Fractional CAE Engagement Models, Onboarding, and Independence

The case for integrated assurance is easy to agree with and hard to buy. The three perspectives on our landing page — the leadership team that owns the risk, the board and its Audit Committee that must rely on what is reported, and the external audit partner who depends on the quality of what sits underneath the opinion — all point to the same end state: one risk taxonomy, one assurance plan, one issue register, one report. The question that decides whether it happens is not "does this make sense?" It is "how would you actually deliver it, and what changes in my first ninety days?"

This blog post answers that. Section #1 sets out the five ways we engage, with the Synergy-IA Fractional Chief Audit Executive that anchors most engagements, interim coverage when a seat is suddenly empty, combined-assurance design and uplift for organizations that already have the pieces, targeted reviews for specific exposures, and external quality assessment for functions that have never been measured against the Global Internal Audit Standards. It also explains how we price: to the risk retained, not to hours, and, where the model is designed to reduce overtime, how the fee steps down on a trajectory agreed in writing at the outset.

Section #2 walks the first ninety days: what is diagnosed by day thirty, what is designed and approved by day sixty, and what is executed and evidenced by day ninety. Buyers deserve to know exactly what will be in the Audit Committee's hands at the end of onboarding, so we name the deliverables rather than describing activities.

Section #3 states the independence position plainly, because a single senior practitioner standing between management and the Audit Committee only works if the boundaries are explicit: what we will not own, how advisory work is separated and disclosed, why second-line scope is declined where it would impair third-line assurance, and how direct assistance to the external auditor, where contemplated at all, is delivered under the external auditor's direction and documented as such, subject to the rules that apply in your jurisdiction.

Read it from whichever seat is yours. This is the section you can hold us to.

1. How we engage

Pricing for each model is scoped to the risk retained rather than to hours. Where the model is designed to reduce over time, most commonly the fractional CAE — the fee profile steps down as the function stabilizes, and that trajectory is agreed in writing at the outset.

2.  The first 90 days

3.  Independence — stated plainly

• The fractional CAE provides independent assurance and objective advice. It does not own management's risk decisions, and it does not design or operate the controls it later tests.
• Where the engagement includes advisory work, that work is labeled as advisory, scoped separately, and disclosed to the Audit Committee.
• Second-line scope is not accepted where it would impair the ability to provide third-line assurance on the same subject within the engagement period.
• The reporting line to the Audit Committee is primary, not dotted. Escalation to the Committee is available without management clearance.
• Direct assistance to the external auditor, where provided, is delivered under the external auditor's direction and documented as such.

By this point, the model should be legible: one taxonomy, one plan, one register, one report — delivered by a senior practitioner whose independence is engineered, not asserted. What separates a durable assurance capability from a well-formatted retainer is rarely the deck. It is the quality of the questions asked before the engagement letter is signed. Ask these three.

1. For the Leadership Team (the model and its economics). Which of your engagement models fits the risk we actually retain, and what does the fee look like in year three? The answer should name the model and the fit without hedging, and where the model is designed to reduce over time, put the step-down trajectory in writing at the outset, as Section #1 commits. A practitioner who cannot describe what the engagement looks like when it is working, and when it ends, has priced a retainer, not a capability.
2. For the Audit Committee (the first ninety days). What exactly will we have received by day ninety, and what baseline will we hold you to afterward? Section #2 names the artifacts: the assurance landscape map, the single taxonomy and rating scale, the one assurance plan, the consolidated issue register with owners and dates, the first consolidated report, documented independence safeguards, and a performance metrics baseline. If the answer arrives in activities rather than artifacts, onboarding has not been designed; it has been improvised.
3. For the external audit partner (independence in practice). How are the safeguards documented, how is advisory work separated and disclosed, and if direct assistance is contemplated, under whose direction is it delivered, and is it permitted under the standards that govern this engagement? Section #3 answers the first two. The third deserves a jurisdiction-specific answer: the rules on external auditor use of internal audit work differ between the ISA framework (ISA 610) and the PCAOB's standards in the US, so the credible response is a documented position confirmed against the applicable rules, not a confident generalization.

Ask the three questions. The answers, or the absence of them, will tell you more than any proposal. The full perspectives from all three seats are on the landing page.

To learn more about Synergy-IA or our Fractional CAE Services, email us at information@synergy-ia.com