Muhammad bin Ibrahim: Audit as a partner of change
Remarks by Mr Muhammad bin Ibrahim, Governor of the Central Bank of Malaysia (Bank
Negara Malaysia), at the 5th PETRONAS Board Audit Committee (BAC) Forum "Audit as a
partner of change", Kuala Lumpur, 16 August 2016.
* * *
The theme of today's forum "Audit as a Partner of Change" is highly relevant and timely, as
the events in the global market today, involving failures of large firms, frauds and market
manipulation activities, underscores the criticality of the three lines of defenses in
organizations. For confidence and trust to be restored in the marketplace, the role of the BAC
and internal auditors as the third line of defense will be even more critical than ever.
Our role as members of audit committees is much broader than what we may perceive it to be.
Organisations such as PETRONAS are widely regarded as amongst the few key flag bearers
for the country. Hence, it is incumbent upon the Board and the BAC members to be strong and
energetic in upholding the highest standards of professionalism, ethics and integrity in
discharging their roles and responsibilities. The people of Malaysia must have confidence and
pride that an institution entrusted with much strategic natural resources are run with utmost
integrity and professionalism.
Before I proceed further on the topic for today, allow me to touch briefly on the current outlook
on the global and domestic economy. The global economy has experienced multiple shocks
in recent years, with its effects reverberating across the globe. Global growth has continuously
underperformed expectations and is expected to remain moderate going forward.
The divergence in monetary policy in advanced and emerging economies as well as the
unexpected policy adjustments in several economies have also culminated in a global
environment of heightened volatility and uncertainties. One of the most significant
developments we have experienced thus far is the sharp volatility in commodity prices which
has created destabilising implications on commodity-driven countries. Amid a confluence of
shocks, ranging from weaker-than-expected growth prospects to geopolitical uncertainty and
moderation in China's economic growth, oil prices declined by more than 50% in a span of
6 months in 2014. The volatility in oil prices has also been heightened by unanticipated
economic and geo-political developments. The events unfolding in the United Kingdom and
consequent effect to the European region have also contributed to the increased volatility in
oil prices. Oil prices rallied to above USD50 per barrel from an average of USD33 per barrel in
the first quarter of the year, and today, oil prices have settled back to around USD48 per barrel.
The oil price is likely to remain volatile over the next few years due to oversupply and
recordhigh oil inventories against slow demand especially in China. LNG prices are also expected to
remain low for a protracted period of time. LNG capacity start-ups in Australia and North
America which will boost new LNG supplies amidst stagnating demand will put more pressure
on LNG prices, hence further disrupting the LNG market. Due to low oil and LNG prices, the
profitability of oil majors and National Oil Companies (NOCs) has been severely eroded. The
impact has been pronounced. More than 300,000 oil and gas workers have been laid off
globally since mid-2014; some USD 380 billion of global oil and gas projects have been
deferred or cancelled; and more than USD 150 billion worth of assets have been planned for
disposal or divestment.
Given Malaysia's openness and high financial and trade integration with the rest of the world,
the Malaysian economy is not isolated from these developments. On the external front, lower
global demand continues to weigh down on Malaysia's export performance.
Investment activities especially in the upstream oil and gas sector, contracted for the first time
since the global financial crisis in 2015, after expanding by an average of 16% from 2010 to
2014. However, investment activity in the manufacturing and services sectors remained
resilient, and is expected to underpin investment growth moving forward. Private consumption
remained relatively resilient and anchored domestic growth, especially during the first half of
the year, driven by sustained income and employment levels. Going forward, domestic
demand is expected to remain a key driver of economic growth in Malaysia. We should expect
Malaysian economic growth to range between 4.0 to 4.5 % for 2016.
Amid the changes in the financial landscape, there have been equally significant developments
in the auditing standards both globally and locally. The standards and regulations are
becoming increasingly tighter and more stringent. The Institute of Internal Auditors (IIA) for
example, has proposed several changes to the Internal Audit Standards, which are expected
to take effect in January 2017. The changes to the Standards are aimed at reinforcing the
fundamental principles of internal auditing practices, promoting a broad range of value-added
internal auditing and fostering improved organisational processes and operations. The
direction of changes in the financial reporting standards also places more accountability on the
Audit Committees to provide strong oversight on the organisation's financial reporting and
internal controls. The new Companies Bill 2015 (the Bill) was passed by the Dewan Rakyat
and is anticipated to come into force by end-2016. The new law is expected to bring major
reforms to our corporate landscape and will place greater pressures on the audit function to
understand the emerging regulatory requirements and their impact on business operations.
In the wake of uncertainties due to the global developments, the change in regulatory
standards and technological advancement require businesses and regulators to think beyond
conventional norms in order to navigate through these unchartered waters.
Turning to the theme today, the importance of an independent and effective internal audit
function as a core line of defense with a strong Audit Committee in business cannot be
overemphasized.
