L Wilson Kamit: Role of internal auditors in the Bank and supervised
institutions
Keynote address by Mr L Wilson Kamit, CBE, Governor of the Bank of Papua New Guinea,
for the 5th annual conference "Harnessing internal auditors for today's challenges", hosted
by the Institute of Internal Auditors - PNG, Port Moresby, 12 June 2008.
* * *
Mr Bernard Kisekol, President of IIA-PNG, Directors, Distinguished Guests, Ladies and
Gentlemen.
Thank you for inviting me to deliver the keynote address at the 5th Annual Conference of the
Institute of Internal Auditors, PNG. The theme of the conference "Harnessing Internal
auditors for today's challenges" could not have come at a more opportune time. In our stride
towards ensuring sound corporate governance, the role of internal audit has become more
critical. The thrust of my presentation today will be on the Role of internal audit in the Bank
and the institutions that we supervise.
The internal audit function is one of the fundamental "checks and balances" for sound
corporate governance. Now more than ever, a robust and objective internal audit function,
with the skills to identify risk control problems and the authority to pursue its concerns, is
essential to the proper discharge of directors' responsibilities. It is, as well, a firm ally of the
prudential regulatory authority. For this reason, I welcome the opportunity to offer a
regulatory perspective on the role of internal audit in our supervised institutions, and for a
growing relationship between the Institute and the Regulatory Authority.
Corporate governance, as we all know, has been under a strong and critical public scrutiny in
recent years, in the wake of a succession of blows to market confidence and integrity. The
community's expectations of boards and senior management, and of those charged with
providing an independent review of a company's operations and financial accounts, have
been raised. To meet those expectations, governments and regulatory authorities around the
globe have mounted a concerted effort to improve standards of corporate behaviour and
transparency through the international harmonisation of accounting standards, strengthening
the principles of corporate governance, lifting the bar on the "fitness and propriety" of
directors and managers and introducing improved market disclosure standards.
It is in the interest of Bank's, financial institution and corporate business entities for standards
of corporate governance to be raised and thereafter maintained, as effective corporate
governance ensures that long-term strategic objectives and plans are established, and that
proper management and management structure are in place to achieve those objectives;
while at the same time making sure that the structure functions to maintain the organization's
integrity, reputation, and accountability to its relevant constituencies. Enforcement alone
cannot guarantee good corporate governance.
Whilst measures to enhance corporate governance are primarily aimed at boards of
directors, who are seen as the agents responsible for protecting shareholder value, the
internal audit fraternity is another industry group that is of particular importance. It is evident
that the significance of internal auditing as a key contributor to corporate governance has
emerged as a theme.
This new paradigm in internal auditing will see the profession becoming a front player in
ensuring good corporate governance structures.
In this demanding environment, boards and senior management need quality advice from
sources that can be trusted and that can offer an objective viewpoint. Much of the focus of
Sarbanes-Oxley in the United States and Basle Committee has been on the external audit
function.
Equally, however, there is a need to ensure that internal audit is organised, resourced and
empowered so that it can provide competent, impartial and fearless advice. In contrast to
external auditors, however, our sense is that internal audit is still evolving as a profession
and has further to go in promoting its own professional standards and profile in Papua New
Guinea. We in BPNG observe that internal audit in our supervised institutions is not based on
widely utilised standards, recognised by Audit Committees for example, and it is not always
focused on the same set of issues. Internal audit functions vary from a narrow concern with
compliance or financial accounts to a broader remit reviewing efficiency and effectiveness or
acting as an internal consultant.
My address today offers a prudential perspective on the role of internal audit. It starts with
the separate roles of internal audit in the corporate governance framework. Specific
references will be made to the internal audit setup in the Bank of PNG. It then sets out the
expectations of internal audit held by prudential regulators at the international level and how
the regulator assesses whether internal audit in the institutions it supervises meets these
expectations. Finally, I discuss some regulatory issue, the problems and challenges. My
comments are offered in a constructive spirit to encourage debate within the internal audit
profession.
I will start by borrowing the definition of internal audit approved by the Board of Directors of
your Institute:
"Internal auditing is an independent, objective assurance and consulting activity designed to
add value and improve an organisation's operations. It helps an organisation accomplish its
objectives by bringing a systematic, disciplined approach to evaluate and improve the
effectiveness of risk management, control, and governance processes."
