Helen Li FCPA, President of The Institute of Internal Auditors Hong Kong (IIA HK) and Group Chief Auditor at The Bank of East Asia Ltd. (BEA), is on a mission to change people’s perception of internal auditors. “People used to think of internal auditors as being policemen, but we should be the trusted advisors to collaborate with management to help achieve organizational goals,” she says.
She explains that with the world becoming increasingly complex and volatile, internal auditors must be much more proactive and agile to identify systemic issues with wider implications and emerging vulnerabilities. Internal audit (IA), she adds, should critically challenge the status quo and provide quality challenges, not just in hindsight, but with insight and even foresight. “As an independent function in an organization, IA is the outsider to all other internal functions. The value of IA is that fresh perspective with insider knowledge of the organization. It doesn’t mean that internal auditors are better salespersons than frontliners or more familiar with systems than IT professionals. Even the most intelligent people have blind spots. While people are busy with their responsibilities, internal auditors look at the end-to-end process to see if anything is missing or doesn’t make sense,” she says. “It is also our job to educate key stakeholders and the public at large about what IA can do and how to use IA to provide more value.”
Promoting internal audit
IIA HK is the local chapter of the global Institute of Internal Auditors (IIA), which has more than 200,000 members worldwide.
Li’s role as President of IIA HK is a busy one. As Chairman of the Board of Governors, she oversees the organization’s different committees. At the same time, she handles a lot of the administration work that keeps the organization running, as IIA HK is one of few chapters in Asia that has no staff, with daily operations primarily supported by volunteers.
Li also acts as the bridge between IIA HK and the global headquarters as well as its regional body, the Asian Confederation of Institutes of Internal Auditors (ACIIA), which has 17 affiliate members, including chapters in Mainland China, Japan, and Australia. Li has served on the ACIIA executive committee, and is currently a member of the IIA Global Nominating Committee.
“It was a great experience attending IIA regional and global meetings, speaking at conferences and forums and exchanging ideas with incredible volunteers across the globe. I remember calling for volunteers to organize IA conferences in Cambodia and Vietnam, places with no local IIA chapter. After witnessing how eager people in other parts of Asia were to learn, I started to be truly grateful for what I used to take for granted.”
Her vision as President of IIA HK is to promote the internal audit profession, as well as good governance and practices of the local IA community, she says.
IIA HK currently has over 900 members, although Li adds there are many more internal audit practitioners working in Hong Kong. “We’d like to attract people to join IIA HK by providing value to members. We are trying to serve as a platform for experience and knowledge sharing to promote better practices, as well as for networking,” she says.
Li considers the biggest challenge of her role to be achieving her vision for the organization with limited resources. She overcomes this by leveraging on the resources of the IIA’s regional and global organizations where she can. Li adds that she is most grateful to all the IIA HK governors and other volunteers, as well as strategic partners like the Hong Kong Institute of CPAs for their help to promote the IA profession, Certified Internal Auditor certification and better practices.
She is trying to recruit more volunteers as the IIA HK continues to expand its service offering locally. “When I first joined IIA HK, there were only three dedicated committees. Now we have six and this will increase to seven next year, thanks to all our wonderful volunteers.”
Helen Li FCPA acts as the bridge between The Institute of Internal Auditors Hong Kong and the global headquarters as well as the Asian Confederation of Institutes of Internal Auditors.
Learning to survive
With digital transformation reshaping businesses and every aspect of our lives, continuous learning is essential for internal auditors to stay relevant in this disruptive landscape.
Li says a key aim of IIA HK is to promote a learning and improvement culture among the IA community. “During the pandemic, we offered free webinars to support members. We also leverage on the global and Asian network to offer live-streaming and playback webinars from other IIA affiliates. It has been well received by our members.” IIA HK has also been collaborating with the Institute to promote the IA profession and better practices, such as its recent Joint Webinars – Internal Audit Series.
Li places a strong emphasis on the need for internal auditors to make the most out of new technology. “Embracing technology and big data is not optional. Harnessing technology is not just about enhancing efficiency, it is really for survival to meet increasing customer and employer expectations and remain competitive in the fast-changing environment.”
