It has become the norm for most companies, even those not under some sort of regulatory obligation, to appoint non-executive directors. Indeed, most appoint a majority within the board. The notion of a non-executive director is brilliant - a provider of objective and wise mentoring from a strategic perspective, gently assisting in steering the boat in the right direction. Louw van der Merwe takes a closer look.
 

Most organisations are currently looking at their internal resources and cost effectiveness in these turbulent times. Presumably, one of their conundrums will be whether or not to retain the internal audit function. Louw van der Merwe, Director of Moore Risk Services, takes a closer look.

We are regularly asked this question by clients who are looking to establish an internal audit function.

As professional service providers of internal audit services on an outsourced basis, there is obviously a case to be made that we are not in a position to provide independent advice, as it relates to this question. We do, however, like to think that we put our ethics before our wallets.

Feedback on the Risk Management Process to Oversight obviously depends on the level of oversight required. In most organisations, the Risk and Audit Committees are combined. Feedback would, therefore, come from both these bodies.  

We have seen many organisations implement an Enterprise-wide Risk Management Process during the last few years.  Yet very few have derived any practical value from this process.
 
The most common reasons why most ERM processes effectively fail during the first year, are discussed below.

The term “Combined Assurance” has been very popular over the last few years, and we have fielded many queries as to what exactly this concept entails.  Much like Risk Management, the removal of the capital letters somewhat demystifies the notion. 

We are often asked the above question by organisations. Much like the answer to any business endeavour, the short and easy answer is when the value exceeds the cost. 
 
However, the value is not always very easy to measure. Contrary to, for example, the value derived from starting a new manufacturing line or upgrading a key piece of equipment which is visible in the short term, the value derived from appointing a top non-executive director, strengthening the finance function to enable meaningful data analysis or establishing an internal audit or risk management function, is over a longer term. In addition, value derived from establishing an internal audit or risk management function is much more difficult to quantify. 

We are often asked about the operational responsibilities of directors. There is a large degree of subjectivity associated with the answer, and therefore no short, definitive answer that applies to all.  The importance of getting it right, however, cannot be overestimated.  Ask any executive about the frustrations and inefficiencies of a director getting it wrong towards the heavy end; and then ask any shareholder about the disappointments in a well-paid director being on the barely asleep side of involvement.  So how do some get it right, and what constitutes “right”?

Many internal audit functions within organisations fail to add practical value that exceeds their costs.  Why is this?
 
Firstly, it is our experience that an internal audit function is hard pressed to demonstrate and deliver value if not underpinned by a robust Enterprise-wide Risk Management (ERM) process.  In fact, where there is no ERM process in place, it is our recommendation that internal audit resources should first be applied in establishing an ERM process.  

Top Management Tool or Administrative Nightmare?
 
We have seen many organisations implement an Enterprise-wide Risk Management Process during the last few years.  Yet very few have derived any practical value from this process.