W A Wijewardena: The internal auditor in banking institutions – challenges and his new role Keynote address by Mr W A Wijewardena, Deputy Governor of the Central Bank of Sri Lanka, at a seminar by the Institute of Internal Auditors, Colombo, 30 November 2007. * * * The precise role which an auditor should play in an organization has always been subject to much debate. Different schools of thought had held different views on the subject based on their personal feelings and ideologies. When we were studying auditing at the university some four decades ago, an adage which was firmly planted in our heads was that “an auditor was a watch dog and not a blood hound”. This principle which had ruled the sphere of auditing for decades had been established in many legal cases that had been judged in the United Kingdom and elsewhere by reference to the common practice of auditing. This simple expression amply described what role an auditor was expected to play in an organization. He was simply to keep a watchful eye on the operations of a business and alert his masters of any irregularity that was happening. Once this was done, it was the responsibility of the masters to take necessary corrective action. An ambitious audit officer may be tempted to go beyond the bound of this adage and take upon himself the responsibility of passing penal judgments on those whom he finds as miscreants of financial responsibility. But, the auditor’s role is simply to function as a pointer and not a financial crusader. If he chooses to function as a financial crusader, he may not only embarrass his masters, but also endanger his own position as well. Without any penal power vested in the auditor, it is also practically impossible for him to act as a penal authority. The auditor is a watchdog and not a blood hound Businesses today, specifically those involving banking institutions, are very much complex in nature. Hence, one may rightly question whether the old adage relating to auditing could still serve a purpose. Though the complexity of the businesses has grown tremendously, I feel that the old adage relating to auditing is still valid and relevant. It has demarcated the boundary within which an auditor has to operate. If he steps outside this boundary, the most likely consequence would be the creation of a hostile atmosphere for the auditor to perform his duties. No organization, whether big or small, could function effectively and efficiently in that scenario. This caution is equally valid for both external auditors and internal auditors. The role of the internal auditor Internal audit, as against the external audit, is the first safeguard available to the management and owners to run their business free from financial irregularities and misbehaviour. Internal auditor is available on site throughout the period and, therefore, can play his role as an effective watchdog continuously. His screening and evaluation of the operations of an organization makes the work of the external auditor easier. It cuts the cost of the external audit which otherwise has to conduct all audit examinations and tests on his own in order to arrive at his audit conclusions. By relying on the audit trails continuously conducted by the internal auditor, the external auditor could complete his audit examinations on time by conducting only the relevant sample tests. In this sense too, an internal auditor is a necessary element in modern organizations. Internal auditor or management auditor? Over the years, the scope of the internal audit has expanded to cover new areas which have become important to an organization from the point of view of efficiency and productivity. Modern business is fiercely competitive and, unless an organization acquires a competitive edge over its rivals, it would not be able to continue in business. This is specifically relevant to banking institutions. Hence, in addition to the normal routine surveillance over financial matters, internal auditor was required to comment on the efficiency of operations as well. This involved his examination of processes, systems and methods to gauge whether the money spent by a business really makes a contribution to the business in return. The new work-load changed the title of the internal auditor to management auditor. He was, therefore, required to function as an in-house management consultant and advisor to the top management of organizations. Today, we do not make any distinction between “internal audit” and “management audit”. Whatever the term we use to call him, an internal auditor has to function as a management auditor as well. New challenges for internal auditors The expansion of banking business both horizontally and vertically over the years has posed new challenges to the internal auditor. This expansion has resulted in creating giant banking holding companies encompassing almost all areas of financial services. A bank which was confined only to borrowing and lending some six to seven decades ago is now a universal bank that provides all types of financial services to its customers. They may do it through different units or departments set up under one umbrella or through the establishment of a host of associate and subsidiary companies under one holding company. An internal auditor in a bank, therefore, cannot simply confine his work only to the main business of banking. Since there are cross-border risks involving different segments of a banking holding company, he now has to expand his area of operation to cover the entire business as a single entity. This adds not only a new work-load, but also a new challenge to an internal auditor. It behooves on the auditor to acquire new knowledge and skills to handle the job effectively. Hence, an internal auditor today has to be an all-rounder in banking and associated financial business, if he is to do his job effectively. This makes it necessary for the internal auditor to put him on a continuous