Distinguished Guests, Ladies and Gentlemen, thank you for inviting me to speak to all of you today. Allow me first to extend my congratulations to the organisers for the timely launch of the survey on the "Profile of Institute of Internal Audit in Malaysia" in conjunction with the seminar appropriately titled "Internal Audit - A New Paradigm".

Corporate governance

The issue of enhancing corporate governance has occupied much of our thoughts recently, and continues to be the "buzzword" in corporate and regulatory circles, both domestic and international. It is clearly an area to which the SC - and indeed all parties concerned in restoring investor confidence - is giving significant emphasis. The release of the High Level Finance Committee Report on Corporate Governance has been followed through with the setting up of the Implementation Project Team, as well as the establishment of private sector initiatives such as the Institutional Minority Shareholder Watchdog Group. In addition, the Malaysian Institute of Corporate Governance continues to play a significant role in raising the awareness of corporate governance standards in Malaysia.

The role of Internal Audit

It must be highlighted that the achievement of good corporate governance will ultimately be the result of co-operative efforts between regulators and parties subject to such regulation. It is in the interest of corporate Malaysia for standards of corporate governance to be raised and thereafter maintained, as effective corporate governance ensures that long-term strategic objectives and plans are established, and that proper management and management structure are in place to achieve those objectives; while at the same time making sure that the structure functions to maintain the organization's integrity, reputation, and accountability to its relevant constituencies. Enforcement alone cannot guarantee good corporate governance. Whilst measures to enhance corporate governance are primarily aimed at boards of directors, who are seen as the agents responsible for protecting shareholder value, the internal audit fraternity is another industry group that is of particular importance.

At the conclusion of the Internal Audit Conference entitled "Emerging Roles for Internal Auditors" and the National Conference on Internal Auditing entitled "Building the Future of Internal Auditing" earlier this year, it was evident that the significance of internal auditing as a key contributor to corporate governance had emerged as a theme. This theme is no doubt close to your own thoughts today as the survey on the "Profile of Institute of Internal Audit in Malaysia" is about to be launched, and as you talk about "a new paradigm" in internal audit this afternoon. This new paradigm in internal auditing will see the profession becoming a front player in ensuring good corporate governance structures.

Requirement for Audit Committees

In 1994, the Kuala Lumpur Stock Exchange made it mandatory for every listed company to have an audit committee. The recognition of the importance of the audit committee is now universal. Audit committees were virtually unheard of in 1970. However in less than twenty years following that, they have become a statutory requirement for public companies in Canada and Singapore. They are now a normal feature in publicly-owned corporations in the United States. They are also widely accepted and expected in the United Kingdom, Australia, New Zealand and South Africa. The Stock Exchange of Hong Kong, on the recommendation of the Hong Kong Society of Accountants, has, since 1 January this year, imposed the requirement of audit committees in respect of all listed companies. Many of the best known reports on the subject of corporate governance such as the US's Treadway Commission report, Canada's Macdonald Report and UK's Cadbury report, recognise the importance of audit committees as a valuable mechanism for ensuring good corporate governance.

Changing perception towards Internal Audit

It is clear from these regulatory developments abroad that audit committees, and not internal audit functions, have been given greater recognition and responsibility to assist boards of directors in carrying out their duties properly in the interest of the company. However, it has now become apparent that audit committees require the help of internal auditing departments in order for them to be able to effectively fulfil their obligations to the board, the shareholders, and other outside parties who have a stake in a company. The contribution of internal auditors as business advisors or consultants to the company and their role in ensuring compliance with various statutes, policies and procedures cannot be over-emphasized.

It was within this context that the SC, at the National Conference of Internal Auditing in June this year, called upon the Institute of Internal Auditors Malaysia, the Malaysian Association of Certified Public Accountants, and the Information Systems Audit and Control Association (Malaysia Chapter) to draw the attention of their members to the crucial role of internal auditing. Internal auditors of the future will be the catalyst of change management and will increasingly be relied upon by the board of directors to assist in the formulation of strategic plans for their organizations. An appropriate internal audit function can also serve to ensure balance in the management of control functions within a company - that is, how internal control functions are directed by company directors and how such functions are monitored and controlled.

According to the Institute of Internal Auditors, the internal auditor should provide a broad range of audit coverage in a variety of areas and should offer adequate findings and recommendations to the audit committee. The internal auditor should not only have a good working relationship with the audit committee regarding corporate governance, financial reporting and control issues, but should also have good rapport with senior level management on such issues as well. The significance of the internal audit function is underlined by the Institute of Internal Audit's statement that "the ability of the audit committee and internal auditing to work well together significantly impacts how effective the audit committee can fulfil its responsibility ".

As there is currently still a gap for compulsory audit functions in public listed companies, there have been suggestion that without such support the audit committee may not be able to effectively discharge its oversight function. With the view that internal audit plays an integral part in corporate governance and that the establishment of an internal audit function will enhance shareholder value, the SC has therefore initiated recommendations to the High Level Finance Committee to further refine the Code on Corporate Governance by the introduction of a best practice requiring all public listed companies to set up an internal audit function. As you will be aware, it is also proposed that where there is no internal audit function, the audit committee should assess whether there are other means of obtaining assurance of regular review and appraisal of the company's internal control functions. The audit committee should also disclose such means. In other words, the audit committee would have to disclose how it could function effectively without the support of the internal audit function.

As contrasted with primarily financial and compliance-oriented auditing of the past, today's internal auditing must be vibrant, diverse and broad-based in order to survive in the rapidly integrated and globalized financial environment. The immediate challenge facing internal auditors is to keep pace with new demands and requirements. The approach that internal audit should adopt is that it serves as a proactive, value-added management function that embraces a multitude of responsibilities. However the profession moves forward, certain fundamentals, which the SC has reiterated in the past, must remain. They are:

• the need for internal auditors to preserve their independence and objectivity at all times;
• the development of the necessary expertise in the area of identification, measurement, reporting and management of business risk; and
• the need to understand organizational needs in order to serve the organization better.