Assalamualaikum wbt. And a very good morning
Yang Berusaha Pengerusi Majlis, Presidents and Board Members of the Institute of Internal Auditors Malaysia and Malaysian Association of Certified Public Accountants
1. Thank you for inviting me to give a keynote address to what looks like Malaysia's largest gathering of auditors and accountants. The topic that was suggested to me for the keynote address is Corporate Governance in Malaysia - Achievements and Challenges. However, given the crowd that is present, I have taken the liberty to focus on corporate governance issues which are of particular relevance to the auditing and accounting professionals.
2. We are witnessing in recent times, increasing criticism and cynicism about the auditing profession, in the international scene. Some of you may have heard the following phrases or words being used to describe the state of the profession - "Accounting Abracadabra", "The Auditors are Always the Last to Know", "Earnings Hocus Pocus", "How Companies Come Up With the Numbers they Want", "Pick a Number, Any Number". The internal auditing profession has similarly met with immense skepticism about its ability to independently and objectively assess processes employed by management. This has certainly raised cause for concern and any such perception should be addressed forcefully.
3. The conference today on auditing in the new millennium addresses the critical aspects of the challenges facing the auditing profession - governance, control and assurance. I would therefore like to congratulate the joint-organizers of this conference for their commitment in organising this timely and highly relevant conference. In bringing to you this significant conference, the IIAM and MACPA have demonstrated how professional bodies can play a leadership role in nation building through the pursuit of professional excellence. Having said that, this conference must be part of a wider effort to respond to the challenges facing the profession. I urge IIAM, MACPA and other relevant professional organizations to continue to take on this leadership role.
Good Governance 4. The issue of enhancing standards of governance has occupied much of our thoughts recently, and continues to "buzz" in corporate and regulatory circles, both domestic and international. It is clearly an area to which the SC - and indeed all parties concerned in restoring investor confidence - is giving significant emphasis. The release of the High Level Finance Committee Report on Corporate Governance has been followed through with the setting up of the Implementation Project Team, as well as the establishment of private sector initiatives such as the Institutional Minority Shareholder Watchdog Group. In addition, the Malaysian Institute of Corporate Governance continues to play a significant role in raising the awareness of corporate governance issues in Malaysia.
5. Good governance is said to promote relationships of accountability among corporate participants to enhance corporate performance. In this connection, key participants in the area of financial and risk management, internal controls and financial reporting are the board of directors, the audit committee, financial management, internal and external auditors.
6. The board of directors are the protagonists in the process. A board must understand a company's operations - from top to bottom; from beginning to end. It must demonstrate both a keen interest in overseeing the company's affairs, hunting down problems and a genuine eagerness for finding solutions. Key aspects of the board's oversight function includes that quality accounting policies, internal controls and that independent and objective external auditors are in place to deter fraud, anticipate financial risks and promote accurate, high quality and timely disclosure of financial and other material information to the board, to the public markets and to shareholders.
7. This oversight function is typically delegated by the full board to the audit committee, pursuant to the board's general ability under company law to delegate certain of its duties to committees. Of course in the case of companies listed with the KLSE or MESDAQ, the listing rules actually mandate that audit committees be established comprising a majority of independent directors.
8. In discharging its oversight capacity, the audit committee is neither intended to guarantee with certainty to the full board and shareholders the accuracy and quality of a company's financial statements and accounting practices or to be ultimately responsible for establishing the internal controls. The audit committee, as the first among equals, oversees the work of the other actors in setting up internal controls and financial reporting process.
9. Management typically will apprise the audit committee of the overall business environment and risks and its system for internal controls, and provide an explanation of the company's financial statements.
Once this basic financial knowledge has been imparted, the committee then looks to the internal auditor to verify management's compliance with the system of internal controls and any additional input on any significant judgments made.
The audit committee then looks to external auditors to conduct their review to assess management and the internal auditors.
10. Therefore a proper and well functioning system of internal controls and financial reporting exists when there is effective interrelationships between the three main groups- the full board including the audit committee, financial management including the internal auditors, and the outside auditors. To quote the phrase used by the Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committees -- (they) "form a 'three legged stool' that supports financial disclosure and active participatory oversight".
