Internal Audit - A Key Element of Corporate Governance in Credit Institutions
Internal Audit - A Key Element of Corporate Governance in Credit Institutions
Ciprian Mihăilescu1
Corina Ducu2
ABSTRACT: The world has always been in constant change and evolution, but the rate at which
changes and the evolution of humanity take place has dramatically increased over the past 70
years. Corporate governance and internal audit profession were no exception, both evolving with
great speed. All changes on the global financial markets in the last 10-15 years and the multiple
crises that the global economy went through during this period produced multiple mutations both in
the internal audit activity and the role that this activity and the audit committees have in corporate
governance. There are several aspects that will significantly mark internal audit in the 21st century,
and the organizations that will take account of these issues will have an internal audit service that
will truly bring them added value.
Key words: internal audit, corporate governance, risk management, credit institutions.
JEL Code: M4
1
″1 Decembrie 1918″ University Alba Iulia, Romania, e-mail: ciprian.mihailescu@yahoo.com
2
″1 Decembrie 1918″ University Alba Iulia, Romania, e-mail: corina_ducu@yahoo.com
387
Annales Universitatis Apulensis Series Oeconomica, 13(2), 2011
The lack of a single model of corporate governance at global level, has determined OECD to
identify a set of principles of corporate governance and publish them in the document entitled
“OECD - Principles of Corporate Governance 2004”. These principles do not impose restrictions
and do not take into account a thorough implementation in the national legislation. Their main goal
is to deliver a reference system, following the identification of goals and the means of achieving
them. They have an evolutionary character, being examined and revised according to the evolution
of global business. Thus, companies must continuously improve their corporate governance
policies, adapting them to the changes that continuously occur due to the innovation process.
OECD Principles (Abram V, 2003) are divided into six sections, as follows:
1. Providing a basis for corporate governance framework taking into account the promotion
of some principles of transparency and efficiency of markets, which should be in harmony with the
legislation and clearly formulate the separation of responsibilities between supervisors, authorities
of normalization and implementation;
2. Shareholders’ rights and the key functions of ownership pursuing protection and guarantee
of shareholders’ rights;
3. Shareholders’ fair treatment, ensuring a fair and adequate treatment within corporate
governance, including for foreigners and minority shareholders, stipulating the need to reward all
shareholders if their rights are violated;
4. Shareholders’ role in corporate governance is seen as a means of creating value and jobs
through cooperation between shareholders and companies, corporate governance recognizing the
shareholders’ rights, stipulated by law;
5. Accurate and timely reporting and transparency should be provided in corporate
governance in order to obtain a clear image of the organization in terms of performance, capital,
financial position and its governance;
6. Responsibilities of the board of administration must be clearly defined in corporate
governance to ensure effective strategic guidance to entities and to allow effective monitoring of
executive management by the board of administration, by assuming its responsibilities.
Corporate governance principles set forth by OECD were initially meant to apply the
concept of corporate governance in joint stock companies in order to efficiently manage companies,
but this concept was later extended to other types of organizations, being taken by most developed
or developing countries. We must observe that the emphasis is on the shareholders’ role and rights,
on the information transparency and on the crucial importance of company managers.
OECD principles are universally recognized, representing one of the 12 basic standards of a
solid financial system. They serve as a reference framework for achieving a large number of
national codes on corporate governance (White Chart of corporate management in South Eastern
Europe, the Stability Pact, and Agreement of South Eastern Europe for reforms, investments,
integrity and economic growth).
The central element of OECD principles is the transparency of all financial-accounting
information, as they are the basis of the decisions made by the information users. The quality of this
information plays an important role in the efficient administration of entities, leading ultimately to
the increase of their market value.
If, at European level, Great Britain can be considered a pioneer in the implementation and,
subsequently, the development of corporate governance, in the U.S., the Sarbanes-Oaxley Act,
appeared in 2002, is considered the cornerstone in establishing standards regarding the regulation of
registered companies (KH Spencer Pickett, 2006) at global level. The need for this law, which - in
case of non-compliance - imposes fines of millions of dollars, return of bonuses and serious
penalties (up to 25 years in prison), was due to the huge financial scandals that shook the U.S. in
2001-2002 and led to the collapse of some financial giants such as Enron in 2001 and WorldCom in
2002.
