Ewart S Williams: The internal auditor in our emerging financial
environment
Feature address by Mr Ewart S Williams, Governor of the Central Bank of Trinidad and
Tobago, at the Institute of Internal Auditors Anniversary Dinner, Port-of-Spain,
27 September 2007.
* * *
Let me thank the Trinidad and Tobago Chapter of the Institute of Internal Auditors for their
invitation to address you on the occasion of your 19th Anniversary. I am delighted for the
opportunity, though the invitation reminded me that life is so full of contradictions.
I must confess that for the five years I have been at the Central Bank I have had more of my
fair share of run-ins with my auditors - both with my internal and external auditors. I hasten
to add however, that I emerged from each encounter with a clearer understanding of the role
of the auditor, with tremendous respect for the internal and external auditors I dealt with; and
with a keen appreciation of how critical but how thankless the job of an auditor was.
I must also concede that from the vantage point of the Central Bank as regulator, it has
become exceedingly clear that we cannot have effective financial sector supervision in the
absence of close collaboration with the auditing profession. I am also convinced that for
efficient financial markets, the auditing profession is critical to promoting credibility and
confidence among shareholders and investors, and for promoting market discipline. But I
would come back to these issues after some brief reflections on how the auditing profession
has evolved.
I don't know if you remember, but it was not so long ago that internal auditing was
considered a boring and perhaps an unnecessary hassle. And then starting around the end
of the 1990s, a series of well-publicized international financial scandals changed all that.
Accountants and auditors became suddenly intriguing in 2002 with the collapse of Arthur
Anderson because of its involvement in the scandals surrounding Enron. Revelations of
significant corporate governance and accounting failures at Parmalat and Shell served to
demonstrate that these concerns were indeed world-wide, not just in the United States. As
The Economist Magazine said, "these scandals added unwanted color to a grey
profession".
But the attention was initially unwanted and perhaps unhelpful, for the judgment was that,
while in most of the cases high corporate officials betrayed the trust of their shareholders and
put their hands into the till, equal blame was put to the auditing profession - both internal
and external - because they did not do their jobs; they abdicated their responsibilities.
As you know, these scandals created suspicion of large corporations and raised the cost of
capital in international financial markets. In the final analysis, the verdict was that it was the
weaknesses in a few companies and major audit firms that were responsible for the
significant increase in the cost of capita across financial markets.
As you know, in the US, these scandals led to the enactment of the Sarbanes-Oxley Act,
which has been described as one of the most far-reaching reforms of American
business practices. The Act, for instance, made corporate management responsible for
maintaining "an adequate internal-control structure and procedures for financial reporting.
Company auditors were required to attest to management's assessments of these controls
and to disclose any material weaknesses. The Sarbanes-Oxley Act (SOX, as it is called) also
created the Public Company Accounting Oversight Board to help re-establish the trust that
investors could rely on the quality of audits. One of the mandates of the Board was to ensure
that emphasis on high-quality professionalism for accountants and auditors became the
standard.
Not unexpectedly the corporate scandals and Sarbanes-Oxley have had their impact on our
corporate environment here in Trinidad and Tobago.
For example:
•
like in the US, to address some obvious conflict of interest, the large auditing firms
have ceased to do a variety of non-audit work for their clients;
•
large firms are paying closer attention to corporate governance;
•
they are establishing independent audit committees;
•
boards are having a closer look at company loans to executives; and
•
internal audit departments are being given more recognition and more resources.
As I indicated earlier, recent developments have also heightened the importance of
accounting and auditing standards to the financial sector supervisory framework. As you
know financial innovation has increased the complexity of certain types of financial
transactions. At the same time, new accounting standards and anti-money laundering
statutes have created additional information and disclosure requirements for financial
institutions. The purpose of the new accounting standards is to provide the foundation for
credible financial statements and other disclosures that faithfully communicate the
institution's operating results and overall health. And the more the accountants come up with
new proposals to capture the essence of the financial transactions, the greater the onus on
the auditor to provide independent verification.
Perhaps an even greater justification for intensified collaboration between the auditor - both
internal and external - has been the changing pattern of financial sector regulation. As you
may know over the past few years, the Central Bank has moved to streamline the
examination process to make it more focused on risk-management. Our financial
regulation strategy now emphasizes:
• Active oversight by Management and the Board of Directors;
•
Clearly defined policies, procedures and authority;
•
Comprehensive risk measurement and risk mitigation; and
•
Adequate systems of internal controls.
Unlike in the past when the focus was mainly on capital and operating results, the new
regulatory strategy requires the Central Bank to take a far greater interest in the corporate
governance of financial institutions. Understanding how institutions are managed is now the
key. The hallmark of our regulatory approach is to identify problems early - well before they
manifest themselves in the financial statements when it is usually too late to act effectively.
Early intervention allows us to work with management and boards to effect remedial actions.
Early identification of problems essentially involves a qualitative assessment of an
institution's risk management processes and methodology, its internal control environment
and its compliance mechanisms. As regulators we cannot do this alone.
