Internal auditors: integral to good corporate governance
The IIA’s new chairman of the board, LeRoy E. Bookal, CIA, underlines the exceptional opportunity today’s professionals have to extend beyond their comfort zones and strengthen the auditor’s role in governance processes
BY NOW, ALL INTERNAL AUDITORS HAVE HEARD ABOUT THE ACCOUNTing problems at Enron. The mistakes made at the energy giant and other companies with highly publicized auditing failures were disasters for e accounting profession, but they have given us a unique window of opportunity. More than ever before, audit committees and boards are looking to internal auditors for help with corporate governance issues. And more than ever before, we have an opportunity to step out of our traditional comfort zone and strengthen the role of internal auditing in that realm.
Internal auditors’ unique full-time focus on risks and controls is vital to sound governance process — and to sound financial reporting. According to recent statistics from international news and information organization Bloomberg News, in more than half of the 673 largest bankruptcies of public corporations since 1996, external auditors provided no cautions in annual financial statements in the months before bankruptcy. Five of the seven largest bankruptcies in history, including Enron, Global Crossing Ltd., and Kmart Corp., followed annual reports with clean audit opinions from the external auditors. These statistics demonstrate that the larger and more complex the company, the more difficult it is for external auditors, management, and boards to have an accurate picture of risks and controls. With our unique viewpoint as independent but inside observers, internal auditors play a vital role within governance processes by keeping the board, senior management, and external auditors aware of risk and control issues and by assessing the effectiveness of risk management.
The need for internal auditing within corporate governance structures has never been more clearly demonstrated than by recent events. Take for example WorldCom , where $3.8 billion of dubious accounting was discovered by the internal auditor, who called the matter to the attention of the audit committee chairman when the then-chief financial officer resisted taking corrective action.
Audit committees and boards are facing skyrocketing liability costs and ever-increasing workloads. It’s no wonder that liability costs are rising — boards have to meet more governance challenges each year, but their resources for information about their increasingly complex organizations are limited. In the post-Enron era, it is surprising that boards of directors for any publicly held companies would choose to do without internal auditing. It is also surprising that investors, liability insurers, and other stakeholders have not questioned the decision to do without internal auditing more often.
AS THE IIA’S CHAIRMAN, I AM committed to working hard to help businesses — and the public — understand the key role internal auditors can play in governance processes. Under the guidance of its Executive Committee, The Institute is taking a strong stand on the importance of internal auditing at all publicly held companies.
To that end, in April, I appeared with IIA President Bill Bishop before the Special Committee of the Board of Directors of the New York Stock Exchange. We addressed what we believe are the four cornerstones on which effective corporate governance must be built: internal auditors, boards of directors, senior management, and external auditors.
In part, our testimony focused on the need for all publicly held companies to establish and maintain independent, adequately resourced, and competently staffed internal audit functions. We stated that if there is no internal audit function, boards should be required to disclose this fact in the annual report and state why internal auditing is not present. We have also called for public reporting on corporate governance principles and on internal controls.
The Institute is taking a more forceful stand on governance issues than ever, and in the post-Enron environment, management and boards are very receptive to this approach. But, when we call for internal auditing at all publicly held organizations, we need to ensure that internal auditors can contribute effectively to governance processes — that internal auditors are ready to step up to the challenges that come with this opportunity. When we call for public reporting on internal controls, we have to be ready to furnish boards with the information they need to make informed decisions and disclosures.
We have an opportunity today that may never come again, and it is of paramount importance to the profession’s image that internal auditors are qualified to fill the new roles they are being assigned.
Plotting the Course
The IIA’s new strategic directives are especially important if internal auditing is to fulfill its potential within corporate governance processes. During the past year, I have overseen the strategic planning process for The Institute, one that has produced a set of directives that will impact the internal audit profession in years to come. The four directives lead toward the establishment of a more visible internal audit profession, grounded in technology and responsive to the everchanging organizations in which we apply our professional skills.
1. PROFESSIONALISM AND COMPETENCY
To meet the demands of our organizations, today’s internal audit practitioners must play a strong and visible role in governance, risk management, and internal control processes. Under the first strategic directive, The Institute will promote professionalism and competency by encouraging all internal auditors to:
* Understand and respond to the changing needs of the profession.
* Practice in accordance with the Standards for the Professional Practice of Internal Auditing and abide by the Code of Ethics by implementing the Professional Practices Framework.
* Demonstrate quality within our departments by undertaking periodic quality reviews.
* Demonstrate personal quality and professionalism by achieving certification through The IIA’s Certified Internal Auditor exam.
* Address the needs of industry and specialty groups through special services, or through alliances and partnerships with other groups.
