Internal audit function to lift smaller company governance

The new recommendation by the Australian Security Exchange (ASX) Corporate Governance Committee for listed entities to disclose whether they have an internal audit function will deliver a long overdue boost to the governance standards of around 1,800 Australian small and medium-sized companies.

Mark Harrison, managing director of global risk consulting company Protiviti, says: “Most well-resourced companies at the ‘big end of town’ already have an internal audit function because, quite apart from being good for governance, it adds value to the business. However, for the remaining 1,800 or so companies below the S&P/ASX 300, internal audit is practically non-existent.”

The recently released third edition of the ASX Corporate Governance Principles and Recommendations introduced Recommendation 7.3 which states that a listed entity should disclose if it has an internal audit function, how the function is structured and what role it performs. If it does not have an internal audit function, the entity needs to disclose that fact and the processes it employs for evaluating and continually improving the effectiveness of its risk management and internal control processes. The new recommendations apply to listed entities from 1 July 2014.

Harrison believes smarter operators will see this as an opportunity for positive differentiation in a crowded market.

He says many institutional investors and sophisticated investors now view the existence of an internal audit function as an indicator of the health and stability of the company.

“It’s a shortcut sign that the company’s a safer bet. Accordingly, companies that disclose a solid internal audit function will inspire greater confidence and enhance their attractiveness to investors.”

Similarly, Institute of Internal Auditors – Australia (IIA-Australia) CEO, Peter Jones, says: “Any public company that operates without a dedicated internal audit function in today’s environment is doing themselves and their shareholders a great disservice. Shareholders are relying on access to this information in making better informed investment decisions and board members need to be presented with any information that could potentially be of detriment to the operational or financial efficiency of that business.”

He notes the ASX guideline recommends that if a listed entity has an internal audit function, the head of that function should ideally have a direct reporting line to the board or to the board’s audit committee in bringing a requisite degree of independence and objectivity to the role.

While establishing a dedicated internal audit function might not be cost-effective for many small companies, Harrison says other competitive options are available. These include adopting a shared service model where two or three companies split the cost of an internal auditor, an approach which is common in the government sector, or outsourcing to an internal audit consulting firm.

To safeguard the quality and integrity of internal audit reviews, Harrison says companies should always insist their internal auditor applies the IIA International Standards for the Professional Practice of Internal Auditing.  These are the only globally accepted standards for internal audit work and represent professional best practices. 

“To be effective, a company’s internal audit review must be rigorous and independent. Applying the IIA’s international internal audit standards guarantees that the work will be robust and that company directors and executives will receive reliable and objective information to improve their business processes. Some service providers currently use accounting standards or their own internal manuals to perform internal audit work, but those references are not appropriate for internal audits and risk compromising the quality of the audit.”

As a leading practice document, IIA-Australia believes the new ASX guidelines are likely to affect all entities across Australia, not just listed entities. Government regulators are likely to take note of this inclusion as are not-for-profit organisations and private companies, it says.

value investors large