The Future of Internal Audit
The future of the internal audit profession in financial services is the subject of hot debate.
On the prompting of the Financial Services Authority, the Institute of Internal Auditors UK forced a committee of the great and the good to produce a code for the function.
The draft code has published with a consultation period running to 12th April.
As a key stakeholder community, Stop Press readers should have their say.
Today’s Stop Press is dedicated to sharing some thoughts about the draft guidance.
First all I would like to applaud the fact that we have got around to acknowledging that internal auditing in the financial services sector deserves some guidance. The effects of the failure of internal controls is there for all to see as recessionary wastelands bear testimony to risks not properly mitigated.
Scope of Internal Audit
The guidance states that our scope should be unrestricted. Agreed. Unfortunately it seems to limit this scope to the “executive”. This is a shame as key controls will be operated by the non-executive directors who are supposed to challenge the executive. As the third line of defence the control processes operated by these non-executives should be within scope.
Culture
The guidance requires internal auditors to engage with the culture of control. This is excellent news. That said, culture is about human behavior. Human beings not only function at a logical level but also an emotional and spiritual level. The two forgotten dimensions should be captured by our work.
The how is something that Risk Audit’s training business will actively engage in during the next twelve months.
Involvement on a “Real Time” Basis
I am delighted to see that the profession is being encouraged to get involved on a real time basis. To me this means involvement from the moment a major initiative is “a glint in the CEO’s eyes”.
We need to develop new processes and a presence to be invited into the CEO’s thought processes.
Internal Audit & Risk, Compliance& Finance
Too many internal auditors continue to report into senior risk and compliance personnel.
Why has the Financial Services Authority given tacit blessing to these arrangements?
Some soul searching needs to occur within the new PRA and FCA hierarchy.
Standing of Internal Audit
I learn that a major bank is to appoint its Head of Internal Audit to the board.
Isn’t it time we took a more robust stand on this reporting line?
Remuneration
I am delighted to see that pay and rations should be responsibility of the audit committee.
The invisible hand of the CFO and CRO should be stamped upon in this context.
The London Perspective
London is populated by many companies with branches and satellite subsidiary structures. These are substantial businesses in their own right.
It is a shame that the guidance has not addressed the inter-relationship between local UK functions and Head Office function, many of which are deeply dysfunctional.
Resources
The guidance does not specify mandatory areas of knowledge that all internal auditors operating in financial services should possess.
It should!
Quality Assurance
I am delighted to see the paragraphs dealing with quality assurance.
May I be so bold as to stress more quality and less quantity?
Regulators
There is a major tendency in London for the FSA to use the internal audit function as a proxy for regulatory inspection. This undermines the role of internal audit and creates the feeling that we are the “spy in the camp”.
In the longer term this situation is not consistent with the regulators’ own objectives.
It is a shame that the draft guidance has not taken a more robust stance on this aspect.
I hope readers do not feel my tone is hectoring in nature.
It is the tone of someone who cares about the profession having worked in it for 33 years with some energy left for the next ten!
I should also declare a conflict of interest. My company, Risk Audit provides paid for training to the profession. Whilst the courses contribute to my living, they also contribute to Risk Audit’s higher purpose which is to support internal auditors in making a difference.