She points out that internal auditors need to understand how organizations are using technology – as well as the associated risks – so that they know how to audit relevant systems and processes.
Li supplements that the extent of using technologies varies among industries, giving the example of deploying blockchain, artificial intelligence (AI) and machine learning in the insurance claims process. She adds that internal auditors must understand these new technologies and their implementation in business operations before they can effectively audit them. Li also emphasizes that cyber threats are growing in volume and sophistication. “Cyber risk is on the board agenda for all companies,” she says. “IA should evaluate the effectiveness of a company’s cyber resilience governance, management and processes covering not only risk identification, prevention and detection, but also responses and recovery from cyber incidents. As this area is highly technical and fast evolving, using external expertise is necessary, such as static penetration tests and dynamic ethical hacking.”
At the same time, Li says internal auditors must harness technology to assist them in their own work to enhance audit efficiency and effectiveness. “Traditionally, accountants and auditors talk about sampling, but if you sample 100 transactions, it may still be a very small percentage of the total. Now, you can harness big data to provide insight from analysing the entire population instead of a tiny slice from traditional audit samples.”
To help its members get up to speed, IIA HK’s webinars and annual conference cover new technologies, such as AI and big data. Li had to make sense of these technologies herself. “I do not come from a tech background, but started to learn more about it a few years ago. At first, I had to Google a lot to follow what the speaker presented at most conferences I went to. But after some time, I started to understand it. So when people sigh that it’s too hard to learn technologies, I would say: ‘if a middle-aged working mum with kids can do it, so can you.’”
“Apart from hard controls such as processes and systems, modern IA functions place more focus on assessing soft controls such as culture and ethics, which are much harder to audit.”
Adding value
To add value to business, internal auditors must audit smartly, Li says. “Due to its unique positioning, IA has the authority to audit anything in a company, but even a sizeable IA function represents merely 1 percent of the total workforce. Therefore, it’s critical for IA to have the right focus, instead of trying to audit everything in an organization. Leading IA functions embrace technologies and change as businesses do. Senior IA executives participate in management meetings to stay on top of the latest developments and adjust the audit approach and focus in a timely way when necessary. With access to many data points in the organization, IA can and should connect the dots to present the bigger picture.”
Li adds that internal auditors need the business acumen and courage to advise what stakeholders need to know, including the ugly truth. “Apart from hard controls such as processes and systems, modern IA functions place more focus on assessing soft controls such as culture and ethics, which are much harder to audit. Internal auditors should add value to companies by focusing on what really matters to the board and C-suites, such as strategic risk management. At the very least, they can look at the strategic risk management framework to ensure a good governance process is in place.”
She adds that internal auditors can also add value by acting as a sounding board on the internal controls and risk management matters. For example, IA can play an active role in promoting good governance and risk culture, such as through sharing common lessons learned and better control practices.
Li thinks internal auditors can also play a role in helping companies with their environmental, social and governance (ESG) strategies, for example on the assurance side, in terms of assessing the control mechanisms in place on data quality for ESG reporting. “Internal auditors can also be involved on the advisory side, such as helping companies identify the steps they need to take to move into the next ESG rating agency tier,” she says.
She adds that internal auditors must stay on top of industry trends, emerging risk areas and the latest professional developments to continuously upskill themselves to stay relevant and to critically challenge the status quo in an organization, including their own thinking and way of doing things to really add value.
Li, who previously worked at KPMG, is also Group Chief Auditor at The Bank of East Asia Ltd., overseeing the bank’s internal auditors based in Hong Kong, the Mainland and overseas.
From finance to internal audit
Li never planned to have a career in auditing. While studying business at the Chinese University of Hong Kong (CUHK), she found her first accounting course very useful, as she was helping to close down her family business, which could not afford an accountant. Li later requested a transfer to major in professional accountancy. “I was rejected because my grade point average was too low, so I sat in the CUHK professional accountancy courses and took the Institute’s Joint Examination Scheme (JES), offered in partnership with the Association of Chartered Certified Accountants at the time, during the summer holidays.”
