Sean Turner
Committee Secretary
Parliamentary Joint Committee on Corporations and Financial Services
PO Box 6100
Parliament House
Canberra ACT 2600
Dear Mr Turner
Ethics and Professional Accountability: Structural Challenges in the Audit, Assurance and Consultancy Industry
The Institute of Internal Auditors – Australia (IIA-Australia) appreciates the opportunity to provide this submission to the Inquiry. We believe that our comments are a balanced representation of the views of our membership.
We represent 3,000 internal audit professionals, around 35% of whom work within government services. We also have many members working within the professional services firms. Therefore, this inquiry is of critical importance to IIA-Australia and our members.
Broadly, we understand that the professional services firms play an important role in helping government agencies discharge their duties. We also know that internal audit plays a crucial role in ensuring good governance, risk management and control. Therefore, we believe placing greater emphasis on professional internal audit processes (both within government and the professional services firms) will help ensure consultants may continue to fulfil the needs of government agencies, without compromising good governance.
Professional Standards in Internal Audit
IIA members are bound by Standards (the International Professional Practices Framework or IPPF), which has three components: the International Standards for the Professional Practice of Internal Auditing (Internal Audit Standards); the Code of Ethics; and other recommended guidance. While the engagement partners within the service firms are typically members, the personnel that work down the line are often not. We believe mandating professional membership requirements for all internal audit consultants would strengthen governance within the firms.
IIA-Australia’s Professional Responsibility and Ethics Committee (PREC) is charged with promoting an understanding of the professional responsibilities of members and monitoring emerging ethical issues. Should any complaints be received in relation to members and their adherence to the Standards or Code of Ethics, PREC determines whether the complaint should be investigated by a Disciplinary Tribunal. Should a member be found to have breached the Standards or Code of Ethics, the Disciplinary Tribunal has the authority to recommend appropriate action against this member, which may include expulsion from the Institute. Consultants who are members of IIA-Australia are required to follow the Standards set out in the IPPF and are subject to disciplinary measures if they do not.
Additionally, IIA-Australia, and others, provides independent five-year External Quality Assessments (EQA) of internal audit functions. Such assessments are required under the global internal audit Standards. They provide feedback to the internal audit function of its conformance, or otherwise, with the internal auditing Standards. EQAs are currently not mandatory within federal government agencies nor the consulting firms themselves.
Governance and Internal Audit
Overall, we believe the problems identified with the use of external consultants within government represent a failure in effective governance. While there was unquestionably unethical (and at times illegal) behaviour, that this behaviour could continue undetected and unreported for so long, points to inadequate structural measures to identify and manage such risks, both within government and the services firms themselves.
We believe strengthening the governance frameworks by establishing an internal audit function within the professional services firms would help avoid these issues in the future, while also ensuring the management of the framework for service firms does not become overly onerous and complex. A successful framework that should be considered, and which applies to all listed entities in Australia, is the ASX Corporate Governance Council Corporate Governance Principles and Recommendations. This operates on an ‘if not, why not’ basis and is reported annually.
As the third line of assurance, internal audit provides the governing body with holistic oversight of risk management and governance structures, which helps foster a culture of continuous improvement and responsible oversight.
Embedding mandatory internal audit functions within the firms, would help improve governance. Internal audit provides an objective and evidence-based view of governance processes, risk management and internal controls.
Recommendations
We believe implementing the following would help ensure public expectations of good governance are met and that external consultants operate efficiently, ethically, and responsibly:
- Require that all contractors undertaking internal audit work for government agencies are members of a professional association and as such, are bound by professional Standards and Code of Ethics.
- Mandate five-yearly EQAs on the work undertaken by in-house professional services firm internal auditors, as well as any internal audit work they may be performing for government.
- Introduce a mandatory governance reporting framework for professional services firms who contract to government.
- Ensure that professional services firms have robust internal audit processes, examining their work with government agencies. These internal audit reports should be made available on request to the audit committee of any government department employing the consultancy.
I would welcome the opportunity to appear before the Committee to discuss these recommendations and how internal audit can strengthen governance within government agencies and the consultancy firms upon which they rely.
Yours sincerely
Peter Jones
Chief Executive Officer