Getting Value from Compliance

I read through the draft of the King 3 Corporate Governance code recently to contribute my comments. (See IODSA). What was mentioned (in my own words) was the large cost of "forced" compliance incurred relative to the initial events that triggered it, and I refer here to the Enron/SOX relate issues.

There is little mention of a value added approach to compliance, instead of compliance for the sake of it. I would rather advocate a semi marketing approach to implementation i.e. look for ways of improving competitive advantage for your organisation, making you slicker, more innovative, more responsive and more profitable. I think that it was Sir Adrian Cadbury who intimated that good governance is good business, although I suspect that this had more to do with the higher share premium than the effectiveness of management.

If you follow the apply or explain principle,

• then involve your colleagues in the process
• define what the positive result will be or how it can be achieved
• look for the sweet spots how it can contribute to competitive advantage
• don't do it if there is no real justification for it in terms of the above
• Obviously, don't be stupid and ignore the risks in the process or the spirit of compliance in the first place
• Remember your duty of care as a CIO to sustainability, you shareholders and stakeholders
• Turn compliance into an investment, not a cost

Audit - Time to add value

I should have perhaps titled the article - Audit - What Value? In a recent presentation I did on behalf of the South African Chapter of ISACA (Information Systems Audit and Control Association), as is my provocative bent, I challenged the group to review the value proposition offered by the audit function, not only IT, but all the elements of good governance.

Where there is a legislative framework in place that forces companies to use a service, its inevitable that a certain amount of service ethic falls by the wayside (Why should you when companies are forced to use your services anyway?). This in turn effects value delivery. Given that the current global economy is shaky, the focus on cost and value is now suddenly at the top of the board agenda. If good governance was the order of the day, and boards actively practiced their duty of care, this would already be a way of life!

However, back to the point. The days of an audit firm attaching itself like a bloated leech to
a company at year end, and completing the required audited statements in a detached fashion, without actively contributing to the good governance of the entity, are over.

Shareholders and boards should view this kind of activity and behaviour with circumspection and downright suspicion. After all, you pay a fortune for the service, and for what - to rubber stamp? Why not go to the CA down the road and do the same thing at a fraction of the cost? Better still, force your board to instill good governance at source, it will save you a lot in the long term.

This is not a singling out of auditors in anyway. We should apply the same rigour when selecting any vendor or service provider. We should look for value, we should question the return on investment and we should look to it supporting our strategy and sustainability. Above all, we should look for practical solutions that fit our market and culture. Why should we not expect the same from the audit function?

The challenge is for auditors to look inside of their own organisations and develop a value proposition. Why would I look to you as a valued partner? What makes you different and why shouldn't I use the CA down the road?

Shareholders and boards are well advised to rethink their relationships with their partners, and Auditors are no exception.