Business Ethics from Top to Bottom
Predictable and plentiful though they may be, the soul searchings and analyses of internal controls that have followed the Barings debacle are unlikely to prevent a repetition. So says David Brilliant, and since he is head of internal audit at another international bank, the Chemical Bank, as well as being president of the Institute of Internal Auditors UK, he is in a better position than most to know.
The problem, he says, is not that the Singapore trading disaster is not a lesson for all organisations with far-flung and complex operations. Rather, it is that there is a danger people will say: "It can't happen to us because of a, b, and c. Next time it could be a, b and y - that thing you haven't thought about."
The answer, he believes, is to go back to basics. Making no apologies for the well-worn phrase, he adds that this means sound internal control will be an organisation's best asset. This is because if the people working in that area know their job, they will look at all the risks facing the business. That involves understanding it from the top down. This, in turn, requires translating that information into what risks there are - which then means assessing what controls are needed to meet those risks.
A fundamental part of understanding the business you are in involves knowing how the company makes money. People are generally less quick to ask why they are making money than to worry about where they are losing money, Mr Brilliant points out. "It's a different mindset - to challenge the good as well as the bad."
But surely management will not stand for such impertinent questioning? Mr Brilliant accepts that this may be the case, but he adds that a company which is serious about internal control will hire someone who is competent for the job rather than just a position-filler. "They'll be prepared to listen and to be challenged," he argues.
On the other hand, the good internal auditor has got to be prepared to be challenged and able to articulate the real risks in language that a business person can understand - "not jargon, not stock phrases".
"You need people with competence and confidence. We don't generally get our own way without some reasonable arguments. It's like any other management role," Mr Brilliant adds. Part of the problem, he admits, is the name. But he insists that "control" does not mean bureaucracy. "It's a living thing."
Like many other management initiatives, this depends on a team approach. But it is important that senior executives make it clear that they regard it as important - otherwise middle managers can be obstructive.
At Chemical Bank this is done by the chairman issuing periodic reminders that a control culture is important to the bank, the chairman and the board. …