Corner stones: internal audit looks for its rightful place in Canada's new corporate governance model.

Internal auditors have been misunderstood for a long time, and the merits of what they do haven't been as highly regarded as perhaps they should in many quarters. Much of this is due to the low profile they've had in Canada. But with the corporate governance challenges now being faced by companies around the world, they're starting to speak their minds, letting governing bodies blow that they have a substantial role to play in the new governance landscape. Internal auditors have always had an important role to play, but perhaps now the internal audit function will be noticed for what it is: one of the four cornerstones of excellence in corporate governance.

The Institute of Internal Auditors (IIA) defines internal auditing as "an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It brings a systematic, discipline approach to evaluate and improve the effectiveness of risk management, Control, and governance processes." Perhaps this is why a flair number of CMAs have found a comfortable place among their ranks.

Positive perceptions

Alphonse M. Galluccio, CMA, FCMA, a member of CMA Canada's national board of directors and a certified fraud examiner (CFE), exemplifies what internal audit can do for a company--and how a CMA's skills can fit that bill He was recently hired by Montreal-based Le Groupe Jean Coutu (PJC) Inc., the largest company in its sector in Quebec, second in Canada and eighth in North America, to launch their new internal audit function. Galluccio's career path demonstrates why he was tapped for this top job.

For instance, as manager of the IA department of a major pulp and paper company and its subsidiaries, he:

* introduced operational auditing and identified savings and cost reductions of $6.3 million and $1.3 million respectively;

* performed due diligence audits on three acquisitions or sales and identifed recoveries amounting to $2 million.

* modified the audit approach for a $990 million construction project, finding cost recoveries of $1 million.

As the vice-president of IA in a bank, Galluccio, among other responsibilities, introduced a value-added approach to operations and restructured the organization's branch audit services, reducing the average number of audit days per branch by 40% and reducing from 90 to 21 days the delay in issuing the reports.

"We're no longer thought of as policemen," notes Galluccio. "It's understood that we are in an organization to support management and the Board of Directors in the effective discharge of their responsibilities, to contribute to the achievement of business objectives, to ensure the existence of an acceptable control environment and to promote it's efficiency. We perform independent reviews to provide them assurance that governance, risk and control management systems and operation processes are understood and managed appropriately. When required we propose solutions to improve the efficiency of these processes."

Brian Brown is another internal auditor who has seen the perception of internal auditors change. Brown is a CMA, a Certified Internal Auditor (CIA), and the director of corporate audit services with Agricore United in Winnipeg.

"IA is really a hidden jewel, and there are a lot of reasons for this," he explains. "First, people remember the old days, when IA was like an internal police force, getting people in trouble for what they hadn't done. But we've evolved past that to take on a much

"Second, too many people compared us with external auditors. They perceived external auditors as the trim professionals. We were seen as the poor cousins. But really, IA offers different information from that available from an external audit. It provides feedback and analysis. As an internal auditor, I determine the likelihood of achieving certain strategic goals. We want to know, are processes efficient and effective? How is the business managed and what's preventing operations from being successful? That doesn't strictly involve accounting--it's operations, systems, IT and security issues. In fact, I spend next to no time on accounting issues in my day-to-day job."

Strong and independent

But in some places there's still a stereo-type of internal audit as a mini accounting department. "Historically it has been a reporting structure problem," notes Brown. "IA was reporting to the CFO or someone lower. It was seen as a clerical job. Really, IA should be reporting to the audit committee." Because of these poor arrangements in the past, however, a lot of companies weren't getting their money's worth from IA because the information wasn't necessarily being acted upon.

There's also the fact that a lot of companies simply don't have an internal audit presence. Galluccio believes that some companies just haven't seen the need or added value until recently.

"In Quebec, there are a lot of entrepreneurs who have built up their businesses and think, 'who could understand my business better than me?' Once they reach a certain size, however, they realize that an independent opinion is worth considering."

Jean Coutu is a case in point. The family owns 92.5% of the voting rights and 65% of the equity in the company, so it's very closely held and managed. But it now has 311 franchised outlets in Canada and 332 Brooks Pharmacy corporate stores in seven northeast States in the U.S. "They have reached a certain level, with $4.052 billion in sales, and they want to make sure they remain very transparent with shareholders and franchisees," says Galluccio, who reports to Mr. Jean Coutu, the chairman of the board.

The company has diversified its board as well, bringing in members of the Quebec corporate elite, and the expertise of former Auditor General Denis Desautels. "The family is very keen that the company go beyond what it is today," says Galluccio.

Companies like Jean Coutu and Agricore, a company providing a complete selection of products and services to farmers and their end-use customers, are giving internal audit the respect it requires to get the job done. Brown has an excellent working relationship with management at Agricore and is given independence and the resources necessary to get his work done and add his knowledge to any significant initiatives being discussed at the company.

Brown explains the four cornerstones of good corporate governance as the following: management, external audit, internal audit, and the board of directors. "There has to be a high skill level and good communication at all levels," he says. "internal audit should be equally prominent and it should be independent of management. It is more like consulting work than anything else, and creates part of a series of checks and balances with the other three cornerstones."

