Donald M. Sartori

Auditing is never the same in any two locales; but doing business in Hawaii offers some unusual challenges. Here's how three internal audit shops stay in sync with management and make solid contributions to the growth and expansion of their Hawaii-based companies.

When companies in Hawaii look for growth and new markets, it's a little more complicated than just taking their business into the next state or province. Often, the only viable option is to look across the Pacific for new business ventures, and internal auditors in Hawaii are devising approaches that support and enhance those efforts.

Three dynamic Hawaii companies are among those that boast successful transnational audit shops: Pacific Century Financial Corporation, formerly known as Bankcorp Hawaii Inc., the islands' largest financial institution; Hawaiian Electric Industries, Inc. (HEI), the islands' largest utility holding company; and The Broken Hill Proprietary Company, Ltd. (BHP), an Australian company with an island presence. The key to success in each is the strong link forged between the overall business strategy and that of the internal audit department.

PACIFIC CENTURY FINANCIAL CORPORATION

Pacific Century is the parent company of the Bank of Hawaii, which has been in operation for more than 100 years. In 1997, Pacific Century reported income exceeding $139 million and assets near $15 billion. Its strategic advantage lies in its unique franchise, which consists of four markets spanning nearly 12,000 miles from Singapore to New York. While its primary market is Hawaii, the company's position in the Asia and Pacific regions and on the U.S. mainland provides additional markets, an alternative source for loan and deposit growth, and an important link to businesses with interest in these regions.

BUSINESS STRATEGIES

In late 1993, Pacific Century Chairman and CEO Larry Johnson announced that the Asian and Pacific markets held the best opportunities for growth and that the bank would be inclined to make more acquisitions outside Hawaii than within. At the time, Bank of Hawaii operated 12 branches in the Pacific Islands, including a joint venture in Vanuatu.

Over the last several years, the company has expanded its presence in the South Pacific by acquiring banks in Papua New Guinea, New Caledonia, and Tahiti and by establishing branches in Fiji. It also reported a substantial increase in volume in its Philippine, Taiwan, and Korean offices and concluded an alliance with the Bank of Queensland in Australia. In 1997, it acquired the Bank of California and further expanded its Arizona subsidiary.

The company's Asian and Pacific business focuses on import and export trade financing and correspondent banking services. On the U.S. mainland, the strategy emphasizes lending to Fortune 1000 companies, especially those with interest in the Asia-Pacific region.

Pacific Century is repositioning itself for the next century by targeting several areas that offer exceptional growth potential. These include providing asset management and other services for private clients, expanding convenience in retail banking and residential lending, and building strategic alliances. One of Pacific Century's strategic alliances involves providing credit and debit card processing services to more than 6,000 merchant customers in Hawaii, Guam, Saipan, and other Pacific Islands. As a third-party processor, the company achieves critical economies of skill and scale and can bring new products and services to ever expanding markets.

AUDIT STRATEGIES

At Pacific Century, the Director of Audit and Credit Review reports directly to the Chairman of the audit committee as well as to the Chief Operating Officer. The audit department is centralized in Honolulu, and company auditors routinely visit overseas sites. Audit planning is based on a risk assessment process that takes into consideration the unique requirements of foreign locations.

The internal audit department has taken a number of initiatives to improve audit coverage and service to a management team focused on expansion throughout the Pacific region. The installation of an ACL-based CAAT program has enhanced data gathering and analysis capabilities. In addition, auditors partner with operating management to assess the reliance of the internal control process, and they provide business advice to operating managers in the business units being audited. Regulatory internal control examination and reporting is now the responsibility of company cross-functional teams.

The efficient use of continuing education is especially important in developing new skills, as auditors learn new business and audit technologies. With expansion into the South and Western Pacific, foreign language capabilities are increasingly important, and the company continually seeks French linguistic skills in all new audit staff hires. In addition, auditing business units where British and French influences prevail requires an understanding of British and French business practices. In these countries, for example, management and communication styles are much more formal, and management is more layered than in Hawaii businesses.

Outsourcing figures prominently in Pacific Century's audit strategy and will become a more likely option as the company continues to broaden its products and services. Tasks are outsourced when the internal staff is unavailable or does not have the technical skills required to conduct a specific audit. Some overseas locations are visited by external auditors who perform audit services beyond those required for financial statement examination purposes. In some audits, company auditors team up with auditors from the outsourcing provider to gain needed technical, local business, and other audit skills. Using outsourcing, technology, and education to competitive advantage helps Pacific Century's audit team keep all the bases covered.

