Lessons From Toshiba: When Corporate Scandals

Implicate Internal Audit

Richard Chambers July 27, 2015

Last week's high-profile resignations of CEO Hisao Tanaka and eight other Toshiba
Corp. executives amid revelations of systemic and prolonged financial misstatements
raise questions anew about Japan's corporate governance culture.

The venerable conglomerate, which makes everything from consumer electronics to

nuclear energy technology, was under fire over accounting irregularities and had
established an Independent Investigation Committee. That committee's report
concluded that Toshiba overstated profits by 151.8 billion yen (US$1.2 billion) from
2008 to 2014.

The report's findings and subsequent resignations could set back efforts to reform the
Japanese corporate governance culture. Toshiba had been viewed as a pioneer in
Japan in adopting an "audit committee" structure more commonly found in Western
corporate governance.

But details of the findings make clear that the problem was not limited to the
company's culture, actions by management, or inaction by the company's audit
committee concept. Instead, the report included what I often dread the most, pointed
criticism of Toshiba's internal audit function. After reviewing translated summaries of
the investigative committee's report, I believe the overarching problem with Toshiba's
audit function was that it tried to run before it could walk. In some ways, Toshiba's
internal audit function was too modern for its own good.

Details from the report help explain my conclusion.

Like many contemporary internal audit functions for large global companies,
Toshiba's internal audit function adopted a rotational staffing model, and internal
auditors were recruited with the explicit understanding that they would rotate through
the department in route to other opportunities within the company. While many
organizations use the rotational model as a pipeline for talent, there are pitfalls when
the model is not well thought out based on the organization's specific needs. In a
previous blog, I describe how organizational size, reputation, complexity, quality, and
executive support all contribute to the success or failure of the rotational model.

In Toshiba's case, it appears that an excessive reliance on the rotational staffing model
left the internal audit department vulnerable in terms of resources and competency in
accounting and in the company's ability to conduct effective audits, according to the
report.

Additionally, the report found Toshiba's governance structure relied too heavily on
internal audit as a consulting service rather than as an assurance provider. The audit
department focused primarily on providing consulting services to various Toshiba's
companies as part of operational audits, without assessing the appropriateness of
accounting processes. While an effective internal audit function often provides advice
and consultancy services for key stakeholders, internal audit will often struggle to
address a company's critical risks if little or no assurance is provided to management
and the board on the overall effectiveness of mitigating controls.

Despite a limited focus on assurance, audits by the department twice identified

instances of irregularities that could have highlighted the company's accounting
problems much earlier. However, they were dismissed as not significant enough to
report.

This brings me to an important point about the dangers of not identifying the root
cause of problems. In a previous blog, I described how internal audit must focus on
the roots, not just the trees. Had Toshiba auditors taken the additional steps to try to
understand the accounting anomalies, they likely would have uncovered the bigger
problem much sooner. But they may not have had the skill or sophistication to
connect the dots.

Sometimes, knowing enough to ask the right questions is the difference between a
routine audit and one that uncovers significant deficiencies. I explored this issue in
another blog that warned that the biggest risk to an organization is the one that
internal audit misses. This certainly proved true in Toshiba's case.

Another potential contributor to the irregularities being dismissed prematurely they

were never included in final audit reports is the reporting-line structure Toshiba
created for its internal audit function.

While Toshiba created an audit committee and appointed independent board

members to it, the internal audit department never enjoyed a direct reporting line to
the audit committee. Instead, the department reported to the company's president -
with no routine access to the company's board of directors. Questioning or challenging
actions of corporate executives is difficult in any culture, but it is virtually impossible
in traditional Japanese corporate cultures..

Indeed, this aversion to questioning authority was identified as a primary culprit to

the overall problem. Corporate culture in Japan is hierarchical, with an emphasis on
loyalty and doing all that is possible to avoid bringing shame to its own group. When
Toshiba's top executives set unrealistic performance (profit) goals, division presidents,
line managers, and employees below them carried out inappropriate accounting
practices to meet targets in line with the wishes of their superiors. It must be
acknowledged that we have witnessed the same outcome in high-profile American
corporate accounting scandals.

Instead of questioning the wisdom of these earnings goals, ". . . (Toshiba's) employees
felt cornered into resorting to inappropriate measures," according to the report. One
has to wonder whether this contributed to the internal audit department accepting the
decisions to ignore early findings of accounting irregularities.

A deeper analysis of the 300-page report reveals additional problems with Toshiba's
governance structure that contributed to or complicated its shortcomings. In the end,
the report makes a number of recommendations, including scrapping the existing
internal audit function and creating a new internal audit department with adequate
resources and skills mix that reports to an independent director outside the company.

If such a restructured internal audit function is given the appropriate resources and
independence to carry out its work, Toshiba will be the better for it and possibly serve
as that shining example that other Japanese corporations should emulate. In the
meantime, there are lessons in the Toshiba scandal for all of us who seek to modernize
internal audit functions.
Comment on or "Subscribe" to this blog post.

The opinions expressed by Internal Auditors bloggers may differ from policies and official statements of The Institute of Internal Auditors and its
committees and from opinions endorsed by the bloggers' employers or the editors of Internal Auditor. The magazine is pleased to provide you an
opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.

Richard Chambers
Richard F. Chambers, CIA, QIAL, CGAP, CCSA, CRMA, is
president and CEO of The IIA. In Chambers on the Profession,
he shares his personal reflections and insights based on his 40
years of experience in the internal audit profession.

Copyright 2017 The Institute of Internal Auditors. All rights reserved. | Privacy Policy