Q: Describe the role of the Institute of Internal Auditors South Africa (IIA SA) as a guardian of governance.
A: Internal audit is the eyes and ears of the board through the audit committee. It protects value creation and the assets of the organisation by checking and giving assurance that the risks the organisation faces are mitigated by adequate and effective controls.

It has evolved from being seen as a watchdog or policeman to being a trusted adviser and confidant to the leadership. At this level, internal audit no longer focuses purely on lessons learnt through hindsight, but provides deep insight and foresight related to key risks. This naturally means that it has taken a more strategic-driven approach and looks at multiple futures to determine whether the organisation has adequate controls in place to mitigate against even the unexpected.

Q: How does internal audit differ from external audit?
A: Internal audit is often still a misunderstood discipline, with many confusing it with external audit. The latter is primarily a financial discipline with the mandate to give assurance on financial control; that the organisation’s financial statements are a true reflection of the organisation’s position; and that it is a going concern.

Internal audit, on the other hand, is a multi-dimensional risk-based discipline that considers governance, risk and control related to the achievement of organisational objectives in all areas of organisational activity, from strategy, sustainability and finance to HR, marketing, procurement and so on.

Q: Why should even small businesses appoint internal auditors?
A: In a world characterised by volatility, uncertainty, complexity and uncertainty, the risks organisations face have increased significantly. Internal audit’s value lies in the assurance it gives the leadership that the risks are being dealt with appropriately, but also in the best-practice advice it can offer. Where the organisation is too small to afford its own in-house internal audit function, it could bring in internal auditors periodically.

Q: What are the main challenges the IIA SA faces? How do you tackle these?
A: The institute is a voluntary professional body. Therefore individuals may practise as internal auditors without being members of the institute and without being held accountable, as we have jurisdiction over our members only.

In addition, we still find that many organisations employ internal auditors without checking whether they are certified. This results in many being employed without meeting the institute’s recommended requirements.

Coupled with that is the fact that still too many internal auditors and audit activities are not conforming to international internal auditing standards. We are constantly educating the market around these dimensions.

Q: How does the IIA SA contribute to the professionalisation of internal auditors?
A: The institute plays an active role in the development of national internal audit occupational qualifications that are designed to develop competence in the profession.

In old terms, we would have referred to these as ‘articles’. Training in preparation for these qualifications takes place through the academy, and the institute conducts the final individual competency assessments.

We are in discussion with the relevant bodies with regards to the institute becoming a self-regulatory body. Our main focus would be around competence and accountability as opposed to the extreme spectrum of regulation.

Q: In what ways have recent high-profile external accounting scandals in SA affected the profession?
A: As a result of the general public not understanding the difference between external and internal audit, our profession has also been swept up in the furore.

The institute has made some changes toward rebuilding trust and credibility, which include, inter alia, compulsory annual ethics training for members who hold our designations, an annual declaration to be completed by all members, inclusion of ethics components in our major events, and increasing awareness around the role that the institute plays in holding internal auditors accountable. We have also signed an MoU with other professional bodies that allows us to work together in terms of holding individuals with multiple memberships accountable.

Q: How can ethical business behaviour – from the small players up to major JSE-listed entities – stimulate SA’s economy?
A: Unethical behaviour diminishes organisations’ bottom lines as well as investor confidence. Over time it destroys organisational value. For the SA economy to thrive, it needs to be inclusive, and that in itself has ethical dimensions.

Stakeholders, including investors, need to see strong adherence to governance principles in order to feel what and where they invest is safe. The safer they feel, the more they will invest. In ethical organisations the likelihood is higher that sustainable value would be extracted and optimised.

Q: How important do you consider King IV for small businesses? And how can SMEs incorporate it in their business model?
A: The King Code is hailed in all quarters of the globe and hugely important. Speaking as a CEO of a small NPO, I can attest to the fact that there is great value in applying the principles.

The challenge that we see in SA is that too many business leaders consider governance as a compliance burden as opposed to seeing the principles as designed to assist in building strong organisations. The principles should be a way of life, not just another tick-box exercise.

Key performance indicators should link the creation and destruction of value to the capitals of the integrated reporting framework to business objectives, and these need regular review and assessment.

It’s also important that the organisation ensures its oversight bodies are independent, positioned to ask the right questions and encourage integrated thinking among themselves and within the organisation. Their structures should therefore facilitate integrated thinking and not hinder it.

Q: Do you find that the attitude towards accountability and whistleblowers is improving in SA? How should SMEs encourage this?
A: There is certainly an improvement in the attitude towards accountability, with all the recent scandals, but I can’t say that whistleblowing has significantly improved. Too many are afraid to speak up. Key to encouraging whistleblowing is to make people feel safe, as well as to ensure that action is taken. Employees who see no positive change after they have blown the whistle will become discouraged and refrain from speaking up.

Also, leaders should often have conversations around ethical dilemmas their organisations and staff may face, and provide guidance on how they should be dealt with.

Q: Who should be driving corporate governance in an SME? Is this a top-to-bottom approach?
A: The tone is set by the board, and the MD/CEO should be the champion who ensures it permeates throughout the organisation. The MD/CEO may appoint someone to drive programmes and monitor adherence to good governance principles. Internal audit would play a crucial role in providing assurance on the adherence to governance principles.

Q: In tough economic times, small business owners may be tempted to cut corners or pay bribes. How can this behaviour be rooted out and in what way does it affect the broader economy?
A: Consequence management is key, but we should also get to a stage where perpetrators are shamed by their peers. In a society where unethical behaviour is tolerated, it will thrive. When leaders know their peers will turn their backs on them and report them, they may feel less inclined to break the law.

Part of our problem is that perpetrators do not recognise the impact of their actions. It is easy to think it’s a victimless crime and therefore justify their actions.

We need to make people more conscious of the ripple effect of unethical behaviour, and how they harm ‘faceless’ people and communities. There is no victimless unethical behaviour.

Q: What is the value of the annual IIA SA Corporate Governance Index (CGI) as a benchmarking tool for SMEs?
A: The CGI gives us insight into the degree to which SA organisations are adhering to good governance principles. It’s a great benchmarking tool that leaders can use to ascertain where they are in relation to their industry and sector but, more importantly, identify the areas where they can improve.

The most significant trends we’ve observed include a decline in sentiment around whether organisational cultures are ethical; risks (both internal and external) not being managed appropriately; leaders seeing governance as a tick-box exercise; organisations not having suitable human resources and that the human resources are not being optimally utilised; executive teams not functioning optimally; the ICT strategy not being aligned to the overall organisational strategy; and, given organisations’ current resources, output/delivery levels are not optimal.

Q: What is your vision for SA’s internal auditing sector for the next five years?
A: We would like to see greater accountability through self-regulation. We need to get to a point where all practising internal auditors are held accountable against the Code of Ethics and Standards.

We’d also like greater commitment by organisations to train internal auditors. Too often we see organisations only looking for skilled internal auditors without making any effort to upskill internal auditors. We would welcome it if internal auditors played a stronger role in protecting organisational value and providing insight and foresight to the leadership. And then we would like to see the profession positioned for the impact of new technologies, in particular AI.

By Silke Colquhoun
Image: Hanlie Huisamen