on the administrative side. The External Auditor and the Chief Financial Officer work from the same findings when assurance is being coordinated.
How quickly can an internal audit function move onto SmartSuite?
New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows. For an audit function the first is the audit universe: load it and map it to enterprise risks, bring in the current plan and open findings, and configure the function's methodology into the engagement templates. Engagements in progress are recorded at their current stage. The Audit Director, Audit Managers, Audit Analyst and Audit Quality Assurance Reviewer then work in one system, and the CAE's reporting line to the committee is served from a record the function controls.
See SmartSuite for your role
Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.