Protiviti’s Managing Director for the United Arab Emirates shares his insights and discusses the priorities for Chief Audit Executives (CAEs) in 2014
In an exclusive interview, Internal Auditor Middle East spoke to Arindam De (BE, MBA, CFA), who is one of the founding members of Protiviti in the Middle East. Arindam started his career over 20 years ago as an engineer and a few years later moved to consulting; both business consulting and risk advisory. Arindam is also an active supporter of the UAE Internal Audit Association (UAE IAA) and a member of its Executive Committee.
Internal Auditor Middle East met with Arindam De at Protiviti’s office in Abu Dhabi.
Over the past few years, Protiviti’s profile has been increasing significantly within the region. What do you think is the reason for this?
(Smiling) Do you know that we only came to the region back in 2007? We set up the Middle East firm with a handful of people and now we have established multiple service lines that offer Internal Audit, Risk Management, Capital Projects, Business Consulting, Information Technology and Forensics solutions to clients across diverse sectors like Telecom, Banking and Financial Services, Oil & Gas, Utilities, Government, Healthcare, etc.This shows that we have been able to understand what our clients want,and over the years we have been able to successfully build a strong team of specialists to cater to our client needs .
Based on your experience within the region, what are your views on the emphasis that is being placed on internal audit?
You see, the maturity of internal audit in the region differs by both country and industry. At the country level, the “Tone at the Top” plays a key role in the emphasis on internal audit. We see that, this tone is quite advanced in the UAE, as the Securities and Commodities Authority is driving good governance practices in listed companies across the country. Further in Abu Dhabi, the mandate of the Abu Dhabi Accountability Authority (ADAA) has resulted in the creation of internal audit departments across various governmental and semi-governmental entities. Another good example is Saudi Arabia, where the combination of large businesses and good regulation has focused on the need for internal audit. There, the Capital Market Authority and SAMA have played an active role in advancing good governance and internal audit. It is generally seen that the financial services industry has the most matured internal audit functions within the region. This maturity has come from the market and central bank regulations (from the region and globally) which continue to emphasize the need for an effective and independent internal audit function.This industry is highly regulated and the financial implications of a risk are quite high due to the nature of banking business.Regardless of the regulation, the challenge every CAE faces is the need to increase awareness at the Board or Audit Committee level in order to drive “Tone at the Top”.Without sustaining this commitment to stakeholders it is difficult to succeed as a CAE !
So what are the ways in which a CAE can increase the awareness of Board or Audit Committee members on internal audit and other related topics?
This is a journey that the CAE will need to take. Something like this doesn’t happen overnight or in one session. It starts with sharing new publications or thought leadership, followed by presentations and workshops on emerging issues in internal audit, governance, risk management, and internal control. You can even choose to invite experts from the profession to speak to the Board or Audit Committee. Such practices are not uncommon; many governance codes have provisions on the continued professional development of board members. By doing this, the Board or Audit Committee will slowly but surely realize the value of internal audit and the breadth of its mandate.
“Without sustaining your commitment to stakeholders it is difficult to succeed as a CAE”
You mentioned that financial services industry was one of your specializations and that internal audit functions in this industry are relatively mature. What do you think are the biggest challenges facing financial services industry in the region?
According to me, the top spot would be shared by two equally important challenges. The first would be regulatory risk. Banks globally and across the region are faced with a stream of new and complex regulations such as Basel Committee guidelines, FATCA, local regulations etc. This puts a burden on the processes and systems that support compliance with such regulation. The second would be information security risk including privacy risks (including impact of cloud computing and mobile apps). Protecting the data of a bank and its customers from the latest technological tools & techniques that may be used to breach security protocols is vital to the continuity and reputation of any bank. Audit Committees would want assurance from the CAE that compliance & security risks are being adequately managed by the business.
What else would Audit Committees in the region expect from the CAE? In other words what should be the CAE’s priorities for 2014?
First of all, linking corporate strategy to the internal audit plan is a primary focus area. Internal audit is not only about compliance with policies and delegated authority.Audit Committees expect that a major portion of the internal audit efforts (whether assurance or advisory) are directed towards risks which hinder strategic objectives. This has also been emphasized by the Institute of Internal Auditors’ (IIA) Standards.
Secondly, we have seen many companies implement Enterprise Risk Management (ERM) programs but has internal audit carried out it’s role in evaluating the effectiveness of this framework? ERM is a major investment for companies and Audit Committees need assurance from the CAE on this key initiative.
Finally, companies, and particularly in the governmental and semi-governmental sectors are focusing on nationalizing their labor force. Regardless of program structure, all of them have a similar objective- which aims at recruiting and retaining local talent after training them. The CAE needs to review this program to see if the organization is taking the right steps in supporting the country’s nationalization drive. I feel that Internal Audit Department should also extensively encourage young national talent in taking up internal audit profession.
Quote : “Without sustaining your commitment to stakeholders you cannot succeed as a CAE”
Would these priorities be different for CAEs in Dubai & Qatar as they approach the Expo 2020 and World Cup 2022 respectively?
I would say that the priorities would still be relevant but with the boom in Dubai and Qatar, the nature of the risks (both strategic and operational) would also differ. The planned large-scale construction activity will impact both real estate developers and contractors alike; each of them would want to learn from the lessons of the past and ensure proper controls are in place (including controls to mitigate fraud risk). The boom will also bring in major M&A deals, new entrants to the market, etc. Therefore CAEs should actively be aware of such risks while assessing the impact of change and the effectiveness of the organization’s change management programs.
How can the CAE keep senior management and the Board or Audit Committee aware of any new risks that may arise during the audit cycle?
The traditional once a year risk assessment for audit planning purposes would not address this. Alternatively, integrating the internal audit process with the company’s ERM program would result in synergies and would better focus internal audit effort on the organization’s changing risk profile. For example, technology is becoming a bigger dimension in the internal audit world. As companies grow and become more automated, new audit areas such as social media risk and cloud computing risk become more prominent.
Any final advice to CAEs on how they can stay relevant given the challenges of the profession and changing Audit Committee expectations?
Professional knowledge and awareness is constantly challenged by global changes. As individuals, CAEs need to update themselves on what is happening globally & regionally by attending IIA conferences, building a strong professional network, reading thought leadership, participating in surveys etc. This will help today’s CAE in aligning their internal audit strategy in a way that strikes a perfect balance with all of his stakeholders.