Corporate Governance and the Role of Internal Audit The Case of Arabia Insurance Company

1. Corporate Governance and the Role of Internal Audit The Case of Arabia Insurance Company Presented by: Naji FayadMBA, CA, CIA, CISA, CCSA Senior Manager/Head of Internal Audit Division Arabia Insurance Company SAL ACAL Presentation by Naji Fayad

2. Corporate Governance Process at Arabia Insurance Company Outline • Initiation of Process • Major Components • Road Map/Major Tasks Achieved • Limitations and Challenges • Audit Committee and Internal Audit Function • Lessons learned • Final Thoughts ACAL Presentation by Naji Fayad

3. Initiation of Process • Originally started in 1998 • New Board of Directors and New Management in 1999 • Seeds of a new culture planted • Not an official process but individual initiatives inspired by the need for improving the company’s internal business environment and creating value and competitive edge ACAL Presentation by Naji Fayad

4. Major Components • Spirit of modernization • Strive to effectively compete in challenging Regional and Global economies • Changing Regulatory, legal and business environments in countries of operation. • Tone at the Top (BOD, General Management) as a major driver in the process of how Arabia is run and controlled • Initiatives inspired from international corporate governance codes and internal brainstorming and discussions ACAL Presentation by Naji Fayad

5. Road Map / Major Tasks Achieved • Written Policies and Procedures drafted for all functions • Operations Processes streamlined • New Organization Chart / Functions interrelations clarified • Audit Committee formed • Hiring an Internal Audit Senior Manager • Internal Audit Function Established • Official Internal Audit Charter • Official Audit Committee Charter • Various initiatives to Promote Transparency, Disclosure and Accountability (Top Down) • Code of Business Conduct (Best Practices, Whistle blowing, grievances etc.. with reporting and enforcement mechanisms) ACAL Presentation by Naji Fayad

6. Limitations and Challenges • Cultural Resistance to Change • Arabia Size and Geographical spread • Being good could sometimes be costly • Actual Focus on Financial indicators with lesser regard to Non-Financial Factors such as good corporate governance (a very common approach worldwide) Note: An international survey conducted by Deloitte & Touche LLP in 2004 revealed a critical fault line between “rhetoric” and “reality” or between “awareness” and “action” in the boardrooms of the world’s leading companies. Non-financial factors are widely regarded as extremely important drivers of success for a company, yet they receive considerably less attention than financial data from the board and senior managers ACAL Presentation by Naji Fayad

7. Arabia Audit Committee and Internal Audit Function • Two of the aspects that were critical in the corporate governance process: • Audit Committee • Internal Audit ACAL Presentation by Naji Fayad

8. Definition of Internal Auditing • Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.  It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes Source: “Professional Practices Framework”: International Standards for The Professional Practice of Internal Audit, IIA Inc. Altamonte Springs, Florida, USA, January 2004 ACAL Presentation by Naji Fayad

9. Definition of Governance • The combination of processes and structures implemented by the board in order to inform, direct, manage and monitor the activities of the organization toward the achievement of its objectives. Source: “Professional Practices Framework”: International Standards for The Professional Practice of Internal Audit, IIA Inc. Altamonte Springs, Florida, USA, January 2004 ACAL Presentation by Naji Fayad

10. Arabia Audit Committee • Governance body charged by the Board of Directors with oversight responsibilities of the organization’s audit and control functions • Established in December 2000 • Composed of 3 Members of the Board of Directors • Guided by a Written “Audit Committee Charter” ACAL Presentation by Naji Fayad

11. Arabia Audit Committee Charter • Mission Oversight responsibilities for: • Considering the effectiveness of system of internal controls designed by management to: Safeguard assets and income, Manage significant Risks, Assure integrity of Financial Statements, Maintain compliance with the company’s ethical standards, policies and procedures, and with laws and regulations • Ensuring the independence and objectivity of the company’s external auditors and reviewing their performance; • Monitoring the performance of the company's internal audit function ACAL Presentation by Naji Fayad

12. Arabia Audit Committee Charter (Cont’d) • Composition Three members of the board. The Board will ensure that members meet the independence requirements and that the members are either financially literate or have industry knowledge. • Meetings issues • Duties And Responsibilities • Oversight of the Financial Statements and Disclosure Matters • Oversight of Company’s Relationship with the External Auditors • Oversight of Internal Audit function • Oversight of Company’s Risk Management Function (in the absence of a Risk Management Committee) • Oversight of the Company’s Compliance • Reporting issues ACAL Presentation by Naji Fayad

13. Arabia Internal Audit Division • Established in December 2000 • Full Time Senior Manager and Team of 4 internal auditors with relevant financial and insurance experience and professional designations (3 MBA, 1 CA, 4 CIA, 2 CISA, 4 CCSA, 2 CFE) • Reporting directly to the Board through the Audit Committee • Various Reports to Audit Committee (Audit plan, Missions, Quarterly, Yearly, and Ad-hoc reporting, etc..) • Meeting regularly with Audit Committee • Mission clearly stated in an “Internal Audit Charter” ACAL Presentation by Naji Fayad

14. Arabia Internal Audit Charter • The purpose, authority, and responsibility of the internal audit activity was defined in a charter • Charter officially approved by Board and Management in 2001 and documented in BOD minutes • In summary, the Internal Audit charter: • Establishes the internal audit activity’s position within the organization; • Defines Authorities (access to records, personnel, and physical properties) and Responsibilities • Defines the scope of internal audit activities ACAL Presentation by Naji Fayad

