Internal auditing 26 August 2012 From police to partner August 2012 27 W hen Keith Stephenson started work in an in- ternal auditing depart- ment, he thought it was a backwater. “I think back and it seemed that internal audit was the place you put people when there was nowhere else to put them,” he recalls. “Internal audit was a function that didn’t have great visibility.” Stephenson, now a risk advisory part- ner with PricewaterhouseCoopers in Hong Kong, says times have changed dramati- cally since the 1990s. “It’s been a remark- able transformation. The internal auditor has been pulled out of effective obscurity 20 years ago into a high profile position.” That transformation was evident in a recent PwC survey of 1,500 stakeholders worldwide, which focused on the rising importance of risk management and the in- creasing expectations of internal audit’s con- tribution to the effort. The survey showed that company executives are calling upon internal auditors to identify and mitigate risks outside traditional internal audit core competencies. Monitoring fraud, ethics, data privacy and security have always been the duties of internal auditors. Now business continuity, large project risk, mergers and acquisitions, regulations and government policy, and reputation and branding have been added as areas that respondents said they expect internal auditors to oversee. Those tasks mark a departure from the old view of internal auditors as monitors – or worse. “Internal auditors were regarded as guard dogs,” says Kim Chong, the head of the internal audit division at the Hong Kong Monetary Authority and a member of the Hong Kong Institute of CPAs’ standards and quality accountability board. “But I think ex- pectations have changed.” For the most part, internal auditors have welcomed not only a shift in expectations, but also the change in perceptions. “I think – and I hope from our profession’s side – that we no longer want to be perceived solely as police,” says Winifred Ng, internal audit director at Hopewell Holdings and an Institute member. “We want to be seen as a consultant and busi- ness partner to the management team.” Stepping up The impetuses for this evolution were the landmark 1992 Cadbury Report into cor- porate governance in the United Kingdom, commissioned following a series of high profile corporate collapses – including those of Maxwell Communications and Bank of Credit and Commerce International – and, a Internal auditing has broadened from passive monitoring to the vital role of analysing and managing risk. George W. Russell asks internal audit experts about changing perceptions and what it means for the accounting profession Illustrations by Harry Harrison From police to partner 28 August 2012 Internal auditing decade later, the aftermath of the Enron and WorldCom collapses in the United States. Both events had international repercus- sions. Today, internal auditors say concerns over the continuing worldwide economic slowdown and the never-ending string of corporate scandals such as the recent rev- elations of money laundering at HSBC are among the reasons that they have been thrust to the fore once more. “Everyone is worried about compliance and control, giv- en the global economy,” says Ng. Once more, internal auditors are finding themselves stepping up to an ever more cen- tral role in company supervision. Terence Chow, head of group internal audit at equipment packaging manufacturer ASM Pacific Technology and an Institute member, points to supply chain manage- ment – a significant risk area – as an example of a company function that internal auditors have been called on actively to participate. Chow adds: “In the past, you just needed to see whether there was a separation of du- ties or whether there was sufficient control to avoid fraud. But now since you are a busi- ness partner of the operation, you also want to tell them how well the control is working and give them some analysis.” Internal auditors say they are more antic- ipatory than before in all areas of their work. “I think one of the most important roles for internal auditors is to make sure they do add value to their organization,” says Barry Ho, group chief internal auditor at Great Eagle Holdings, the Hong Kong-listed Chinese real estate company, and a member of the Insti- tute. “The way they try to do that is not only to audit something that’s already happened in the past, but also to consider what will be happening in the future.” Chow’s internal audit department boasts its own motto: “Insight, integrity, indepen- dence.” While integrity and independence are cornerstones of successful internal audi- tors, insight is a relatively recent addition, he says. “It’s about how you can give the man- agement insight from an independent party’s view on how well the operation is working.” Chow says his objective is still examining risk controls, but “looking in a deeper way rather than just a high level of compliance.” He says he wants to provide management with information they can use, rather than something that merely assures them. “It’s different from 10 years ago. Then you met the minimum requirements and gave them a general health report,” he says. “Now man- agers want to see specifically how opera- tions are affected.” New responsibilities mean continuous professional development. “Our CPA [quali- fication] gives us accounting and analysis skills but we also need risk management skills and how to apply this to day-to-day business,” says Ng at Hopewell. “Principles “Companies – even the Institute – find it increasingly difficult to recruit internal auditors.” August 2012 29 and guidelines are provided by the Institute and Hong Kong Exchanges and Clearing, and we use international benchmarks as well.” At the same time, internal auditors are faced with increased regulation that changes rapidly. Those at multinational corporations, in particular, must keep up with a raft of both international statutory and self-regulating standards. “For example, ASM has just complied with an audit for the EICC code of conduct,” Chow says, referring to the Washington- based Electronic Industry Citizenship Co- alition, an industry lobby group. “It’s new to us. The point is that you need to be very alert about what is going on in your industry as well as the accounting profession.” Chances of conflict To be sure, not all internal auditors are com- fortable with their new responsibilities, sug- gesting that an advisory role conflicts with their auditing duties. “We need to balance be- tween auditing and consulting,” says Ronnie Wong, director of internal audit at the Uni- versity of Hong Kong and an Institute mem- ber. “We do not want to be thought of taking a dominating role in deciding what the depart- ments should do in particular situations.” Stephenson suggests the truth might lie in the middle. “There is this debate about whether you are a policeman or a consultant,” he says. “I think you need to be a ‘smart police- man.’ You’re giving warmth and comfort on control structures, and where possible you’re giving smart answers on how these can be ob- tained more effectively and efficiently.” To achieve that, internal auditors need to improve their abilities outside technical ac- counting skills, they say. “One key skill is com- munication and another is business sense,” says Ng. “You’re trying to sell an idea not purely from an internal control side or docu- mentation issue but by applying a business perspective. That way the management team can more easily understand and accept it.” Audit committees In Hong Kong, all listed companies must estab- lish an audit committee, comprising of non- executive directors only and having at least three members. “The internal auditor and the company audit committee have to work very closely together,” says Chow at ASM. “They [non-executive directors] are the external directors, not from inside the com- pany, so the internal audit group is filling a gap between them and management,” he adds. “We supply them with information and keep them updated on the company, on what the risk areas are, on what the controls are, on what our concerns are, and then they also feed back to us about their concerns.” There are some obstacles, however, to effective interaction between the internal audit department and the audit committee. “It’s about how you can give the management insight from an independent party’s view on how well the operation is working.” 30 August 2012 Internal auditing “Sometimes the head of internal audit is in awe of the audit committee chairman and sometimes the audit chairs don’t feel com- fortable with the internal auditing head,” observes Stephenson at PwC. Part of the problem, he says, is a lack of finesse on the part of some internal audi- tors. “If you’ve got smart ideas but if you can’t present or you don’t have gravitas you will be struggling,” he says. “You need boardroom presence. You need to match the CFO, if not the CEO. You can’t look weak or apologetic.” One benefit of the improved image of in- ternal auditors is that the field is attracting high calibre, senior recruits. “You’re now seeing Big Four partners going into internal audit, which wouldn’t have even been con- sidered 20 years ago. You need that polish at the top,” says Stephenson. Having more experienced accountants as internal auditors, he says, can make for bet- ter interactions with audit committees. “The head of internal audit should be comfortable enough to ring up the audit chair and have one or two meetings a year outside the au- dit committee setting,” Stephenson advises. “He should be the extended right arm of the audit chair when it works well.” While most agree that internal auditors should act as a partner to the company man- agement and the audit committee, there are potential pitfalls. “The inevitable risk of conflict arises as the internal auditor and au- dit committee are both remunerated by the company that they are reporting on,” warns Lionel Choong, an Institute member who is CFO of sourcing company Global Regency and who served on the audit committee of garment maker Tack Fat Group during re- structuring after its 2008 bankruptcy. He adds that internal auditors should put their core role – internal audit – first. “The internal auditor is an extension of theaudit committee’s execution of their supervisory responsibilities with respect to confirming the effectiveness, or otherwise, of the com- pany’s sound ethical practices and participa- tion from all ranks.” Recruitment woes Despite the role’s higher profile, many com- panies have difficulty attracting internal au- ditors. While senior accountants do switch to high level internal auditing roles, CPAs on their way up are reluctant to join internal audit departments. “Companies – even the Institute – find it increasingly difficult to recruit internal auditors,” says Raphael Ding, the Institute’s chief executive and registrar. “Auditors start their career by visiting different clients and not a lot of them want to settle in by just do- ing one single business.” Private sector professionals confirm a shortfall. “I have always an opening,” says Chow at ASM. “We’ve already received hun- “There is this debate about whether you are a policeman or a consultant. I think you need to be a ‘smart policeman.’ ” August 2012 31 dreds of applications [but] most applicants are from pure accounting firms, whether Big Four or second-tier or local companies,” he says. “This is not exactly the right mix that we want to have. We want people who have at least two or three years of working experi- ence in the commercial area so that they can understand how a real business is running.” One solution for companies short of in- ternal auditors is to outsource all or part of their internal auditing functions to third parties, such as accounting firms. “Increas- ingly, companies are engaging an external firm as internal auditor, selected by the audit committee, to ensure independence, trans- parency and corporate governance,” says Choong at Global Regency. But while this is common globally and in certain Asia Pacific countries such as Austra- lia and Singapore, the idea is yet to catch on in Hong Kong in a big way. Stephenson at PwC, which has a substan- tial third-party internal audit business, says there are three types of contracts. “There are one-off pieces of work, there is co-sourc- ing where the head of internal audit needs support in specialist areas – such as health and safety, treasury and information tech- nology – or outsourcing the whole thing.” He says Hong Kong is becoming more aware of the advantages of third-party inter- nal audit. “You blend the commercial exper- tise of internal audit with the discipline of ex- ternal audit and that works very well indeed.” Further developments The growing sophistication of internal audit- ing in Hong Kong is yet to be matched in the mainland – although there are encouraging signs. Financial institutions, for example, say mainland regulators are particularly aware of the importance of internal auditing. “The effectiveness of the internal audit function within the bank is closely monitored by the China Banking Regulatory Commis- sion,” says Telly Chan, head of China audit and group internal audit at Standard Char- tered Bank China and an Institute member. Stephenson, who has studied internal au- diting issues in China, says the performance of internal auditors in Chinese companies can depend on an organization’s size. The heads of internal auditing at larger organiza- tions in China are very modern and proac- tive in their approach, he says, but internal auditors are far tamer at smaller companies. Both Hong Kong and the mainland pres- ent plenty of new opportunities for internal auditors. Overall, and despite some reserva- tions, internal auditors are embracing their new-found popularity and ability to provide practical advice. As Ng at Hopewell says of her expanded role: “You are no longer just talking about theory or documents but the real world of business.” “You are no longer just talking about theory or documents but the real world of business.” . expect internal auditors to oversee. Those tasks mark a departure from the old view of internal auditors as monitors – or worse. Internal auditors were. important roles for internal auditors is to make sure they do add value to their organization,” says Barry Ho, group chief internal auditor at Great Eagle