Shariah Auditing: Between Ideals and Realities

1. MIDF SHARIAH DIALOGUE 29TH MARCH 2016 SHARI’AH AUDITing: between theideals and realities · Al-Hujurat (The Dwellings) [49:6] O ye who believe! If a wicked person comes to you with any news, ascertain the truth lest ye harm people un wittingly, and afterwards become full of repentance for what ye have done. Dr. ShahulHameedHj. Mohamed Ibrahim Member, Shariah Committee, MIDF

2. INTRODUCTION Shariah auditing has currently emerged as an important subject of discussion inline with the advance development of Islamic Financial Institutions (IFIs) . This demands the proper governance of the Shari’ah compliance issues. As a new emerging discipline, there are several issues which need to be dealt . It is important that we discuss these issues and make inputs to the development of shariah auditing. This lecture will proceed as follows:

3. Presentation outline

4. Types of auditing and review

5. Financial Statement Audit • International Standards on Auditing (ISA) 200, Objective and General Principles Governing an Audit of Financial Statements, states that: “The objective of an audit of financial statements is to enable the auditor to express an opinion whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework”.

6. Audit Definition • Broader definition of audit • AAA defined auditing as: “a systematic process of objectivelyobtaining and evaluating evidence regarding assertions about economic actions and events to ascertain the degree of correspondence between those assertions and established criteria and communicating the results to interested users” (Committee on Basic Auditing Concepts [COBAC], 1972: 2)

7. Auditing process

8. Comparison between conventional and Shariah auditing

9. Evolution of Auditing Social & Environmental Audit Financial Audit Performance Audit Shari’ah Audit Every aspect of organization’s activities as required by Islamic religiious teaching Economy, effectiveness and efficiency of resource utilization, programs & activities Social contribution & environmental compliance Financial statements Late 1800s/1900s 1960s/1970s 1970s 2000s

10. Issues in shariah auditing

11. Shariah auditing definition According to GSIFI 2 of AAOIFI, Shari’a review is an examination of the extent of an IFI’s compliance, in all its activities, with the Shari’a. This examination includes contracts, agreements, policies, products, transactions, memorandum and articles of association, financial statements, reports (especially internal audit and central bank inspection), circulars, etc. The objective of a Shari’a review is to ensure that the activities carried out by an IFI do not contravene the Shari’a. While the SSB is responsible for forming and expressing an opinion on the extent of an IFI’s compliance with the Shari’a, the responsibility for compliance therewith rests with the management of an IFI • The AAOIFI definition is broad “in all its activities” • It uses the word “review” instead of the word audit • Review =negative assurance, lower level of assurance than audit • Perhaps in the beginning this is better than a full scale audit, however, the scope in AAOIFI is quite broad

12. REVIEW AND AUDIT

13. Shariah Review and Shariah Auditing BNM Shariah audit framework definition • Both the above are referred to as CG functions (departments?) in the IFI • Shariah review is the regular assessment of shariah compliance in the activities and operations of the IFI by qualified shariah officers (BA Shariah) of ensuring that the activities and operations carried out by the IFI do not contravene the shariah • Includes remedial rectifications measures to resolve non compliance and control mechanisms to avoid recurrences. • Scope:overall business operations, including end to end product development process from structuring to product offering. • Reports to SC and management, highlighting non compliances and their rectifications.

14. Shariah Review and Shariah Auditing BNM Shariah audit framework definition • Shariah Auditing is the periodical assessment conducted from time to time to provide: • Independent assessment and objective assurance designed to add value and improve the degree of compliance in relation to the IFIs business operations, with the objective of ensuring a sound and effective internal control system for shariah compliance • Performed by internal auditors (IAs) with adequate shariah knowledge and training. The Ias may engage the expertise of shariah officers but mut maintain objectivity. • Can be embedded in Management audits, AML audits, • Critical areas depending on risk profile of IFI must be audited at least once a year. • Deliverables (which must be consistent with auditing standards!) are determined by Board Audit Committee in consultation with Shariah Committee. • Scope: financial statements, organizational structure, people, process, IT applications systems and review of shariah governance process.