Internal controls
Ladies and Gentlemen,
11. The importance of understanding the interrelationships cannot be over-emphasised. Certainly, the financial crisis of 1997/1998 had highlighted various instances of internal control failures that resulted in significant cost to shareholders, raising issues of the quality of risk management practiced by Malaysian corporations. This is usually followed by a tirade of blame shifting and finger pointing - Where was the audit committee? Where were the internal auditors? Where were the external auditors? And ultimately of course - Where were the regulators?
12. The events certainly point to shortcomings in internal control practices of companies - i.e. the failure to properly identify those risks and achieve a proper balance between risks incurred and potential returns to shareholders. The innovation and complexities that result from a corporation's pursuit of profitable activities creates a constantly changing body of business and economic risks which should be identified and regularly reviewed.
13. Internal control in this respect is one of the principal elements in the management of risk used by the board to achieve the company's objectives. A sound system of internal controls depends on a thorough and regular evaluation of the nature and extent of risks to which it is exposed.
14. In response to the lack of emphasis given to internal controls by companies and pursuant to a recommendation of the Finance Committee, the soon to be introduced listing requirements will require directors to make a statement about the state of internal controls. A Taskforce was established by the KLSE to prepare guidance for directors of public listed companies on internal controls. The Taskforce is chaired by Encik Samad Alias, a very senior and respected member of the auditing profession. The draft guidance has since been released for industry consultation. I understand that the Taskforce is currently reviewing comments received.
15. The SC certainly commends the work of the Taskforce in developing the Guidance. It rightly adopts a risk-based approach to establishing a sound system of internal controls and reviewing its effectiveness. The company's internal control system should:
be embedded within its operations and not be treated as a separate exercise to meet regulatory requirements;
be able to respond to changing risks within and outside the company; and
enable each company to apply it in an appropriate manner related to its key risks.
16. The SC hopes that the reporting statement by companies on the state of internal controls respects not just the letter but also the spirit of the Guidance. It should be a descriptive statement, as that is most important from a reader's point of view. It is the information contained therein that will enable them to judge the board's approach to risk and control.
I would like to thank the members of the Taskforce, the Project Director and IIAM for taking time to produce this valuable contribution to our understanding on internal controls.
Financial reporting
Ladies and gentleman,
17. Moving on, it is fair to say that disclosure and transparency have increasingly become the first hallmark of good governance that investors look for. Quality information is the lifeblood of strong, vibrant markets. Without it investor confidence erodes. Liquidity dries up. Fair and efficient markets simply cease to exist.
18. Today, we also witness an explosion of on-line information sources, real time news feeds, and TV channels devoted to business news. All of this had reinvented how we gather and disseminate financial information. As the speed of delivery and the quantity of information increase exponentially through the Internet and other technologies, the quality of information must be our priority. On top of that a global economy demands that investors have confidence in financial numbers on a global basis.
Accounting standards 19. It goes without saying that in prioritising the quality of information, the standards by which companies produce their accounts is critical. They must be useful to investors in a way that provides transparency and consistency. We have made considerable progress in this direction. The Malaysian Accounting Standards Board was established in 1997 (just on the eve of the Asian financial crisis) under the Financial Reporting Act 1997 as the sole authority to issue, approve and review accounting standards for Malaysia. Companies are now required by law to comply with these standards. Powers of enforcement have also been conferred to the various regulators, including the Securities Commission to enforce compliance with accounting standards.
Auditing Standards 20. The infrastructure for financial reporting must, however, extend beyond accounting standards to include high quality auditing standards, strong auditing practices with effective quality controls, profession wide quality assurance and meaningful regulatory oversight.
Here the issue of auditor independence has dominated discussions in recent times - both of internal and external auditors.
Internal auditors
21. The internal auditor's role, as I have highlighted above, is to evaluate and report on the adequacy and effectiveness of controls established and maintained by management.
The internal auditor however occupies a unique position - he or she is employed by management, but is also expected to review the conduct of management. This can create significant tension, since the internal auditor's "independence" from management is necessary for the auditor to objectively assess management's actions, but the internal auditor's "dependence" on management for employment is clear.
22. The Malaysian Code on Corporate Governance, released in March this year, attempts to strengthen the independence of the internal audit function. The Code prescribes among others that the Board or the audit committee should determine the remit of the internal audit function, review the internal audit programme and results of the internal audit process. These are embellished with a prescription that any removal of an internal audit member must be subject to the approval of the audit committee.
