STRANGER IN THE HOUSE
Finance managers are discovering that outsourcing internal audit can bring real rewards.
By Jenny Daneels

For some CFOs in Asia, the notion of outsourcing a company's internal audit conjures images of scandalous tabloid headlines and bank accounts robbed blind. Certainly, laying bare some of a company's most sensitive data to outside eyes can be a nerve-wracking experience - one that usually requires a large leap of faith on the part of conservative finance managers. And for some local CFOs, convincing family owners that it's a good idea to have strangers poking through the family business can be a nightmare in the making.

But despite the fear and loathing, more finance managers in the region are finding that outsourcing the internal audit function makes good sense. The fact is, without an effective internal audit function, companies are flying blind. An exhaustive internal audit can help a company figure out if its processes are flawed, if work is being duplicated, or if the company is being cheated by its own employees. Hazman Yusri, financial controller at Malakoff Berhad, a publicly listed Malaysian power company, decided to outsource his company's internal audit for a very practical reason. He couldn't pull together and keep a crack in-house internal audit team. "When we decided to outsource in 1995, there was a boom in Malaysia, and it was very difficult to find good people, to train them and keep them," he says. Today, with the company reporting annual sales of US$370 million a year, Yusri says he wouldn't dream of bringing the internal audit back in-house.

More finance managers in the region seem to be thinking that way. "There is definitely a growing interest in outsourcing internal audit," says Tan Hoon San, senior manager for internal audit services at PricewaterhouseCoopers (PwC) in Kuala Lumpur. Although his department was set up just two years ago, Tan now supervises ten consultants who handle internal audits full time. And those numbers may be increasing. According to one estimate, 10 percent of listed companies in Asia have no internal audit department. Of those that do, at least half don't have enough trained finance people to properly staff the internal audit group.

Hard to Find

With many companies in the region now desperate to improve their business processes, such a shortage may leave them little choice but to outsource their internal audits. To help ease corporate concerns about security, most consultants now routinely offer confidentiality contracts to prospective clients. Experts say CFOs can also maintain some measure of control by denying outside auditors access to documents they deem too sensitive for non-employees. Most finance managers say they also chose a different firm for their internal and external accounting to eliminate possible conflicts of interest. Hiring two accounting firms has other benefits as well. According to Ar Karu, accounting manager for Malaysian Life Reinsurance Group, it encourages a healthy competition between the two providers. "It keeps them on their toes," he says.

Although consultants generally charge a hefty fee for doing an internal audit, outsourcing is often cheaper - and easier - than trying to do the job in-house. The chairman of the Institute of Internal Auditors in Malaysia, Stanley Yap, who formerly ran the internal audit department for a publicly traded company, says it takes one-and-a-half years to properly build a company's internal audit team. "It is difficult to find good people with a wide spectrum of expertise," Yap says. And he points out, once the team is in place, a company's better internal auditors often get itchy feet. "High-flyers are reluctant to stay put," he says. "They move on."

For some smaller companies, such defections could be financially draining. In fact, an internal audit staff is usually out of the reach of all but the most profitable small corporations. "We are a company of eleven people," says Malaysian Life's Karu. "It is not practical to have an internal audit department." But Karu had no choice but to conduct internal audits: Malaysian law requires all local insurance companies to conduct regular internal audits. Rather than throw much-needed resources at building an internal audit team, Karu decided to outsource the task to a big five accounting firm.

Top-tier Asian companies and multinational corporations are also turning to outsiders for their internal audit, although for slightly different reasons. Freddie Kwok, regional financial controller in Singapore for Schick Asia, the shaving products division of US-based Warner-Lambert, explains that he needed both traditional internal auditing expertise and auditors who could monitor the company's electronic data processing. That kind of expertise is hard to find, he says, and the cost of hiring such an auditor would have been prohibitive. Instead, Kwok chose Corporate Outsourcing Professionals (COP) based in Kuala Lumpur to do the internal auditing at Schick's plants in Malaysia and China, as well as the company's offices in Hong Kong and Singapore. "We pay for one head count, but we get a lot of support," he says, explaining that different staff members at COP provide different skills. Kwok was also impressed by the language skills at COP. "Malaysians speak four or five different languages or dialects," he says.

Finance managers often choose to outsource their internal auditing for another important reason - quality control. "You can't compromise on standards," says Shuba Kumar, regional financial controller for Sydney-based Southern Pacific Hotels Corporation, which manages the Parkroyal and Travelodge hotels in Thailand and Mal-aysia. Kumar had been doing all the company's internal auditing herself until senior management decided to set up a separate department last year. The choice to outsource made sense. Southern Pacific could either fly their own auditors around Asia, or hire one firm to handle the job. Hiring one consultancy would ensure that standards were maintained at the company's dif-ferent operations. In the end, Kuma decided to sub-contract the hotel company's internal audit function to a Big Five accoutancy.

Not Just Police

So far, Kuma says the benefits have been substantial. She notes that there's more to outsourcing than just saving the company time and money. "A third party is unbiased," she says. Malakoff's Yusri agrees. "You get rid of politics," he says. This is particularly important since the internal audit department is increasingly asked to advise on which staff members should be retained, and which should be let go. That's never an easy business - and particularly difficult for employees who have friends in other departments. Surprisingly, some finance managers note that outside consultants are often more sensitive to local traditions than company employees who have been flown in from distant corporate headquarters.

Moreover, an accounting firm that performs internal audits can be a good source of information on industry best practices. "The more forward-looking companies see internal auditors as inside consultants, not just policemen," says Yap. Tan of PwC agrees. "We check the general health of internal controls," he notes. "But we also offer more value added by making recommendations on how to reduce inefficiencies and costs."

Despite these pluses, outsourcing an internal audit is far from a quick fix. Those who have done it say that it may take months before the out-sourcers become familiar with a particular company or industry. Says Southern Pacific's Kumar: "The hotel business is unique. It took some time before the con-sultant knew the business." Further, industry watchers say the big accounting firms do not yet offer the same breadth of internal audit services in Asia as they do in the US and Europe. Until these accounting firms flesh out their internal audit divisions in the region, CFOs would be well advised to do some careful homework before choosing a consultancy to handle any sensitive financial tasks.

Jenny Daneels, a contributor to CFO Asia, is based in Kuala Lumpur.