15. SHARIAH REVIEW AND SHARIAH AUDITFUNCTIONS ShariahReview ShariahAudit • To ensure that the activities and operations carried out by the IFI do not contravene with the Shariah • To provide an independent assessment & objective assurance to ensure a sound and effective internal control system for Shariah compliance Objective • Overall business operations, including the end‐to‐ end product development process (from product structuring to product offering) • All aspects of the IFI’s business operations & activities, including: • audit of financial statements; • compliance audit on organisational structure, people & IT application systems; and • review of adequacy of the Shariah governance process. Scope • Planning the review program (includingobjectives, • Understanding the business activities of the IFI – to allow for better scoping of an audit exercise; • Developing a comprehensive internal audit program; • Obtaining and making reference to relevant sources (e.g. SAC’s published rulings, the SC’S decisions, etc) • Communicating results or findings to the Board Audit Committee and the Shariah Committee; and • Providing recommendations on rectification measures taken as well as following‐up on the implementation by the IFI. scope, reporting, rectification and follow‐up actions followed by the execution of the program); • Documentation of the processes involved; • Communicating the outcome & highlighting any non‐compliances to the Shariah Committee & the management; and • Rectifying any instances of Shariah non‐ compliance to prevent such events from recurring. Process Source: Bank NegaraMalaysia

16. OTHER KEY INTERNALFUNCTIONS Apart from Shariah review & audit IFIs are also expected to establish other functions that complement and provide necessary support to Shariah compliance functions within the organisation Objectives Scope & Functions • Identification & assessment of Shariah risk would be systematically controlled & monitored • Form part of IFIs integrated risk mgmt control function S h a r i a h r i s k Shariah risk management control m a n a g e m e n t c o n t rol • Perform in-depth research on Shariah including providing day-to- day Shariah advice & consultancy • Perform by qualified Shariah officers • May seek input from experts on technical matters • Ensure proper deliberation of Shariah related matters S h a r i a h r e s e a r c h Shariah research function f unction • Provide necessary support to Shariah committee & IFI in implementing Shariah governance • Coordinating meetings, compiling papers, disseminating Shariah decisions • Engaging with relevant parties that need assistance S h a r i a h s ecretariat Shariahsecretariat function f u nction Source: Bank NegaraMalaysia

17. BNM’S SHARIAH GOVERNANCEFRAMEWORK • Effective date 1 January 2011 and Islamic banks are given 6 (six) months to comply with all requirements. • IFI to confirm status of compliance with SGF at the end of the six months. Full enforcement 1 July 2011. • Objectives: • Set out the expectation of BNM on Shariah governance structures, processes and arrangements to ensure that all its operations and business activities are in accordance with Shariah. • Provides a comprehensive guidance to the Board, Shariah Supervisory Council and management of the Bank in discharging its duties in matters relating to Shariah; and • Outlines the functions relating to Shariah review, Shariah audit, Shariah risk management and Shariah research.

18. FRAMING SHARIAH GOVERNANCEFRAMEWORK Independence • Recognition by board on SC’s independence • Appropriate reporting structure • SC decision shall not be set aside • Access to necessary info by SC • Appointment & removal of SC Oversight, accountability & Responsibility Clear demarcations on accountability & responsibility • Board overall accountability • SC accountability on decisions, views & opinions • Management’s responsibility in providing adequate support Guiding Principles Competency • Comply to fit & proper requirement • Continuous training provided to key internal stakeholders • Performance assessment for SC • Succession planning program for SC Confidentiality & consistency • Duty to observe confidentiality on sensitive info obtained by SC • Restriction on SC membership in IFI within same industry • Structured decision making process • SC should not undermine SAC rulings Source: Bank NegaraMalaysia

