L Wilson Kamit: Role of internal auditors in the Bank and supervised institutions Keynote address by Mr L Wilson Kamit, CBE, Governor of the Bank of Papua New Guinea, for the 5th annual conference “Harnessing internal auditors for today’s challenges”, hosted by the Institute of Internal Auditors – PNG, Port Moresby, 12 June 2008. * * * Mr Bernard Kisekol, President of IIA-PNG, Directors, Distinguished Guests, Ladies and Gentlemen. Thank you for inviting me to deliver the keynote address at the 5th Annual Conference of the Institute of Internal Auditors, PNG. The theme of the conference ”Harnessing Internal auditors for today’s challenges” could not have come at a more opportune time. In our stride towards ensuring sound corporate governance, the role of internal audit has become more critical. The thrust of my presentation today will be on the Role of internal audit in the Bank and the institutions that we supervise. The internal audit function is one of the fundamental “checks and balances” for sound corporate governance. Now more than ever, a robust and objective internal audit function, with the skills to identify risk control problems and the authority to pursue its concerns, is essential to the proper discharge of directors’ responsibilities. It is, as well, a firm ally of the prudential regulatory authority. For this reason, I welcome the opportunity to offer a regulatory perspective on the role of internal audit in our supervised institutions, and for a growing relationship between the Institute and the Regulatory Authority. Corporate governance, as we all know, has been under a strong and critical public scrutiny in recent years, in the wake of a succession of blows to market confidence and integrity. The community’s expectations of boards and senior management, and of those charged with providing an independent review of a company’s operations and financial accounts, have been raised. To meet those expectations, governments and regulatory authorities around the globe have mounted a concerted effort to improve standards of corporate behaviour and transparency through the international harmonisation of accounting standards, strengthening the principles of corporate governance, lifting the bar on the “fitness and propriety” of directors and managers and introducing improved market disclosure standards. It is in the interest of Bank’s, financial institution and corporate business entities for standards of corporate governance to be raised and thereafter maintained, as effective corporate governance ensures that long-term strategic objectives and plans are established, and that proper management and management structure are in place to achieve those objectives; while at the same time making sure that the structure functions to maintain the organization's integrity, reputation, and accountability to its relevant constituencies. Enforcement alone cannot guarantee good corporate governance. Whilst measures to enhance corporate governance are primarily aimed at boards of directors, who are seen as the agents responsible for protecting shareholder value, the internal audit fraternity is another industry group that is of particular importance. It is evident that the significance of internal auditing as a key contributor to corporate governance has emerged as a theme. This new paradigm in internal auditing will see the profession becoming a front player in ensuring good corporate governance structures. In this demanding environment, boards and senior management need quality advice from sources that can be trusted and that can offer an objective viewpoint. Much of the focus of Sarbanes-Oxley in the United States and Basle Committee has been on the external audit function. Equally, however, there is a need to ensure that internal audit is organised, resourced and empowered so that it can provide competent, impartial and fearless advice. In contrast to external auditors, however, our sense is that internal audit is still evolving as a profession and has further to go in promoting its own professional standards and profile in Papua New Guinea. We in BPNG observe that internal audit in our supervised institutions is not based on widely utilised standards, recognised by Audit Committees for example, and it is not always focused on the same set of issues. Internal audit functions vary from a narrow concern with compliance or financial accounts to a broader remit reviewing efficiency and effectiveness or acting as an internal consultant. My address today offers a prudential perspective on the role of internal audit. It starts with the separate roles of internal audit in the corporate governance framework. Specific references will be made to the internal audit setup in the Bank of PNG. It then sets out the expectations of internal audit held by prudential regulators at the international level and how the regulator assesses whether internal audit in the institutions it supervises meets these expectations. Finally, I discuss some regulatory issue, the problems and challenges. My comments are offered in a constructive spirit to encourage debate within the internal audit profession. I will start by borrowing the definition of internal audit approved by the Board of Directors of your Institute: “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” As we see it, the basic function of internal audit is independent appraisal of an institution’s internal controls, including controls over financial reporting. Simply put, it is about reviewing activities to ensure that they are carried out as intended. Of course, a by-product of internal audit will be recommendations on internal control and process improvements that could be made, an important role for internal audit at large and complex