Growth opportunities

While trying to bolster the image of internal audit in general, Canadian members of the Institute of Internal Auditors (IIA) are also trying to improve the profile of their institute. The IIA was quite involved south of the border with the SEC in creating the new governance rules now in place in the U.S. Subsequently, the international president, William Bishop, along with a number of Canadian representatives, met with the OSC, TSX and the Institute of Corporate Directors earlier this year to build bridges with institutions here in Canada as well.

Brown is currently a member of IIA International's Professional Issues Committee and recently completed a one-year term as president of the Winnipeg Chapter of the IIA. He is also one of eight Canadian IIA members (along with Galluccio) involved in the drafting of the institute's Canadian-based response to the OSC's proposed new rules. While at the time of CMA Management's interview the institute's recommendations had yet to be completed, Brown did note that the audit committee make-up was definitely compatible with the IA function.

"And though I question the real value of CEO/CFO certification of financial results, it does have a communication value," he notes. "It makes the point that they've got to be reasonably certain that what they're reporting is right. That comes with a lot of homework. In the U.S. it has meant that the IIA has been very involved with internal controls. This may mean that internal auditors are going to get pushed into a more strictly accounting role in many companies, but we will have to wait to see how that unfolds."

Because it's based in the U.S., IIA is often perceived as a strictly U.S. animal. But Archie Thomas, CMA, CIA, stresses that it truly is a global institution. Thomas is a director on the IIA's 37-member global board and chairman of its International Relations Committee.

"This board represents a new global structure for IIA, which was introduced last year," he notes. "We've reorganized to better represent our worldwide members. There are 10 seats designated to North America, at least one of which is guaranteed to come to Canada, and 19 committees appointed by the board."

Thomas spent most of his working career in internal audit at Rio Algom Limited in Toronto, formerly a Canadian-based multinational mining and metals distribution corporation. The last few years there, Thomas was chief audit executive. He is past president of Toronto's IIA chapter, and currently an independent consultant.

The International Relations Committee of the IIA promotes the presence and expansion of the global IIA, and works to develop a truly global mindset to create stronger integration among IIA affiliates and potential affiliates. More than 20 countries are represented on the committee.

"Canada would be seen as one of the top 10 or 15 countries in the world for internal audit," notes Thomas. "Internal audit has been a profession in Canada since 1944, when the first chapter was created in Toronto, and yet the extent that we're used in contemporary organizations leaves much to be desired."

Thomas understands this deficiency from having seen better representation at work worldwide. "Senior volunteers in IIA are aware of what's going on around the world, not just in the U.S.," he says. "The U.K. is coming up with ideas, and others are taking the lead as well--Australia, South Africa, and the Philippines.

"There's a strong educational role that we still have to take to change this," he notes. "One of the main problems we have is that there is a tendency to consider risk a strictly negative thing. But risk management should also emphasize the positive attainment of objectives. We have to be transparent and show the good and the bad. Similarly, good governance is good business. Investors have to have confidence in what we're telling them."

Alphonse Galluccio is one of the people who is trying to create a more substantial educational presence for the IIA, by creating a channel for developing internal auditors. "It isn't clearly defined yet, but we would like to create an executive designation for CIAs," says Galluccio, who is also currently the president of the Montreal Chapter of the IIA and the chair of the International Conference Committee. "The IIA of Montreal and National Bank are ready and willing to invest in a development program through one of the universities here in Quebec. Once we can establish something in one institution we can start to explore the idea of introducing it to other universities across Canada."

Popularity shift

There's no question that internal audit is becoming a more popular career destination for a wide variety of professionals. In courses he teaches for the institute, Thomas sees a wide swath of mid-career professionals--engineers, IT experts, medical experts and even lawyers--who are interested in using their expertise in a different environment.

"It involves a tremendous variety of work, and every, day is different," says Brown. "It's not an easy job, because every week you're learning something new--computer systems, operations, etc. But it's interesting and nothing's routine. And you have the satisfaction of improving a company's operations."

Each of these individuals sees the value of the GMA designation for the job as well. "I'm fortunate to be a CMA," says Thomas. "Internal audit is similar in many ways, because it also focuses on strategic thinking. The two complement each other."

"The CMA is a good fit for internal audit," Brown concurs. "It's not essential to have accounting to do the job, but it certainly helps. The CMA has a broad education program that helps you understand a business as a whole, which is what we try. to do in internal audit."

It's clear that a good number of CMAs agree with Brown and Thomas. There are 85,000 IIA members worldwide with 3,500 in Canada. Of the 3,500, 1,300 are professional accountants, and 25% of these are CMAs. But even more interesting is the fact that over the last five years, 37% of the senior elected leadership of IIA in Canada has been CMAs. Yet another key area of corporate governance where CMAs are making a strong statement--and, happily, regulators and corporations are sitting up and taking notice.

Robert Colman is editor-in-chief of CMA Management.