IN the past few years, the Minority Shareholders Watch Group (MSWG) has been raising questions at AGMs on the exceptionally low cost spent by PLCs on their internal audit (IA) function. MSWG considers a cost of below RM24,000 per annum as exceptionally low.
During the last year, a few of the PLCs queried have stated that the low IA cost was due to less or no audit work performed during the year because of movement controls arising from the COVID-19 pandemic.
Meanwhile, most of the other PLCs replied that they felt that the cost was reasonable, and that the scope covered by the IA function was sufficient to ensure that internal control systems were adequate and effective.
Some of the other reasons provided for the low IA cost include:
- The management and CEO were also undertaking necessary steps to ensure internal control procedures are being followed.
- The audit committee was receiving assurance from the management that risk management and internal control systems were adequate and effective.
- The reduction was due to cost cutting measures due to difficult times.
Unreasonable reasons
The reasons provided by the PLCs for the low cost incurred for their IA function does not hold water.
One of the reasons given was that the management and CEO were also undertaking necessary steps to ensure that the internal control procedures were being followed. Another was that the audit committee was receiving assurance from the management that risk management and internal control systems were adequate and effective.
In both these instances, the audit committee was relying on management for assurance on management when it should be relying on someone independent of management for that assurance – only an independent IA function, correctly positioned, can provide such independent assurance.
IA provides assurance on management – it does not make sense to ask management to provide assurance on itself – this is an obvious conflict of interest.
Another common reason given for the low IA cost was that it was due to cost-cutting exercises due to difficult times. The IA function should not just be regarded as any other ‘cost centre’ that can be downsized during difficult times.
It is exactly in such difficult times that there should be a robust IA function. It appears that some companies maintain an IA function just to ‘tick the box’ to say that they have complied with the listing requirement to have an IA function.
MSWG’s findings
The findings of the MSWG-ASEAN CG Scorecard 2020 assessment revealed that 158 PLCs had exceptionally low IA costs of RM24,000 per annum (or equivalent to RM2,000 per month) or less. The lowest cost incurred for the IA function was RM1,752 per annum (2019: RM1,488).
The bottom five PLCs with IA cost of RM6,000 per annum or below are:
All the five PLCs listed above had outsourced their internal audit functions.
The finding of the MSWG-ASEAN scorecard assessment revealed that out of the 158 PLCs with IA cost of less than RM24,000 per year, 154 of them relied on outsourced service providers for their IA functions.
An IA cost of RM1,752 per year for a PLC with more than RM10 mil revenue and RM6,000 for a PLC with almost RM200 mil revenue should spark concerns on the adequacy of the scope of work and the effectiveness of the IA function.
For that matter, even the 158 PLCs which had IA cost of RM24,000 per annum or less should also be viewed with concern.
IA role & function
The IA function is considered as one of the four cornerstones of good corporate governance – the other three being the board, the management and external audit. IA is considered important enough to be mandated by the listing requirements.
Chapter 15, Paragraph 15.27 of the Main Market Listing Requirements (MMLR) requires a listed issuer to establish an IA function that reports directly to the audit committee. The plans and scope of the IA function are determined by the audit committee of the PLC. As such, the role, the function, and the scope of the IA function could vary among PLCs.
IA provides independent assurance to the board through the audit committee that all is well when it comes to risk management, control processes and governance structures and processes of organisations.
Business organisations are susceptible to fraud and all kinds of wrong. As such an effective IA function is essential to safeguard the interest of the shareholders and other stakeholders.
Unregulated function
Unlike external auditors of PLCs who are regulated by the Audit Oversight Board (AOB) under purview of the Securities Commission (SC) and the Malaysian Institute of Accountants (MIA), the internal auditors are unregulated.
There is the Institute of Internal Auditors Malaysia (IIAM) but it is not mandatory for an internal auditor or for the head of an internal audit function to be a member of that Institute.
The unregulated nature of IA could be a reason for the low cost of the IA function. All things being equal, the lower the cost the lesser the quality, the competence and effectiveness.
That which is unregulated tends to fall into disarray. Important professions are always regulated. With regulations, there is higher quality and more accountability.
It is well and good to realise the importance of IA and make it mandatory for listed companies. If the IA function is indeed that important enough to be acknowledged as a mandatory requirement under the listing requirements, then surely it is important enough to be regulated – just like any other profession worth its salt.
Devanesan Evanson is CEO of the Minority Shareholders Watch Group (MSWG).
The views expressed are solely of the author and do not necessarily reflect those of Focus Malaysia.
