UBFA 2043 Audit Practice Individual assignment

Question :

Bursa Malaysia's Revamped Listing requirements makes it mandatory for the Board of Director of public listed companies to disclose their compliance to the Malaysian Code of Corporate Governance (the code).

As an internal function is listed as best practice in the code, discuss whether non-listed public companies should also comply with the code with respect to internal audit function.

Answer :

1. Introduction

Bursa Malaysia’s Revamped Listing Requirements makes it mandatory for the board of director of public listed companies to disclose their compliance to the Malaysian Code of Corporate Governance (the code). However non-listed public companies do not necessary need to comply with the code. Suggestions have been made that non-listed public companies should comply with the code with respect to the internal audit function since internal audit is seen as a crucial function in an organization.

The code is meant to protect the interest of public by forcing the public listed companies to comply with all the best practices listed. Since public listed company is listed in the Bursa Malaysia and public could easily be the owner of these companies (by buying shares of the company), hence the percentage of public interest in public listed company is much more higher compared to a non-listed company. Therefore mismanagement in the company would severely causes the share prices to drop significantly and the public would nonetheless be the biggest victim. To minimize the possibility such tragedy to occur, all the public listed companies should comply with the code by employing internal auditors. I have to stress here that even when the company sets up an internal audit department, mismanagement could still occur and the company would go bankrupt in no time. A very good example would be the Perwaja case which is still on trail at this moment. Therefore there is no ultimate way for us to avoid mismanagement in a company. What we could do is just to reduce the chances of mismanagement to protect the public interest.

2. Describe the main issues in relation to the question

Now, let us go back to the main issue concerned. Should non-listed public companies comply with the code with respect to internal audit function? My answer is a firm NO. First, as I have mentioned earlier, comply to the code would not necessary guaranteed a company from mismanagement. Hence when a non-listed public company’s have an internal audit function, mismanagement could still occur.

We need to understand how an internal audit functions in a company and how does it benefits public listed companies. The main reason internal auditors are employed is to ensure accountability, transparency and credibility of the company’s operations. Internal auditors’ responsibilities vary among employers. Some internal audit staff might spend most of their time doing compliance auditing; some might be following up the work of accounting staff. Most important, the internal audit functions as a watchdog in a company, to check on the day-to-day operations and the internal controls of the company. The check and balance on the company’s internal control such as the segregation of duties and physical controls over the company’s assets is seen as an important job performed by the internal auditors. However since the internal auditors are employed by the company, it has little independence. It would only be a puppet position in the company. Therefore it is a big question mark whether the money spent is worth the value!

The main reason for public listed company to set up an internal audit function lies in the public interest. There is not much option left for the public listed company since public interest should always be in the first place. However in a non-listed public company the proposition of public owning the shares are relatively low compared to public listed company (since it’s not listed on Bursa Malaysia). Therefore the reason for non-listed public company to employ internal auditors would not be tenable here. Say that if a public listed company does not have an internal audit function and mismanagement causes the share price to fall significantly, this price dropped would definitely have a chain effect on the Bursa Malaysia. Worst still if the company is a blue chip it would significantly affect the composite index and this would bring disaster to the nation’s economy. This however is irrelevant for non-listed public companies.

Besides this, we must understand the nature of a non-listed public company. There are two types of non-listed public company that we could distinguish. The first group is companies that do not fulfill the requirements of Bursa Malaysia listings. These companies usually comprise those of relatively small paid up capital. The second group of companies fulfilled the requirements to be listed however they chose not to be listed by some reasons, might it be political or financial decisions. These companies are very stable financially and they have plenty of resources and cash to play around hence they chose not to be listed (to increase capital). The similarity of these two groups of non-listed company is the ownership is usually concentrated on one party. In other words, it is said to be ultimately controlled by one party.

Since non-listed public company is ultimately controlled by one party, the party would by all means ensure that nothing would go wrong with the day-to-day operations. Hence they would make the best decision (whether to employ internal auditors). Should anything go wrong, the party would have suffered major losses. The decisions to employ internal auditors should therefore lie in the hand of the management instead of making it mandatory.

Some of you might disagree with me. Since the code is already written and it comprises all the best practices in corporate governance, why non-listed public companies should not be made mandatory to employ internal auditors? Instead I have another question, why not make each and every company in Malaysia including private limited company to employ internal auditors? Obviously the issue we should deal here is to which extend the types of company should be made mandatory to employ internal auditors. Since not every types of company is suitable to employ internal auditors (though it’s the best practices in corporate governance), a line should be drawn to separate between those who should employ and those who do not necessary employ internal auditors. Undoubtedly, the line that should be drawn upon should be between public listed company and non-listed public company.