23. This underscores the fact that the effectiveness of the internal audit function depends largely on the support given to it by the board, through the audit committee. The board and the audit committee must establish and support a culture that promotes open disclosure on the part of the internal auditor.
External auditors 24. Moving on to the external auditing profession, they shoulder the responsibility of guarding the integrity of our companies' financial statements. In doing this they must remain inquisitive, skeptical and rigorous in their application of the highest standards. External auditors must therefore perform their services without being affected by economic or other interests that would call into question their objectivity and, accordingly, the reliability of their attestation.
25. The need for independent external auditors is premised on the fact that the integrity of financial information provided to investors is critical to the effectiveness and safety of the capital markets. Thus it is the independent external auditor's objective "second look" at the issuer's financial statements that gives confidence to investors that those statements are reliable and provide a credible framework for investor decisions to buy or sell securities of public issuers.
26. As such, to us, the crux of the issue on external auditor independence is (1) whether auditors making critical decisions are in an environment where they are free from pressures which might negatively affect their independence and objectivity when making a difficult decision and (2) whether the investors would also perceive the auditor to be free of potential and financial conflicts and independent.
27. The issue of external auditor independence has received significant attention in recent times. This has largely been instigated by evidence of increased reliance on fee income from consulting services, as well as the growing number of business relationships between auditors and clients. This calls into question the ability of auditors to be independent when carrying out their statutory responsibilities.
28. The outsourcing of internal audit functions to auditing firms also raises issues pertaining to their independence. The possibility for inherent conflicts and impairment of external auditor independence and audit integrity is greatest when a company out-sources its internal audit function to the same firm that performs the company's external financial audit. These arrangements eliminate the normal checks and balances that can be expected to operate where the internal and external audit functions are performed independently. In addition, the combination of these functions deprives the board of having an independent review and assessment of the internal audit function performed by an entity that is best situated to do so - i.e. independent external auditors.
29. In recent times we have also witnessed efforts by accounting firms to expand into legal services. Questions have been raised as to how a lawyer client relationship can be reconciled with the appearance of independence. Lawyers are there to act in the best interests of their clients whereas auditors owe a duty to the investing public to have an independent "second look" at financial statements prepared by management.
30. Given the important and evolving role that external audits and auditors play in ensuring the credibility of financial statements and in a company's risk management programmes, a review of these areas may be timely and warranted. The review is consistent with discussions taking place in more developed jurisdictions (such as the US) and it is crucial that this issue is addressed in a balanced and careful manner, having regard to the considerable expertise that audit firms can provide their clients.
31. I think all of us here are aware that there is nothing more important to the accounting profession than its credibility through its reputation for independence and objectivity. The issues I have raised today have been around for a while and are complex and perplexing. And while there will probably be deep differences of opinion, we will have to evaluate the differences with due consideration for the protection of the credibility of financial reporting and at the same time the viability of the auditing profession.
Reporting on the New Economy
32. Before I conclude, allow me to highlight another issue that has been receiving considerable attention - reporting on New Economy companies. Today we witness new industries spurred by new services and new technologies and they are creating new questions and new challenges that must be addressed. We are also witnessing a shift from an industrial economy to a more service based one; a shift from bricks and mortar to technology and knowledge.
33. This has important ramifications for our disclosure and financial reporting models. We have long had a good idea of how to value manufacturing inventory or assess what a factory is worth. But today, the value of R&D invested in a software programme, or the value of a user base of an Internet shopping site is a lot harder to quantify. Existing financial reporting models may not be able to ensure that true value - and the drivers of that value - is being reflected properly in publicly available disclosure. These issues therefore also require attention.
Conclusion
Ladies and gentleman
I have sought to highlight the issues that are getting the attention of the Commission.
34. Let me also add that I believe that many members of the public accountant profession and auditing community discharge high professional standards. However, there is a great need today for leadership that can take financial reporting and auditing through the 21st Century. This leadership must be willing to challenge the status quo and look for new ways to make audits more effective, to improve upon the financial reporting model, to meet the expanding globalisation of the capital markets, to protect and ensure the integrity and independence of the standard setting process and to meet the demands of ever changing technology. These leaders in meeting these challenges must be willing to put investors and professionalism first. I hope the issues I have raised will set the tone for discussions over the course of this conference and inspire lively debate.
