In 2019, Guardian Holdings Ltd (GHL) decided to build out an internal audit department.
They had previously outsourced their auditing needs.
To head it, they recruited Sasha Ali, who is GHL’s Group Head Internal Audit.
Ali, 40, began working at GHL in December 2019, four months before the pandemic hit. PricewaterhouseCoopers (PWC) remained GHL’s external auditor.
She began her career as an auditor at PWC when she was 17, straight out of school, before working at different organisations nationally and internationally.
“It’s been a journey since then,” she told the Express Business in an interview last week, as she wanted to bring more awareness to the role of internal auditors in organisations with a footprint like GHL.
The month of May has been designated Internal Audit Awareness Month by the (International) Institute of Internal Auditors.
She started her career in auditing by learning about external auditing at PWC.
“At that point, I had no clue what the difference was, right? I’m fresh out of school. I’m like, Yeah, okay. No problem. I was joining that department straight out of school and understanding what it was about. So obviously, with external auditing it is more focused on the financial statements, understanding financials, checking and making sure the balances are correct,” she said.
But that was just one part of the job.
Ali said she developed a passion for learning about different aspects of a company, which led her to focus on internal auditing.
“And I can utilise that knowledge to identify processes, improvements, which is what I’m more passionate about- helping others. So I’m helping those in the organisation in order to strengthen the control environment there. I mean, as internal auditors, we have a unique holistic view of the organisation, where we have the ability to understand the end-to-end business process, and that puts us in an advantageous position to identify potential risk, to help the business etc,” she said.
Ali, a married mother of one, studied Business at St George’s College, Barataria before she attained her ACCA (accounting) certification, and then added Certified Internal Auditor and Certified Information Systems Auditor certifications as well.
“My faith as a Muslim drives the values I hold dear in my life which is loyalty to my family, willingness to help others and diligence at the workplace,” she said.
She’s been at GHL for two years and five months.
For the better part of two years, she has worked online to build out an entire team virtually, and to oversee the company’s subsidiaries across the region.
Ali has an 11-member team, including herself- seven members in Trinidad, three members in Curacao and one in Jamaica.
She said the Jamaica office still gets support from its external auditor, EY.
She observed that while there was an existing audit plan in place, one of her first mandates was to review the audit plan.
The audit plan is done in three-year cycles, she explained.
“So I was coming in just as I was on the brink of the new cycle, right? So they said Sasha, with fresh eyes, can you look at it and tell us what would be the most appropriate audits to do in the next three years. So from 2020 to 2022, that was my first mandate, and I did that by delivering the audit plan.
“And now with each quarter that the committee meets, I will now give them an update on that plan,” she said.
But how did GHL now react to having its own internal auditor?
She described it as a bit of a culture shock.
“We’re internal with the organisation so it was a bit of a culture shock, I would suppose, for the wider organisation to get used to us now. And that’s why this Internal Audit Awareness Month is an opportunity for us to bring greater awareness to the organisation, in terms of who we are and what we do because they would not have been accustomed to that for some time,” she said.
One of the key things in building out the team was to ensure its independence within the Group structure and managing its risk structure.
“We do have a very strong risk management culture. We adopted three lines of defense in risk management. The first line is obviously the businesses themselves, where they’re responsible for understanding their processes and managing risks that can go wrong there. Then we have a very strong group risk and compliance department which is the second line. So they’re also responsible for working with the business and monitoring risks, and reporting on risks. And then we have our role as third line of defense, where we come in and we provide assurance to the audit committee. We tell the board and the audit committee, whether the second line or the first line, how they are doing in managing the risk of the organisation,” she said.
She explained that the internal audit has to be seen as independent.
“That’s very critical in our work because we have to provide independent assurance in terms of what’s happening in the business. The internal audit team reports directly to the chair of the audit committee. So my position reports directly to the chairman of the audit committee,” she said.
The chairman of the GHL’s audit committee is Maxim Rochester, who is based in Jamaica.
For her, internal auditing is very intense.
“I work seven days a week. I can’t tell you one last time I’ve gone on vacation without my laptop, as an example. It’s become sort of like a norm for me to just always check in, always be connected to emails. As I said, I do take my time, my personal time, especially when it comes to my daughter on weekends to have that time with her. But then I find myself Okay, I’ve spent eight hours with my daughter. Now I’ll just go and spend three hours now on Guardian’s work. So it’s all about that balance.”
Ali said among the challenges she encountered in her career were companies’ aversion to change.
“If someone is used to doing something a particular way for a prolonged period of time, there may be no inclination to change even if the change is for the better. One constant challenge that exists as an internal auditor is helping others in the organisation to better understand their role in risk management and accept accountability in driving change that is needed to help protect an organisation from any exposures. Combined with the fact that there may also be a difference of opinion in the severity of the risks impacting the business, both these scenarios can lead to a potential delay in acceptance of corrective actions required to close gaps identified,” she said.
“The primary reason I chose internal audit as my lifelong career path is because I have a passion for learning about different aspects of an organisation and how I can utilise that knowledge to identify process improvements and help strengthen the organisation’s control environment. As internal auditors, we have a unique holistic view of the organisation and that ability to understand the end to end business process puts us in an advantageous position to identify potential risks and work with the business to help mitigate these risks,” she said.
She is a champion for the cause she has dedicated her career to.
“I believe Internal Auditors have an opportunity during Internal Audit Awareness month to bring greater awareness and appreciation for the value that the role brings to an organization. Although we play an important part in helping the organization to understand and mitigate risks, we are often constrained by negative preconceived views on our profession. As such, we need to do more to promote our role as a trusted independent business advisor who is there to add value and help improve the wider organisation. As mentioned previously, this is also an opportunity for internal auditors to utilize lessons learnt from the pandemic to revisit our internal practices and audit approach in order to evolve with the digital age and invest wisely in technology to support the audit process,” she said.