19. SHARIAH GOVERNANCE FRAMEWORK’SMODEL Shariah Principle in Islamic finance BOARD AUDIT COMMITTEE BOARD RISK MANAGEMENT COMMITTEE BOARD Overall oversight on Shariah compliance & review SHARIAH COMMITTEE Oversight accountability on Shariah related matters MANAGEMENT ❖Ensure executions of business & operations are in accordance with Shariah rules & principles ❖Provide necessary support to the Shariah committee Shariah Risk Management Control Function Identify, measure, monitor, report & control Shariah non-compliance risk Shariah Review Function Review business operations on a regular basis to ensure Shariah compliance Shariah Research Function Conduct comprehensive Shariah research prior to submission to the Shariah committee Shariah Audit Function Provide independent assessment & objective assurance designed to value add & improve IFI’s compliance with Shariah Shariah compliance and ResearchFunctions Source: Bank NegaraMalaysia

20. The meaning of “shariah’” in sharia auditing • Shariah compliance according to AAOIFI means “compliance with Islamic Shari’a Rules and Principles as reflected in the fatwas, rulings and guidelines issued by them (hereinafter, the Shari’a) • This seems contradictory. Unless fatwas, rulings and guidelines covers all activities, then the “extent of shariah compliance in all its activities cannot be reviewed.” • In practice, as our research confirms, the SSB is mainly issuing fatwa's related to financing products and not other activities, hence aaofi’s definition is a bit contradictory. • Auditing by persons based on criteria issued by the auditor themselves poses a “self review” threat to independence. • It does not bode well for the use of audit judgment making the review a mechanistic procedure.

21. Shariah auditing standards • In the conventional accounting world, the IAASB develops International standards on auditing and assurance services and these are pretty established and accepted globally • In the case of shariah auditing, the Accounting and Auditing Association for Islamic Financial Institutions (AAOIFI ) has a set of standards both for conventional and shariah auditing of IFIs. • The shariah auditing standards were reclassified as Governance standards. These are : • Shari’a Supervisory Board: Appointment, Composition and Report • Shari’a Review • Internal Shari’a Review • Audit and Governance Committee for Islamic Financial Institutions • Independence of Shari’a Supervisory Board (new) • Statement on Governance Principles for Islamic Financial Institutions (new) • Corporate Social Responsibility (under development)

22. Independence and qualifications of shariah auditors (SSB) • A unique corporate governance mechanism of Islamic financial Institutions is the shari’a supervisory board (SSB) which is theoretically an independent external body akin to external auditors. • Consisting of at least 3 scholars in fiqhmuamalat, who may be supported by experts in Islamic banking with knowledge of fiqhmuamalat- problem may not have accounting or auditing expertise • The board is supposed to direct, supervise and review the activities of the Islamic Financial Institution to ensure shari’a compliance in all its activities- problemSelf interest threat to independence. • The SSB is known under various names • In Malaysia, Bank Negara calls it shari’a committee, although Bank Islam Malaysia Bhd., uses the term Shariah Supervisory Council, • whereas Meezan Bank of Pakistan has both a Shari’a Advisor (who issued the Shari’a Report) and a SSB, • Shamil Bank of Bahrain uses Religious Supervisory Board, • and al Baraka Bank uses the term Shari’a Board.

23. Confusion in SSB Nomenclature? Bank Negara Malaysia Shari’a Committee Bank Islam Malaysia Shariah supervisoryCouncil Meezan Bank Pakistan Shari’a Advisor Al Baraka Bank Bahrain Shari’a Board Shamil Bank Bahrain Religious SupervisoryBoard

24. Duties of the SSB(SC) – A Malaysian view • Responsibility and accountability The Shariah Committee is expected to understand that in the course of discharging the duties and responsibilities as a Shariah Committee member, they are responsible and accountable for all Shariah decisions, opinions and views provided by them. • Advise to the board and IFI The Shariah Committee is expected to advise the board and provide input to the IFI on Shariah matters in order for the IFI to comply with Shariah principles at all times. • Endorse Shariah policies and procedures The Shariah Committee is expected to endorse Shariah policies and procedures prepared by the IFI and to ensure that the contents do not contain any elements which are not in line with Shariah. • Endorse and validate relevant documentations To ensure that the products of the IFI comply with Shariah principles, the Shariah Committee must approve: • i) the terms and conditions contained in the forms, contracts, agreements or other legal documentations used in executing the transactions; • and ii) the product manual, marketing advertisements, sales illustrations and brochures used to describe the product. • To assess the work carried out by Shariah review and Shariah audit in order to ensure compliance with Shariah matters which forms part of their duties in providing their assessment of Shariah compliance and assurance information in the annual report. • Assist related parties on Shariah matters The related parties of the IFI such as its legal counsel, auditor or consultant may seek advice on Shariah matters from the Shariah Committee and the Shariah Committee is expected to provide the necessary assistance to the requesting party. • Advise on matters to be referred to the SAC The Shariah Committee may advise the IFI to consult the SAC on Shariah matters that could not be resolved. • Provide written Shariah opinions The Shariah Committee is required to provide written Shariah opinions in circumstances where the IFI make reference to the SAC for further deliberation, or where the IFI submits applications to the Bank for new product approval.

