Setting up internal audit within listed companies: Not that hard

By Xavier Potier - Director of Risk Assurance Services, PwC Vietnam

Simply put, internal audit is an independent, objective assurance and consulting activity designed to help an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

In the last few years, we have seen a number of high-profile financial and corporate governance scandals that point to the indispensability of good corporate governance. And it goes without saying that internal audit adds value to that good governance by providing effective oversight of the control environment. Yet, there are many enterprises in Vietnam, both large and small, that continue to operate without internal audit.

Internal audit will protect your business

When a listed company has no internal audit function, one must ask: Who provides the independent and objective insights that the board needs in order to determine how well risks and mitigating controls are managed? If it is only management that provides that assurance, the board may be operating at a disadvantage.

In fact, we have seen many recent examples of management causing a toxic corporate culture that can destroy shareholder value. Neither the boards nor the shareholders they serve should solely rely on the management team when determining how well risks are being managed or controls are being applied in companies in which they have a vested interest.

It should be noted here that the lack of an internal audit function does not automatically lead an organisation to failure or reflect bad intentions from its leadership. Likewise, the presence of the function does not guarantee success. However, I do believe that an organisation’s commitment to good governance would fail to reach its targets without the independent oversight that internal audit offers. Enterprises in Vietnam are operating in an emerging marketplace that is dynamic, fast-moving, technology-driven, and more competitive than ever. In this space, the odds are piled up against those with a less-than-ideal risk management and control environment.

This drives home the value of requirements outlined in the draft decree which will enforce internal audit within listed companies in Vietnam. Via this draft decree, Vietnamese regulators highlights the case for internal audit to serve as a foundation for, if not a catalyst to, restoring investor confidence.

Indeed, the presence of an effective internal audit function signals management's and the board's support of strong and effective risk management, internal control, and governance. However, for many listed companies in Vietnam, internal audit is still a new concept. And there are a lot of concerns over how to setup and run this business function in a cost-efficient manner, and in time to comply with the new law.

Although internal audit is going to be enforced within listed companies in Vietnam, I suspect there will be strong resistance to an internal audit mandate from some people who either do not understand its value or fear its added scrutiny or cost. But we must overcome that resistance, as well as other concerns that are bothering business decision makers.

Setting up internal audit is not that hard

The first and foremost question I often get asked is: How much will setting up and running an internal audit function cost my company? This is a legitimate concern, given the current stage of many listed companies operating in Vietnam. Some companies may assign personnel from within to manage its newly created internal audit function to save costs. These people surely understand the company well, but the problem is they are not internal audit professionals and do not know the internal audit techniques. On the other hand, if companies want to look for internal audit professionals in Vietnam, it is difficult because they are rare and could be very expensive to hire.

In more advanced companies, they often take a more balanced approach. They can pick someone from within the company to head the internal audit function, and be assisted by a professional service provider at the same time. Either the professional provider can help in setting up the whole internal audit function, or advise to improve the function’s effectiveness, or be responsible for all internal audit related tasks of companies if asked.

The advantage of this balanced approach is that listed companies can gain access to international audit standards at their convenience, and the cost is much lower than hiring long term audit professionals. For example, at PwC, we always offer an internal audit team ranging from a highly experienced expert to senior staff for every client’s project, large or small. Besides the core team leaders, other members are hand-picked depending on the client’s business or specific issues such as corporate tax, supply chain or even cybersecurity.

Most of these people are Vietnamese, who understand the local culture values and practice international audit standards on a daily basis at the same time. This means we can provide a lot of relevant expertise in a short period of time, which is virtually impossible for any listed companies to have unless they hire the same team on a long term basis.

Another major concern is: How much time do we need to set up a capable internal audit function? The draft decree mentioned above is projected to come into effect soon, so it is important for listed companies to start working on it right now. I would suggest these companies to “take a snapshot” of their current organisational structure in relation to internal audit, to see what they are missing and start planning. With an action plan for internal audit strategy to follow in hand, they will know if they need to hire external audit professionals, or work with a professional service provider, or figure out something in between.

Setting up a capable internal audit function within a listed company is a process that could take from two to four months. It is not a full-time project and also scalable, which mean if you are a small company, it is not going to be a big project.

I have heard many listed companies say that they are afraid this is going to be something challenging. It is not. We have a client who is already listed in Vietnam, but they plan to be also listed in another Asian market, and that market is much stricter in terms of internal audit enforcement. Within a couple of months, we finished helping them to prepare internal audit documents required by that market’s regulators, and training their internal audit team so that when we leave, they can do it themselves with confidence.