388
Annales Universitatis Apulensis Series Oeconomica, 13(2), 2011
Although it uses the same principle: “comply or explain yourself”, just like Great Britain,
the Sarbanes-Oaxley Act focuses on individual and corporate responsibility as compared to
corporate financial results, but also to the membership of the Audit Committee. The imperatives of
this act against the listed companies include several provisions regarding the managers’
independence, governance and audit committees, compensation and remuneration, and codes of
business conduct.
Like the Combined Code, the American model of corporate governance requires the
existence of an audit committee composed only of non-executive independent managers who act as
a detector of problems that can occur within the organization. Section 302 also stipulates that
managers must certify the financial statements and the information given to external auditors, as
complex, accurate and have responsibility for maintaining and evaluating internal control (Institute
of Internal Auditors in the UK and Ireland, 2002).
Sarbanes-Oaxley Act is presently used by a growing number of jurisdictions and
corporations, as it is more complex, closer to the legislative framework and concentrated more on
internal control, as compared to the other governance models used worldwide.
389
Annales Universitatis Apulensis Series Oeconomica, 13(2), 2011
Corporate governance within credit institutions is based on a set of principles that should be
applied regardless of the bank ownership: state or private. These principles were formulated by the
International Regulation Bank, as follows:
Principle 1: Board members must possess the necessary professional qualification for the
occupied position to fully understand their role in governance and have the ability to exercise
common sense on the bank business.
Principle 2: The Board of Managers must approve and oversee the banking strategic
objectives and ensure that its corporate values are disseminated within the organization.
Principle 3: The Board must establish clear areas of responsibility within the bank.
Principle 4: The Board should ensure that management exercise appropriate supervision by
board policies.
Principle 5: The Board of Managers and management should effectively utilize the results of
the activities of the internal and external auditors as well as of the internal controllers.
Principle 6: The Board should ensure that remuneration policies are consistent with the
bank corporate culture, the objectives and its strategy on a long-term and the control environment.
Principle 7: The bank should be governed in a transparent manner.
Principle 8: The Board of Managers and management should understand the bank
operational structure, including in various situations in which it operates under jurisdictions or
structures that restrict transparency.
In recent years, global discussions on corporate governance have been intensified in general
and the number of supervisors and audit committees has grown in particular, because over time, the
audit committees have received more and more responsibilities, including the direct or indirect
supervision of all processes and internal audit functions.
In the U.S., the audit committee has become a necessary component of corporate
governance system of large financial institutions. Sarbanes Oaxley is very clear in this respect,
stipulating the mandatory existence within the organizations listed on the NYSE (the American
Stock Exchange) and of those under the supervision of the FDIC (the U.S. equivalent of the Deposit
Guarantee Fund), and an audit committee composed of independent non-executive managers. In the
EU and the UK, the Combined Code does not require an audit committee, but only recommends its
existence. Although Winter Group has taken important steps in terms of the role of internal audit in
corporate governance, it did not detail on the provisions of internal audit and did not support the
idea of a unitary corporate governance in the EU. However, all major European financial groups
have audit committees in their corporate governance structure.
The size of the audit committee varies from a credit institution to another depending on
more factors. A study that analyzed the composition of the Audit Committee of 25 large European
banks in 2008 (David Ladipo, Stilpon Nestor, 2009) reveals that the number of the audit committee
members fluctuates between 3 (UBS Raiffesien, Dexia) and 9 (Erste Bank).
The audit committee and the internal auditors should be seen as an extension of risk
management procedures issued by the board of managers. Traditionally, internal auditors carried out
an independent assessment of the level of compliance with the internal control procedures,
accounting practices and systems within the bank. Still, the latest trends in the internal audit activity
describe its role as being one to provide assurance regarding risk management processes, control
systems, and not least the bank’s corporate governance. This can be achieved only by understanding
and analysis of the key indicators that govern each business line of the credit institution. Although
the audit committees play a valuable role in assisting executive management in identifying and
managing the business risk areas, the primary responsibility in risk management cannot be
transferred to them, rather being integrated at all management levels.
The objectives of the audit committee include: helping management identify and manage
risks, providing an independent assessment of control systems and risk management, evaluating the
efficiency, the effectiveness and the costs of operations, assessing the compliance with laws,
390
Annales Universitatis Apulensis Series Oeconomica, 13(2), 2011
procedures, regulations and other operating instructions, evaluating credibility of the information
provided by the accounting and computerized systems, providing investigations to superior
management.