learning path so that he could update himself of the new developments in banking as well as his own field. High tech and associated risks In modern banking, the internal auditor has been challenged by a new dimension of business process development in banks. This has basically arisen from the extensive employment of advanced technology, namely, information and communication technology, in banks and the consequential business process outsourcing that has sprung up throughout the world as an efficient cost-cutter for banking firms. The second would not have been possible, had the first had not taken place. With regard to the employment of high-tech in business processing, banks have been the pioneers in the game. With the rapid advancements that took place from around early 1960s, banks successfully resorted to advanced ICT so as to cut costs, have a wider customer outreach, supply a wide range of financial products and out-beat their less tech-savvy rivals. This resulted in a tremendous growth in banking business in the subsequent decades. The very same development has now paved the way for a further quantum leap type of business expansion in the form of business process outsourcing. Both have been beneficial to banks. Yet, they have brought new types of risks to banks as well. Internal auditor as the principal risk manager The internal auditor of a bank is the principal risk management officer as well. Since banks are highly leveraged institutions, they also face different types of risks which other businesses do not normally face. These risks are numerous and usually range from operational risks to fraud risks to liquidity risks to reputation risks and so on. These risks, unless properly managed, are often fatal to a bank. It is, therefore, necessary that a bank should be adequately prepared to successfully mitigate or avoid these risks. The failure to do so will lead the bank to closure of business. A bank which operates well by any standard may soon find itself boggled with a serious liquidity issue arising from some external shock. If it is unable to raise funds quickly to meet liquidity, it will face a general bank-run forcing it to plead for assistance from other banks, authorities etc. The recent liquidity crunch due to the sub-prime issue is a case in point. It had been reported that one such bank that had faced this liquidity crunch severely had boasted of itself in August that it was indeed a well-run robust bank. To its much embarrassment, just one month later, it had to swallow its pride when it had to plead with authorities for assistance. This points to the fact that the internal auditor has to develop risk assessment and mitigation systems in a bank and take effective measures to give advance warning in the event of an impending risk crisis. The significance of systems and governance principles Given the gigantic nature of the risks faced by banks and the inability to foresee the delivery of external shocks, the life of the internal auditor is made miserable today. He has to function as an effective watchdog. But, he does not possess a set of well tested paraphernalia to do this job. He may be an honest, genuine and committed worker. But, the rest in the organization may not be so to the same degree. Hence, any mishap can occur without warning or the knowledge of the internal auditor. If it so occurs, the internal auditor himself is driven to a serious quandary. The way to overcome this risk is to develop and place in place suitable and effective systems, processes and methods across the organization at all levels. The internal auditor could just monitor and ensure that the systems are genuinely and effectively followed by all. An important element which also helps him to perform his job effectively is to introduce and follow to the letter the good governance principles in the organization. These governance principles would bind all in the organization by a common code of ethics. The absence of proper governance will lead to misuse of the resources to the detriment of outside stakeholders. The internal auditor cannot keep a watchful eye on everything that happens in a bank. A good deal of discipline that should be inculcated throughout the bank comes from self-discipline and there again, through the strict adherence to governance principles. It is, therefore, in the interest of the internal auditor to promote governance to facilitate his job in a bank. The need for continuous learning These new challenges that are faced by internal auditors require them to acquire the necessary skills and competencies on a continuous basis. This makes it necessary for them to place them on a learning path so that they could update themselves with new developments. As I mentioned earlier, the internal auditor should be an all-rounder. He should know all aspects of banking in order to perform an effective job as an internal auditor. In this respect, the work done by the Institute of Internal Auditors in developing a wholesome internal auditor is laudable. In addition to providing professional qualifications, it conducts regular seminars, lectures and short-term training programmes to keep its membership continuously updated of the new developments. In the modern world where human knowledge is subject to the fastest depreciation and obsolescence, the cry by any professional should be learning, learning and learning. I hope that this seminar will fulfill that task. Conclusion The functions of internal auditors have expanded substantially over the years due to the expansion of business, addition of new risk elements and adoption of advanced technology. Yet, the basic character of the auditors remains the same. They should function only as extended ears, eyes and arms of the top management and owners. They may point at irregularities, but would not act as penal authorities. Hence, the auditor, including the internal auditor, is still a watchdog and not a bloodhound.