Salz Review - Wall Street Journal

Salz Review
An Independent Review of Barclays’ Business Practices
162
12.55 Barclays’ Internal Audit Charter defines the objective of Barclays Internal Audit as
being to “provide independent, reliable, valued, insightful and timely assurance to
the Board and Executive Management over the effectiveness of governance, risk
management and control over current and evolving risks, in the context of the
current and expected business environment.” 254 The staffing of the Internal Audit
function increased from 157 in 2003 to 611 in 2012. The function also increased its
independence. Since 2003, the Chief Internal Auditor (CIA) has reported functionally
to the Chairman of the Board Audit Committee and only administratively to the
Group Chief Executive. Business unit audit teams have reported to the Group CIA
since 2004.
12.56 In 2009, Barclays Internal Audit was reviewed by an external assessor. The review
concluded that it was an industry-leading function which complied with relevant
codes and standards, and met the expectations of management, the Board and
other stakeholders.
12.57 However, some interviewees felt that the methodologies and metrics followed had
resulted in some governance and control issues not being identified early enough by
Internal Audit. Barclays has recently identified the need for certain changes, including
more rotation of business unit auditors, greater audit focus on the investment bank
to reflect its growth, a reduced number of auditable entities, and improved ways of
reporting issues.
12.58 Across the industry banks and professional bodies have been reviewing the remit of
the internal audit functions to improve their ability to influence the effectiveness of
governance, risk management and internal controls. A recent consultation document
by the Chartered Institute of Internal Auditors has proposed that the scope and
priorities of the audit function include the risk and control culture of the organisation
and the risks of poor customer outcomes, giving rise to conduct or reputational
risk. 255 We support these recommendations as a practical way to reinforce sound
business practices.
Recommendation 33: Internal Audit
Barclays’ Internal Audit should ensure the effectiveness of its audits in each of
the businesses to identify control issues, prioritising high-risk entities. This will
be aided by developing specialist internal audit teams able to deal effectively
with the bank’s more complex business units.
The Internal Audit Charter should be updated and periodically reviewed to
ensure that it covers all aspects of governance, control and risk culture, as the
business and external environment evolves.
254 Barclays Internal Audit Charter, 25 July 2012.
255 Chartered Institute of Internal Auditors, Effective Internal Audit in the Financial Services Sector, 11 February
2013.