Accountancy & Management: Campaigning for internal control: The Cadbury report has been accused of paying inadequate attention to an important way of improving corporate governance. Roger Trapp reports

WHEN THE Cadbury Committee on the Financial Aspects of Corporate Governance published its final report last month, a great deal was made of its recommendation that companies should endeavour to split the roles of chairman and chief executive. Avoiding the build-up of too much power in one pair of hands could prevent much corporate wrongdoing, the thinking went.

But central as this principle and the related stress on the importance of having independent non-executive directors are to the committee's code of best practice, one group is convinced the committee has missed a trick in its attempt to improve corporate governance and hence reduce the risk of failure.

That group is the Institute of Internal Auditors-United Kingdom, and - not surprisingly - the trick is internal control. While accepting that Sir Adrian Cadbury's committee has given greater emphasis to the role of the internal audit (basically, assessing and reporting on the effectiveness of systems and controls within an organisation), the institute believes the lack of statutory backing denies it real power - a criticism, incidentally, that observers have applied to the whole report.

Harold Izzard, the institute's spokesman on corporate governance, was blunt when the report was published on 1 December. 'Until it is accepted that internal control is an integral part of corporate life which requires the active involvement of directors, management and external auditors, there can be no real improvement in corporate governance,' he said.

Several weeks on, his colleagues are still adamant that this responsibility needs to be made explicit in company law. They believe it is not good enough to put the issue in the ambit of external auditors, who - being accountants - are bound to concentrate on the financial aspects, which make up only a small part of internal control.

The internal auditors are not alone in their concern. The Chartered Institute of Management Accountants recently issued guidelines on internal control. And, with the concept increasingly covering a range of topics, such as strategic planning and marketing, monitoring of internal control can, for instance, help to assure non-executive directors that the information they are receiving can be relied on for making appropriate decisions.

But besides its value in assisting the non-executives to perform their tasks, internal audit has a vital role to play in making other recommendations of the Cadbury report effective.

For example, it can be used to assess the extent to which employees are complying with the standards of conduct laid down in the code of practice. In addition, since the internal audit department is supposed to be independent, it can act as an investigator for the audit committee (whose members are drawn from the non-executive directors).

At the same time, its contribution to the evaluation of operational controls is essential if an auditor of a large company is to be able to judge whether it is a 'going concern'.

In short, says David Brilliant, second deputy president of the Institute of Internal Auditors-United Kingdom, the external auditors place great reliance on the work of their internal counterparts.

This is partly because - particularly at a time when audit fees are under pressure - the cost of doing all the tasks themselves would be prohibitively high. But he adds it is also because the external auditors are not around the company often enough to pick up such matters as internal fraud (the most common type).

At this point, of course, the cynic suggests that the internal auditor is in no position to spot it or report it because he or she is beholden to the management and will do only what it wants.

Mr Brilliant disagrees. Where the directors are serious about running their company they will be able to handle and relay both good and bad news, he says, adding that at his bank he frequently points out issues that his board would rather not hear. He can go to the audit committee, which can summon the executive director responsible to account for it.

'The effective internal controller is not a policeman, but is vital for the company committed to corporate governance. If you say things that a company doesn't want to hear it's good for the company,' he says.

However, he is conscious that the power is not to be taken lightly - and calls for a responsibility and judgement to match that of the directors being monitored. 'You can't have that kind of authority and swing it around like a brickbat. There should be a partnership where you are essentially an internal firm that has a professional approach and is independent.'

Establishing guidelines and a code of conduct to back up this professional approach has taken up much of the energies of the institute, which was formed as part of the international institute in 1948.

Now an autonomous part of the 40,000-strong international body, it is - partly prompted by the debate surrounding the Cadbury report - seeking to raise its profile.

With half of its membership drawn from the public sector, it is particularly keen to convince private industry of its worth. As a result, it is emphasising that it can boost management performance not just by such means as checking on the reliability of management information, compliance with internal regulations and external laws and efficiency, but also by advising on the impact of new systems and activities and proposing solutions to problems.

It is a long way from the widely imagined number crunching and ledger checking, and consequently requires experience of a range of disciplines other than accounts. Understanding the business and setting the right objectives are far more important than establishing procedures, Mr Brilliant says.

At a time when a number of companies have contracted out their internal auditing to accountancy firms in the latest manifestation of the 'outsourcing' trend, it appears that the institute still has some way to go in putting across the notion that their work is central to company management.

And while the organisation's brochure predicts widening horizons for the internal auditor, Mr Brilliant acknowledges that there is 'too much of a view that managers know how to run their business and don't need people to tell them how to do it'.

But with pressure mounting for a wider, more worthwhile audit of listed companies, the internal controllers may yet have their day.

After all, if effective and truly independent they are in a much better position to provide a true picture of the health of a business (whether or not it is a 'going concern') than a set of company accounts, which - as investors must be tired of hearing - are just a snapshot of a situation in the past.

(Photograph omitted)