Ewart S Williams: The internal auditor in our emerging financial environment Feature address by Mr Ewart S Williams, Governor of the Central Bank of Trinidad and Tobago, at the Institute of Internal Auditors Anniversary Dinner, Port-of-Spain, 27 September 2007. * * * Let me thank the Trinidad and Tobago Chapter of the Institute of Internal Auditors for their invitation to address you on the occasion of your 19th Anniversary. I am delighted for the opportunity, though the invitation reminded me that life is so full of contradictions. I must confess that for the five years I have been at the Central Bank I have had more of my fair share of run-ins with my auditors – both with my internal and external auditors. I hasten to add however, that I emerged from each encounter with a clearer understanding of the role of the auditor, with tremendous respect for the internal and external auditors I dealt with; and with a keen appreciation of how critical but how thankless the job of an auditor was. I must also concede that from the vantage point of the Central Bank as regulator, it has become exceedingly clear that we cannot have effective financial sector supervision in the absence of close collaboration with the auditing profession. I am also convinced that for efficient financial markets, the auditing profession is critical to promoting credibility and confidence among shareholders and investors, and for promoting market discipline. But I would come back to these issues after some brief reflections on how the auditing profession has evolved. I don’t know if you remember, but it was not so long ago that internal auditing was considered a boring and perhaps an unnecessary hassle. And then starting around the end of the 1990s, a series of well-publicized international financial scandals changed all that. Accountants and auditors became suddenly intriguing in 2002 with the collapse of Arthur Anderson because of its involvement in the scandals surrounding Enron. Revelations of significant corporate governance and accounting failures at Parmalat and Shell served to demonstrate that these concerns were indeed world-wide, not just in the United States. As The Economist Magazine said, “these scandals added unwanted color to a grey profession”. But the attention was initially unwanted and perhaps unhelpful, for the judgment was that, while in most of the cases high corporate officials betrayed the trust of their shareholders and put their hands into the till, equal blame was put to the auditing profession – both internal and external – because they did not do their jobs; they abdicated their responsibilities. As you know, these scandals created suspicion of large corporations and raised the cost of capital in international financial markets. In the final analysis, the verdict was that it was the weaknesses in a few companies and major audit firms that were responsible for the significant increase in the cost of capita across financial markets. As you know, in the US, these scandals led to the enactment of the Sarbanes-Oxley Act, which has been described as one of the most far-reaching reforms of American business practices. The Act, for instance, made corporate management responsible for maintaining “an adequate internal-control structure and procedures for financial reporting. Company auditors were required to attest to management’s assessments of these controls and to disclose any material weaknesses. The Sarbanes-Oxley Act (SOX, as it is called) also created the Public Company Accounting Oversight Board to help re-establish the trust that investors could rely on the quality of audits. One of the mandates of the Board was to ensure that emphasis on high-quality professionalism for accountants and auditors became the standard. Not unexpectedly the corporate scandals and Sarbanes-Oxley have had their impact on our corporate environment here in Trinidad and Tobago. For example: • like in the US, to address some obvious conflict of interest, the large auditing firms have ceased to do a variety of non-audit work for their clients; • large firms are paying closer attention to corporate governance; • they are establishing independent audit committees; • boards are having a closer look at company loans to executives; and • internal audit departments are being given more recognition and more resources. As I indicated earlier, recent developments have also heightened the importance of accounting and auditing standards to the financial sector supervisory framework. As you know financial innovation has increased the complexity of certain types of financial transactions. At the same time, new accounting standards and anti-money laundering statutes have created additional information and disclosure requirements for financial institutions. The purpose of the new accounting standards is to provide the foundation for credible financial statements and other disclosures that faithfully communicate the institution’s operating results and overall health. And the more the accountants come up with new proposals to capture the essence of the financial transactions, the greater the onus on the auditor to provide independent verification. Perhaps an even greater justification for intensified collaboration between the auditor – both internal and external – has been the changing pattern of financial sector regulation. As you may know over the past few years, the Central Bank has moved to streamline the examination process to make it more focused on risk-management. Our financial regulation strategy now emphasizes: • Active oversight by Management and the Board of Directors; • Clearly defined policies, procedures and authority; • Comprehensive risk measurement and risk mitigation; and • Adequate systems of internal controls. Unlike in the past when the focus was mainly on capital and operating results, the new regulatory strategy requires the Central Bank to take a far greater interest in the corporate governance of financial institutions. Understanding how institutions are managed is now the key. The hallmark of our regulatory approach is to identify problems early – well before they manifest themselves in the financial statements when it is usually too late to act effectively. Early intervention allows us to work with management and boards to effect remedial actions. Early identification of problems essentially involves a qualitative assessment of an institution’s risk management processes and methodology, its internal control environment and its compliance mechanisms. As regulators we cannot do this alone. This is where you, as internal auditors, have a critical role to play. This is where the work of the internal audit and the supervisory function are closely aligned, specifically