To help establish the authority of the internal audit activity, an internal audit charter should document the chief audit executive's (CAE's) reporting line. This information clarifies the CAE's position within the organization, reinforces their independence, and underscores the authority granted to them by the board, which is crucial for enabling the internal audit activity to fulfill its mandate effectively.
IIA Standard 1110 - Organizational Independence, which emphasizes the importance of defining the CAE's reporting lines in the internal audit charter to ensure organizational independence.

According to ISO 31000, the risk management framework is designed to be adaptable and effective for organizations of all sizes, including very small entities. This flexibility ensures that all types of organizations can implement risk management practices that are appropriate to their context, scope, and risk profile.
ISO 31000 - Risk Management Guidelines

When the Chief Audit Executive (CAE) reports to the Chief Financial Officer (CFO), there is a potential risk of impairing the independence and objectivity of the internal audit function. This reporting relationship might limit the scope of audit engagements, especially in areas that could affect the CFO, such as financial reporting or other areas directly under the CFO's control. The CAE should ideally report functionally to the board or audit committee to maintain independence, as suggested by The IIA standards.
IIA Standard 1110: "Organizational Independence"

When developing a new cybersecurity risk management program, the first priority should be to define the cybersecurity risk appetite. This involves setting the acceptable level of risk the organization is willing to tolerate and is critical to guide the scope and focus of the cybersecurity initiatives. Performing a cost-benefit analysis of the program at this stage is also crucial to ensure that the planned measures are economically viable and align with the organization's strategic objectives.
Best practices in cybersecurity risk management

The most appropriate response for a chief audit executive (CAE) who has been asked to oversee the organization's insurance function is to report the request to the board and recommend alternate processes to obtain assurance related to insurance activities. Taking on operational responsibilities such as overseeing the insurance function could impair the objectivity and independence of the internal audit activity, making it difficult to audit those activities impartially in the future.
IIA Standards on independence and objectivity, particularly Standard 1130: Impairment to Independence or Objectivity.