By Instituto dos Auditores Internos do Brasil (IIA Brazil) director Paulo Gomes
Auditing is the art of communicating. Few people connect the concept of an internal auditor to the image of a professional capable of showing admirable characteristics in the strategic role of transmitting information. Among the many revelations uncovered by Operation Car Wash, one of the most important ones – and barely touched on by the media – is the combination of a lack of integration with the redundancy in the actions of control and inspection mechanisms operating in Brazil.
There is an immense paradox between the massive investments made in the past two decades in controls and regulations to prevent fraud, and the flood of barbarities revealed by the largest corruption investigation ever tackled in world history. The math does not add up, but there are explanations for this. If we had to define in a simple way the complex situation of fragility that we currently experience, it would be fair to say that: we have many organisms in place that do not speak the same language, surrounded by dangerous sparks around bonfires of vanity.
There is a tangle of unfortunate bureaucratic overlaps, coupled with an absurd amount of rework, resulting in the ineffectiveness of various inspection and control systems, generating costs beyond necessary. Any large company is subject to evaluation by numerous review bodies, and for state-owned organizations, the verifications almost double. Transactions, processes, purchases and sales, almost everything, in theory, goes through area managers, internal control, risk department, compliance and the internal audit itself, which tests what was previously audited, in addition to making a comprehensive assessment of the entire company. It should interact with the forementioned bodies, including the ethics committee and the ombudsman.
Now joining the team of misconduct fighters, we have external bodies, such as: external audit, regulatory bodies and municipal, state and federal controllerships, represented by the CGU (at the federal level) and by the municipal courts (TCM), the states (TCE) and the federation (TCU). There is also the Public Prosecutor's Office, the Federal Police, the Financial Activities Control Council (COAF), among others. Most of these institutions have the sole purpose of preventing and stopping corruption.
With this entire gear at our disposal to fight irregularities, it would seem that we live in a safe scenario, but not really. In a country where the concept of mishmash is almost a cultural factor, it is not surprising to realize that there is a lack of communication and integration between all powers that be, which hinders the chance of an effective fight against irregularities. The elements defining who is responsible for a each particular action need to be clearer and more objective. It is common to hear from security experts that, if there is no intelligence exchange between civil, military and federal police, crime will continue to win the war. When fighting for corporate ethics, the analogy should not be any different.
Among so many partners involved in the analysis and investigation processes, there are gaps that are used strategically by fraudsters. Despite the technical competence of supervisory bodies, the lack of communication creates a patchwork made of flaws, portraying a control system that is broad, but unable to provide the result our society expects.
The excessive red tape is also seen as one of the culprits for the weakness in our risk control systems. While some areas get stuck, others take advantage of the vacuum left behind by incoherent actions to commit the most creative and harmful illicit acts, from rigging bidding processes to manipulating results and balances.
Rework is common occurance in our society, with strong cultural roots. The competitiveness and agility in giving positive responses in operations sometimes bring about utopias such as those that occur, for example, in the infamous proceedings in our country’s judiciary. We have to be careful and prevent control bodies from running into each other in identical assessment processes, where 'ego' disputes commonly occur in order to identify those responsible for taking action.
While internal or external control bodies audit an organization without communicating the scope of the work, important processes and procedures may be left uncontrolled. In this limbo, a gap creates the perfect opportunity for misconduct. In this wicked game, the loser – of course – is the people, that can no longer stand so much inefficiency.
After Operation Car Wash, supervisory bodies should review the way they perform, in search of a formula to avoid sacrificing productive areas with an overload of redundant requests and rework. Without a macro, cohesive communication project, incluing appropriate training, the use of technology and the integration between these control bodies, Operation Car Wash’s cleaning jet will have only removed some of the dirt from the ethical chaos that hits the country. We have to cry out for integrated audits to be effective, and not seen simply as cost drivers for companies, unable to avoid the serious fallouts of corporate fraud.
*Paulo Gomes serves as Director at Instituto dos Auditores Internos do Brasil – IIA Brasil