Corporate Governance and the Role of Internal Audit The Case of Arabia Insurance Company

1
Corporate Governance and the Role of Internal
Audit The Case of Arabia Insurance Company

• Presented by
• Naji Fayad MBA, CA, CIA, CISA, CCSA
• Senior Manager/Head of Internal Audit Division
• Arabia Insurance Company SAL

2
Corporate Governance Process at Arabia Insurance
Company

• Outline
• Initiation of Process
• Major Components
• Road Map/Major Tasks Achieved
• Limitations and Challenges
• Audit Committee and Internal Audit Function
• Lessons learned
• Final Thoughts

3
Initiation of Process

• Originally started in 1998
• New Board of Directors and New Management in 1999
• Seeds of a new culture planted
• Not an official process but individual
  initiatives inspired by the need for improving
  the companys internal business environment and
  creating value and competitive edge

4
Major Components

• Spirit of modernization
• Strive to effectively compete in challenging
  Regional and Global economies
• Changing Regulatory, legal and business
  environments in countries of operation.
• Tone at the Top (BOD, General Management) as a
  major driver in the process of how Arabia is run
  and controlled
• Initiatives inspired from international corporate
  governance codes and internal brainstorming and
  discussions

5
Road Map / Major Tasks Achieved

• Written Policies and Procedures drafted for all
  functions
• Operations Processes streamlined
• New Organization Chart / Functions interrelations
  clarified
• Audit Committee formed
• Hiring an Internal Audit Senior Manager
• Internal Audit Function Established
• Official Internal Audit Charter
• Official Audit Committee Charter
• Various initiatives to Promote Transparency,
  Disclosure and Accountability (Top Down)
• Code of Business Conduct (Best Practices, Whistle
  blowing, grievances etc.. with reporting and
  enforcement mechanisms)

6
Limitations and Challenges

• Cultural Resistance to Change
• Arabia Size and Geographical spread
• Being good could sometimes be costly
• Actual Focus on Financial indicators with lesser
  regard to Non-Financial Factors such as good
  corporate governance (a very common approach
  worldwide)
• Note An international survey conducted by
  Deloitte Touche LLP in 2004 revealed a critical
  fault line between rhetoric and reality or
  between awareness and action in the
  boardrooms of the worlds leading companies.
  Non-financial factors are widely regarded as
  extremely important drivers of success for a
  company, yet they receive considerably less
  attention than financial data from the board and
  senior managers

7
Arabia Audit Committee and Internal Audit Function

• Two of the aspects that were critical in the
  corporate governance process
• Audit Committee
• Internal Audit

8
Definition of Internal Auditing

• Internal auditing is an independent, objective
  assurance and consulting activity designed to add
  value and improve an organization's operations. 
  It helps an organization accomplish its
  objectives by bringing a systematic, disciplined
  approach to evaluate and improve the
  effectiveness of risk management, control, and
  governance processes

Source Professional Practices Framework
International Standards for The Professional
Practice of Internal Audit, IIA Inc. Altamonte
Springs, Florida, USA, January 2004
9
Definition of Governance

• The combination of processes and structures
  implemented by the board in order to inform,
  direct, manage and monitor the activities of the
  organization toward the achievement of its
  objectives.

Source Professional Practices Framework
International Standards for The Professional
Practice of Internal Audit, IIA Inc. Altamonte
Springs, Florida, USA, January 2004
10
Arabia Audit Committee

• Governance body charged by the Board of Directors
  with oversight responsibilities of the
  organizations audit and control functions
• Established in December 2000
• Composed of 3 Members of the Board of Directors
• Guided by a Written Audit Committee Charter

11
Arabia Audit Committee Charter

• Mission
• Oversight responsibilities for
• Considering the effectiveness of system of
  internal controls designed by management to
  Safeguard assets and income, Manage significant
  Risks, Assure integrity of Financial Statements,
  Maintain compliance with the companys ethical
  standards, policies and procedures, and with laws
  and regulations
• Ensuring the independence and objectivity of the
  companys external auditors and reviewing their
  performance
• Monitoring the performance of the company's
  internal audit function

12
Arabia Audit Committee Charter (Contd)

• Composition
• Three members of the board. The Board will
  ensure that members meet the independence
  requirements and that the members are either
  financially literate or have industry knowledge.
• Meetings issues
• Duties And Responsibilities
• Oversight of the Financial Statements and
  Disclosure Matters
• Oversight of Companys Relationship with the
  External Auditors
• Oversight of Internal Audit function
• Oversight of Companys Risk Management Function
  (in the absence of a Risk Management Committee)
• Oversight of the Companys Compliance
• Reporting issues

13
Arabia Internal Audit Division

• Established in December 2000
• Full Time Senior Manager and Team of 4 internal
  auditors with relevant financial and insurance
  experience and professional designations (3 MBA,
  1 CA, 4 CIA, 2 CISA, 4 CCSA, 2 CFE)
• Reporting directly to the Board through the Audit
  Committee
• Various Reports to Audit Committee (Audit plan,
  Missions, Quarterly, Yearly, and Ad-hoc
  reporting, etc..)
• Meeting regularly with Audit Committee
• Mission clearly stated in an Internal Audit
  Charter

14
Arabia Internal Audit Charter

• The purpose, authority, and responsibility of the
  internal audit activity was defined in a charter
  
• Charter officially approved by Board and
  Management in 2001 and documented in BOD minutes
  
• In summary, the Internal Audit charter
• Establishes the internal audit activitys
  position within the organization
• Defines Authorities (access to records,
  personnel, and physical properties) and
  Responsibilities
• Defines the scope of internal audit activities

