Puan Fatimah Abu Bakar, President Institute of Internal Auditors, Malaysia
Ms Patricia Miller, Vice Chairman, Professional Services, IIA Inc.
Distinguished guests
Ladies and gentlemen

Introduction

1. I am delighted to be here this morning. I would like to thank the Institute of Internal Auditors Malaysia (IIAM) for inviting me to deliver the keynote address for this year’s annual conference with the theme “Make the Difference - Be VITAL ¹.

2. As we have seen, external auditors have borne the brunt of the backlash from corporate debacles and fraudulent practices both at home and abroad. It is therefore a timely call for internal auditors to ‘make the difference’. I, for one, am a firm believer in this. Indeed internal auditors as a professional group can bring about a seachange to the standard and quality of corporate governance in Malaysia, thus enhancing the quality and investibility of our companies.

3. The pursuit of quality PLCs as you may be aware, is high on the agenda of the SC. Quality companies are integral to enhancing Malaysia’s competitiveness, promoting greater integration with the global economy and shifting the economy up the value chain – all of which are key thrusts of the 9th Malaysian Plan announced by the Government earlier this year. In fact the Plan underscores the critical role of the private sector in funding economic growth - it expects the private sector to grow on average, by 11.2% over the next 5 years. Such a demand on the private sector can only be met by companies that are well-managed, have visionary leaders and responsible boards, and observe high standards of corporate governance. Capable and professional internal auditors with the highest standards of professionalism and integrity are a vital component in this equation.

The Changing Role and Expectations of Internal Auditors

4. Internal auditors used to be described as ‘those who enter the battlefield after the battle is over and bayonet the wounded’. To be fair, I do not think internal auditors deserve this dubious distinction. At least not any more. Thanks, perhaps to the brave trio from WorldCom – the internal audit vice president and two of her team members who doggedly uncovered the evidence of fraud that sent WorldCom into bankruptcy.

5. In fact, I would prefer to describe internal auditors as the ‘independent insider’ or perhaps, ‘the in-house regulator’. According to a study in the US, employee tips and internal audits uncover more frauds within a company than external auditors. I do not believe there is a similar study in Malaysia but from the SC’s own experience, PLC’s internal audit findings, have on various occasions, been extremely useful, if not instrumental, in several of the enforcement actions we have taken.

6. On other occasions though, I believe that corporate frauds could have been discovered in a more timely manner or perhaps even avoided, had internal auditors been more vigilant. Investigative audits and the SC’s surveillance and investigation efforts have shown that many of the losses suffered by PN4 and PN17 companies were largely caused by mismanagement, fraud and other unethical practices. Surely internal auditors could have played a more proactive role in surfacing these misdeeds before the companies become financially distressed.

7. The SC would like to see PLCs utilise better practice principles when establishing the role and managing the use of their internal audit functions. Internal auditors can only effectively discharge their role as the ‘independent insider’ or the ‘in-house regulator’ if the Board and management recognise the value and strategic significance of the role of internal auditors. However as long as management and boards of companies see internal auditors as the ‘enemy from within’ and treat their role with detachment, discomfort or worse, distrust, the full potential of internal auditors can never be unleashed.

8. The regulators have given due recognition to the changing role and expectations of internal auditors. The principles of corporate governance enunciated in the Malaysian Code on Corporate Governance requires the Board of directors to maintain a sound system of internal control to safeguard shareholders’ investment and the company’s assets. The Code recommends that the board should establish an internal audit function. Where such function does not exist, the board should assess whether there are other means of obtaining sufficient assurance of regular review and appraisal of the effectiveness of the system of internal control. The provisions of the Code are further strengthened by Bursa’s Listing Requirements which require a listed issuer to ensure that its Board of Directors make a statement about the state of internal control in its annual report.

