Muhammad bin Ibrahim: Audit as a partner of change

Remarks by Mr Muhammad bin Ibrahim, Governor of the Central Bank of Malaysia (Bank Negara Malaysia), at the 5th PETRONAS Board Audit Committee (BAC) Forum "Audit as a partner of change", Kuala Lumpur, 16 August 2016.

The theme of today's forum "Audit as a Partner of Change" is highly relevant and timely, as the events in the global market today, involving failures of large firms, frauds and market manipulation activities, underscores the criticality of the three lines of defenses in organizations. For confidence and trust to be restored in the marketplace, the role of the BAC and internal auditors as the third line of defense will be even more critical than ever.

Our role as members of audit committees is much broader than what we may perceive it to be. Organisations such as PETRONAS are widely regarded as amongst the few key flag bearers for the country. Hence, it is incumbent upon the Board and the BAC members to be strong and energetic in upholding the highest standards of professionalism, ethics and integrity in discharging their roles and responsibilities. The people of Malaysia must have confidence and pride that an institution entrusted with much strategic natural resources are run with utmost integrity and professionalism.

Before I proceed further on the topic for today, allow me to touch briefly on the current outlook on the global and domestic economy. The global economy has experienced multiple shocks in recent years, with its effects reverberating across the globe. Global growth has continuously underperformed expectations and is expected to remain moderate going forward.

The divergence in monetary policy in advanced and emerging economies as well as the unexpected policy adjustments in several economies have also culminated in a global environment of heightened volatility and uncertainties. One of the most significant developments we have experienced thus far is the sharp volatility in commodity prices which has created destabilising implications on commodity-driven countries. Amid a confluence of shocks, ranging from weaker-than-expected growth prospects to geopolitical uncertainty and moderation in China's economic growth, oil prices declined by more than 50% in a span of 6 months in 2014. The volatility in oil prices has also been heightened by unanticipated economic and geo-political developments. The events unfolding in the United Kingdom and consequent effect to the European region have also contributed to the increased volatility in oil prices. Oil prices rallied to above USD50 per barrel from an average of USD33 per barrel in the first quarter of the year, and today, oil prices have settled back to around USD48 per barrel.

The oil price is likely to remain volatile over the next few years due to oversupply and record-high oil inventories against slow demand especially in China. LNG prices are also expected to remain low for a protracted period of time. LNG capacity start-ups in Australia and North America which will boost new LNG supplies amidst stagnating demand will put more pressure on LNG prices, hence further disrupting the LNG market. Due to low oil and LNG prices, the profitability of oil majors and National Oil Companies (NOCs) has been severely eroded. The impact has been pronounced. More than 300,000 oil and gas workers have been laid off globally since mid-2014; some USD 380 billion of global oil and gas projects have been deferred or cancelled; and more than USD 150 billion worth of assets have been planned for disposal or divestment.

Given Malaysia's openness and high financial and trade integration with the rest of the world, the Malaysian economy is not isolated from these developments. On the external front, lower global demand continues to weigh down on Malaysia's export performance.

Investment activities especially in the upstream oil and gas sector, contracted for the first time since the global financial crisis in 2015, after expanding by an average of 16% from 2010 to 2014. However, investment activity in the manufacturing and services sectors remained resilient, and is expected to underpin investment growth moving forward. Private consumption remained relatively resilient and anchored domestic growth, especially during the first half of the year, driven by sustained income and employment levels. Going forward, domestic demand is expected to remain a key driver of economic growth in Malaysia. We should expect Malaysian economic growth to range between 4.0 to 4.5 % for 2016.

Amid the changes in the financial landscape, there have been equally significant developments in the auditing standards both globally and locally. The standards and regulations are becoming increasingly tighter and more stringent. The Institute of Internal Auditors (IIA) for example, has proposed several changes to the Internal Audit Standards, which are expected to take effect in January 2017. The changes to the Standards are aimed at reinforcing the fundamental principles of internal auditing practices, promoting a broad range of value-added internal auditing and fostering improved organisational processes and operations. The direction of changes in the financial reporting standards also places more accountability on the Audit Committees to provide strong oversight on the organisation's financial reporting and internal controls. The new Companies Bill 2015 (the Bill) was passed by the Dewan Rakyat and is anticipated to come into force by end-2016. The new law is expected to bring major reforms to our corporate landscape and will place greater pressures on the audit function to understand the emerging regulatory requirements and their impact on business operations.

In the wake of uncertainties due to the global developments, the change in regulatory standards and technological advancement require businesses and regulators to think beyond conventional norms in order to navigate through these unchartered waters.

Turning to the theme today, the importance of an independent and effective internal audit function as a core line of defense with a strong Audit Committee in business cannot be overemphasized.

