W A Wijewardena: The internal auditor in banking institutions -
challenges and his new role
Keynote address by Mr W A Wijewardena, Deputy Governor of the Central Bank of Sri
Lanka, at a seminar by the Institute of Internal Auditors, Colombo, 30 November 2007.
* * *
The precise role which an auditor should play in an organization has always been subject to
much debate. Different schools of thought had held different views on the subject based on
their personal feelings and ideologies. When we were studying auditing at the university
some four decades ago, an adage which was firmly planted in our heads was that "an auditor
was a watch dog and not a blood hound". This principle which had ruled the sphere of
auditing for decades had been established in many legal cases that had been judged in the
United Kingdom and elsewhere by reference to the common practice of auditing. This simple
expression amply described what role an auditor was expected to play in an organization. He
was simply to keep a watchful eye on the operations of a business and alert his masters of
any irregularity that was happening. Once this was done, it was the responsibility of the
masters to take necessary corrective action. An ambitious audit officer may be tempted to go
beyond the bound of this adage and take upon himself the responsibility of passing penal
judgments on those whom he finds as miscreants of financial responsibility. But, the auditor's
role is simply to function as a pointer and not a financial crusader. If he chooses to function
as a financial crusader, he may not only embarrass his masters, but also endanger his own
position as well. Without any penal power vested in the auditor, it is also practically
impossible for him to act as a penal authority.
The auditor is a watchdog and not a blood hound
Businesses today, specifically those involving banking institutions, are very much complex in
nature. Hence, one may rightly question whether the old adage relating to auditing could still
serve a purpose. Though the complexity of the businesses has grown tremendously, I feel
that the old adage relating to auditing is still valid and relevant. It has demarcated the
boundary within which an auditor has to operate. If he steps outside this boundary, the most
likely consequence would be the creation of a hostile atmosphere for the auditor to perform
his duties. No organization, whether big or small, could function effectively and efficiently in
that scenario. This caution is equally valid for both external auditors and internal auditors.
The role of the internal auditor
Internal audit, as against the external audit, is the first safeguard available to the
management and owners to run their business free from financial irregularities and
misbehaviour. Internal auditor is available on site throughout the period and, therefore, can
play his role as an effective watchdog continuously. His screening and evaluation of the
operations of an organization makes the work of the external auditor easier. It cuts the cost
of the external audit which otherwise has to conduct all audit examinations and tests on his
own in order to arrive at his audit conclusions. By relying on the audit trails continuously
conducted by the internal auditor, the external auditor could complete his audit examinations
on time by conducting only the relevant sample tests. In this sense too, an internal auditor is
a necessary element in modern organizations.
Internal auditor or management auditor?
Over the years, the scope of the internal audit has expanded to cover new areas which have
become important to an organization from the point of view of efficiency and productivity.
Modern business is fiercely competitive and, unless an organization acquires a competitive
edge over its rivals, it would not be able to continue in business. This is specifically relevant
to banking institutions. Hence, in addition to the normal routine surveillance over financial
matters, internal auditor was required to comment on the efficiency of operations as well.
This involved his examination of processes, systems and methods to gauge whether the
money spent by a business really makes a contribution to the business in return. The new
work-load changed the title of the internal auditor to management auditor. He was, therefore,
required to function as an in-house management consultant and advisor to the top
management of organizations. Today, we do not make any distinction between "internal
audit" and "management audit". Whatever the term we use to call him, an internal auditor has
to function as a management auditor as well.
New challenges for internal auditors
The expansion of banking business both horizontally and vertically over the years has posed
new challenges to the internal auditor. This expansion has resulted in creating giant banking
holding companies encompassing almost all areas of financial services. A bank which was
confined only to borrowing and lending some six to seven decades ago is now a universal
bank that provides all types of financial services to its customers. They may do it through
different units or departments set up under one umbrella or through the establishment of a
host of associate and subsidiary companies under one holding company. An internal auditor
in a bank, therefore, cannot simply confine his work only to the main business of banking.
Since there are cross-border risks involving different segments of a banking holding
company, he now has to expand his area of operation to cover the entire business as a
single entity. This adds not only a new work-load, but also a new challenge to an internal
auditor. It behooves on the auditor to acquire new knowledge and skills to handle the job
effectively. Hence, an internal auditor today has to be an all-rounder in banking and
associated financial business, if he is to do his job effectively. This makes it necessary for the
internal auditor to put him on a continuous learning path so that he could update himself of
the new developments in banking as well as his own field.