9. Although the Code and the Listing Requirements do not make the establishment of an internal audit function mandatory, Boards and managements of PLCs must be under no illusion that they can take their responsibility for ensuring an effective internal control system lightly. The SC expects companies to pay strict attention to the spirit and substance of these requirements. The Board and management must be no less than diligent and demanding in enforcing good corporate governance, particularly the responsibility for instituting strong and effective systems of internal controls and ensuring compliance therewith.

10. While securities laws do not impose specific duties on internal auditors, the whistleblowing provisions in the Securities Industry Act 1983 provide auditors with protection against possible retaliation by management where internal auditors have, in good faith, reported breaches of securities laws and any rules of the stock exchange. It was our belief that internal auditors can indeed make a difference in enhancing corporate governance practices within corporations that led the SC to introduce these provisions to protect whistleblowers when the Securities Industry Act was amended in 2004.

Good Governance Enhances Company Performance and Shareholder Value

Ladies and Gentlemen

11. I do not wish to belabour the point made by numerous studies and surveys - that all over the world, good governance practices make a difference investors are willing to pay for.

12. In a recent Australian Stock Exchange user survey conducted to understand the relevance of corporate governance disclosure to the investment and analyst community, a key finding was that, in total, 80% of private investors and 75% of organizations or professionals surveyed use corporate governance information in analyzing and reviewing equity investments.

13. There is no doubt that good corporate governance is inexorably linked to good performance and increase in shareholder returns. Consequently, good governance arrangements are increasingly recognized as a major contributor to company performance. It forms the basis of a robust, credible and responsible framework necessary to ensure the accountability of management to shareholders, value creation and responsible business practices.
Performance Beyond Conformance Leads to Substance Over Form

Ladies and Gentlemen

14. When we speak of corporate governance, it is essential to look at performance beyond conformance; at substance over form. Conformance is when the organization meets the requirements of the law, rules and codes. But this is merely the minimum that is expected of a listed entity. I expect public listed companies to go well beyond conformance; to use their governance arrangements to meet their stakeholders’ expectations of honesty and accountability and to enhance their overall performance to deliver value for their shareholders.

Internal auditors as the in-house regulator must be particularly vigilant about form undermining substance. Boards are often more focussed on conformance, concentrating on box ticking exercises whilst ignoring the spirit and substance of the laws, rules and codes. This is often seen for example in the appointment of independent directors where often such directors, while outwardly appearing independent based on the legal criteria of proximity and relationship, are often beholden to the company or its chief executive, thus interfering with their ability to exercise independent management or to act in the best interest of the stakeholders.

15. This is not to say that conformance is irrelevant, just that mere conformance is inadequate. It is the minimum, the starting point. Indeed organizations need to achieve both conformance and performance and not trade one off against the other. Using an integrated risk management framework will help develop the right control environment and provide reasonable assurance that the organization will achieve both, within an acceptable degree of risk.

16. Rules-based and prescriptive systems tend to allow the guardians of corporate governance in a company to feel they have done their job so long as they can tick off boxes to say that they have complied with laws and rules. Internal auditors would probably understand best that a principles-based system which insists on substance over form is not that easily circumvented. Underlining the SC’s regulatory approach of ‘no more regulation than necessary’ is our commitment to move towards more principles-based regulation. But this however can only be achieved when there is a sufficient degree of market and self discipline, and less reliance on regulators to catch wrongdoers.

Good Governance is a Shared Responsibility

Ladies and gentlemen

17. Good governance is increasingly being institutionalized and valued. I would like to emphasise that corporate governance is a shared responsibility.

18. The SC continues to be relentless in our efforts to promote good corporate governance. From the Finance Committee Report on Corporate Governance to the Capital Market Masterplan, corporate governance is recognised as a priority area, critical to the attainment of a transparent, accountable and performance-driven corporate sector. In this regard, the SC’s responsibility is essentially to establish and maintain a robust legal and regulatory framework, one that strikes an optimal balance between encouraging entrepreneurial drive and protecting investors.