2. TECHNOLOGY
Auditors today have no choice when it comes to understanding technology and its associated risks, challenges, and opportunities. To help auditors understand technology and how to make it work for them, The Institute will become the internal audit professional’s primary resource for obtaining guidance, training, and research essential to building and maintaining core technology competencies; tools and techniques for creatively leveraging technology to enhance effectiveness and productivity; and professional products, services, and support available anytime, anywhere. In addition, The Institute will increase its own technology with e-commerce, Web training, and other Web-based member services.
3. GLOBAL VOICE
Under the third strategic directive, The IIA will speak with a global voice for the profession, seeking out and building alliances with other organizations to advance and integrate the profession worldwide.
Moving forward, The Institute’s goals will be to increase the visibility of the profession and to influence stakeholders, public and private-sector leaders, regulators, and internal auditors on issues affecting governance, risk, and control. It will continue to promote enhanced corporate governance, more definitive guidelines for world-class internal audit practices, stronger systems of internal control, more accurate and timely reporting structures, better coordinated internal and external audit services, and more effective management.
4. PROCESS/CHANGE MANAGEMENT
Finally, The IIA will examine the ways it serves its members, the products and services it offers, and the infrastructure — at both the volunteer and staff levels — needed to meet the rapidly changing profession. Preparedness is critical; therefore, both The Institute and internal audit practitioners throughout the world must be poised to address the changes that introduce new concerns and challenges on an almost daily basis. The goal is to have a nimble infrastructure that allows the organization to seize opportunities quickly and create value for its members.
Adding Value to the Governance Process
The Institute’s strategic directives are designed to help us meet the challenges ahead. But, if the internal audit profession is to fulfill its potential within corporate governance processes, action must be taken not only by The Institute but also by individual internal auditors throughout the world.
As internal auditors, we must reach beyond our traditional comfort zone and believe we are integral to governance. Then, we must convince management, audit committees, and the public. But before we can convince others that we are integral to effective governance, we first need to ensure that we will add value to governance initiatives.
There is no simple checklist showing everything internal auditors can do to add value, because, at times, techniques for adding value are as unique and personalized as the organizations for which we work. There are certain essential elements, however, that must be in place to have a working environment conducive to creating opportunities to add value:
WORKING RELATIONSHIPS. Effective corporate governance is founded upon strong working relationships between four groups: management, the board, external auditors, and internal auditors. As the WorldCom situation clearly illustrates, it is essential for each of these groups to have unrestricted access to the others, especially if information on risks and controls is to be communicated freely. There should be a comfort level that allows any of the four parties to pick up the phone at any time and seek advice, either as a group or in a private session.
STRONG LEADERSHIP. The internal audit function must have a strong, tenured chief audit executive to work effectively in governance processes. It takes time to build effective working relationships, and it takes strength, experience, and judgment to resolve governance issues satisfactorily.
INDEPENDENCE. If governance bodies are to rely on the work of internal auditors, independence is essential. The Institute recommends that, functionally, internal auditing should report directly to the audit committee and, in most cases, administratively to the chief executive officer. These reporting relationships will not only enhance independence, but will also foster the open communication necessary for effective governance.
AWARENESS AND PROBLEM SOLVING. For management and boards to come to rely on internal auditing in governance processes, it is not enough just to ensure that activities on the audit plan are performed each year. Contributing to governance processes entails active involvement in planning sessions and high-level meetings dealing with governance issues.
Internal auditors must maintain independence, but we must also go beyond just pointing out what is wrong; we need to be part of the solution. To do this, we must understand the business and its challenges.
PROFESSIONALISM. If we are to convince management, the board, and even the general public of the value that internal auditors can bring to governance processes, we must ensure that internal auditing is practiced professionally. All true professions require adherence to ethical principles and standards. Each profession is based on a common body of knowledge, and each has formal quality control mechanisms. Internal auditing is no different, in this respect, from other professions.
We need to practice internal auditing in accordance with the Code of Ethics and the Standards for the Professional Practice of Internal Auditing. Internal auditors should exhibit professional competency through attainment of The IIA’s Certified Internal Auditor designation, and internal auditing functions should demonstrate effectiveness through formal quality assurance review mechanisms.
PROGRESS THROUGH SHARING. Every time a major audit failure or control breakdown occurs, we can learn through the experience of others. After an event like Enron, auditors at all organizations should analyze what happened and why it happened so that they can apply this knowledge to their own organizations. The concept of progress through sharing” is so fundamental to the professional practice of internal auditing that for years it has been the official motto of The IIA. During this time of dynamic change in our profession, learning from each other’s mistakes is more important than ever.
Meeting the Challenge
Internal auditing is integral to good corporate governance. Our profession is especially challenged at this time, but we are well equipped to deal with corporate governance issues. We need to take advantage of the opportunity and ensure that our profession becomes a fulcrum for effective corporate governance.
To comment on this article, e-mail the author at lbookal@theiia.org
COPYRIGHT 2002 Institute of Internal Auditors, Inc.
COPYRIGHT 2002 Gale Group
