Chapter 3a - Role of Internal Auditor in CG STDT

INTERNAL AUDITING
CHAPTER 3A:
ROLE OF INTERNAL AUDITING
IN CORPORATE GOVERNANCE
DISCUSSION TOPICS
 Meaning of corporate governance

 Internal auditing as part of control
 Internal auditing as an aid to management
 Internal auditing and the Audit Committee and Board of
Directors
 Regulation and Guideline affecting IA function
 Role of IA in risk management
2
MEANING OF CORPORATE GOVERNANCE
 “Is the process and structure used to direct and

manage the business and affairs of the company
towards enhancing business prosperity and
corporate accountability with the ultimate
objective of realizing long term shareholders
value, whilst taking into account the interest of
other stakeholders” - Finance Committee on
Corporate Governance
3
CG – WHOSE RESPONSIBILITY?
 Board of Directors and management

 Takes interests of shareholders/stakeholders at heart
 Conduct their work diligently & carefully
 Comply with relevant legislation
 Ensure transactions be conducted and recorded in honest,
ethical and transparent manner
 Achieves maximum profit, at same time to protect
company’s image, efficiency/effectiveness, and maintain
reputable CSR
4
MALAYSIAN PERSPECTIVE
 The economic crisis of 1997/1998 put a tail on East Asian economies

including Malaysia
 High level Finance Committee in March 1998 recommend a
framework for CG setting out best practices for industry
 Reform of CG in Malaysia mainly focuses on:
 fair treatment of all shareholders, particularly minority
shareholders
 Transparency disclosure
 Accountability and independence of Board of Directors
 Strengthening regulatory enforcement
 Promoting training and education to all levels
5
CG REFORMS
 SC (1994) – all listed companies with BMSB to have Audit

Committee
 Malaysian Code of Corporate Governance (MCCG) under
MoF (1999) – importance of having independent Board of
Directors and independent Audit Committee
 Details of MCCG – text pg 46, 48-49
 BMSB Task Force (2002) – guidelines to assist listed companies
in making disclosure on internal control
6
CONTENTS OF MCCG
 Principles
 Directors
 Directors’ remuneration
 Shareholders
 Accountability and audit
 Best Practices
 Directors
 Accountability and audit
 Shareholders
 Other Participants – other stakeholders
 Explanatory Notes – further elaboration on principles 7
and best practices

REGULATIONS AND GUIDELINES
 Regulations and guidelines affecting IA:

 Three relevant sections in MCCG (voluntary):
 The Board should maintain a sound system of internal control to
safeguard shareholders’ investment and company’s assets
 The Board should establish internal audit function.
 Where internal audit function does not exist, the Board should assess
whether there are other means of obtaining sufficient assurance
 The internal audit function should be independent of the activities
they audit and should be performed with impartiality, proficiency and
due personal care
 BMSB (mandatory):
 To disclose “Corporate Governance Statement” in annual reports 8
 To disclose “Statement of Internal Control” in annual reports

POOR CG?
 Instances of poor CG:

 Ineffective Board of Directors
 Ineffective Audit Committee
 Excessive remuneration - Not closely linked to actual corporate
performance
 Unreliable annual report and audited accounts
 What would be the impact of poor CG:

 Poor financial reporting
 Unreliable financial information
 Inaccurate decision making
 Poor firm’s performance
9
CHARACTERISTICS OF GOOD CG
 Good management structure & clear line of responsibility

 Important elements of good CG:
 An effective Board of Directors
 Good strategic direction & plan
 Balance of executive & non-executive
 Management structure & policies/procedures
 Delegation from Board to the management
 Independent supervision of Audit Committee
 Independent supervisory body
10
ROLE OF INTERNAL AUDIT IN CG
 Internal Control
 Governance
 Risk Management
11
IA AS PART OF CONTROL
 The governance structure comprises of 4 levels:

 Level 1 – Oversight (Board and committees)
 Level 2 – Supervisory (senior management)
 Level 3 – Operational (Operational management)
 Level 4 - Monitoring (audit, self assessment, consulting activities) –
Internal auditor, external auditor
 IA is an integral part of the internal control system, is to

ensure that:
 Financial and operational information are reliable and possess integrity
 Operations are performed efficiently and achieve effective results
 Assets are safeguarded
 Actions and decisions of the organization are in compliance with laws,
12
regulations and contracts