19. Many of you would be aware that corporate governance related cases are high on our enforcement priority list. It is encouraging to note that these efforts have been acknowledged. The CLSA-ACGA ‘Corporate Governance Watch 2005’ issued this year observed that enforcement is publicly demonstrated in Malaysia. In the most recent World Bank report on ‘Doing Business 2006’, Malaysia was ranked number three in regulating the liability of directors and fifth in terms of investor protection. Finally, the World Bank’s 2005 ‘Report on the Observance of Standard and Codes’ (ROSC) released recently observed that Malaysia is largely seen to be observing Corporate Governance practices and noted the strengthening of disclosure rules, the rights of shareholders, responsibilities of the Borad and whistleblower provisions.

20. The SC will continue with our enforcement efforts but regulatory discipline alone cannot ensure high standards of corporate governance. Self-discipline is as important for the corporation as it is for the individual. As individuals, most of us do what is right not because it is a legal imperative but because it is morally the right thing to do. That is what self-discipline is about and self-discipline among companies will go a long way towards ensuring good governance. For one thing you will not have the regulators on your back. For another, you will get value recognition from the market because there is sufficient evidence to show that shareholders will walk away from a company that does not practice good corporate governance. But there is more. Companies that show self-discipline may get easier access to the capital market. The greater the self-discipline, the less the need for regulatory discipline. This means that the cost and burden of regulation can be reduced, leading to a more efficient capital market and more competitive companies.

21. It is in the area of self-discipline that internal auditors have a most crucial role to play. Self-discipline requires the commitment of the board of directors, the management and critically, the internal auditors. The Board is the key enforcer of good governance – it acts as the oversight and supervisory body to ensure that the company minds its obligations to its shareholders and other stakeholders. Management, on the other hand, plays a key role in creating and maintaining systems and a culture that encourages good governance by designing appropriate policies and procedures to ensure risks are managed and proper conduct enforced. Internal auditors, with their focus on risks and controls, are vital to the governance process and to sound financial reporting because they are instrumental in providing that independent and objective opinion as to whether risks which may hinder the company from achieving its objectives are being adequately evaluated, managed and controlled.

Role of Internal Auditors in Effectiveness of Audit Committees

22. In this regard the internal auditors also play a key role in ensuring the effectiveness of the audit committee, an integral part of an effective audit function. The significance of the audit committee has long been recognised in Malaysia. Bursa Malaysia’s Listing Requirements on the establishment of audit committees have been in effect since 1993, long before Sarbanes-Oxley (2002).

23. The audit committee is important because it introduces an independent perspective of the company’s finances and brings to bear constructive challenge to the Board and management’s implementation of effective controls and governance processes. An effective audit committee is an indication of best practice and reinforces the independence and objectivity of the internal audit department.

Challenges for Internal Auditors Going Forward

Ladies and gentlemen

24. Let me now share with you what I see to be the more significant challenges for internal auditors going forward. As I have said earlier, internal audit is one of the fundamental checks and balances for good corporate governance. The traditional role of internal audit is well documented and understood. It centers on examination, evaluation and monitoring of the adequacy and effectiveness of the control structure of an organization. The contribution of internal audit in this regard cannot be diminished given that it improves accountability, promotes ethical and professional business practices, advances risk management, enhances communication, decision making and performance reporting and, contributes to quality outcomes and results.

25. However, it is clear that going forward, more is expected of internal auditors. Increasingly, the role of internal auditors is viewed as being linked to the processes, techniques and tools employed by an organization to achieve its strategic objectives. This development will represent significant challenges to internal auditors and will require them to be adequately equipped to meet these new demands, perhaps even to rethink some of the established tenets of the profession and adopt new ones.

