Business ethics from top to bottom

Predictable and plentiful though they may be, the soul searchings and analyses of internal controls that have followed the Barings debacle are unlikely to prevent a repetition. So says David Brilliant, and since he is head of internal audit at another international bank, the Chemical Bank, as well as being president of the Institute of Internal Auditors UK, he is in a better position than most to know.

The problem, he says, is not that the Singapore trading disaster is not a lesson for all organisations with far-flung and complex operations. Rather, it is that there is a danger people will say: "It can't happen to us because of a, b, and c. Next time it could be a, b and y - that thing you haven't thought about."

The answer, he believes, is to go back to basics. Making no apologies for the well-worn phrase, he adds that this means sound internal control will be an organisation's best asset. This is because if the people working in that area know their job, they will look at all the risks facing the business. That involves understanding it from the top down. This, in turn, requires translating that information into what risks there are - which then means assessing what controls are needed to meet those risks.

A fundamental part of understanding the business you are in involves knowing how the company makes money. People are generally less quick to ask why they are making money than to worry about where they are losing money, Mr Brilliant points out. "It's a different mindset - to challenge the good as well as the bad."

But surely management will not stand for such impertinent questioning? Mr Brilliant accepts that this may be the case, but he adds that a company which is serious about internal control will hire someone who is competent for the job rather than just a position-filler. "They'll be prepared to listen and to be challenged," he argues.

On the other hand, the good internal auditor has got to be prepared to be challenged and able to articulate the real risks in language that a business person can understand - "not jargon, not stock phrases".

"You need people with competence and confidence. We don't generally get our own way without some reasonable arguments. It's like any other management role," Mr Brilliant adds. Part of the problem, he admits, is the name. But he insists that "control" does not mean bureaucracy. "It's a living thing."

Like many other management initiatives, this depends on a team approach. But it is important that senior executives make it clear that they regard it as important - otherwise middle managers can be obstructive.

At Chemical Bank this is done by the chairman issuing periodic reminders that a control culture is important to the bank, the chairman and the board. The bank was also one of the first organisations to introduce a code of ethics. Examining how it fitted with that of Manufacturers Hanover was one of the first areas to be investigated following the merger of the two organisations.

"A good control culture is important," says Mr Brilliant. "But if people lack an ethical culture, you tend to have a control environment that's arid, lacking colour and enthusiasm. If people are enthusiastic about doing things properly - which good ethics tends to create - then you're going to have a great combination of a good control environment and people interest. If you look at control as needed in business it's not about control alone. It's about doing things right."

If this idea of "doing things right" is given a broad definition, it becomes clear, for instance, that banks' back offices have a special relationship with those working in the front line. They have to establish a balance between supporting the traders and protecting the bank. Some might put this at 50:50, but Mr Brilliant would prefer 49:51 in favour of protection.

In the absence of a report on the Barings affair, it is not known what happened there. But Mr Brilliant hopes that the back office supported Nick Leeson while at the same time telling top management that things were not as they should be.

As for taking responsibility, should things go wrong in this sort of way, he accepts that it is a tricky area. In the wake of the report of the Cadbury Committee on corporate governance, there have been attempts to formalise statements made by management and advisers about companies' trading positions. The problem with this is that it opens up such people to litigation of the type that has bedevilled external auditors.

Mr Brilliant maintains that he fully expects to be held accountable. "If I hold a view, it should be based on sound audit work and good professional judgement." But he does not see why an unexpected event should make him a victim of "disaster retribution". He adds: "We should make it clear to the public that we can't predict beyond a reasonable period."

On the other hand, the Barings disaster and others like it focus attention on what goes on inside organisations. "People have to recognise that they are there to do a job and they should be accountable for it. They are paid as professional managers and that means understanding the business.

"If you hire accountants to make sure the accounts are proper, why not hire an expert controller to make sure the business is being run properly?"