Currently, internal audit operates on two levels. First, internal auditors provide an objective
and independent assessment regarding the structure of corporate governance (if it meets the needs
of the respective entity), as well as regarding the effectiveness of the operations specific for
governance activities. Second, internal auditors act as a catalyst for change, providing
recommendations or suggestions in order to strengthen corporate governance practices and structure
of financial institutions.
In an organization, superior management and the board of managers establish and monitor
large systems in order to achieve effective corporate governance. Internal auditors can support and
improve these activities. Moreover, although internal auditors must remain independent, they could
involve themselves in setting corporate governance mechanisms. Thus, providing assurance on risk
management, control systems and corporate governance processes of the organization, internal
auditors become a key element of effective corporate governance. The effective corporate
governance attributes are: relevant and reliable public reporting, to avoid the excessive
concentration of power on top of the organization, a strong and independent board of managers, and
the existence of effective risk control and assessment systems, strong internal and external audit
processes.
The way internal audit work in the corporate governance of financial institutions varies
according to the maturity degree of the corporate governance structure and processes of each entity
separately. Thus, in an organization with a low maturity degree of governance structure and
processes, the internal audit will focus more on providing advice on best practices and corporate
governance structures, while making an analysis of how the existing governance structures and
processes meet the requirements requested by supervisors and other regulators. In terms of financial
institutions which have mature governance structures and processes, the internal audit regards the
main areas of action: it evaluates if the different components of corporate governance function
together well, it analyzes the transparency degree of the reports made between different parts of the
governance structure, it makes a comparison of best practices of governance, and it sets out how the
codes of governance are recognized and enforced.
At this point, the internal audit is involved in all corporate governance processes, just like
the audit committees in the past were focused more on analyzing the financial statements of risk and
control. Today we are the witnesses of a process of rebranding the internal audit process in which
the internal auditor gains increasingly more recognition from the stakeholders. At this moment it is
not enough for the credit institutions, and companies in genera, to declare that they organized the
internal audit activity, as stakeholders will seek confirmation that the internal audit is conducted on
a truly professional framework regarding the role of consultant, insurance advisor and provider.
391
Annales Universitatis Apulensis Series Oeconomica, 13(2), 2011
stakeholders rely on the internal auditors’ work; the improvement of the coordination of internal
audit with the external audit will lead to an increase in this trend.
Risk management is a domain where the internal audit role has changed and is still
changing. The global financial crisis that led to the collapse of some credit institutions famous on
the financial market showed more than ever the need for change in terms of risk management and
internal audit and the role that the audit committees must hold in this activity. Although, like any
change, there is opposition, it is obvious that we need new approaches to risk management in terms
of internal audit. Thus, internal audit will have an increasingly important role in risk management.
The credit institutions must take into account that the head of the internal audit department must get
involved in strategic risk issues. Consequently, we can ensure the efforts of alignment of internal
audit activity to risk strategy adopted by the credit institution. This involvement of the head of the
internal audit department regarding risk management issues does not diminish the primary role that
executive management has in implementing risk management strategies. The result of this approach
will be that, when the executive management and the audit committee review risk management
activities, they will be eligible for assistance and recommendations to strengthen its internal audit
from the internal audit.
Focusing on the evaluation of risk management systems and the identification of key risks,
internal audit helps the organization to know the key risks it must face and to ensure that there are
existing mechanisms to manage those risks when they occur. Thus, internal audit will have a
rational approach in selecting the risk areas that it reviews each year, thus being able to provide an
overall assessment of the organization’s risk management systems and internal control of the entity.
This general opinion is requested more and more by the head of the internal audit department due to
increasing external pressures to publish control systems and risk management in the existing risk
credit institutions. Yet, internal auditors should take into account that their role does not completely
eliminate risks, but keeps them at an acceptable level for the organization when the costs of benefits
do not surpass the benefits that could be achieved through the control activity. Also, internal
auditors should understand how great are the risks that the credit institution wishes to take and
which are the areas of action of these risks. Another important task of internal audit is to evaluate
the capacity of the credit institution to cope with those risks that have been identified and, although
they were identified, underestimated the impact on the organization or the probability that those
risks affect the credit institution.