This is where you, as internal auditors, have a critical role to play. This is where the
work of the internal audit and the supervisory function are closely aligned, specifically in the
identification, management and mitigation of risk, and ensuring that the institution's
operations are conducted effectively, efficiently and in compliance with applicable laws and
regulations.
Increasingly over the last decade operations risk has taken on greater prominence within the
context of enterprise risk management systems. As you know, operations risk arises from
inadequate or failed internal processes, people or systems or from external events.
Operations risk has always been a part of banking but it has become a greater threat to the
safety of financial institutions in the contemporary financial environment. This is because the
institutions themselves have become more complex and their products and services have
become more numerous and varied. In addition, advances in information technology have
greatly increased the speed at which vulnerabilities in one institution can escalate into
serious problems in other institutions. Consequently, there has been an increasing incidence
of failure linked to operations risk.
In 2003, the Basel Committee on Banking Supervision, the main international
standardssetting body for bank supervision, identified as a cardinal principle the responsibility of the
Board of Directors "to ensure that the bank's operational and risk management
framework is subject to effective and comprehensive internal audit by operationally
independent, appropriately trained and competent staff". That's the mandate that all
banks face and that's the challenge for all of you internal auditors.
What this implies is that internal auditors must provide assurance that management is
appropriately identifying and managing risks that arise, both from business operations,
and from the systems supporting those operations. As Regulator, we also look to the
internal audit function
to provide us with evidence of action taken to improve the control
framework and mitigate risk.
At this stage I would like to risk a comment, again from the vantage point of the Regulator,
on how well our Audit profession seems to be matching up to its onerous
responsibilities. And I must confess that here I am not making a distinction between internal
and external auditors; I am lumping them both in the same basket.
Let me first state categorically, that I have every respect for the auditing profession and the
professional manner in which most of its members conduct their work. However, I
would be less than candid if I did not mention that there are too many instances where as
regulators, we are confronted with poor examples of quality audits.
Auditors are required to sign off on financial statements and to vouch for the presence of
adequate internal controls. In too many cases, we have evidence that the job was not done
with the thoroughness that is required.
As I mentioned earlier, regulators and other stakeholders place great reliance on the audit
opinion and basic auditing principles require that these opinions are qualified when, for
example:
•
A company is insolvent, with insufficient assets to support the company's
liabilities; or
•
The accounting system is so untidy that the auditors cannot reasonably be
expected to arrive at an informed judgment of the company's health; or
•
When the balance sheet clearly omits some of the contractual obligations of
the company - such as outstanding policy claims, in the case of insurance
companies.
Some other areas of concern that we sometimes encounter are:
•
Long delays in issuing management letters, sometimes well after the audit itself
has been completed;
•
Too liberal an interpretation of standard accounting rules; and
• Sometimes, inexplicable and undue compromises on corporate governance issues.
We should be reminded, ladies and gentlemen, that the 1989 auditors' reports gave an
excellent bill of health to the Workers Bank, right up to the moment when the Central Bank
had to intervene because of insolvency.
More recently, the Central Bank intervened in two insurance companies against the backdrop
of successive unqualified audit reports.
I have focused on examples from the financial sector, because that's the sector I know best. I
am sure that there are as many, if not more occasions in the non-financial corporate
sector where audit reports do not reflect the true reality.
I would like to raise one other challenge that internal auditors are likely to face, particularly in
smaller institutions, where there is not sufficient talent to go around. This challenge has to do
with maintaining the independence of the internal auditor.
Internal auditors are in a unique position to obtain an informed perspective of the
organizations for which they work. As such, they are in the best position to assist and advise
Management on developing the broad principles that should govern the risk management
and internal control environment.
On the other hand, to be effective, internal auditors need to be independent and cannot
assume a line-management role for control activities, including those they helped to design.
Accordingly, internal auditors need to be continually alert to conflicts of interest. It is a
situation that calls for delicate professional judgment to promote a win-win situation.
Let me close by again emphasizing that by and large our internal audit profession has served
the country well. I am sure that your dedication and quality efforts have contributed to
strengthening our corporate sector and to avoiding some of the pitfalls other countries have
faced. But you must ensure adherence to the highest professional standards.
Perhaps one way of doing that is for the Institute of Internal Auditors, as the governing body
of the auditing profession to take a more aggressive leadership role, by implementing some
form of structured oversight of the auditing profession. This oversight would be in keeping
with what now exists in several parts of the world - in both developed and developing
countries. I am sure you know that the continued absence of appropriate oversight carries
potential legal and reputational risks, especially for financial institutions which operate in a
fiduciary capacity.
And my final suggestion to you, individually and as a group, is to continue upgrading your
skills. Improvements in technology, the quick pace of financial innovation and evolving
riskmanagement techniques will ensure that businesses will use increasingly complicated
configurations of products and financial structures. The internal auditor needs to stay abreast
if you are to add value and help your organization accomplish its objectives while bringing a
systematic and disciplined approach to risk management, control and governance.
And the answer is training, and learning new technical skills. I thank you once again.