Corporate governance: better informing the board about internal audit

Corporate governance in Mauritius has recently been issued a series of challenges that could have major implications for the internal audit profession. Many, although not all, of these have been in the financial services sector. We only need to look at a few international cases to understand the full impact of such events;

•  2008 – Bernard Madoff Scandal – tricked investors out of $ 65 billion through the largest Ponzi scheme ever – 150 years in prison for the CEO and the finance director.

•  2002 – Worldcom Scandal – inflated assets by $ 11 billion – CEO sentenced to 25 years in prison. CFO fired and company filed for bankruptcy.

•  2009 – Satyam Scandal – falsely boosting revenue by $1.5 billion – CEO and brother sentenced to life imprisonment.

What these, and other examples, have in common is that internal audit did not appear to be positioned, tasked or resourced properly to act as the effective eyes and ears of the board as the third line of defence in managing organisational risk.

Our experience in BDO has allowed us to develop a framework for internal audit and this offers boards ten essential actions to ensure companies maximise the value they get from internal audit and gain maximum protection and assurance from its activities. While this detailed guidance is produced primarily for private-sector organisations, boards in the public sector may also find it of value. In summary the ten actions are

•  Evaluate the business case for an internal audit function

•  Assess and approve the internal audit charter (terms of reference) and review regularly.

•  Ensure a close working relationship with the head of internal audit, promoting effective formal and informal communication.

•  Assess the resourcing of the internal audit function.

•  Monitor the quality of internal audit work, both in-house and external.

•  Evaluate, approve and regularly review the risk-based annual internal audit plan.

•  Oversee the relationship between internal audit and centralised risk monitoring.

•  Ensure the collective assurance roles of internal audit, other internal assurance providers and external audit, are coordinated and optimised.

•  Assess internal audit findings and the breadth and depth of internal audit reports.

•  Monitor management implementation of internal audit recommendations.

The internal audit profession in Mauritius is at a crossroad and this is mainly due to the fact that not all Boards are as welcoming of the idea of giving internal audit a proverbial seat at the table. This is also a reflection of a lack of risk management culture within companies. It remains a “nice to have” function, a box ticking exercise to comply with Code of Corporate Governance, as opposed to a “must have” function. In fact, many Boards in Mauritius still believe that internal audit is a finance director 'problem' and even more surprisingly, the same sentiment runs amongst the audit committee members. A plausible explanation behind this perception may lie in the fact that the board is not being kept abreast of the latest developments in the profession. This is further exacerbated by a lack of defined mechanism in place to test the audit committee effectiveness on a periodic basis.

The vast majority of Boards in Mauritius still views Internal Audit as the ‘policeman’ of the organisation; worse, some even confuses them with forensic auditors. In contrast, multinationals operating in developed markets have a different business approach to internal audit. They are generally viewed as professionals who will work with the organisation’s major functional units such as sales, marketing, finance, procurement, HR etc. to generate value to its various stakeholders.

A confluence of increased regulation, intense focus on corruption and heightened scrutiny of risk management has changed the role of the internal auditor and I believe that as Internal Auditors in Mauritius, we have a great challenge to push executive management and the board to respond to these changes. From evaluating deficiencies in the financial controls to improving business operations efficiency, the Internal Audit profession has evolved to a great extent to meet the expanding needs of management and other stakeholders.

A key ingredient to a value added internal audit function is finding auditors with the right skills and capacity to deliver a modern approach and address organizational performance issues. As the profession continues to evolve, we are seeing a transformation in the skills and attributes required for professional success. Technical skills remain absolutely necessary, but they are no longer sufficient on their own. Of the five most sought-after internal auditor skills by global recruiters, only one covers a technical area:

•  Analytical and critical thinking

•  Communication skills

•  Leadership skills

•  Business acumen

•  Risk management

All too often in Mauritius, the internal audit function is pitched as a commodity rather than as a service; be it an in-house, a co-sourced or an outsourced function, the Board needs to demand more from their auditors.