Tough love: the importance of the internal audit function for central banks

First of all I want to apologise for not being able to welcome you on the first day of the event. I hope you have had good discussions so far and have been able to see something of the city of Amsterdam.

For those of you who don’t know me, I am Olaf Sleijpen, Executive Board member at De Nederlandsche Bank. In that capacity, I am also a member of the Committee on the Global Financial System (CGFS) and the Committee on Payments and Market Infrastructures (CPMI). So I know the BIS well.

As a board member, I rely on your work as internal auditors to govern the central bank. You and your colleagues in the internal audit department provide me with information on the functioning of risk management, internal control, and governance processes. You are the eyes and ears within the organisation. And you serve as a mirror for the board and management by evaluating the organisation in an unbiased and impartial manner.

Internal audit in central banks is vital. Our organisations perform a very special public task. Keeping the financial system safe and sound. People trust us. If we breach that trust, it not only damages our organisation, it affects the entire financial system. What’s more, as a supervisory authority we impose all kinds of standards on the financial sector, including governance and internal controls. If we do not live up to the standards we impose on others, we lose all authority. This means that we have to set the bar very high on governance and internal controls in our own organisations.

So your role is difficult but essential. What is necessary to effectively perform that role? I want to mention five points here.

First of all, it goes without saying that the internal audit department follows the rules of the profession as laid down in the Global Internal Audit Standards, and those of their own internal organisation. That’s the basis.

Second, internal auditors need to have thorough understanding of the organization and a good network within it. That sounds logical, but such a network does not arise all by itself and it must also be maintained. Because, let’s face it: most people in the organisation don’t see you as their best friend. You ask them all kinds of difficult questions, and as a reward for their efforts, you tell them that they are doing it all wrong. And you also tell their bosses. So your colleagues may see you as a necessary evil, at best. That means it requires skills to develop and maintain good contacts. Of course, they have to cooperate. But if you can make your colleagues understand that your job is to help them improve their work, then they will probably be more open to feedback and more inclined to give you the information you need.

Building good relationships is all the more difficult given the added challenge of the hybrid working culture that has developed since the pandemic. Where full-time presence in the office used to be the norm, it is now sometimes difficult to get employees to come to the office at all. I don't know if and how this dilemma is playing out in your organisations, but here in the Netherlands, it is a topical theme. We now even organise Friday afternoon drinks every two weeks, with my fellow board members and me standing behind the bar, just to persuade people to come to office.

Third, it is important to have not only an internal network but also a good network outside the bank. So go and take a look at companies in the private sector as well as other government agencies. This will give you the opportunity to learn from best practices of other internal audit functions. Since central banks are somewhat special animals, it is also good to learn from each other. This meeting is, in my opinion, a good opportunity for that.

Fourth, strong communication skills are key. Present your observations concretely, clearly, and sharply where necessary. And avoid making the message too cautious, which could make it difficult to understand. That requires not only skill but also will. Speaking truth to power is not always easy, but if you don’t, you deny your organisation an opportunity to learn and improve.

My fifth and final point is to provide insight into the interrelationships between risks, or in other words: connect the dots. By viewing findings from separate audits in conjunction and reporting on them in a quarterly report, for instance, you can bring new insights to directors. Board members may otherwise only receive relevant information in a fragmented way. Moreover, the information that reaches us is often filtered. But you have a unique perspective on the entire organisational landscape. So do not hesitate to mention insights into causes and behavioural and cultural aspects when formulating your findings. After all, if you want to ensure that an organisation successfully implements a strategy, behaviour and culture are key. In general, the causes of problems that occur in the organisation can often be traced back to these underlying aspects.

So these are my five points. Five key elements of good internal auditing, if you will. It is all easier said than done, of course. We ourselves at DNB are learning continuously. There are several change projects underway to improve our internal organisation. DNB is organised into four key domains (Monetary, Supervision, Resolution, and Internal Operations) comprising the various task areas. While each domain is well-organised in itself, cooperation between and across these domains needs improvement. To achieve the desired bank-wide changes such as in the areas of operational risk management and business continuity, all parts of the organisation need to work together. As board members, we assume that if we have explained our aims, they will work in practice. However, practice can be stubborn. It is precisely at this point that the IAD, in its independent role, steps in to test, assess and provide insight into what is happening within the organisation.

Let me conclude by saying a few words about why we are here. By sharing information and exchanging views, we learn from each other. This is one of the many reasons why international cooperation is important. However, multilateralism is under pressure on all fronts. This is dangerous because it impedes our ability to address common challenges effectively. Therefore, it is essential that we as central banks continue to set a good example and cooperate effectively, for example in the BIS. Multilateralism is a form of enlightened self-interest. It’s not always the easiest way, but in the long term it is the best way.