Corporate social responsibility is an element that derives from the attention and the respect
that we need to pay to our environment. Internal auditors play a vital role in understanding the risks
arising from corporate social responsibility. Companies need to respect the environment in which
they operate, to respect the social, to pay for the economic obligations, and, at the same time, to
become competitive. Internal auditors should update the global standards and initiatives related to
the corporate social responsibility, since they measure the level of corporate social responsibility.
The internal auditors’ need to have multidimensional knowledge vitally adds value to the
organization. In the era of rapid technological advances, changes in the business environment and
globalization, the internal auditors’ ownership of knowledge in various fields is a mandatory feature
of their professional capacity. Thus, in the financial services industry, and, especially, in the banking
industry, the internal auditors must have various Banking Audit Certificate and Financial Services
Diploma that will enhance their credibility in these areas.
New trends and perspectives regarding the role of internal audit in corporate governance
Corporate governance in credit institutions must be reinvented. Corporate governance bodies
of these economic entities must become smaller in terms of number of members in order to be more
professional and aim to ensure long-term solvency of the financial institutions they govern.
Therefore, it is necessary to reduce the number of members that make up corporate governance
bodies, accepting a maximum of 9-12 members. It was noted that banks that have larger bodies than
392
Annales Universitatis Apulensis Series Oeconomica, 13(2), 2011
the average corporate governance system, they are the least efficient among the largest 25 European
banks (David Ladipo, Stilpon Nestor, 2009). Another direction of action meant to increase the
efficiency of corporate governance in credit institutions is the need for expertise in the financial
industry for a significant part of corporate governance bodies and especially the board president.
Recent studies highlight the fact that in 2010 only 64% of the presidents in the 25 largest European
banks have any financial experience, compared with 80% in 2007.
Non-executive managers who form the corporate governance bodies should be involved as
little engagements as possible, compared with other sectors of the economy. In Europe, many
members of various boards of managers and audit committees in top banks admit that they do not
allocate enough time for the tasks they must perform within those bodies. Banks should also
remunerate non-executive managers better than they do it in the present, especially if they require
more time to devote to their activity. The best banks offer the best salaries to their non-executive
managers. But at this point one may find an upside-down relationship between the responsibilities
of non-executive managers and the remuneration they receive, meaning that they get less money for
some increased attributions.
Another burning question is about the performance based on remuneration of the managers
responsible with long-term solvency of credit institutions. Some analysts believe that it is necessary
to link the remuneration of these non-executive managers with the achievement of long-term
objectives regarding the solvency of financial institutions, as this measure would further empower
the members of corporate management. Other commentators believe that such an approach is not
appropriate for non-executive managers whose basic responsibilities are to ensure long-term
solvency of the credit institutions they manage.
In our opinion, the remuneration should be designed based on two components: the cash that
should not be tied to bank performance, because of the lack of correlation between the cash bonus
received by non-executive managers and the solvency of the financial entities limits the excessive
risk exposure, because there is no temptation to obtain higher cash income depending on the
reported figures, even if it means lower returns for shareholders and another component based on
stock-options granting for non-executive managers. The latter should be the dominant part of the
salary and bonus package, and represents an additional argument for managers to be more cautious
and to fulfill their duties more consciously. If the personal financial situation of non-executive
managers is linked to the credit institution they serve, they have a greater responsibility as they have
a high interest in doing things well and benefit from the good results obtained by the company.
At the same time, one must bring into question the role of non-executive managers who
form the remuneration committees regarding the bonus policy to management and the board of
directors. Non-executive managers can help mitigate the influence that shareholders exert over
CEO’s to obtain short-term results, including the reduction of the pressure to take excessive risks
because the CEO’s bonus package is currently influenced by the shareholders and it reflects their
desire for risk. Regulators worldwide are striving to limit this pressure exerted against the
executives and the board members. Thus, in the U.S., the Dodd-Frank Act obliges U.S. corporations
to provide the necessary funds for the remuneration committee to assure its independence, and also
its control on the bonus policies of the credit institutions. In September 2010, the G20 has released
the standards regarding the compensation packages offered for top managers and board members,
suggesting that - within the credit institutions - remuneration committees should establish the wage
policies of that organization. The recommendations issued both by the U.S. Federal Reserve and by
the Basel Committee on Banking Supervision suggest that the wage policies in the credit institution
must be established by the remuneration committee. The purpose of such measures is to ensure that
bankers no longer take excessive risks, generating losses for creditors and taxpayers. Another
objective is to offer a link between the payment of salaries and bonuses or any losses incurred by
the credit institution. In this sense, more and more CEO’s are have to accept the compensation
packages with a component formed mainly of shares or stock options instead of cash.
