by Glenn Cheney
Altamonte Springs, Fla. - The Institute of Internal Auditors has named Bob McDonald, CIA, CGAP, FIIA, ASA, JP, chair of the institute, though he lives about as far from the IIA’s headquarters here as an internal auditor can get.
McDonald lives in Brisbane, Australia.
McDonald joins a succession of non-Americans who have chaired the organization, a reflection of its international expansion. More than half the institute’s 85,000 members live outside the U.S. All members share the common challenge of dynamic competence.
“For those of us in the developed countries, the challenge is to stay relevant and competent and at the edge that our organization needs us to be at,” McDonald said. “The challenge in the developing countries is how to move beyond the old-fashioned tick-and-flick pre-audit function that abrogates much of management’s responsibility.”
McDonald is currently director of internal audit for Australia’s Department of Natural Resources. His 32 years of public service has taken him through the departments of forestry, primary industries, and transport, and he has moved up through the ranks of the IIA since the late 1980s. He was on an international team that reviewed the internal audit function of the International Monetary Fund, and he has delivered papers at conferences in 13 countries.
David Richards, internal auditor of First Energy, has known McDonald for many years.
“Personality-wise, he’s an excellent individual, and he’s got really good support from [the DNR], which has really stepped up to the plate and allowed him the time away from the office he needs to do the IIA job,” Richards said. “His travel schedule is a lot different from that of the rest of us. He does back-to-back trips that take two or three weeks. Once he gets somewhere, he just keeps going.”
One recent trip extended from Johannesburg north through Malawi, Ethiopia and Kenya, where McDonald talked with internal auditors who live in countries with barely functional accounting and auditing systems. He has long recognized that this is a worldwide problem among developing nations, and he is working in concert with the World Bank to ameliorate the situation.
It just so happens that the World Bank’s current auditor general is the IIA’s previous chair, Leroy Bookal. McDonald, Bookal, the World Bank and the IIA’s executive committee hope to establish a global strategy project to provide practical experience in developing countries, starting in Africa.
“It was amazing,” McDonald said of his trip across East Africa. “The thirst for knowledge is so real you could touch it. They’re clamoring to get the contemporary knowledge and share the particular experiences of professionals in the developed countries. It was a most rewarding personal and professional experience for me to go there and share with them.”
McDonald’s worldwide odysseys give him opportunities to visit not only IIA chapters but corporate and governmental entities that need to know what’s happening in internal auditing.
What’s happening, mainly, is, of course, Sarbanes-Oxley, and not just in the United States. The law is affecting corporate governance all over the world. The law has become somewhat of a global benchmark that is inspiring comparable initiatives in various countries. It is, according to Richards, “the No. 1 topic in internal auditing not only in the U.S. but in countries around the world.”
Focus on 404
Internal auditors are especially concerned about Section 404 of Sarbanes-Oxley, which requires chief executive and financial officers to swear to the efficacy of their internal controls by the end of 2004. The responsibility of proof has fallen largely on internal auditors, who are having trouble interpreting the vague language of the law and the associated requirements of the Securities and Exchange Commission.
McDonald himself is concerned that the requirements regarding internal control fail to mention risk management.
“You can’t effect control assessment without a risk assessment,” he said. “You need to assess risks, then assess the controls that manage them and, more important, look for the controls that should be in place but are not.”
Some of Section 404, McDonald said, requires the assessment and documentation of controls that have no corresponding risks, which constitutes an inefficiency, if not a complete waste of time. In response, the IIA is advocating more effective enterprise risk management, ideally through professional cooperation rather than legislation.
“When you legislate these things, people just pay lip service to it and look for loopholes,” McDonald said. “I think we’re far better off lobbying professional organizations, corporate directors and stock exchanges, for example, to tell them that audit committees must be mandatory, internal audit must be mandatory, and, to do the job properly, enterprise risk management should be mandatory. If you legislate risk management, people will look at it the wrong way, and that’s worse than not doing it at all.”
That thought extrapolates into a concern that overly ambitious regulation may become self-defeating.
“We’ve got to make sure we don’t over-regulate the market,” McDonald said. “We may be addressing the symptoms rather than the problem. Certainly, accounting and auditing standards needed re-engineering, and that was a good outcome of the [Sarbanes-Oxley] process. But surely one of the real problems comes down to human greed - executives and senior management whose remuneration is tied to profit or short-term share prices. If we’re going to do that, why don’t we make those things payable five years out rather than in the current year?”
The solution, McDonald suggests, is what the IIA has been preaching for years - that good corporate governance depends on the goodwill of four cornerstones: the board, management, external audit, and internal audit. And that message is important enough to put Bob McDonald on yet another airplane, out of Brisbane to Tokyo then over to Nova Scotia, then down to Florida.
And wherever else the word needs to go.