In the year Li graduated, she completed the JES, which helped her land an external audit position at KPMG two years later. “I was truly fortunate as KPMG gave me a lot of opportunities in different services including financial audit, technical accounting advisory, mergers and acquisitions etc. For example, after the Asian Financial Crisis, I spent months on financial due diligences in South Korea and Thailand. I participated in the initial public offerings and consulting projects for many large Chinese entities after my secondment in London,” she recalls. “My last position at KPMG was consulting partner offering risk governance and compliance management services, including IA co-sourcing work, as well as external quality assurance on the IA function.”
But when Li’s second child was about one year old, she decided to take a career break. “I was struggling with how to strike a work-life balance. I felt that I was not a good enough professional and not a good enough mother. I thought that a one to two year career break would help me think through the next move for a proper balance. I was so happy for the first month with no work then got so bored, feeling life wasn’t balanced,” she remembers.
When Bank of China (Hong Kong) (BOCHK) approached her months into her career break, Li started her IA practitioner career, first to implement recommendations for BOCHK’s audit function she made while she was a KPMG consultant. She stayed at BOCHK for two years, before moving to join BEA as Group Chief Auditor, overseeing around 100 internal auditors based in Hong Kong, Mainland China and overseas. Li feels particularly grateful to BEA, which gives her the freedom to transform the group audit function and is supportive of her work, including volunteering at the IIA.
Regarding the differences between internal audit and external audit, Li comments that IA’s assurance role focuses on the control mechanism covering all risks facing an organization, while external audit assesses the truth and fairness of financial statements, mostly focusing on the end results and financial risk.
“I thought I should do something to serve my profession. I thought I would be helping others but I was wrong, I was the one who benefited.”
Work-life balancing act
Li first got involved with the IIA HK as a speaker at its annual conference 10 years ago. “After I left KPMG, I had a lot more time, so I thought I should do something to serve my profession. I thought I would be helping others but I was wrong, I was the one who benefited.” Li then started chairing the committees before being invited to join the IIA HK board and the ACIIA executive committee.
“Because of the IIA work, I have met with many leading practitioners and consultants across the world. This has helped me to continue to learn and improve on both professional and personal fronts,” she says. “I have learned more about leadership from my volunteer work than from my day job, for example how to manage industry leaders you’ve barely met and motivate staff not on your payroll. It inspired me to rethink what leadership means. A lot of volunteers are very capable, passionate and selfless; they are just trying to give back to the community. Working with them is a great pleasure and some have become lifelong friends,” she adds.
She remembers doing IIA work on her iPad at weekends while her children were playing at the museum or theme park. “To be honest it’s a lot of work, but it didn’t feel like working because I really enjoyed it. I used to think in terms of a work-life balance, but now I have realized it is more about having work-life integration, which requires more discipline about having me time and family time,” she says.
When she is not working, Li enjoys sports and family time. She used to be a keen dancer, taking part in amateur Latin dancing competitions, but she had to give up due to injuries. “I was training like crazy and developed problems as a result. It was hard quitting dancing, but it also gave me more time to be with family which was lovely.”
A promising future
In terms of personality attributes for internal auditors, she says they should be curious, persevering, and have strong critical thinking and communication skills. She adds that the qualities of a good internal auditor are not much different from other professionals.
Li points out that IA can be a very promising career, as successful internal auditors often go on to become chief financial officers, chief operating officers and even chief executive officers. “Many leading organizations use the IA function as the training ground for future leaders. IA is probably the only function that gives you the breadth to see an organization holistically and the option to dive deep into any business process. It gives you a very good gateway if you want to move into another function,” she says.
The Institute has been collaborating with The Institute of Internal Auditors Hong Kong for their members to take the CIA Challenge Exam, a fast-track route to gain the Certified Internal Auditor designation. “This accelerated version of the CIA exam is an excellent opportunity to show a CPA’s achievement and expertise in the internal audit field,” says Helen Li FCPA. The exam is open for applications until 30 September. Find out more information on the Institute’s website.