25. SHARI’A REVIEW CYCLE Shariah audit procedures

26. Shariah audit reports

27. AAOIFI’S SHARIAH AUDIT REPORT In the name of Allah, The Beneficent, The Merciful To the Shareholders of The Example Islamic Financial Institution AssalamAlaikumWaRahmat Allah WaBarakatuh In compliance with the letter of appointment, we are required to submit the following report: We have reviewed the principles and the contracts relating to the transactions and applications introduced by the Example Islamic Financial Institution during the period ended. We have also conducted our review to form an opinion as to whether the Example Islamic Financial Institution has complied with Shari’a Rules and Principles and also with the specific fatwas, rulings and guidelines issued by us. The Example Islamic Financial Institution’s management is responsible for ensuring that the financial institution conducts its business in accordance with Islamic Shari’a Rules and Principles. It is our responsibility to form an independent opinion, based on our review of the operations of the Example Islamic Financial Institution, and to report to you. We conducted our review which included examining, on a test basis of each type of transaction, the relevant documentation and procedures adopted by the Example Islamic Financial Institution We planned and performed our review so as to obtain all the information and explanations which we considered necessary in order to provide us with sufficient evidence to give reasonable assurance that the Example Islamic Financial Institution has not violated Islamic Shari’a Rules and Principles. In our opinion: a) the contracts, transactions and dealings entered into by the Example Islamic Financial Institution during the year ended ... that we have reviewed are in compliance with the Islamic Shari’a Rules and Principles; b) the allocation of profit and charging of losses relating to investment accounts conform to the basis that had been approved by us in accordance with Islamic Shari’a Rules and Principles; (where appropriate, the opinion paragraph shall also include the following matters:) c) all earnings that have been realized from sources or by means prohibited by Islamic Shari’a Rules and Principles have been disposed of to charitable causes; and d) the calculation of Zakah is in compliance with Islamic Shari’a Rules and Principles. We beg Allah the Almighty to grant us all the success and straight-forwardness. WassalamAlaikumWaRahmat Allah WaBarakatuh (Names and signature of the members of the Shari’a supervisory board) Place and Date

28. Evolution of the shariah report in Malaysia (2006 to 2012 SGF)

29. Shariah report post BNM SGF(2011)

30. Actual shariah report RHB 2014

31. EXTREMES IN PRACTICE – THE GOLD STANDARD – MEEZAN BANK OF PAKISTAN

32. EXTREMES IN PRACTICE – THE GOLD STANDARD – MEEZAN BANK OF PAKISTAN

33. Planning Review Procedures • The Shari’a review procedures shall be planned so that it is completed in an effective and efficient manner. The plan shall be adequately developed to include a complete understanding about the IFI’s operations in terms of products, size of operation, locations, branches, subsidiaries and divisions. The planning shall include obtaining a list of all fatwas, rulings and guidelines issued by the SSB. • Understanding the activities, products and management’s awareness and attitude towards compliance with the Shari’a is essential. This will have a direct effect on the nature, extent and timing of the Shari’a review procedures. • The plan shall be properly documented including the sample selection criteria and sizes, taking into consideration complexity, and frequency of transactions. • The review procedures shall be designed based on the above input. The review procedures shall cover all activities, products and locations. These procedures shall ascertain whether the SSB approved transactions and products have been undertaken and all related conditions have been met.