15
Arabia Internal Audit Charter Contents

• Independence and Objectivity section
• Mission and Duties section
• Reviewing and appraising the soundness, adequacy,
  and application of accounting, financial, and
  other operating controls
• Ascertaining the extent of compliance with
  established policies, plans, and procedures
• Appraising the economy and efficiency with which
  resources are employed
• Ascertaining the extent to which company assets
  are accounted for and safeguarded from losses of
  all kinds
• Ascertaining the reliability of management data
  developed within the organization.
• Recommending improvements

16
Arabia Internal Audit Charter Contents

• Ethical standards and Internal Audit Professional
  Code of Conduct
• Responsibility and Authority
• Scope Operational, Compliance, Financial
• Internal Audit Planning Methodology
• Risk-Based Assessments
• Risk Measurements
• Audit Reporting Issues
• Ratings of audit reports
• Mutual Responsibilities of Management and
  Internal Audit Department (Dealing with
  differences of opinions, Recommendations follow
  up process, etc..)

17
Important Duties of Internal Audit

• Report significant issues related to the
  processes for controlling the activities of the
  organization, including potential improvements to
  those processes
• Provide information on the status and results of
  the annual audit plan and the sufficiency of
  department resources
• Assessing the overall adequacy and effectiveness
  of the organizations internal controls,
• Monitoring compliance with the organizations
  code of conduct and ensuring that ethical
  policies and other procedures promoting ethical
  behavior are being followed

18
Relationship with Audit Committee

• Audit committees and internal auditors have
  interlocking goals. A strong working relationship
  is essential for each to fulfill its
  responsibilities
• Three areas of activities that are key to an
  effective relationship between the audit
  committee and the internal audit function
• Assisting the audit committee to ensure that its
  charter, activities, and processes are
  appropriate to fulfill its responsibilities
• Ensuring that the charter, role, and activities
  of internal audit are clearly understood and
  responsive to the needs of the audit committee
  and the board
• Maintaining open and effective communications
  with the audit committee and the chairperson

19
Lessons Learned

• Effective corporate governance requires a
  proactive, focused state of mind on the part of
  directors, CEO and senior management. All must be
  committed to business success through maintenance
  of the highest standards of responsibility and
  ethics
• Even the most thoughtful and well-drafted
  policies and procedures are destined to fail if
  directors and management are not committed to
  enforcing them in practice

20
Lessons Learned

• A good corporate governance structure is a
  working system for effective decision-making and
  appropriate monitoring of compliance and
  performance
• Sound Governance is dependent on the synergy
  generated among the four principal components of
  effective corporate governance systems Boards of
  directors, Management, Internal auditors, and
  External auditors. In that structure, internal
  auditors and audit committees are mutually
  supportive

21

• Some related literature from the Institute of
  Internal Auditors
• Professional Practices Framework (PPF)
• International Standards for the Professional
  practice of Internal Audit (ISPPIA)

22
IIA Standard 2130 Governance

• The internal audit activity should assess and
  make appropriate recommendations for improving
  the governance process in its accomplishment of
  the following objectives
• Promoting appropriate ethics and values within
  the organization
• Ensuring effective organizational performance
  management and accountability
• Effectively communicating risk and control
  information to appropriate areas of the
  organization
• Effectively coordinating the activities of and
  communicating information among the board,
  external and internal auditors and management

Source Professional Practices Framework
International Standards for The Professional
Practice of Internal Audit, IIA Inc. Altamonte
Springs, Florida, USA, January 2004
23
IIA Practice Advisory PA 2130

• Internal Audit Activity as Ethics Advocate
• Internal auditors and the internal audit activity
  should take an active role in support of the
  organizations ethical culture. They possess a
  high level of trust and integrity within the
  organization and the skills to be effective
  advocates of ethical conduct. They have the
  competence and capacity to appeal to the
  enterprises leaders, managers, and other
  employees to comply with the legal, ethical, and
  societal responsibilities of the organization

Source Professional Practices Framework
International Standards for The Professional
Practice of Internal Audit, IIA Inc. Altamonte
Springs, Florida, USA, January 2004
24
IIA Practice Advisory PA 2130

• Internal Audit Activity as Ethics Advocate
• The internal audit activity may assume one of
  several different roles as an ethics advocate.
  Those roles include chief ethics officer
  (ombudsman, compliance officer, management ethics
  counselor, or ethics expert), member of an
  internal ethics council, or assessor of the
  organizations ethical climate

Source Professional Practices Framework
International Standards for The Professional
Practice of Internal Audit, IIA Inc. Altamonte
Springs, Florida, USA, January 2004
25
Final Thoughts

• The published reports of corporate governance
  failures in various countries underscore the need
  for change to achieve greater accountability and
  transparency by all organizations
• Senior management, boards of directors, internal
  auditors, and external auditors are the
  cornerstones of the foundation on which effective
  organizational governance is built
• Internal audit activity plays a key role in
  support of good organizational governance it has
  a unique position to assist in improving an
  organizations operations by evaluating and
  improving the effectiveness of risk management,
  control, and governance processes

26
Final Thoughts

• Lebanese Code of Corporate Governance is an
  excellent source and roadmap to companies for
  adoption of corporate governance initiatives
• LCCG Contains principles widely accepted in US,
  Europe, etc. and recently embraced by many Arab
  Countries in their regulations (Oman CMA, Bahrain
  CBB, Saudi Arabia SAMA, Jordan)
• LCCG is still Voluntary and not legally binding
• Role of Audit Committee as stated in Appendix F
  of the Code could be improved

27

• Thank You