The fundamentals of an internal audit function involve identifying risks that could threaten the
viability of the company and keep it from achieving its goals, ensuring management fully
understands these risks, and proactively recommending improvements to minimise these
risks. Internal auditors are essentially the eyes and ears of the Audit Committee and the overall
Board. The failure of audit functions can result in devastating consequences as seen in recent
times.
The case of the British Petroleum (BP) oil rig explosion in 2010 is one that reinforces the
important role of the internal audit function. Occupational safety is widely regarded as a critical
success factor for a company that undertakes oil exploration. The BP oil rig was awarded as
the industry model for safety in 2009. However, in 2010, the oil rig exploded in the Gulf of
Mexico, causing one of the worst man-made disasters in history. The U.S investigation
commission attributed the disaster to the "failure of individuals involved to identify risks they
faced and to properly evaluate, communicate and address them". This indirectly highlighted
the shortcomings of the internal audit function as a contributory source of failure in the lines of
defence in the company. Some level of scepticism to consider the remote possibility that the
safety measures in place may not work in the event of disaster, could have avoided the risk
event from occurring.
Another example is the LIBOR manipulation scandal involving several banks which culminated
in substantial fines imposed by the UK Financial Services Authority (FSA). In its internal audit
report published in March 2013, the FSA highlighted several issues pertaining to the
breakdown of the internal audit function, which led to the manipulation of the rates. Despite the
Group internal audit functions carrying out their routine audits in this area, deficiencies in the
banks' systems, controls and policies were not adequately highlighted.
The lessons learnt from the above cases and others clearly reinforce the key roles played by
both the internal audit function and the Audit Committee. My view is that the strength and
effectiveness of the internal audit function will influence the risk and compliance culture in an
organisation. The function has to continually be refreshed such that it remains robust and
effective.
Clearly, the job is now more difficult and challenging than ever, given the increased
expectations by stakeholders and heightened scrutiny when things go wrong, as well as
increasing obligations under the statute that place additional fiduciary responsibilities on audit
committee members. I would like to share my thoughts on four matters where efforts are
necessary to raise the bar on audit standards and audit quality.
Firstly, the audit coverage and scope should not be confined to compliance or risk-based
parameters. The audit scope should be holistic, encompassing new risk areas and tail risk
events that originate from the evolving operating environment and financial landscape. The
process of ascertaining the audit scope must be robust, such that audits focus on higher risk
areas as the company grows and evolves in its products and processes. Internal auditors
should be constantly challenged to think beyond the scope of the audit framework and focus
on the broader picture. The so-called ability to 'connect the dots' about the implications of the
audit findings across the organisation is an important starting point to identify new and
emerging risks.
Secondly, internal audit should move beyond compliance to strategic auditing and to provide
value-added recommendations for the betterment of the organisation. My view is that before
an organisation seeks to venture into new or higher risk areas of growth, it is imperative for the
board and senior management to seek assurance from the internal audit function so that the
risk and control frameworks are rigorous in identifying gaps in the system. The Audit
Committee should identify opportunities where the internal audit function is able to add value,
through consultation and advice on business process improvements. The input from the
internal audit function would also be helpful to craft initiatives to embed good behavioural
norms, ethical and responsible culture within the organisation.
Thirdly, the internal audit function must be supported by a strong quality assurance process.
This requires internal auditors to be equipped with the requisite skills such that they are able
to leverage on their expertise and experience to make sound judgement and challenge the
norm. This becomes even more important as companies grow in scale, venture into new lines
of business and become more complex. Further, the internal audit function should leverage on
technology as a key enabler to improve audit quality and audit effectiveness. Innovation in
audit techniques should be promoted with greater usage of data analytic tools for better risk
profiling and sampling.
There ought to be close engagement between the internal audit function and external auditors
on key risks and systemic issues, and in strengthening the overall assurance process.
Fourth, the role of the Audit Committee is integral in these efforts. The Audit Committee at the
apex needs to exercise strong oversight through setting the "tone from the top" and embedding
the right culture to ensure that the internal audit function is independent and objective in
delivering its mandates. One message of 'tone from the top' is a reminder to all Heads of
Internal Audit that any findings that might indicate unethical or fraudulent activities or have
reputational impact to PETRONAS should be communicated to the BAC immediately without
waiting for the BAC to meet. There should be 'zero tolerance' for any cases that involve abuses
and corrupt practices.
Another important imperative is the Committee's responsibility to design governance structures
that avoid placing the internal audit function in conflicted positions, and ensure that the function
has sufficient standing and authority within the organisation. This will help to strengthen the
ability of the internal audit function to independently audit and raise red flags where risks are
observed. Direct accessibility to the Audit Committee is key in this respect.
Concluding remarks
As the world becomes more interconnected, an effective organisation will see its business
managers and control functions partnering with the auditors, leveraging on their skills to build
more effective operations, and strengthen business prospects. Audit as a partner of change
lies on the ability of the organisation to adapt and collaborate with the auditors towards
securing the organisation's long term success.