The President of the Institute of Internal Auditors Armenia Ara Chalabyan provided his article to Banks.am on challenges of internal audit and governance and recommendations to overcome them.
I started my career in internal auditing in 1999, when I moved from the Banking Supervision Department of the Central Bank to the Internal Audit Group - the first Internal Audit in Armenia, which was founded in 1996. We used to work in isolation until 2002, didn’t even know about Internal Audit Standards. With the new Chief Auditor, we had a flow of fresh ideas and started researching the best practices in the world.
Today we have internal audit units in all banks and insurance companies, as required by the CBA since 2005, as well as in public sector, which is a legal requirement developed with the support of international organizations since 2013. I am delighted that there are well-established internal audit units nowadays in companies, which are not required to have them. Our association (IIA-Armenia) currently has 177 members from 60 organizations, another 250 internal auditors work in state and territorial governing bodies (public sector).
Nevertheless, the maturity level of internal audit is very different in all those places similar to many areas in Armenia. We have functions operating in conformance to the best international practice and standards, as well as those that only bear the name of ‘Internal Audit’. Bellow, I have tried to highlight the challenges, which we need to overcome to shape a more developed internal audit and in general governance culture. Those are typical not only for Armenia, but for our region at large, from Eastern Europe to Middle Asian countries, and are mainly explained by governance culture.
Challenge 1. Culture of Sole-governing
The Boss is always right and knows answers to all questions, you cannot question or discuss his words.
Sole-governing culture is wide spread in both public, and private sectors, be that a minister or governor, owner of business or director. Moreover, this system cascades down, in each further step the boss makes decisions solely. In such cases internal audit is treated either as an obstacle or just an inspection tool – without the right to have own opinion. The companies that have moved to collegial decision making, were able to improve governance culture.
Challenge 2. Culture of Avoiding Responsibility
The Boss knows answers to all questions, let him take the responsibility.
This culture is derivative from sole-governing, which results in subordinates avoiding responsibility and decision making. Managers usually complain that employees avoid taking responsibility and forget that they have failed to encourage initiatives. Changing this culture will take a long time, as most of the people don’t rush to share the burden of business when get the opportunity to express themselves: that should be nurtured. In today’s informational tornado, it is important to get the input of every capable individual and the internal audit may play a triggering role.
Challenge 3. Shame Culture
“I am not guilty,” says a kid when breaks something. “We don't have risks,” says a manager when internal auditor asks about inherent risks of their processes.
A human being is not infallible, and each process has inherent risks, but usually people don't want to be noticed with their problems. They think if their issues are not highlighted they will not be blamed, failing to understand that not managing risks in advance will leave them with bigger problems in future. We have colleagues who ask for more audits each year in order to identify new risks and find solutions together. This is the healthy approach and path for self-improvement.
Challenge 4. Rule Based Culture
In article number N of this or that law or regulation it is written something and we cannot violate it.
International standards, which we started to translate and adopt after independence, are principles based. Nevertheless, when we put those principles in our laws or regulations, they become into imperative norms and rules. As a result, we forget the principle upon which the standard was developed, and stick to the rule that was developed from the principle. One of the basic principles of many international standards is substance over form, though often we pay more attention to the form. Here we need to change the mindset, which is also rooted in our educational system.
Challenge 5. Educational Culture
Most of us would remember that girls who took lecture notes when we studied at universities had had an important role.
We then copied those handwritten lectures and learned in order to pass the exam. I kept those copies after graduating for a long time, but one day realized that had never used them and threw away. Our educational system usually requires memorizing instead of teaching how to think. As a result, students anticipate that you will be filling their brain with knowledge instead of learning from you to think and seek directions. Those who continue their education in modern universities or get professional qualifications, make that shift.
Challenge 6. Inspector Syndrome (Culture)
The inspector is always right, and a good inspector will always find a mistake.
Many people want to become inspectors (tax, customs or traffic police), supervisors, and revisers, as this will provide them with opportunity to express themselves on behalf of others’ mistakes. Even if there is no corruption, the inspector sees his/her role in finding incompliance to the word of law. Internal audit is a completely different culture, focused on risk identification and mitigation. Interestingly, many Eastern-European languages and even German language do not have the word ‘audit’ and they use equivalents of ‘revision’ instead, which considerably limits the meaning of the word. All the attempts to translate the word ‘audit’ limit its meaning and result in misunderstanding and distortion. Here we also see that the attempts to transform former inspectors to internal auditors usually fail. I see the solution in new generation, new education, and new approaches.
IIA-Armenia (www.iia.am) is a member of the Global Institute of Internal Auditors since 2015, one of three CIS members (other two are IIA-Russia and IIA-Ukraine):