in the identification, management and mitigation of risk, and ensuring that the institution’s operations are conducted effectively, efficiently and in compliance with applicable laws and regulations. Increasingly over the last decade operations risk has taken on greater prominence within the context of enterprise risk management systems. As you know, operations risk arises from inadequate or failed internal processes, people or systems or from external events. Operations risk has always been a part of banking but it has become a greater threat to the safety of financial institutions in the contemporary financial environment. This is because the institutions themselves have become more complex and their products and services have become more numerous and varied. In addition, advances in information technology have greatly increased the speed at which vulnerabilities in one institution can escalate into serious problems in other institutions. Consequently, there has been an increasing incidence of failure linked to operations risk. In 2003, the Basel Committee on Banking Supervision, the main international standardssetting body for bank supervision, identified as a cardinal principle the responsibility of the Board of Directors “to ensure that the bank’s operational and risk management framework is subject to effective and comprehensive internal audit by operationally independent, appropriately trained and competent staff”. That’s the mandate that all banks face and that’s the challenge for all of you internal auditors. What this implies is that internal auditors must provide assurance that management is appropriately identifying and managing risks that arise, both from business operations, and from the systems supporting those operations. As Regulator, we also look to the internal audit function to provide us with evidence of action taken to improve the control framework and mitigate risk. At this stage I would like to risk a comment, again from the vantage point of the Regulator, on how well our Audit profession seems to be matching up to its onerous responsibilities. And I must confess that here I am not making a distinction between internal and external auditors; I am lumping them both in the same basket. Let me first state categorically, that I have every respect for the auditing profession and the professional manner in which most of its members conduct their work. However, I would be less than candid if I did not mention that there are too many instances where as regulators, we are confronted with poor examples of quality audits. Auditors are required to sign off on financial statements and to vouch for the presence of adequate internal controls. In too many cases, we have evidence that the job was not done with the thoroughness that is required. As I mentioned earlier, regulators and other stakeholders place great reliance on the audit opinion and basic auditing principles require that these opinions are qualified when, for example: • A company is insolvent, with insufficient assets to support the company’s liabilities; or • The accounting system is so untidy that the auditors cannot reasonably be expected to arrive at an informed judgment of the company’s health; or • When the balance sheet clearly omits some of the contractual obligations of the company – such as outstanding policy claims, in the case of insurance companies. Some other areas of concern that we sometimes encounter are: • Long delays in issuing management letters, sometimes well after the audit itself has been completed; • Too liberal an interpretation of standard accounting rules; and • Sometimes, inexplicable and undue compromises on corporate governance issues. We should be reminded, ladies and gentlemen, that the 1989 auditors’ reports gave an excellent bill of health to the Workers Bank, right up to the moment when the Central Bank had to intervene because of insolvency. More recently, the Central Bank intervened in two insurance companies against the backdrop of successive unqualified audit reports. I have focused on examples from the financial sector, because that’s the sector I know best. I am sure that there are as many, if not more occasions in the non-financial corporate sector where audit reports do not reflect the true reality. I would like to raise one other challenge that internal auditors are likely to face, particularly in smaller institutions, where there is not sufficient talent to go around. This challenge has to do with maintaining the independence of the internal auditor. Internal auditors are in a unique position to obtain an informed perspective of the organizations for which they work. As such, they are in the best position to assist and advise Management on developing the broad principles that should govern the risk management and internal control environment. On the other hand, to be effective, internal auditors need to be independent and cannot assume a line-management role for control activities, including those they helped to design. Accordingly, internal auditors need to be continually alert to conflicts of interest. It is a situation that calls for delicate professional judgment to promote a win-win situation. Let me close by again emphasizing that by and large our internal audit profession has served the country well. I am sure that your dedication and quality efforts have contributed to strengthening our corporate sector and to avoiding some of the pitfalls other countries have faced. But you must ensure adherence to the highest professional standards. Perhaps one way of doing that is for the Institute of Internal Auditors, as the governing body of the auditing profession to take a more aggressive leadership role, by implementing some form of structured oversight of the auditing profession. This oversight would be in keeping with what now exists in several parts of the world – in both developed and developing countries. I am sure you know that the continued absence of appropriate oversight carries potential legal and reputational risks, especially for financial institutions which operate in a fiduciary capacity. And my final suggestion to you, individually and as a group, is to continue upgrading your skills. Improvements in technology, the quick pace of financial innovation and evolving riskmanagement techniques will ensure that businesses will use increasingly complicated configurations of products and financial structures. The internal auditor needs to stay abreast if you are to add value and help your organization accomplish its objectives while bringing a systematic and disciplined approach to risk management, control and governance. And the answer is training, and learning new technical skills. I thank you once again.