Sir Gerry Grimstone, the Chairman of Standard Life, today called on internal auditors to provide a more rigorous and robust challenge to risk management practices within their organisations in order to reduce the chances of a new systemic crisis caused by corporate failures.
Speaking at the annual conference of the Chartered Institute of Internal Auditors, Sir Gerry said that strong internal audit is central to enabling boards to work effectively and prevent business disasters such as the financial crisis, or the Volkswagen emissions fixing scandal.
Said Sir Gerry: “Whether it is banking, the motor industry, or pharmaceuticals, what is the common thread that causes major disasters to happen?”
“It is when a Board is not at the centre of a business. It is when a Board is not a safe place for executives to report exactly what is going on within a business…..it is when a Board does not have independent eyes and ears telling it exactly what is happening in the business.”
“Good internal audit is the core of this.”
“To move from becoming a valuable function within the business to a critical function requires Internal Audit to clearly demonstrate how it adds value. From my perspective this is clear; it provides rigorous, robust challenge in a knowledgeable independent manner providing the Board with insight and a robust control mechanism.”
He added that strong internal audit can also help businesses to win the confidence of regulators:
“I have seen a number of instances recently where the regulators have recognised the quality and independence of the internal audit teams and asked them to do work which traditionally might have been commissioned independently – what a prize that is!”
Speech highlights growing importance to boards of insight into corporate culture
Sir Gerry also set out the major new challenges that internal audit now needs to rise to, highlighting in particular the risks associated with inappropriate corporate cultures.
He added: “an important new dimension that has arisen in recent years is risk culture and behaviours. This is more difficult to audit than a balance sheet or the evidence of a control…..The challenge for Internal Audit is how to do this and whether internal auditors have the skills to do so.”
“I believe the skills required to look at the risk culture need to be an extension of the core capabilities of internal auditors, and in particular their ability to intelligently and robustly challenge, and most importantly, to anticipate.”