15. Arabia Internal Audit Charter Contents • Independence and Objectivity section • Mission and Duties section • Reviewing and appraising the soundness, adequacy, and application of accounting, financial, and other operating controls • Ascertaining the extent of compliance with established policies, plans, and procedures • Appraising the economy and efficiency with which resources are employed • Ascertaining the extent to which company assets are accounted for and safeguarded from losses of all kinds • Ascertaining the reliability of management data developed within the organization. • Recommending improvements ACAL Presentation by Naji Fayad

16. Arabia Internal Audit Charter Contents • Ethical standards and Internal Audit Professional Code of Conduct • Responsibility and Authority • Scope: Operational, Compliance, Financial • Internal Audit Planning Methodology: • Risk-Based Assessments • Risk Measurements • Audit Reporting Issues • Ratings of audit reports • Mutual Responsibilities of Management and Internal Audit Department (Dealing with differences of opinions, Recommendations follow up process, etc..) ACAL Presentation by Naji Fayad

17. Important Duties of Internal Audit • Report significant issues related to the processes for controlling the activities of the organization, including potential improvements to those processes • Provide information on the status and results of the annual audit plan and the sufficiency of department resources • Assessing the overall adequacy and effectiveness of the organization’s internal controls, • Monitoring compliance with the organization’s code of conduct and ensuring that ethical policies and other procedures promoting ethical behavior are being followed; ACAL Presentation by Naji Fayad

18. Relationship with Audit Committee • Audit committees and internal auditors have interlocking goals. A strong working relationship is essential for each to fulfill its responsibilities • Three areas of activities that are key to an effective relationship between the audit committee and the internal audit function: • Assisting the audit committee to ensure that its charter, activities, and processes are appropriate to fulfill its responsibilities • Ensuring that the charter, role, and activities of internal audit are clearly understood and responsive to the needs of the audit committee and the board • Maintaining open and effective communications with the audit committee and the chairperson ACAL Presentation by Naji Fayad

19. Lessons Learned • Effective corporate governance requires a proactive, focused state of mind on the part of directors, CEO and senior management. All must be committed to business success through maintenance of the highest standards of responsibility and ethics • Even the most thoughtful and well-drafted policies and procedures are destined to fail if directors and management are not committed to enforcing them in practice ACAL Presentation by Naji Fayad

20. Lessons Learned • A good corporate governance structure is a working system for effective decision-making and appropriate monitoring of compliance and performance • Sound Governance is dependent on the synergy generated among the four principal components of effective corporate governance systems: Boards of directors, Management, Internal auditors, and External auditors. In that structure, internal auditors and audit committees are mutually supportive ACAL Presentation by Naji Fayad

21. Some related literature from the Institute of Internal Auditors: • “Professional Practices Framework” (PPF) • “International Standards for the Professional practice of Internal Audit” (ISPPIA) ACAL Presentation by Naji Fayad

22. IIA Standard 2130 – Governance • The internal audit activity should assess and make appropriate recommendations for improving the governance process in its accomplishment of the following objectives: • Promoting appropriate ethics and values within the organization • Ensuring effective organizational performance management and accountability • Effectively communicating risk and control information to appropriate areas of the organization • Effectively coordinating the activities of and communicating information among the board, external and internal auditors and management Source: “Professional Practices Framework”: International Standards for The Professional Practice of Internal Audit, IIA Inc. Altamonte Springs, Florida, USA, January 2004 ACAL Presentation by Naji Fayad

23. IIA Practice Advisory PA 2130 • Internal Audit Activity as Ethics Advocate • Internal auditors and the internal audit activity should take an active role in support of the organization’s ethical culture. They possess a high level of trust and integrity within the organization and the skills to be effective advocates of ethical conduct. They have the competence and capacity to appeal to the enterprise’s leaders, managers, and other employees to comply with the legal, ethical, and societal responsibilities of the organization Source: “Professional Practices Framework”: International Standards for The Professional Practice of Internal Audit, IIA Inc. Altamonte Springs, Florida, USA, January 2004 ACAL Presentation by Naji Fayad

24. IIA Practice Advisory PA 2130 • Internal Audit Activity as Ethics Advocate • The internal audit activity may assume one of several different roles as an ethics advocate. Those roles include chief ethics officer (ombudsman, compliance officer, management ethics counselor, or ethics expert), member of an internal ethics council, or assessor of the organization’s ethical climate Source: “Professional Practices Framework”: International Standards for The Professional Practice of Internal Audit, IIA Inc. Altamonte Springs, Florida, USA, January 2004 ACAL Presentation by Naji Fayad

25. Final Thoughts • The published reports of corporate governance failures in various countries underscore the need for change to achieve greater accountability and transparency by all organizations • Senior management, boards of directors, internal auditors, and external auditors are the cornerstones of the foundation on which effective organizational governance is built • Internal audit activity plays a key role in support of good organizational governance; it has a unique position to assist in improving an organization’s operations by evaluating and improving the effectiveness of risk management, control, and governance processes ACAL Presentation by Naji Fayad

26. Final Thoughts • Lebanese Code of Corporate Governance is an excellent source and roadmap to companies for adoption of corporate governance initiatives • LCCG Contains principles widely accepted in US, Europe, etc. and recently embraced by many Arab Countries in their regulations (Oman CMA, Bahrain CBB, Saudi Arabia SAMA, Jordan) • LCCG is still Voluntary and not legally binding • Role of Audit Committee as stated in Appendix F of the Code could be improved ACAL Presentation by Naji Fayad

27. Thank You ACAL Presentation by Naji Fayad