34. Executing Review Procedures & preparing working papers • At this stage all the planned review procedures are executed. The SSB review procedures shall normally include: • obtaining an understanding of the management’s awareness, commitment and compliance control procedures for adherence to the Shari’a; • reviewing of contracts, agreements, etc.; • ascertaining whether transactions entered into during the year were for products authorised by the SSB; • reviewing other information and reports such as circulars, minutes, operating and financial reports, policies and procedures, etc.; • consultation/co-ordination with advisors such as external auditors; and • discussing findings with an IFI’s management. • The execution of the above review procedures shall be documented in work papers which shall be complete, neat and cross referenced to review procedures.

35. Documenting Conclusions & Reporting to shareholders • The SSB shall document their conclusions and prepare their report to the shareholders based on the work done and discussions held. The SSB report shall be read at the annual general meeting of the IFI. A detailed report, when warranted, shall also be issued to an IFI’s management. • Quality assurance • The SSB shall implement adequate quality control policies and procedures to ensure that the review is conducted in accordance with this standard. • Quality control procedures may include review of all work papers to ensure that review procedures were properly understood and executed. Additional discussions may be held with the IFI’s management, if required, to ensure that all significant matters were covered during the review.

36. Research Questions • Is it important to develop the discipline of Shari’ah audit and what should be the definition of Shari’ah audit?This question examines the awareness of respondents of the term Shari’ah audit and their perception on the importance to establish the discipline of Shari’ah audit and its definition. • What are qualification requirements for Shari’ah auditors and who should appoint Shari’ah auditors? This question seeks to identify who are supposed to perform Shari’ah audit, what should be the qualification requirements for Shari’ah auditors, and who should appoint the Shari’ah auditors. • What should be the scope of Shari’ah audit? This question encompasses the investigation on the business areas to be audited under Shari’ah audit • To what extent should Shari’ah audit be performed?This question aims to explore the extent of and when Shari’ah audit should be performed.

37. Question of definition • Review or audit? • Review is defined as “is a service where the auditor’s objective is to provide a moderate level of assurance, being a lower level of assurance than that provided by an audit” (CPA Australia, 2006) • Review has also been defined as “a formal assessment of an activity with the intention of suggesting or implementing changes” or a review “implies an audit type investigation that does not meet the full requirements of Generally Accepted Auditing Standards (GAAS)” (O’Regan, 2004) • GSIFI No.2 on Shari’ah review states that “Shari’ah review is an examination of the extent of an IFI’s compliance in all its activities with the Shari’ah” (AAOIFI, 2002) • Shariah reports indicate an audit not a review

38. Who should Conduct Shari’ah Audit? New Professionals called Shari’ah auditors?? Internal auditors under supervision of SSB?? Shari’ah Supervisory Board?? External Financial auditors?? Islamic Jurists (Ulama)?

39. Qualification & Competence Requirements Degree/Professional qualification in accounting and specialized certification in Shari’ah audit?? ? Degree/Professional qualification in accounting & Fiqh (Islamic Law)?? Degree/Professional qualification in accounting?? Trax Associates, Sept 2003

40. Scope of Shari’ah Audit Business Policies?? Processes & Procedures?? Human resource Management?? Zakat calculation & payment?? Scope of Shari’ah Audit Marketing & advertising?? Contracts & agreements?? Social contribution?? Environmental impact of operation??

41. Every single activity? To the extent deemed satisfactory by the auditors? Using sampling method? Throughout financial year? During new product application? At the end of financial year? To What Extent & When Should Shari’ah Audit be Performed? To what extent? When?