HAWAIIAN ELECTRIC INDUSTRIES, INC.

Hawaiian Electric Industries, Inc. (HEI), is a diversified holding company providing electric and banking services to the people of Hawaii. In 1997, HEI reported revenues of more than $1.4 billion and assets in excess of $7.9 billion. HEI earned the 1995 Edison Award, a major national honor, for its promotion of energy-efficient heat pump technology. A new subsidiary, HEI Power Corporation, was formed in 1995 to pursue independent power and energy services projects in Asia and the Pacific.

HEI pursues three major strategies to stay competitive in its utility and banking businesses: improve customer satisfaction; contain costs; and find new revenue sources, such as contract operation of utility plants. In 1997, HEI won the contract to operate the 50-megawatt Tanguisson plant on Guam and is now working on closing contracts to operate utility plants in China, the Philippines, and other Pacific islands.

The central theme that HEI stresses in all of its business strategies is "adding value." HEI bases this strategy on the premise that change seems to be the only constant that can be depended upon in this age of global competition; and the companies that add value are the ones that will survive the changes taking place around and within them.

Internal auditing within HEI consists of three loosely connected audit organizations. A corporate internal audit department provides audit support for HEI and its smaller subsidiaries, such as HEI Power Corporation, that do not have an internal audit function. HEI's two largest subsidiaries, the Hawaiian Electric Company (HECO) and the American Savings Bank (ASB), maintain their own audit departments, although the corporate audit department provides resource support as needed. Each audit department reports directly to its respective company CEO and audit committee. In addition, the HECO and ASB internal auditors have a "dotted line" reporting relationship to the HEI auditor and the HEI audit committee.

In keeping with the organizations overall emphasis on adding value, HEI auditors have embraced technology as a key strategy for providing services that go beyond traditional auditing activities. In 1990, the use of audit technology was nonexistent in any company within HEI. Audits were paper-based, and auditors spent much of their time looking for documents. Senior management began asking internal auditors to conduct "more meaningful" audits of greater depth, and the HEI audit department turned to technology to add audit value without adding costs.

As a result, the HEI Computer Assisted Auditing Tool or HEI CAAT, was developed. HEI CAAT is a collection of different pieces of computer equipment and software that all work together on a network. The heart of the system is a Sybase relational database management system. Data is transferred from the corporate mainframe to a database server that can be accessed easily from any auditor's desktop PC. The auditor can list, sort, select, and perform additional analyses of the data. The information is then saved in spreadsheet format or textual form to be incorporated into audit reports or presented graphically.

HEI CAAT has proved successful as a value-adding audit tool. Auditors routinely use the system in audits of its 69 savings bank branches and throughout its different accounting systems. The program gives auditors more time to assess controls instead of looking for data. For example, in conducting branch audits, auditors are able to download all of the pertinent branch information onto a laptop computer for use in the field.

The system also provides different views of management information, and senior management routinely requests HEI CAAT reports from the internal audit department. Report requests typically include identification of individual customers and the total value of all accounts held by a customer or customer group. HEI CAAT reporting is also regularly used in fraud investigations.

In 1994, HEI began considering a high speed connection to the Internet. Due to its experience with implementing HEI CAAT, internal auditing had acquired extensive knowledge about the UNIX operating system and the foundations of the Internet, the TCP/IP networking protocol. The internal audit department leveraged this experience by helping design and implement HEI's Internet connection and security firewall.

Today, a separate workstation is used to monitor and test network security. Test results are regularly reported to senior management and the audit committee. Test reports indicate the overall effectiveness of the company's network security, weaknesses, and recommended corrective actions. On a quarterly basis, internal audit provides senior management with Web access statistics profiling internal Web usage and external originations.

HEI auditors continue to leverage their technological experience as they participate in the design and implementation of new networked systems, including systems for a utility plant in Guam. Overseas, there is heavy reliance on Internet communications since the telecommunications infrastructures in many of the countries into which HEI is expanding are limited. Internal auditing is an important part of the HEI team that is designing and implementing these new Internet systems. Using technology to ensure data security and cost effectiveness are two additional strategies that are enabling the audit team and HEI to add value to their customers.

THE BROKEN HILL PROPRIETARY COMPANY. LTD.

The Broken Hill Proprietary Company, Ltd. (BHP) is the largest public company in Australia. Incorporated in 1885, it is an energy and industrial company with interests in oil, minerals, and steel making. In 1990, it purchased Pacific Resources, Inc., then a Fortune 500 Hawaii energy company. At the time, the purchase gave BHP oil refining and marketing capabilities it didn't have and gave Pacific Resources a stable source of crude oil produced by BHP in Australia.

