Datin Josephine Low, President, IIA Malaysia
Distinguished guests
Ladies and gentlemen
Assalamualaikum wbt and Good morning
Ladies and Gentlemen,
- Tough global economic environment, shorter product lifespans due to intense competition and complex business and supply chain structures are among the factors which pose strategic challenges to many organisations today. This, inevitably, requires organisations to have a greater and more holistic focus on risk management to ensure their strategies and business models remain viable given the endlessly changing business landscapes. This is perhaps one of the important lessons learnt from the global financial crisis – as we saw time and again, global corporations that failed to manage their risks effectively had been severely affected.
- A survey by Pricewaterhousecoopers published in the Internal Audit 2012 Asia Pacific Supplement noted that in today’s global marketplace, internal audit groups find themselves at strategic crossroads with two primary options: They can pursue the status quo of controls assurance based on risk-based internal audit plan, a path that could lead to functional obsolescence. Or they can take a risk-centric, strategic approach to their work, moving beyond the fundamentals of risk and controls to create a new value proposition where internal audit provides risk management assurance as well as assurance over controls. Not surprisingly, the study concluded that the latter strategic path is more likely to address the changing needs of Asia Pacific organisations and meet the rising expectations of senior management and audit committees.
- Another survey by Ernst & Young confirms the view that internal audit can no longer continue to operate as it always has. While acknowledging that there is no one-size-fits-all approach, the survey suggests that internal audit teams could consider the following practices:
- A focus on risks that matter;
- Clarity on mandate – finding the right balance between assurance and advisory;
- Putting in place teams with the right experience and competence to deliver the mandate.
- To enable internal audit functions to focus on risks that matter, familiarity with an organisation’s broader strategic objectives and business imperatives is certainly important. In a fast changing business environment, internal audit plans could become irrelevant if they fail to capture recent key events which could cause material disruption to business but were not foreseen when the plan was conceptualised.
- A more flexible framework which allows for audit plans to be modified in addressing emerging risks that matter would increase the relevance of internal audit functions in enhancing the effectiveness of risk management of organisations. Audit plans which consider business cycles and triggering events which alter the risk profile of organisations will make internal audit functions more relevant in the eyes of the board and management.
- Increasingly organisations expect their internal audit functions to provide more advisory-type services which involve providing strategic advice to management in addition to assurance services which focus more on control and compliance activities. Many internal audit professionals are now establishing themselves as subject matter resources to management around strategic initiatives, challenges and changes within their organisations.
- While the recognition of the value provided by internal auditing is welcome, it also poses challenges to internal audit functions in maintaining independence and in ensuring the appropriate and optimum mix of services. This will differ from one organisation to another and may need to change when circumstances within and outside the organisation change. The understanding of audit committee and management expectations on one side, and the organisation’s strategy, initiatives and challenges on the other, may help internal audit functions to decide on the appropriate balance.
- The ultimate value of any strategy or plan depends on the quality of the people involved in the development and execution of such strategy or plan. This principle is similarly applicable to internal auditing. As the role of internal audit gradually shifts into the strategic space, the need for internal audit teams to demonstrate additional competencies beyond traditional compliance, such as having deep industry knowledge and business acumen becomes more critical. These additional competencies will not only help in making their services more effective, but would also ensure that internal audit functions are duly respected and recognised by audit committee and management, an important ingredient in a healthy relationship.
- Like any other business functions, internal audit functions have to be carried out with resources which are not unlimited. With increasing demand for higher levels of competency, innovative solutions in bridging the knowledge and competency gaps need to be found. Bringing in experts or having guest auditor programmes which allow staff from other departments who have the requisite business knowledge and skills to join the audit function on secondment or for a key audit, could be considered. This helps to draw in talent from within the organisation as well as promote the role of internal audit within the organisation. Internal audit functions could also consider co-sourcing arrangements with experts from external organisations in complementing the available skill set and competency as well as providing opportunity for knowledge transfer from the latter.
Ladies and Gentlemen,
- Growth with governance, the theme for the Capital Market Masterplan 2 (CMP2), sends a clear message that the pursuit of growth must be underpinned by good governance. This is key in ensuring further development and sustainability of our capital market. This principle in CMP2 should also be emulated by our market players. The focus of corporations should not be just on risk taking to capture emerging opportunities and provide returns to shareholders, it should also be to attain excellence in governance to ensure short term growth does not compromise their long term sustainability. Our guiding principle of growth with governance is further reinforced by the Corporate Governance Blueprint which was released last year, which advocates that excellence in corporate governance is achieved through strengthening self and market discipline and promoting good compliance and governance culture.
Ladies and Gentlemen,
- The SC has long recognised the critical role of internal auditors in strengthening corporate governance. As such the role of internal auditors in contributing towards good governance is well established and well recognised in Malaysia. Malaysia’s Code of Corporate Governance 2000, our first code of corporate governance which was based on the Report on Corporate Governance by the High Level Finance Committee, mentioned that it is good practice for companies to establish internal audit function to undertake regular monitoring of key controls and procedure. Companies which do not have an internal audit function were required by the Code to review the need for one, from time to time. The increasing importance of the role of internal auditors was further emphasised when the Code was amended in 2007. A new paragraph was inserted requiring all companies to have an internal audit function and stipulating that head of the internal audit should report directly to the Audit Committee. The Malaysian Code on Corporate Governance 2012 underscores the critical role of internal auditors with respect to a company’s risk management and internal controls by requiring boards of PLCs to establish an internal audit function which reports directly to the Audit Committee. Furthermore in 2007 the Capital Market Services Act extended the protection provided to principal officers of a company against retaliation for reporting breaches of law to internal auditors.
- The Malaysian Code on Corporate Governance 2012 outlines the expectations of the internal audit functions which include compliance with professional standards set by recognised professional bodies and conducting regular reviews and appraisals of the effectiveness of the governance, risk management and internal control processes within the company, a tall order indeed but not far from the expectations which I discussed earlier.
- Internal audit functions should not just exist in form; it has to deliver the essence. In actualising their potential, internal auditors have to step up and meet increasing expectation especially in ensuring organisations are always on top of the risks which they face. This is certainly not a one person battle. Like other professions, the internal audit profession need to nurture a healthy ecosystem which would then provide the support for its further development. This includes ensuring a baseline competency amongst its members which will enable them to take on the challenges and expectations described earlier.
- In this regard I would like to stress that market recognition and acceptance which is attained through effective and consistent performance by your members is better than any other form of recognition. As with other aspects of life, respect has to be earned and sustained. Respect cannot be prescribed by law. While regulation could create some exclusivity, it does not necessarily guarantee respect and recognition towards the profession.
- The values upheld by members of the internal auditing professionals would also shape how the internal auditing professionals will be perceived in the market. Given your roles and functions, I cannot imagine that you would be able to meet the expectation, not just of those within your organisations but also of your external stakeholders including regulators, if your members are not committed to the values of your profession and to the interest of the public.
Ladies and Gentlemen
- The internal audit profession has certainly progressed well over the years and contributed towards our achievements in enhancing corporate governance in Malaysia. As our capital market grows further so would the complexities and risks that need to be dealt with by market players. Effective management of risks would be one of the success drivers which naturally open ample opportunities for internal auditors to contribute and make the difference. It is for all of you to chart the direction of your profession.
- In closing, I would like to thank the organiser for the opportunity to share my thoughts at this conference. I wish all of you a meaningful and successful conference.
Thank you.