42. Respondents’ Background 1. Muslim accounting academicians • Muslim lecturers teaching at the Accounting Program in public universities in peninsular Malaysia 2. Muslim audit practitioners • Muslim audit practitioners in peninsular Malaysia • Shari’ah scholars • Members of the Shari’ah Committee or Shari’ah Supervisory Board (SSB) of the Islamic commercial banks (ICB) and Islamic subsidiaries of commercial banks (ISCB) in Malaysia

43. Conclusion – Research Question No.1 • While the subject of Shari’ah audit is gradually attracting the attentions from relevant parties such as scholars in the field of Islamic finance, however generally it has yet to become a popular subject to the academic individuals in the accounting field and to the audit professionals especially. • Despite the respondents’ varying degree of awareness, it is very encouraging to discover that the respondents highly regarded the importance to develop the discipline of Shari’ah audit. • While many of the respondents tend to agree towards defining the term Shari’ah audit based on the definition of Shari’ah review by AAOIFI, several other respondents have instead see the inappropriateness of such association.

44. Conclusion – Research Question No.2 • Shari’ah audit should be performed by new professionals called “Shari’ah auditors” who are specifically certified in Shari’ah audit • Shari’ah auditors must be appointed by a new independent body dedicated to oversee the practice of Shari’ah audit • It is seen strongly important to establish and standardize the qualification and competence requirements for Shari’ah auditors who are supposed to have minimum degree/professional qualification in accounting and specialized certification in Shari’ah audit

45. Malaysian Practice- Audit Scope • Most IFIs audit compliance of products only. • Cost consideration of extending scope • Newcomers and therefore need to compete by developing new products • (discuss Implication on audit report on activities and operations) • Education of staff needed before scope expansion • Perceived to be difficult • Other scope under research stage • Extension of scope in agenda • Discussion on going on staff compliance with sharia dress codes and marketing of products • Not in favour of social and environmental or performance audit as considered not within scope and lack of public awareness • Fear workload increase without adequate resources • Capitalist mentality- shariah audit is a business unit to make profits.

46. Malaysian Practice- Audit Procedures • Begins at proposal stage • Use of checklist with non-compliance parameters development by shariah division and endorsed by SSB • Key Risk indicators • Use shariah policy, guidelines, circulars and fatwas. • Non compliance reported to SSB on a monthly basis

47. Ex post audit • Documents reviewed include • Concept papers, structure and terms sheet • Documentation examined include agreements, letters of offer, policies and procedures, corporate advertisements/brochures and pamphlets • The above documents are compared with • Fatwas • Central bank regulations • Company’s shariah compliance audit manual • Non compliance are noted as comments and queries and post audit monitoring is carried out. • Observation: lack of audit judgment, very mechanical process is evidence.

48. Authority , Independence and Qualifications issues • Internal audit teams who conduct shariah audits are not Muslims nor shariah qualified except in a very few cases. • However, they claim to be exposed to concepts/policies and ethics of Islam • They work with shariah qualified officers in the shariah department or compliance unit • Use shariah compliance checklist handed down from HeadQuarters but modified for Malaysian environment • SSB is dominant in the process as they must endorse the work of the SC units

49. Authority , Independence and Qualifications issues • However, there seems to be overdependence on the organizational units to carry out most of the audit work due to: • SSB members are part time • Mostly academics who are busy • Therefore their Independence and reliability of the evidence on which their report is based is put into question. • SSB meetings discuss Shariah compliance matters in addition to product development approvals

50. Recommendations for future development of Shariah Auditing • There is need for integrated education of shariah auditors and accountants to produced competent shariah accountants and auditors • Accountants can be certified in shariah audit (short term) • Shariah/madrasah/hafiz students with a strong grounding in Arabic and islamic studies should follow an integrated curriculum in both Arabic and English with accounting, auditing, business, fiqh muamalat and usulul fiqh subjects as well as Islamic economics, finance, accounting etc • Shariah auditing needs to evolve to cover marketing, personnel, systems, processes, social and environmental areas. • An external shariah audit should be introduced as in Pakistan. This is coming soon. • AAOIFI needs to update its GSIFI standards to differentiate review from audit as well as broadening the scope of shariah audit and develop standards on related audit procedure and better audit report standard. • BNM with the help of MIA and Shariah advisers association to shariah standards in a format which is suitable to become the criteria for shariah auditing. • There needs to be a professional body for Shariah accountants and auditors. • Shariah auditing standards must be developed initially with the cooperation of BNM and MIA and Shariah advisers association and be left to a new professional body of shariah accountants and auditors.