Cerita Audit - Macam Mana Internal Audit Boleh Add Value?

Assalamualaikum wbt.. Dan selamat berpuasa. Wah, diam tak diam, hari ini adalah hari ke-4 kita berpuasa di bulan Ramadhan. Alhamdulillah...

Lanjutan dari kisah sahabat-sahabat Patung Beruang yang meluah perasaan hari tu (sila rujuk entry sebelum ini), ada sorang sahabat Patung Beruang mengadu berkenaan relationship antara Internal Audit dengan client dan juga Senior Management. Susah sangat ke Senior Management nak provide full support to Internal Audit? Susah sangat ke nak maintain good rapport between Internal Audit dan client?

Suatu masa dahulu, Internal Audit fungsinya lebih kepada policeman. Hanya check compliance on the SOP, P&P. Maksudnya, jika SOP kata kena buat A, so Internal Audit akan check betul ke staff buat A? Katalah staff tiba-tiba buat B kerana A sudah tidak relevan dengan current condition, Internal Audit akan kata salah dan kira non-compliance to the SOP. Oleh sebab itu, fungsi Internal Audit sangat terbatas. Ia tidak memberi add value pun pada organisasi. Dan Internal Auditor pula menjadi malas berfikir. Hanya fikir cara ikut SOP sahaja.

Tetapi pada masa ini scope Internal Audit telah diperluaskan. Institute of Internal Auditor (IIA) telah menggariskan definisi Internal Audit sebagai;

•  "Is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. It helps an organisation  accomplish its objectivity by bringing a systematic, disciplined approach to  evaluate and improve the effectiveness of risk management, control and  governance process."

Key word disini adalah "Add value" dan "Improve an organisation's operations."  

Dalam kata lain, our clients and Senior Management expect us as Internal Auditor to give some add value on our services. 

Jadi, macam mana Internal Audit boleh add value? Berdasarkan pengalaman yang tidak seberapa ini, Patung Beruang boleh simpulkan ada 6 cara utk Internal Audit boleh add value iaitu: 

• A deep knowledge on the organisation and industry including its culture, key players and competitive advantage. 
• Courage to innovate in the ways that stakeholders never expect. 
• A broad knowledge on those practices the profession. 
• Creativity to adapt innovations implement by organisation.
• Always possess a positive attitude and deliver the best output to stakeholders. 
• Become a partner to stakeholders instead of policeman. 

Nampak macam senang kan nak implement point2 kat atas tu?? Sebenarnya, point2 tu tak muncul dalam satu malam. We need to have a strong developing process in order for IAD to have those above points. So, what is the developing process? 

Let's check it out..

1. Staff Competency. 

• Auditor sekarang bukan setakat buat kerja-kerja compliance saja. Tugas Auditor sekarang meliputi data analysis, propose new ideas, identify potential threats yang mungkin Management tak perasan pun, dan banyak lagi tugas yg memerlukan Auditor benar2 mahir dengan nature business organisasi dan industry tersebut. Dan, yg paling penting Auditor kena ada ability utk think out of the box and creative. 
• Jadi, statement "Internal Audit Department (IAD) adalah training ground untuk fresh grads" adalah statement yang dah lapuk. IAD perlukan staff yang ada pengalaman dlm business atau industry supaya mereka lebih nampak real world banding dgn fresh grads. 
• IAD juga sepatutnya menghimpunkan staff dari pelbagai background sesuai dengan nature business sykt tersebut. Katalah, jika sykt tersebut adalah pengeluar automotive, maka IAD patutnya mempunyai komposisi staff dari pelbagai background seperti automotive, design, mechanical, accountancy, IT, mechatronics, dan sebagainya. IAD bukanlah hak mutlak mereka yang berjurusan accountancy sahaja.  
• Adalah bagus jika staff IAD mempunyai professional certification. CIA, ACCA, CISCA, PMP etc. Janganlah hanya berpuas hati dengan segulung ijazah. Professional certification akan membentuk pemikiran staff untuk lebih kritis dan dynamic. Malah, ia juga akan buatkan staff lebih peka kepada latest trend dalam industry/specialty mereka.  

    2. A Challenging Work Environment. 

• Talented, motivated auditors are easily bored and require challenging work. Their creativity must be encouraged and rewarded, and their professional challenges must extend beyond regular audit assignments. 
• It is good if auditors being massively involved in decision-making process. Hence, every staff will have ability to think and provide ideas to determine the direction of IAD and develop new practices, not just Audit Managers.
• Using this approach, staff will have sense of belonging to the department. And they will realise that department actually implement 2 not single ways  of communication. The culture of this approach will emphasize partnership over independence, while never losing IAD's objectivity. 
• Remember, auditors are encouraged to be coaches, trainers, counselors of internal controls, not evaluators. So, they must look on ways to improve the business not just simply identify control weaknesses. 

    3. Condone Culture

• IAD should implement carrot and stick concept. Meaning, when staff achieved their target, we give reward via KPI, bonus, increment, promotion etc. But when they failed, we will punish them accordingly. 
• But, what happens now is some bosses very reluctant to punish their staff if they not performed just because of he doesn't want to lost his popularity. And.. that's not a good culture. 
• When the boss has condone behavior, indirectly he gives signal to the respective staff as well as the whole department that "It is ok if you're not performed."  The impact is department's performance will keep on decreasing, a good staff may overwhelm due to imbalance workload, unnecessary stress and eventually these good staff will leave the department. 
• See, this condone culture will ruin the department. Yes, staff may always remember this boss as a good and kind heart-ed boss. He or she may be popular over the time. But, whats the point being popular boss if your department not performed? If your department not appreciated by the stakeholders due to lousy output? 

    4. An Array of Audit Services

• IIA telah defined value proposition untuk fungsi IAD sebagai providing "assurance, insight and objectivity." Dan terma "insight" yang digunakan ini reflect Internal Auditing's role as a catalyst for change in an organisation - improvements in efficiency and effectiveness that are based on internal auditing's observations and recommendations. (petikan dari CIA Ref. Book - Paper 2).
• As a catalyst, IAD boleh offer service lebih dari sekadar check compliance, check PV yang tak bersign atau invoice yang lewat bayar. 
• Ada beberapa common services can be offered by IAD as follows: 

• Risk based audits. - Working with members of management to identify the business risks they face. 
• Process audits - Audits an entire business process rather than an organisational unit. Looking for ways to improve the process instead of simply trying to find control weaknesses.
• Pre-implementation reviews - Participating on new product or system development team and/or reviewing the project at certain defined milestones. 
• Self assessment - Hosting workshops, administering questionnaires, and conducting structured interviews to address soft controls. Also common are self-assessment programs for hard controls in which the business unit perform their own testing to obtain ongoing assurance while the auditors subtest their work, rather than performing all the detailed testing themselves. 
• Internal control education - Formal training programs designed and taught by internal auditors, as well as ad-hoc training, when needed, during assurance or consulting projects. 

Kesimpulannya, internal auditors kena bergerak keluar dari comfort zone. We need to aggressively get Senior Management's attention and support through providing value added services. A strong support from Senior Management to IAD will give signal to the whole organisation including head of business units that IAD is a partner and always willing to improve business same like other business units. IAD is not a fault finder....