INTERNAL CONTROL FRAMEWORK
 Internal control Framework – Committee of Sponsoring Organizations (COSO)
(1992) in US
 Internal control framework components -Has five inter-related companies
components:
a) Control environment
b) Risk assessment
c) Control activities
d) Information and communication
e) Monitoring
13
GOVERNANCE:
INTERNAL AUDIT AS AID TO MANAGEMENT
 “An independent, objective assurance and consulting activity designed to add value
and improve an organisation’s operations. It helps an organisation accomplish its
objectives by bringing a systematic, disciplined approach to evaluate and improve
the effectiveness of risk management, control and governance processes”.
 The internal audit function is a valuable resources to the Board, the Audit
Committee and the management of the company
 The CAE should report functionally to the Chairman of the Audit Committee
to ensure his independence and administratively to the CEO to facilitate work
arrangements.
 IA should meet or exceed the internal auditing standards
 The AC should ensure the audit function is adequately resourced and
appropriate standing within the company
14
GOVERNANCE:
INTERNAL AUDIT AND AUDIT COMMITTEE
 It is a good practice for companies to establish internal

audit functions to undertake regular monitoring of key
controls and procedures and companies which do not
already have a separate internal audit function.
 The board should establish an audit committee of at least:

a) 3 non-executive directors (a majority of whom are independent
b) The chairman should be an independent non-executive director
15
INTERNAL AUDIT AND AUDIT
COMMITTEE
 The framework identified three areas of activities that are keys
to an effective relationship between audit committee and the
internal function
 Assisting the audit committee to ensure that its charter,
activities and processes are appropriate to fulfill its
responsibilities.
 Ensuring that the charter, role and activities of internal audit
are clearly understood and responsive to the needs of the
audit committee and the BOD
 Maintaining open and effective communications with the AC
and the chairperson 16
BEST PRACTICE OF AUDIT COMMITTEE
1) Members should be appropriately qualified and include members who have
accounting or related financial management expertise
2) Names of members, details of activities for the committee, number of
meetings held in a year, and attendance at meetings should be disclosed in
the company Annual report.
3) The committee should meet regularly and have unrestricted access to the
CEO, CFO, senior management and employees.
4) The committee should have an oversight responsibilities of the internal
audit function and of the external auditors over matters arising from
financial reporting process and other related matters
5) The committee should ensure risk assessment and internal control
frameworks are effective and
6) The committee should review the independence of external auditor
17
annually
DEFINITION OF RISK MANAGEMENT
 Is a proactive and an on-going process involving the

identification, assessment, control, monitoring and reporting
of risk-exposures.
 A structured risk management approach also enhances and
encourages the identification of greater opportunities for
continuous improvement through innovation.
 To ensure the successful implementation of risk
management, there must be relevant capabilities in place to
manage the business.
18
RISK MANAGEMENT PROCESS
 RM begins at the top of the organisation, therefore the top

management of a business organisation will need to take the
first steps in laying the foundation to establish an effective
risk management process
 An overview of risk management is best carried out by a
multi-disciplinary team or a risk management committee as
risk management is a multifaceted process.
 Risk management process is undertaken via:
a) Risk assessment
b) Risk management strategies
c) Risk monitoring
19
RISK MANAGEMENT PROCESS
6. Continuous 1. Identify
2. source
Improvement
RISK
ASSESSMENT
RISK
MONITORING
5. Monitor 4. Manage 3. Measure
RISK
MANAGEMENT
STRATEGIES
20
ENTERPRISE RISK MANAGEMENT (ERM)
 The objective of providing the management and board a

commonly accepted model for discussing and evaluating
an organisation’s risk management efforts.
 ERM – is a process, effected by an entity’ board of
directors, management and other personnel that is
applied in strategy-setting and across the
enterprise. Its goal is to provide reasonable
assurance regarding the achievement of
organisational objectives by identifying events that
may affect the entity and managing risk to be
within the entity’s risk appetite.
21
RISK MANAGEMENT:
ROLE OF INTERNAL AUDITOR
 Test check the adequacy of risk management

processes, models and systems
 Act as in-house consultant
 Educate and create awareness among the
management and staff concerning the internal
control issues
 Encourage knowledge – sharing culture
22

Chapter 3a - Role of Internal Auditor in CG STDT

Uploaded by

Copyright:

Available Formats

Chapter 3a - Role of Internal Auditor in CG STDT

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter 3a - Role of Internal Auditor in CG STDT

Uploaded by

Copyright:

Available Formats

INTERNAL AUDITING

 Meaning of corporate governance

 “Is the process and structure used to direct and

 Board of Directors and management

 The economic crisis of 1997/1998 put a tail on East Asian economies

 SC (1994) – all listed companies with BMSB to have Audit

and best practices

 Regulations and guidelines affecting IA:

 To disclose “Statement of Internal Control” in annual reports

 Instances of poor CG:

 What would be the impact of poor CG:

 Good management structure & clear line of responsibility

 The governance structure comprises of 4 levels:

 IA is an integral part of the internal control system, is to

regulations and contracts

 It is a good practice for companies to establish internal

 The board should establish an audit committee of at least:

 Is a proactive and an on-going process involving the

 RM begins at the top of the organisation, therefore the top

5. Monitor 4. Manage 3. Measure

 The objective of providing the management and board a

 Test check the adequacy of risk management

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.