Sonsoles Rubio Reinoso

The aim of good governance is to gain trust – and trust is earned with facts. A well-designed corporate governance system contributes to the sustainable growth of a company by improving its reputation and the level of trust in its management.

Trust brings value to all stakeholders. It generates confidence among investors and customers by balancing the various interests within a company through the separation of functions to create a reliable control environment. This is the mission of the internal auditor when supervising a corporate governance system on behalf of an audit committee.

It is worth mentioning an amendment to the 2020 Unified Code of Good Governance for Publicly Listed Companies which requires directors to follow environmental, social, and corporate governance criteria by: "supervising the preparation and integrity of financial and non-financial information, as well as the management and control systems for financial and non-financial risks, including operational, technological, legal, social, environmental, political, reputational and corruption-related risks."

Internal auditors have an advisory value that enables them to employ long-term strategic vision while maintaining objectivity

Similarly, the Technical Guide on Audits (3/2017) issued by Spain's National Securities Market Commission (CNMV) establishes criteria for the effective supervision of the work of an internal auditor by the audit committee. The guide refers to the International Standards for the Professional Practice of Internal Auditing published by the Institute of Internal Auditors as the reference framework.

Internal auditors as advisors

The work of an internal auditor is advisory and supervisory. The auditor acquires an objective and comprehensive view of risk and business continuity and this has become evident during the Covid-19 crisis.

Now more than ever, internal auditors have an advisory value that enables them to employ long-term strategic vision while maintaining objectivity. This is fundamental for guaranteeing the sustainability and efficiency of business models.

Internal auditor
The internal auditor supervises the reliability and integrity of information, risk management, and asset protection systems – while ensuring the economic and efficient use of resources (Photo: Pheelings Media/Getty)

Given the rapid emergence and linkage of new risks, an internal auditor needs to be agile when adapting to change. The pandemic – surely the biggest black swan our generation has faced – highlights the importance of strengthening risk control and governance mechanisms. This is because new challenges may reveal management systems to be ineffective, leading to a loss of confidence by investors and clients and a major destruction of value for all stakeholders.

For an internal control system to work, it must be integrated into the management of the organisation and involve everyone at all levels. Those individuals responsible for supervising such control systems must have the authority, independence, and resources to fulfil their mission. The internal auditor supervises the reliability and integrity of information, risk management, and asset protection systems – while ensuring the economic and efficient use of resources, as well as compliance with strategic and operational goals. Ultimately, the auditor assists management by identifying needed improvements and making recommendations to the audit committee.

Adding value in the face of new risks

Audit committees can use an effective internal audit to reassess the risks that may affect the fulfilment of their duties. The internal control of risk forms an integral and crucial part of organisational management and governance. In line with the 2017 COSO Enterprise Risk Management framework, the risk approach should be a key part of the strategy and execution of company operations, and it should anticipate and identify opportunities offered by change.  

Internal auditors are the link between risk management and strategy. We are essential for ensuring that a company understands the consequences of a strategy, and that it is aligned with the corporate mission, vision, and values. Audits reveal the importance of managing risks when establishing performance targets and identifying opportunities.

Many boards of directors rely on internal auditors who are technology-driven and forward-looking, flexible, and proactive. These auditors go beyond oversight and collaborate with the business to offer the agile solutions needed in a pressurised environment. These capabilities are added to our independence and objectivity; comprehensive knowledge of the company; strategic vision in the medium and long term; and a deep understanding of business culture, processes, risk control, and management systems. As a result, we generate trust and confidence by guaranteeing the sustainability of the business model. In short, we are essential advisors to the audit committee.

Many boards of directors rely on internal auditors who are technology-driven and forward-looking, flexible, and proactive

Internal auditing is a living profession whose activity requires constant updating in the face of new and evolving risks. The key to our value as professionals is to orientate our work towards the future and the strategic risks facing an organisation.   

The internal audit is an agent of change that directs risk expertise to the priorities of the business. There is also an increasing emphasis on understanding and auditing strategic risk management, decision governance, and corporate risk culture.  

As multidisciplinary professionals, this is a natural step in our role as internal auditors. By being fully integrated into corporate governance models, we take on new challenges in risk management and become the preferred advisors to the board and audit committee, as well as the guarantors of good governance.

In family business

Improvements in corporate governance are helping improve the management of listed public companies, and this is a path that Spanish family businesses should also follow.

By strengthening their corporate governance systems, family businesses also improve their management, ensure their sustainability, and facilitate access to capital markets. This is highly relevant when considering that we are the European nation with the most family businesses (representing 90% of Spanish businesses and generating 60% of gross added value, according to data from the European Family Business and the Family Business Institute). 

Secondly, due to its special idiosyncrasy, family businesses may be tempted to unify all responsibilities into just one position, which – as Montesquieu reminds us – is a risk for the future sustainability of a business.

By strengthening their corporate governance systems, family businesses also improve their management, ensure their sustainability, and facilitate access to capital markets

A family business must find formulas for a system of governance that match its size and maturity. The responsible bodies, with the help of an internal audit, must guarantee transparent and rigorous management for shareholders and stakeholders.   

At the Institute of Internal Auditors, we see three main reasons for creating an internal audit area and these depend on the type of company. Firstly, an internal audit is mandatory for listed public companies, companies operating in certain regulated sectors, and financial service companies. Secondly, businesses that have separated ownership from management need internal audits. In such firms, the assurance offered by internal audit is especially valuable thanks to its dual dependence (functionally, the auditor reports to the board of directors through the audit committee; but hierarchically, auditors report to the chief executive). Thirdly, audits are needed by companies that have separated ownership from management, are internationalised or expanding, and want to standardise processes and supervise regulatory compliance. 

Sustainability and fair play

An internal auditor also contributes to economic sustainability, as audits increase trust and ‘fair play’ in the market. As an example, the European Union recently responded to the Covid crisis by asking organisations for greater transparency to ensure operational reliability.

There can be no good corporate governance without an effective internal audit that helps directors assume their responsibilities

There can be no good corporate governance without an effective internal audit that helps directors assume their responsibilities. Directors and internal auditors agree that improving risk management and control systems results in more responsible management and greater accountability in all areas. This increases market confidence and favours better access to capital markets. 

The growing importance of national and international regulatory regimes, and the proven support provided by audit committees, means that audits are now fully integrated into the corporate governance models of large companies. This gives managers a better understanding of internal control and risks and a wider vision of the business.  

Internal audits form a fundamental element for improving business management and good governance – and this has a positive impact on critical aspects of company performance. Such audits are an effective instrument for corporate management, increase long-term value, and give society confidence.

All written content is licensed under a Creative Commons Attribution 4.0 International license.