May-2015

AUDITING
products. Similarly, an incentive scheme that does
not provide an incentive unless a stretched target is
achieved and provides significant bonus for achieving
results (say, production and sales) higher than the target
creates stress on internal controls. Therefore, internal
audit focuses on sales return and complaints on product
quality (as quality may be compromised to achieve
and surpass the target), particularly in years of subdued
demand for the product.
The debate on whether the internal audit should
work with or around ERM is yet to be settled. The
main reason that has triggered this debate is that many
firms are yet to establish a fully blown up ERM system.
In an ERM system that has attained high maturity
level, every decision-maker understands the risk-appetite
established by the Board and risk management
is embedded in decision-making. At a low maturity
level, risks are managed in silos and enterprise-wide
approach is absent. This has serious implications. Managers
lack understanding of the risk appetite and the
firm fails to develop risk-culture 9 . When risks are managed
in silos, the combined impact of different risks in
different segments are not assessed, and as a result the
firm is exposed to high risks that deserve significant
management attention. The concept of optimising
‘portfolio of risks’ 10 cannot be implemented resulting
in difficulties in formulating risk strategy.
In view of different maturity levels of ERM systems
that the internal auditor encounters, a pragmatic approach,
although not the ideal solution, is to participate
in establishing the ERM system in a firm where
ERM system is at a low-maturity level and to plan
audit around the ERM system where ERM system has
attained a high maturity level.
Internal Audit With ERM
Internal auditor, because of the nature of his work,
develops a clear understanding of risks that the firm is
exposed to. Therefore, he is in the best position to support
developing the ERM system. In the initial years
of developing the ERM system, the internal auditor
may get directly involved in identifying risks, assessing
their impact, and developing risk responses(treatment)
and designing controls, all in collaboration with
managers. Although, this process has the danger of
9 Risk culture refers to shared-understanding of risks.
1O ptimising ‘Portfolio of risks’ refers to the optimization of overall risks to which
the firm is exposed, taking into account risks retained by different segments and
strengths of various controls.
obscuring audit objectivity in audit of controls and
other components of the ERM system, the benefits
are more than the costs. Involvement of the internal
auditor helps accelerating the process of developing
the ERM system and achieving high level of maturity.
The internal auditor can champion the ERM and help
in developing the risk culture much better and faster
than any other actor because of his understanding
of business and risks, relationship with managers at all
levels and superior communication skills. Of course,
this is true, only when the internal auditor could build
his image as a ‘friend, philosopher and guide’ and not
as one who carries the policing function, and when
the internal audit occupies a place of respect in the
organisation.
Internal Audit Around ERM
In an ERM environment, the internal auditor aims
to provide an assurance that the ERM system is adequate
and operating effectively. Therefore, he should
test the whole process by using random sampling
technique. He should audit selected decisions to test
whether risk management is embedded in decision
models and whether decision-makers have understood
the risk-appetite correctly. He evaluates the risk-identification
and impact assessment process by using the
interview technique, that is, by interviewing managers
for collecting evidence (information). He also
evaluates whether risk responses, including mitigation
plans, are in sync with the risk strategy and whether
they have been implemented effectively.
Social audit
Social Impact of Business
Social audit refers to the audit of the social impact
of the strategy and operations of the firm. A firm’s
business has positive social impacts, for example, employment
generation, augmentation of economic activities
around firm’s facilities resulting in community
development through increase in purchasing power
and development of social infrastructure. Firm’s products
and services may also have positive social impact.
For example, when accompany makes hygiene products
available at an affordable price to those who are at
the ‘bottom of the pyramid’, it helps building hygiene
culture and developing healthy communities. Other
business strategies might also have positive impact. For
example, Hindustan Unilever Limited’s ‘shaktiamma’
project, which aims at achieving low-cost penetration
66 the MANAGEMENT ACCOUNTANT MAY 2015
www.icmai.in