Practical lessons on do’s and don’ts for Internal Auditors; A case study of a listed company

1. Practical lessons on do’s and don’ts for Internal Auditors; A case study of a listed company Denish Osodo Director, Internal Audit Safaricom Limited, Kenya

2. The Headlines

3. Where were the Internal Auditors? Internationally Fun Fact Year Amounts involved • Fortune magazine named Enron as “Most innovative Company” for 6 years in a row prior to the scandal • USD 74 Billion of shareholder money lost 2001 • Posted largest corporate quarterly loss in 2008 of USD 61 Billion; got bailed using taxpayer funds, rewarded executives USD 165M in bonuses • Accounting fraud to the tune of USD 3.9 Billion 2005 • In 2007, ranked as “Most Admired Securities Firm” by Fortune magazine • Hid over USD 50 Billion in loans disguised at sales 2008 • The Founder’s wife published a book about his existentialist. • Falsely boosted revenue by USD 1.5 Billion 2009 • Overstated profits by USD 1.2Billion from fraudulent accounting • Commended for setting up governance processes, having Audit Committee and Internal control teams in Japan a practice more common in Western world. 2015 • Unauthorized cross selling and creation of 2Million fake accounts. 2016 • Rose to be the 3rd largest bank in asset base and second largest in deposits

4. Where were the Internal auditors? Locally

5. Stakeholders of Internal Audit in a Listed Company PUBLIC INTEREST A delicate balance for the Internal Auditor to live up to the expectations of multiple stakeholders. When the auditor focusses on one the others may suffer! When things go wrong: Default Question : Where were the Auditors?

6. Nairobi Securities Exchange (NSE) 1920s – 1953: Dealing in shares commenced with trading taking place on a gentleman's agreement with no physical trading floor. London Stock Exchange (LSE) officials accepted to recognize the setting up of the Nairobi Stock Exchange as an overseas stock exchange (1953) 1954 – 1962: The Nairobi Stock Exchange (NSE) was registered under the Societies Act (1954) as a voluntary association of stockbrokers and charged with the responsibility of developing the securities market and regulating trading activities. 1963 – 1970: The Government adopted a new policy with the primary goal of transferring economic and social control to citizens.  By 1968, the number of listed public sector securities was 66 of which 45% were for Government of Kenya, 23% Government of Tanzania and 11% Government of Uganda. 1975: When the EAC finally collapsed in 1975, the Government of Uganda compulsorily nationalized companies which were either quoted or subsidiaries of listed companies. 1988: The first privatization through the NSE, through the successful sale of a 20% Government stake in Kenya Commercial Bank. 1991: NSE was registered as a private company limited by shares. Share trading moved from being conducted over a cup of tea, to the floor based open outcry system, located at IPS Building, Kimathi Street, Nairobi. 1996: Privatization of Kenya Airways where more than 110, 000 shareholders acquired stake in the airline and the Government of Kenya reduced its stake from 74% to 26%. The Kenya Airways Privatization team was awarded the World Bank Award for Excellence for 1996, for being a model success story in the divestiture of state-owned enterprises. June 9 2008:  The immobilized shares of Safaricom Ltd., commenced trading on the NSE after the trading session was opened in a colorful ceremony presided by H.E. President Mwai Kibaki. The Safaricom IPO increased the number of shares listed on the bourse to over 55.0 billion shares, from the previous 15.0 billion.

7. About Safaricom

8. Don’ts of Internal Audit Key Failures 1. Corporate Culture fueling fraud. If Strategy is Culture’s breakfast then Governance, Risk and Controls Are its Appetizers. 2. Management override of controls An assumption that management and the Board is always right and makes the right decisions in the interests of all. 3. Audit sailing through despite of all the happenings till the end when they have to answer questions. Internal Audit failing to be a Canary in the Coal Mine.

9. Don’ts of Internal Audit Key Failures 4. Assuming fraud risk assessment is not the auditor’s role. Fraud Risk Hasn't Reemerged —The auditor never looked at it and everyone else thought the auditor was looking at it. 5. Fear of job loss Auditor’s self interests to preserve job, position and place in society takes precedence over protecting public interest. 6. Incompetence of assurance providers. The Audit function not skilled in certain areas.

10. Navigating the audit terrain - Do’s of Internal Audit 1. Expanding Internal Audit's mandate Internal Audit needs to move beyond the standard compliance focus and drive business and strategic insights.

11. Navigating the audit terrain - Do’s of Internal Audit 2. Increasing the scope of Internal Audit

12. Navigating the audit terrain - Do’s of Internal Audit 3. Increasing competency levels Address all skill gaps identified from the board level to the audit team. Source: EY Survey

13. Navigating the audit terrain - Do’s of Internal Audit 4. Planning for the right Audits • Expand Your Auditable Universe - Nothing should be too complex or difficult for the auditor. • Audit Plan based on Organizational Need and not Internal Audit Competencies • Get a good balance between what management wants and what the role of the public interest protector demands – Avoid management “lap dog” audit plan but implement a “watch-dog” audit plan • Audit Plans change just as much as Strategy Changes – If Strategy is written in pencil, why should audit plan be in non-erasable ink.

14. Key Take Outs : If you still in doubt of what you signed up for as an auditor; • In the unlikely event of a failure, the question, “where was the auditor?” will be asked. • Audit is a Risky Business. • Audit is always in Public Interest.

15. Questions?