Moreover, the code is written specially for public listed company. Should the same code be implemented for non-listed public company, we would be too perfunctory in treating this issue. Since the nature of public listed company differs greatly from non-listed public company, it is ridiculous that non-listed public company should follow the footsteps of public listed companies to be made mandatory to employ internal auditors (comply to the same code). Put it simply, would you share the same clothes with your brother? As the saying goes, one man’s meat is another man’s poison.

Besides that, it is too rigid to make a non-listed public company mandatory to employ internal auditors. In fact, taken a closer look, most of the company would have their own rights to choose whether to employ internal auditors. For those companies opt not to have internal auditors, they might have their very own reason. These might be some issue regarding the company’s operations that prevent them from employing internal auditors. Hence if a bill is passed in the parliament to make it mandatory for all non-listed public company to employ internal auditors, it would create more problem than it solved!

We must also look at the macro level of internal audit. Today, the scope of internal audit has transcended its traditional role, moving towards greater heights. Therefore it is quite silly for us to go against the trend, suppressing the role of internal audit. Companies which want to save on cost and at the same time want to comply with the code would employ incompetence personnel as internal auditors. By making non-listed public companies mandatory to employ internal auditors would make them employ incompetence personnel hence tarnish the noble role of internal auditors.

Those who argue about the mandatory for non-listed public company to employ internal auditors might have their own point. Theoretically, internal auditors might have prevented fraud and check on the management of the company. In actual the independence of internal auditors is eroded by the master servant relationship. Are internal auditors doing their job? Yes. Are internal auditors really giving out the results most of us are expected? No. This is because the jobs assigned to the auditors are given out by the board of directors. Some of you might argue that, having a watchdog is better off than none. However having a watchdog that doesn’t bark would make no difference not to have any watchdog at all. Do not forget that incurring extra cost would mean a burden for non-listed public company.

Another important issue that those who have a hue and cry over the mandatory of non-listed public company to have internal auditors miss out is the practicality of this enforcement. The numbers of public listed company in Malaysia is a large one. However non-listed public company formed even a greater number. How are the authorities to enforce this ruling should all the non-listed public company is required to employ internal auditors. Again, greater problems are created and the chaos created would have far reaching implications. Very often, talking about implementing a governing rule seems much easier than reality. However when put in the statute, things might have turned out unexpectedly.

I have to clear the doubts here. My stand is not to prevent or stop non-listed public companies to employ internal auditors. Having internal auditors could benefit some of the non-listed public companies. However when me make it mandatory for all non-listed companies to employ internal auditors, the problem arise. Therefore we must not take off the rights of the management to have an option over the employment of internal auditors. Company that opted not to have internal auditors might conclude that they have other functions in the department that could perform the jobs better than internal auditors. For example, the information technology department would easily take over the job of internal control by internal auditors by checking on the segregations of duties. The functions of external auditors might also override the functions of internal auditors. Hence internal auditors might be seen as a surplus in an organization. External auditors could also preserve the accountability, transparency and credibility as what an internal auditor does. In fact an external auditor is far more independent compared to an internal auditor.

3. Conclusion and Recommendation.

Instead of making it mandatory for non-listed public companies to employ internal auditors, efforts should be made to improve the independence and credibility of external auditors. Focus should be put on other critical issue in audit profession. Obviously, there are more issues that needs our attention, such as to what extend auditors should be responsible to the audit reports.

Non-listed companies that chose not to employ internal auditors could always outsource this function to a third party. This would indirectly create lesser problems and hassle for the company and at the same time preserve the independence of internal auditors (as it is outsourced to a third party).

If a non-listed company decided to employ an internal auditor, they must ensure that internal auditor performs up to the expectations. A crucial issue to deal with is to what extend the management is going to interfere the internal auditors’ job. Company’s regulations could be amended to give internal auditors greater power and hence greater independence. Besides that, the internal auditor must be a competent individual. It is good to make sure the internal auditors are holders of professional certificate and members of MIA to have some extend of assurance that they could really deliver.

To conclude, non-listed companies must not be forced to employ internal auditors (comply with the code). When they decide to employ internal auditors, they must ensure that internal auditors are performing their job well. If the internal auditors fail to live up to expectations, they shouldn’t be employed at the first place.