Only 45.3 percent of organizations conduct even limited reviews of the appropriateness of their executive compensation and benefit programs, according to a new survey by the Institute of Internal Auditors.

The newly enacted Dodd-Frank Wall Street and Consumer Protection Act and recently effective proxy disclosure requirements of the U.S. Securities and Exchange Commission require public company boards to ensure the compatibility of the organization’s executive compensation practices and its business strategies and risks. The IIA’s survey reveals, however, that few companies do so, and only about one-third of such reviews are spearheaded by internal auditing. Moreover, the survey indicates that when conducting such reviews, internal auditors are most likely to focus on program compliance rather than on overall program design.

Executive compensation is a sensitive and emotional topic, noted Steven E. Jameson, chief audit executive of Community Trust Bancorp Inc., in Pikeville, Ky. “I sense that although many internal auditors are comfortable looking at components of executive compensation packages as part of broader audits of payroll practices or benefits administration, very few are willing to fulfill the larger and more valuable role of providing the board with an opinion of the appropriateness of the overall plan,” he said.

Lynn C. Morley, an internal-auditing consultant and former chief audit executive of Suncor Energy Inc. in Calgary, Alberta, agreed that limited internal audit review of executive compensation can add only limited value to the organization.

“Internal auditors won’t be able to fully understand all the risks unless they examine the system of compensation and benefits holistically,” she said.

Among the minority of respondents who report that their organization formally reviews the appropriateness of executive compensation and benefits, the top five focus areas are overall plan design (56 percent), cash compensation (56 percent), stock-based compensation (37.4 percent), deferred compensation (31.9 percent) and pension and other retirement contributions (25.3 percent).

Reputation risk is cited most often (41.9 percent) as the reason for conducting such a review, which is most commonly conducted by the human resources function (46.2 percent), followed by internal auditing (33 percent) and the legal function (20.9 percent). The results are shared most often with the board’s compensation committee (59.3 percent) or audit committee (38.8 percent).

The IIA recently released practice guidance on auditing ECB, "Auditing Executive Compensation and Benefits," which explores key risks that CAEs need to carefully assess before constructing an audit program. Among the risks are those related to financial reporting, operations, reputation and executive talent flight. The guidance also addresses audit approaches and considerations due to the sensitivity of ECB information and informs CAEs of the potential issues they need to consider as they scope an ECB audit, including the skills and knowledge needed by the audit team. The guidance is available at: http://www.theiia.org/guidance/standards-and-guidance/.