As we see it, the basic function of internal audit is independent appraisal of an institution's
internal controls, including controls over financial reporting. Simply put, it is about reviewing
activities to ensure that they are carried out as intended. Of course, a by-product of internal
audit will be recommendations on internal control and process improvements that could be
made, an important role for internal audit at large and complex financial institutions in
particular.
The Bank of PNG Internal audit charter was drawn up with the assistance from the IMF
Technical Advisor and reviewed periodically - by the internal audit department; it was
approved by senior management (Governor) and subsequently confirmed by the board of
directors as part of its oversight role.
In the charter, the bank's senior management gives the internal audit department the right of
initiative and authorises it to have direct access to and communicate with any member of
staff, to examine any activity or entity of the bank, as well as to access any records, files or
data of the bank, including management information and the minutes of all consultative and
decision-making bodies, whenever relevant to the performance of its assignments.
The charter states the terms and conditions according to which the internal audit department
can be called upon to provide consulting or advisory services or to carry out other special
tasks and the charter is communicated throughout the organisation.
To perform their role effectively, internal audit requires organizational independence from
management to enable unrestricted evaluation of management activities and personnel. To
ensure independence, Manager Internal Audit reports directly to the Governor and also has
direct access to the Audit Committee on matters considered of significant importance to the
functioning of the BPNG.
Audit committees require the help of internal auditing departments in order for them to be
able to effectively fulfill their obligations to the board, the shareholders, and other outside
parties who have a stake in the organisation. The contribution of internal auditors as
business advisors or consultants to the organisation and their role in ensuring compliance
with various statutes, policies and procedures cannot be overemphasized.
These new challenges that are faced by internal auditors require them to acquire the
necessary skills and competencies on a continuous basis. This makes it necessary for them
to place them on a learning path so that they could update themselves with new
developments. He/she should know all aspects of the operations in order to perform an
effective job as an internal auditor. In this respect, the work done by the Institute of Internal
Auditors in developing a wholesome internal auditor is laudable.
An internal audit function within a bank that is organised along the principles set forth in
Basel Committee paper on Banking Supervision (BIS August 2001) facilitates the work of
bank supervisors. Strong internal control, including an internal audit function, and an
independent external audit are part of sound corporate governance which in turn can
contribute to an efficient and collaborative working relationship between bank management
and bank supervisors. An effective internal audit function is a valuable source of information
for bank management, as well as bank supervisors, about the quality of the internal control
system.
Bank supervisors should evaluate the work of the bank's internal audit department and, if
satisfied, can rely on it to identify areas of potential risk. Supervisory authorities have issued
various regulatory provisions covering banks' internal control systems. Although the extent of
this regulation may vary across countries, it generally includes some basic principles aimed
at promoting an adequate system of controls as well as a regulation with regard to adequate
capital.
To evaluate the quality of internal controls, supervisors can take a number of approaches.
One approach is for supervisors to evaluate the work of the internal audit department of the
bank, including its testing of senior management's processes that identify, measure, monitor
and control risks. If satisfied with the quality of the internal audit department's work,
supervisors can use the reports of internal auditors as a primary mechanism for identifying
control problems in the bank, or for identifying areas of potential risk that the auditors have
not recently reviewed.
The Basel II Accord has stipulated that the internal audit would have to capture in a larger
way the application and effectiveness of risk management procedures and risk assessment
methodology and critical evaluation of the adequacy and effectiveness of the internal control
systems. The banks and other supervised institutions will be required to introduce and
implement Risk Focused Internal Audits and Self Audits. The implementation of risk based
auditing would mean that greater emphasis is placed on the internal auditor's role of
mitigating risks. By focusing on effective risk management the internal auditor would not only
offer remedies for current trouble areas but also anticipate problems and play an important
role in protecting the bank and regulated institutions from risk hazards.
The financial institution should create an effective audit program to monitor the operation of
internal controls against self-dealing, conflict of interests and other violations of the Code of
Conduct, identify weaknesses, and ensure corrective action is taken.
Financial institutions work in a highly regulated environment. The Board of Directors/Trustees
should ensure that bank / regulated institution's management and relevant employees are
aware of all applicable laws and regulations.
The Code of Conduct should contain specific and appropriate consequences that would
serve to deter wrongdoing and unacceptable business practices, and promote accountability
amongst employees and others to the Code. Let me conclude by saying that the
achievement of good corporate governance will ultimately be the result of cooperative efforts
between regulators, internal audits and parties subject to such regulation.
Thank you.