The fundamentals of an internal audit function involve identifying risks that could threaten the viability of the company and keep it from achieving its goals, ensuring management fully understands these risks, and proactively recommending improvements to minimise these risks. Internal auditors are essentially the eyes and ears of the Audit Committee and the overall Board. The failure of audit functions can result in devastating consequences as seen in recent times.

The case of the British Petroleum (BP) oil rig explosion in 2010 is one that reinforces the important role of the internal audit function. Occupational safety is widely regarded as a critical success factor for a company that undertakes oil exploration. The BP oil rig was awarded as the industry model for safety in 2009. However, in 2010, the oil rig exploded in the Gulf of Mexico, causing one of the worst man-made disasters in history. The U.S investigation commission attributed the disaster to the "failure of individuals involved to identify risks they faced and to properly evaluate, communicate and address them". This indirectly highlighted the shortcomings of the internal audit function as a contributory source of failure in the lines of defence in the company. Some level of scepticism to consider the remote possibility that the safety measures in place may not work in the event of disaster, could have avoided the risk event from occurring.

Another example is the LIBOR manipulation scandal involving several banks which culminated in substantial fines imposed by the UK Financial Services Authority (FSA). In its internal audit report published in March 2013, the FSA highlighted several issues pertaining to the breakdown of the internal audit function, which led to the manipulation of the rates. Despite the Group internal audit functions carrying out their routine audits in this area, deficiencies in the banks' systems, controls and policies were not adequately highlighted.

The lessons learnt from the above cases and others clearly reinforce the key roles played by both the internal audit function and the Audit Committee. My view is that the strength and effectiveness of the internal audit function will influence the risk and compliance culture in an organisation. The function has to continually be refreshed such that it remains robust and effective.

Clearly, the job is now more difficult and challenging than ever, given the increased expectations by stakeholders and heightened scrutiny when things go wrong, as well as increasing obligations under the statute that place additional fiduciary responsibilities on audit committee members. I would like to share my thoughts on four matters where efforts are necessary to raise the bar on audit standards and audit quality.

Firstly, the audit coverage and scope should not be confined to compliance or risk-based parameters. The audit scope should be holistic, encompassing new risk areas and tail risk events that originate from the evolving operating environment and financial landscape. The process of ascertaining the audit scope must be robust, such that audits focus on higher risk areas as the company grows and evolves in its products and processes. Internal auditors should be constantly challenged to think beyond the scope of the audit framework and focus on the broader picture. The so-called ability to 'connect the dots' about the implications of the audit findings across the organisation is an important starting point to identify new and emerging risks.

Secondly, internal audit should move beyond compliance to strategic auditing and to provide value-added recommendations for the betterment of the organisation. My view is that before an organisation seeks to venture into new or higher risk areas of growth, it is imperative for the board and senior management to seek assurance from the internal audit function so that the risk and control frameworks are rigorous in identifying gaps in the system. The Audit Committee should identify opportunities where the internal audit function is able to add value, through consultation and advice on business process improvements. The input from the internal audit function would also be helpful to craft initiatives to embed good behavioural norms, ethical and responsible culture within the organisation.

Thirdly, the internal audit function must be supported by a strong quality assurance process. This requires internal auditors to be equipped with the requisite skills such that they are able to leverage on their expertise and experience to make sound judgement and challenge the norm. This becomes even more important as companies grow in scale, venture into new lines of business and become more complex. Further, the internal audit function should leverage on technology as a key enabler to improve audit quality and audit effectiveness. Innovation in audit techniques should be promoted with greater usage of data analytic tools for better risk profiling and sampling.

There ought to be close engagement between the internal audit function and external auditors on key risks and systemic issues, and in strengthening the overall assurance process.

Fourth, the role of the Audit Committee is integral in these efforts. The Audit Committee at the apex needs to exercise strong oversight through setting the "tone from the top" and embedding the right culture to ensure that the internal audit function is independent and objective in delivering its mandates. One message of 'tone from the top' is a reminder to all Heads of Internal Audit that any findings that might indicate unethical or fraudulent activities or have reputational impact to PETRONAS should be communicated to the BAC immediately without waiting for the BAC to meet. There should be 'zero tolerance' for any cases that involve abuses and corrupt practices.

Another important imperative is the Committee's responsibility to design governance structures that avoid placing the internal audit function in conflicted positions, and ensure that the function has sufficient standing and authority within the organisation. This will help to strengthen the ability of the internal audit function to independently audit and raise red flags where risks are observed. Direct accessibility to the Audit Committee is key in this respect.

Concluding remarks

As the world becomes more interconnected, an effective organisation will see its business managers and control functions partnering with the auditors, leveraging on their skills to build more effective operations, and strengthen business prospects. Audit as a partner of change lies on the ability of the organisation to adapt and collaborate with the auditors towards securing the organisation's long term success.