Business Knowledge

26. Needless to say, it is essential for internal auditors to have the most thorough understanding of the business of the organization and the changing environment within which it operates. This involves going beyond the accounting and financial records to understanding the organisation’s strategies and business imperatives. The effective internal auditor needs to know the issues that concern the Board, the CEO and the management. He or she needs to be aware of new products, services and technologies; indeed this has been acknowledged by the theme of your conference. And he or she needs to have a thorough appreciation of the challenges faced by the organization, the industry to which it belongs as well as the consequent implications on the organisation’s performance.

27. Indeed, the challenge for internal auditors is to continually update and renew their knowledge of the business. Such business knowledge will encourage the Board and management to utilize internal auditors as a tool to help create business value. Internal auditors must have good business sense so that they can provide the level of services that management and the Board require in a timely and efficient manner.

Managing Competing Demands Through Independence and Professionalism

28. As ‘independent insiders’ internal auditors work with management for the board, via their reporting line to the audit committee. And therein lies the second significant challenge - managing competing demands. Internal auditors, particularly those in PLCs, must be adequately equipped to deal with the potentially conflicting requirements of these differing customers. This challenge, I believe, is best met by the time honoured tenets of the profession - independence and professionalism.

29. Internal auditors must remain sufficiently independent in fact and in perception. The heightened focus on corporate governance, financial reporting, risk identification and disclosure in current times confirm that the need for fearless, effective and appropriately independent internal auditors is, if anything, greater than ever.

30. Internal auditors must ensure that the organizational posture of their function allows them to operate independently. They need to demonstrate that they are free from conditions that threaten objectivity. In addition, they need to carefully manage the tension between their review and promotion of organisational priorities and activities, and, the act of establishing and implementing them. If independence is not maintained, the credibility of the internal auditor’s work may be brought into question.

31. Professional conduct is the other key to managing the competing demands thrust upon internal auditors. Professionalism demands that internal auditors possess appropriate and sufficient knowledge and skills and, that they maintain the highest standards of care in carrying out their work.

32. In this regard, I note that the professional practices framework issued by the IIA sets out the attributes and performance standards, including a code of conduct, that guide the behaviour, scope and quality control of internal audit assurance and advisory work. In addition, it is significant to note that the IIA standards were revised in 2004 to more directly address the internal audit responsibilities in the corporate governance arena. The revised standards acknowledge the close link between corporate governance and the practice of internal auditing, suggesting that the work related to corporate governance is fundamental to the basic practice and performance of the internal audit function.

Adding Value

33. Last but not least, is the challenge to add value. Internal auditors today cannot be static. In meeting today’s expectations, internal auditors must be seen to be adding value to the organisation. Now is the time to formulate a strategy that will take your audit and governance functions to the next level and affirm that the assurances given to senior management are business-focused, reliable and timely.

34. The role of internal auditors must evolve towards one of being a strategic partner to the organisation’s Board and management. Internal auditors must be responsible for many, broad and varied tasks, ranging from assessing the quality, economy and efficiency of business activities and controls, to advising on opportunities to harness emerging technologies and improved business practices.

35. The improvements in technology, the quick pace of financial innovation, and the evolving risk management techniques almost ensure that businesses, particularly PLCs, will increasingly use limitless configurations of products and services and sophisticated financial structures. These developments represent significant challenges to internal auditors as well as opportunities to add value. In this regard, I note that the subjects that will be covered during this conference are extremely relevant to enhancing the value-add potential of internal auditors as well as their role in good governance.

Conclusion

Ladies and gentlemen

36. In conclusion, let me say that today’s corporate environment poses considerable challenges for corporate governance structures and for the internal audit function, a key line of defense in these structures. However, as I have alluded to earlier, every challenge is an opportunity.

37. For the internal audit profession, these circumstances are an opportunity for you to cement your presence in corporate Malaysia. In this regard, I commend the IIAM’s commitment and dedication to professional development of the internal audit function. For internal auditors at the frontline, you have the opportunity to make the difference - to demonstrate your skills, common sense and resolve in the vital role you play.

38. On that note, I wish you all a very successful conference with benefits both for the profession as well as the individuals attending.

Thank you.