In March 1998, BHP announced the sale of its Hawaii operations to Tesoro Petroleum Corporation, headquartered in San Antonio, Texas. While this acquisition has resulted in structural changes for the Hawaii company, a look at the audit structure in place before the divestiture offers a useful benchmark for auditing across the Pacific.

As a leading global resources company with a history of growth, BHP has an inventory of high quality assets and is a significant player in the world's mining, steel, and energy industries. Its primary commitment is to achieve superior financial performance and thereby create shareholder value. With more than 285,000 shareholders, the company reported 1997 revenues in excess of $22.3 billion and assets of more than $36.7 billion Australian dollars.

BHP has a network of operations in more than 50 countries. In further recognition of the importance of its global business, BHP has appointed an International General Manager to develop international business and oversee regional and national offices around the world.

With worldwide operations and a commitment to achieving superior financial performance and creating shareholder value, the primary audit focus at BHP is on corporate governance. Partnering, cross-functional teams, self-assessments, and audit technology are all important audit strategies at BHP.

BHP Group Audit is headquartered in Melbourne, Australia, with decentralized offices located in Australia, the u.s., and the U.K. A resource allocation model based on business size, complexity, and other factors is used to plan staffing. The frequency and extent of individual audits is planned by each audit office and undergoes a higher review by the Group General Manager, Auditing and the Executive General Manager, Finance, who basically serves as the CFO. Audit plans are reviewed in detail with external auditors and in summary with the audit committee.

Before its divestiture, the Honolulu office was responsible for internal audit coverage in Hawaii and related petroleum operations in Samoa and Singapore. Honolulu auditors also partnered with auditors from the nine BHP audit offices on audits in the U.S., Chile, Australia, and Southeast Asia. In recent years, Hawaii auditors worked with their Australian colleagues to review purchasing systems and oil production services for joint ventures in Darwin, Australia, and Ho Chi Minh City, Vietnam, and to audit the costs of oil exploration joint ventures in Indonesia and the Congo. Honolulu auditors also joined Melbourne and San Francisco auditors in reviewing BHP steel product manufacturing and marketing operations in Singapore, Bangkok, Hong Kong, Washington, and California.

High control areas such as foreign exchange and commodities derivatives trading receive internal audit priority at BHP. Thus, the Hawaii auditors reviewed policies and procedures for using petroleum futures to manage price risk on refinery purchases and sales of crude oil production and oil products in Singapore, Melbourne, and Honolulu. The Honolulu audit manager also reviewed hedging of gold production from BHP mines in New Guinea and Chile.

In addition to partnering with their colleagues at other BHP sites, Honolulu auditors participated as members of cross-functional teams. Environmental management reviews, for instance, were conducted as part of business group team reviews. BHP is one of Australia's largest employers of environmental scientists, and environmental audits are carried out at operational sites and environmental management systems within all business groups. BHP internal auditors participate in these review teams, which examine the sufficiency of environmental management systems throughout the company.

Audit technology is centrally developed by BHP Group Audit. Automated workpapers, CAATs, and e-mail are important tools. Worldwide communications and data transmission places increased emphasis on network security reviews. Auditors in Honolulu reviewed networks at BHP's integrated steel center in Newcastle, Australia, coal mine sites in New Mexico, and the San Francisco office. BHP has implemented a control self-assessment questionnaire for smaller business centers and is exploring other opportunities to expand use of control self-assessment tools. While a BHP audit shop will no longer operate in Hawaii, BHP's presence in the islands has given the Hawaii auditors a multinational audit perspective.

ADVANTAGEOUS ALIGNMENT

Business strategies aimed at growth often mean assuming greater business and control risks. By aligning their audit efforts with the vision of the organization, internal auditors are helping their organizations stay on course toward profitability and the achievement of their missions.

As Pacific Century, HEI, and BHP have expanded their operations beyond Hawaii's borders, their respective internal audit departments have effectively addressed new organizational needs. The strategies devised by their internal audit shops offer lessons and insights for others faced with the challenge of auditing in organizations that are experiencing rapid growth and expansion.

DONALD M. SARTORI, CPA, is an Associate Professor of Business Administration at the University of Hawaii - West Oahu in Pearl City, Hawaii.

COPYRIGHT 1998 Institute of Internal Auditors, Inc.

COPYRIGHT 2004 Gale Group