Ensure independence of internal auditors, PLCs told

KUALA LUMPUR: The Institute of Internal Audit Malaysia (IIAM) has urged public listed companies (PLCs) to strengthen their internal audit functions by ensuring independence and professionalism.
"When there is an independent function, the internal auditors will be able to do their work and will be able to report exactly what they see. For example, if the internal auditor reports to the CFO and they are actually auditing some areas under the CFO, what happens is that they will be afraid because it is going to be reported to their boss. At the end of the day, their bonus, salaries and everything will be affected, but if they have independence then there is no fear," IIAM president Lucy Wong told reporters at a briefing yesterday.
She said internal auditors who are empowered would be able to do much more work, especially risk-based auditing, as the management would not be able to dictate the internal auditors' scope of work. Without independence, there is a possibility of management brushing off important findings that internal auditors may highlight.
"The role of the internal auditor is to help the organisation realise what are the strengths and weaknesses and if there are any weaknesses, to improve and take corrective action before things get worse," she added.
IIAM, which commissioned a study to construct the profile of the internal audit function and audit committees in Malaysian PLCs, said that 90% of PLCs that outsourced their internal audit functions paid RM100,000 or less in a year.
"The amounts incurred indicate that very junior staff or very few staff were in the audit team and a limited scope was covered. The low amounts are also a sign that the staff are not professionals and may not have the experience and skill set to effectively carry out the work, thus less is spent," said Wong.
IIAM recommends that PLCs consider the professional qualifications, certification and experience of their outsourced service providers (OSPs) in relation to the scope of work required to ensure adequate coverage of risk areas and reliable reports are issued.
According to IIAM's study, 54% of PLCs preferred OSPs over inhouse internal audit functions. This is more prevalent among small PLCs, with 87% of these organisations hiring OSPs compared with 46% of large PLCs.
To avoid the impairment of independence, the roles of audit committee chair and board chair should be separated. However, the study showed about 7% of audit committee chairs were also board chairs.
Wong said an individual carrying out both roles may not be able to exercise independent judgment if the decision taken at the audit committee differs from that at the board level. The difference in views could also cause frictions while separation would allow decisions to be made without judgment and bias.
IIAM recommends that PLCs select independent and professionally qualified OSPs rather than focusing on the cost alone. These OSPs should also have a diverse range of skills to ensure understanding of industry-related matters.
In terms of gender diversity, the study showed that 92% of audit committee members are men. IIAM recommends the inclusion of women who could provide different perspectives, suggestions and approaches towards issues raised by the internal auditors.
The study was conducted by Thye & Associates with information collected from annual reports of Main Market-listed PLCs with a 2015 financial year-end. A total of 779 PLCs' internal audit function disclosures and 785 PLCs' audit committee disclosures were extracted.