High tech and associated risks
In modern banking, the internal auditor has been challenged by a new dimension of business
process development in banks. This has basically arisen from the extensive employment of
advanced technology, namely, information and communication technology, in banks and the
consequential business process outsourcing that has sprung up throughout the world as an
efficient cost-cutter for banking firms. The second would not have been possible, had the first
had not taken place. With regard to the employment of high-tech in business processing,
banks have been the pioneers in the game. With the rapid advancements that took place
from around early 1960s, banks successfully resorted to advanced ICT so as to cut costs,
have a wider customer outreach, supply a wide range of financial products and out-beat their
less tech-savvy rivals. This resulted in a tremendous growth in banking business in the
subsequent decades. The very same development has now paved the way for a further
quantum leap type of business expansion in the form of business process outsourcing. Both
have been beneficial to banks. Yet, they have brought new types of risks to banks as well.
Internal auditor as the principal risk manager
The internal auditor of a bank is the principal risk management officer as well. Since banks
are highly leveraged institutions, they also face different types of risks which other
businesses do not normally face. These risks are numerous and usually range from
operational risks to fraud risks to liquidity risks to reputation risks and so on. These risks,
unless properly managed, are often fatal to a bank. It is, therefore, necessary that a bank
should be adequately prepared to successfully mitigate or avoid these risks. The failure to do
so will lead the bank to closure of business. A bank which operates well by any standard may
soon find itself boggled with a serious liquidity issue arising from some external shock. If it is
unable to raise funds quickly to meet liquidity, it will face a general bank-run forcing it to
plead for assistance from other banks, authorities etc. The recent liquidity crunch due to the
sub-prime issue is a case in point. It had been reported that one such bank that had faced
this liquidity crunch severely had boasted of itself in August that it was indeed a well-run
robust bank. To its much embarrassment, just one month later, it had to swallow its pride
when it had to plead with authorities for assistance. This points to the fact that the internal
auditor has to develop risk assessment and mitigation systems in a bank and take effective
measures to give advance warning in the event of an impending risk crisis.
The significance of systems and governance principles
Given the gigantic nature of the risks faced by banks and the inability to foresee the delivery
of external shocks, the life of the internal auditor is made miserable today. He has to function
as an effective watchdog. But, he does not possess a set of well tested paraphernalia to do
this job. He may be an honest, genuine and committed worker. But, the rest in the
organization may not be so to the same degree. Hence, any mishap can occur without
warning or the knowledge of the internal auditor. If it so occurs, the internal auditor himself is
driven to a serious quandary. The way to overcome this risk is to develop and place in place
suitable and effective systems, processes and methods across the organization at all levels.
The internal auditor could just monitor and ensure that the systems are genuinely and
effectively followed by all.
An important element which also helps him to perform his job effectively is to introduce and
follow to the letter the good governance principles in the organization. These governance
principles would bind all in the organization by a common code of ethics. The absence of
proper governance will lead to misuse of the resources to the detriment of outside
stakeholders. The internal auditor cannot keep a watchful eye on everything that happens in
a bank. A good deal of discipline that should be inculcated throughout the bank comes from
self-discipline and there again, through the strict adherence to governance principles. It is,
therefore, in the interest of the internal auditor to promote governance to facilitate his job in a
bank.
The need for continuous learning
These new challenges that are faced by internal auditors require them to acquire the
necessary skills and competencies on a continuous basis. This makes it necessary for them
to place them on a learning path so that they could update themselves with new
developments. As I mentioned earlier, the internal auditor should be an all-rounder. He
should know all aspects of banking in order to perform an effective job as an internal auditor.
In this respect, the work done by the Institute of Internal Auditors in developing a wholesome
internal auditor is laudable. In addition to providing professional qualifications, it conducts
regular seminars, lectures and short-term training programmes to keep its membership
continuously updated of the new developments. In the modern world where human
knowledge is subject to the fastest depreciation and obsolescence, the cry by any
professional should be learning, learning and learning. I hope that this seminar will fulfill that
task.
Conclusion
The functions of internal auditors have expanded substantially over the years due to the
expansion of business, addition of new risk elements and adoption of advanced technology.
Yet, the basic character of the auditors remains the same. They should function only as
extended ears, eyes and arms of the top management and owners. They may point at
irregularities, but would not act as penal authorities. Hence, the auditor, including the internal
auditor, is still a watchdog and not a bloodhound.