393
Annales Universitatis Apulensis Series Oeconomica, 13(2), 2011
394
Annales Universitatis Apulensis Series Oeconomica, 13(2), 2011
References
1. Anson M., 2003. Corporate Governance Ratings: Come of Age, Amsterdam, IGGN
Conference
2. Avram V., 2003. Management of the value creation process in the context of enterprise
governance, Bucharest, Economic Publishing House;
3. Basel Committee on Banking Supervision; 1998 . Enhancing bank transparency,
http://www.bis.org, 21.09.2011
4. Basel Committee on Banking Supervision; 2006. Enhancing corporate governance for
banking organizations, http://www.bis.org/bcbs/, 22.09.2011
5. Baker H. K., Anderson R., 2010. Corporate governance - A synthesis of theory, research and
practice, Hoboken, New Jersey John Wiley and Sons Inc
6. Buzatu L., 2004. The capital market in Romania, identifying new ways and opportunities of
developing and diversifying it, Doctoral thesis, scientific coordinator PhD Prof. Alexandru
Puiu, Bucharest, ASE
7. Cadbury Report, 1992. Report of the Committee on the Financial Aspects of Corporate
Governance, http://www.ecgi.org, 1.10.2011
8. Dobroteanu C.L, Dobroteanu L., 2007. Internal audit, Bucharest, InfoMega Publishing House
9. Dochia A., 2001. Report on corporate governance in Romania, presented within the OECD
conference in Bucharest, http://www.oecd.org, 12.09.2011
10. Greuning van Hennie, Bratanovic Brajovic S., 2009. Analyzing banking risk - A framework
for assessing corporate governance and risk management, DC, USA World Bank,
Washington
11. Gup E. Benton, 2007. Corporate governance in banking - A global perspective, United
Kingdom, Elgar Publishing Ltd.
14. Iosivan O.R., 2010. Auditing in Europe – Evolution and trends, Revista Economică,
no.6(53), vol.II, pp.44-51
15. Ivan O.R., 2009. European Standardization of Audit, Annals of the University of Petrosani,
Economics, Volume 9, Issue 4, pp.5-14
16. Pickett K.H. Spencer, 2006. The Internal Audit Handbook, Second Edition, River Street,
Hoboken John Wiley & Sons, III
17. Nestor Stilpon, Ladipo David, 2009. Bank boards and the financial crisis - A corporate
governance study of the 25 largest European banks, London, Nestor Advisors Ltd.
18. Nestor Stilpon, 2001. International Efforts to Improve corporate governance: Why and
How? OECD, http://www.oecd.org, 15.09.2011
19. Ridley J., 2007. Cutting Edge Internal Auditing, Washinton, DC., John Wiley & Sons Ltd.
20. Soltani Bahram, 2007. Auditing-An international approach, Edinburgh, Pearson Education
Limited
21. Smith J., 2003. Audit Committees Combined Code Guidance, http://www.kpmg.co.uk,
1.09.2011
22. Standard & Poor’s, Corporate Governance Scores-Criteria, Methodology and Definitions,
http://www.kantakji.com, 5.09.2011
23. Cartea Alba a administrarii corporatiilor in sud-estul Europei, Pactul de stabilitate, Acordul
Europei de Sud-Est pentru reforma, investitii, integritate si crestere economica,
http://www.oecd.org, 15.09.2011
24. Institutul Auditorilor Interni din Marea Britanie si Irland; 2002, Corporate governance and
risk management, Second edition, http://www.iia.org.uk, 5.09.2011
25. The Value Agenda; 2002, Deloitte & Touche and IIA-UK & Ireland, London,
www.deloitte.com, 14.09.2011
26. www.ccir.ro; 20.09.2011
27. http://www.fsa.gov.uk/pubs/ukla/lr_comcode2003.pdf, 15.09.2011
395