Crossing the International Auditing Divide By Jennifer Baljko
It's no use trying to run and hide. If companies want to play in the global economy, they'll have to contend with all sorts of regional, national and international auditing practices and corresponding legislation.
For better or worse, how well companies survive these measures will depend, in part, on how fine-tuned their IT engines are, and what related steps have been taken to not only comply with, but understand the mindset behind, a bevy of auditing-based rules coming out of the U.S., Europe and, to a lesser degree, Asia and other geographies.
That's what some auditing professionals and corporate board members are saying.
In July, auditors, academic thought leaders, corporate representatives and industry experts gathered in Amsterdam for the Institute of Internal Auditors' international conference. Corporate and IT governance, continuous financial reporting, standards convergence and risk management all took their place on the agenda.
Clearly, top management and board directors will largely be responsible for how companies manage these diverse ideas and balance IT roll-out costs with fiduciary care. But, it's becoming increasingly obvious that IT tools will provide the backbone for implementation, and, therefore, the spotlight will shine brighter on IT compliance executives.
"As companies jumped on the information highway and were galloping at full speed, IT was no longer seen as an enabler. It has become pervasive in the sense that it has helped grow businesses and has been a strategic part of future business development plans, " says Mervyn E. King, chairman of the United Nations Steering Committee charged with governance review and oversight within the U. N., and chairman of the Global Reporting Initiative, which develops corporate sustainability reporting guidelines.
"[IT] has become a valuable asset without being able to put an exact value on it, " adds King, who also sits on a number of international corporate boards, is a member of the Private Sector Advisory Group to the World Bank and is a member of international advisory boards in the U.S., the United Kingdom and the Asian Center of Corporate Governance. "Given its importance, we're driven to the conclusion, logically, that IT governance involves care and diligence. But while IT is a useful tool, when it comes to developing future business strategies, you must apply your mind as well."
This means, company executives --- along with CIOs and the IT team --- have to think broadly about multi-national solutions that promote good corporate citizenry globally, regardless of what local auditing criteria is used, industry observers say.
A key way to address these issues is by keeping a watchful eye on existing and always-evolving auditing policies coming from the U.S. and the European Union, the leaders influencing this space.
Many are already aware that the U.S. and the E.U. have different, and sometimes conflicting, pieces of legislation that drive IT compliance executives crazy (think about the amount of money and resources invested in things like the Sarbanes-Oxley Act, the Health Insurance Portability and Accountability Act (HIPAA) and a host of international privacy and data sharing laws. Since the complexity of auditing rules and resulting legislation will likely increase as globalization continues, IT compliance professionals must aggressively tackle these variations head-on and be ready to integrate whatever comes their way.
A helpful starting point in dissecting these differences, however, lies in understanding the framework behind individual countries' auditing philosophy. Analyzing how government-level auditing offices approach the auditing process, what types of information they seek and what long-term outcome they are going after offers a sneak-peak of what may eventually end up in their internal auditing and IT departments.
For example, in the U.S., directives tend to have a commercial auditing slant, with areas such as assurance standards and risk analysis winning attention, says Mark Funkhouser, a former adjunct professor at several universities who is currently authoring a book about worldwide government auditing practices. Also, the Government Accountability Office conducts more frequent audits than other national auditing bodies, but a vast majority of them are requested by individual Congress members, adds Funkhouser, the long-time city auditor for Kansas City, Mo. and now that city's mayor.
These practices are distinctively different from those in Europe, he says. Particularly in the U.K and the Netherlands, government-level audits focus on identifying major problems or threats to society and the impact they have on society's well-being and government operations. Additionally, especially in the U.K., while the national auditing board carefully follows what members of Parliament are interested in, the department independently chooses what it investigates, Funkhouser says.
To protect themselves globally and earn the reputation of good corporate citizen, companies have to go further and develop scalable systems that offer real-time accountability. Businesses need the ability to detect problems early on, and leverage enterprise-wide tools that can monitor global inputs and sense what changes need to be made to comply with any number of regulations, corporate governance directives or other corporate guidelines, according to Professor Larry E. Rittenberg, chairman of the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
"We are seeing audit committees of the corporate boards ask for more information about the controls being implemented in the IT systems. More frequently, board members want to know how things are being monitored on a continuous basis," says Rittenberg, who also serves on the Board of Directors, Governance Committee and Audit Committee of publicly-traded Woodward Governor Co. and is a financial advisor to the Audit Committee and Board of Petro China Co. Ltd.
"One of the main objectives of any corporate board is to identify problems earlier on and get to the root causes before they become big enough to have a significant impact," he adds.
Many of these problem-solving capabilities are already embedded in existing software, and combine governance and operational benefits, notes Christopher S. Rossie, a speaker at the IIA international conference and vice president of business development at Oversight Systems Inc., Atlanta, Georgia.
"The technology exists to provide near real-time monitoring of 100 percent of the financial transactions that occur inside of companies," Rossie says. "This technology changes the landscape of traditional approaches to financial and IT controls from one focused almost exclusively on automated preventive controls to one where automated detective controls can be implemented in concert with human processes to… identify errors as they occur so that downstream consequences such as inaccurate general ledger postings, revenue recognition errors, and erroneous payments are prevented."
Another factor to consider in this modern-day wave of auditing-derived accountability and governance requirements is the elevation of the CIO to board member, says King. When the CIO has direct board-level responsibility for IT-related decision-making, generally more careful steps are taken, thus reducing liability and risk while boosting shareholder confidence and the company's global reputation global.
"A good governance strategy is about good long-term planning and sustainability," says King.
"This is just good hard-nose business, not feel-good stuff."
Jennifer Baljko has covered business and high-tech issues for more than 10 years. Her work has been published in Electronics Supply & Manufacturing, DSO.com and Work.com. She previously held writing and editing positions at Electronic Buyers' News, Supermarket News and The Home News Tribune.
|