financial institutions in particular. The Bank of PNG Internal audit charter was drawn up with the assistance from the IMF Technical Advisor and reviewed periodically – by the internal audit department; it was approved by senior management (Governor) and subsequently confirmed by the board of directors as part of its oversight role. In the charter, the bank’s senior management gives the internal audit department the right of initiative and authorises it to have direct access to and communicate with any member of staff, to examine any activity or entity of the bank, as well as to access any records, files or data of the bank, including management information and the minutes of all consultative and decision-making bodies, whenever relevant to the performance of its assignments. The charter states the terms and conditions according to which the internal audit department can be called upon to provide consulting or advisory services or to carry out other special tasks and the charter is communicated throughout the organisation. To perform their role effectively, internal audit requires organizational independence from management to enable unrestricted evaluation of management activities and personnel. To ensure independence, Manager Internal Audit reports directly to the Governor and also has direct access to the Audit Committee on matters considered of significant importance to the functioning of the BPNG. Audit committees require the help of internal auditing departments in order for them to be able to effectively fulfill their obligations to the board, the shareholders, and other outside parties who have a stake in the organisation. The contribution of internal auditors as business advisors or consultants to the organisation and their role in ensuring compliance with various statutes, policies and procedures cannot be overemphasized. These new challenges that are faced by internal auditors require them to acquire the necessary skills and competencies on a continuous basis. This makes it necessary for them to place them on a learning path so that they could update themselves with new developments. He/she should know all aspects of the operations in order to perform an effective job as an internal auditor. In this respect, the work done by the Institute of Internal Auditors in developing a wholesome internal auditor is laudable. An internal audit function within a bank that is organised along the principles set forth in Basel Committee paper on Banking Supervision (BIS August 2001) facilitates the work of bank supervisors. Strong internal control, including an internal audit function, and an independent external audit are part of sound corporate governance which in turn can contribute to an efficient and collaborative working relationship between bank management and bank supervisors. An effective internal audit function is a valuable source of information for bank management, as well as bank supervisors, about the quality of the internal control system. Bank supervisors should evaluate the work of the bank’s internal audit department and, if satisfied, can rely on it to identify areas of potential risk. Supervisory authorities have issued various regulatory provisions covering banks’ internal control systems. Although the extent of this regulation may vary across countries, it generally includes some basic principles aimed at promoting an adequate system of controls as well as a regulation with regard to adequate capital. To evaluate the quality of internal controls, supervisors can take a number of approaches. One approach is for supervisors to evaluate the work of the internal audit department of the bank, including its testing of senior management’s processes that identify, measure, monitor and control risks. If satisfied with the quality of the internal audit department’s work, supervisors can use the reports of internal auditors as a primary mechanism for identifying control problems in the bank, or for identifying areas of potential risk that the auditors have not recently reviewed. The Basel II Accord has stipulated that the internal audit would have to capture in a larger way the application and effectiveness of risk management procedures and risk assessment methodology and critical evaluation of the adequacy and effectiveness of the internal control systems. The banks and other supervised institutions will be required to introduce and implement Risk Focused Internal Audits and Self Audits. The implementation of risk based auditing would mean that greater emphasis is placed on the internal auditor's role of mitigating risks. By focusing on effective risk management the internal auditor would not only offer remedies for current trouble areas but also anticipate problems and play an important role in protecting the bank and regulated institutions from risk hazards. The financial institution should create an effective audit program to monitor the operation of internal controls against self-dealing, conflict of interests and other violations of the Code of Conduct, identify weaknesses, and ensure corrective action is taken. Financial institutions work in a highly regulated environment. The Board of Directors/Trustees should ensure that bank / regulated institution’s management and relevant employees are aware of all applicable laws and regulations. The Code of Conduct should contain specific and appropriate consequences that would serve to deter wrongdoing and unacceptable business practices, and promote accountability amongst employees and others to the Code. Let me conclude by saying that the achievement of good corporate governance will ultimately be the result of cooperative efforts between regulators, internal audits and parties subject to such regulation. Thank you.