Navigating Governance & Internal Control: My Journey.

In this article, I set out not to define the statutory imperative of Boards in the mandate of Governance & Internal Controls, but to simply lay-out a firsthand participation and witnessing of one. A yuppie perspective you might say.

Preface

Governance is defined in the glossary of the International Standards for the Professional Practice of Internal Auditing (Standards) as “[t]he combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives.” Control is “any action taken by management, the board, and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved. Management plans, organizes, and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved.”

Through my third year as a professional in Oman's global integrated energy company OQ, I stepped into a completely unchartered area, by me at least.

"Governance & Internal Control" marked an eye-opening slingshot into the molding of the way the organization is positioning itself to do business, the C-suit, authority, and the "tone at the top."

In summary, the role encompassed the comprehensive design, implementation, and oversight of a robust governance, assurance, and control framework within the organization. Key activities ranged from maintaining the delegation of authority, overseeing management committees, conducting control effectiveness assessments, communicating identified issues and risks (In the form of reported Control Failures) to executive management, tracking remediation efforts, and collaborating with multiple stakeholders and advisors to ensure compliance with shareholders' and industry standards.

Why do we need Governance? Internal Controls?

30,000 Ft View

At a macro level, economies abundant with energy reserves, like ours, have had a history of managerialism-dominated governance of energy companies, whereby senior management has for the most part, in practice and theory, little to no pre-defined frameworks of governance between them and the shareholders. All the while, nations, and shareholders grapple with the long-standing risk of balancing reliance on fluctuating oil revenues with economic diversification efforts, which heightens stakes & public anticipation. Contributing to intensifying the need for energy companies to perform, address that risk & streamline their objectives with their overall shareholder & outer customers' objectives. This brings us down to the most recent efforts I was both a participant in & a spectator to, judiciously and equitably, manage at a slight micro level, the insertion of good governance and internal control frameworks.

"the predictive power of any model of the corporation must be measured by the model's ability to predict the separation of ownership and control, the formal institutional governance structures following from their separation, and the legal rules responsive to their separation. Shareholders, who are said to "own" the firm, have virtually no power to control either its day-to-day operation or its long-term policies. Instead, the firm is controlled by its board of directors and subordinate managers, whose equity stake is often small" Stephen M. Bainbridge The New Corporate Governance in Theory & Practice

In Oman, we have witnessed a wave of institutional reform in the public sector & its state owned enterprise (SOEs) in many areas , one of which has gained special attention

"In order to furnish means of support towards the achievement of our future goals, we are determined to undertake necessary measures to restructure the state’s administrative apparatus, modernizing the schema of laws and legislations, work programs and mechanisms, enhancing the values of work, its principles, and espousing and streamlining procedures and performance governance, integrity, accountability to guarantee complete harmony with the requirements and goals of our vision." The speech of His Majesty Sultan Haitham bin Tarik, 23rd February 2020

Subsequently, Oman Investment Authority took steps in this path and formalized the directives of Governance into a Code of Governance which outlines the principles to be observed by its entities, down to the Governance and Internal Control mandates. This came as a paradigm shift in defining embedded powers of the corporation by which Boards are expected to effectively monitor and control compliance across the Entity & ensure the adequacy of internal control systems.

"Efforts towards the governance of state-owned companies came to fruition, as evidenced by the approval of the ‘Code of Governance for OIA Entities.’ This code was designed to streamline the companies’ policies and align them with Oman Vision 2040 as well as the OIA’s overall direction and policies. Further, the Code plays a significant role in enhancing the efficiency and productivity of these companies" HE Sultan bin Salim Al Habsi, Minister of Finance & Chairman of the Board of Oman Investment Authority, OIA's Annual Report 2020-2021

OIA Annual Report 2020-2021

It was here that I saw firsthand, you could argue as a result of these key changes, a far-from-quiescent Board & Board Audit Risk Committee (BARC) in the Governance & Control arena. Corridor & executive conversations referencing post-Enron Governance mandates, Sarbanes-Oxley were had, singling a new way of thinking, or approaching the molding of how we conduct business.

What did this feel like?

Maneuvering an intricate web of organizational objectives among multiple classes of stakeholders.

Most of the corporate body including its staff would conduct their business with little to no Board interactions. This applied to me until I joined my new role. It felt like a new circle & team all together. Whereby your responsibility is to act upon "ongoing BARC advice & supervision", actions and to "monitor & test" internal controls. This often meant

• Strict deadlines to meet Board Audit Risk Committee (BARC) cycle pre-reads
• Long hours
• Managing relationships: This is key. In the grander scheme of things you have to think you're creating value & convince others of the same, despite the intangible nature of Governance & Internal Controls. You act as a bridge between teams , you pull & push, sometimes seniors to you. You are content with losing battles often, in the pursuit of incremental wins. I found myself diving into conflicts a lot more, which raised my skepticism at first and alertness, only to realize that conflict resolution was a key aspect of this area. Not an optimal way of learning conflict resolution but definitely a huge learning opportunity.
• Crunching & analyzing multiple datasets, sometimes new to you.
• Preparing Board Audit Risk Committee reports: The key challenge here was presenting the relevant, operational, and strategic information clearly and?concisely while giving an accurate picture of events and prompting discussion of the options, which proved to be a hill I had to climb fast. I honed the skills of preparing management presentations & communication before, but never at this level. Some nights the objective was to produce a conveyor belt of reports only to be filtered, adjusted, rejected, or for the direction to change altogether. Pooling resources, expert friends & technological solutions like PowerBi helped a lot in here.
• Rapidly acquire expertise across diverse subjects: You have to become a mini expert in topics of interest, whether to BARC or to executive management, to effectively evaluate control performance and monitor objectives with a critical eye. For instance, I had to deep dive into extremely technical topics such as system access controls, the financial period closing process in detail & to look at retrospective analysis of the finance & procurement processes metrics. On the other hand, some fields signified a lower knowledge barrier but required ingenuity in engagement, due diligence & stakeholder management. Not to get a bit highfalutin, but I had to be comfortable with breaking down complex ideas into simpler, more accessible parts while steering efforts in a specified direction. Something I've never been this involved in before.

Concluding Remarks

My journey in Governance & Internal Controls at OQ has been and continues to be a profound exploration into reshaping organizational strategies and fostering effective controls. It's been about more than just enforcing rules; it's been a quest to bridge understanding, manage conflicts, and rapidly become an expert across diverse subjects. From navigating reforms to managing relationships and data, each experience has been an invaluable lesson in adaptability and resilience. It's been a relentless pursuit of clarity, collaboration, and incremental wins in shaping a robust governance framework that aligns with organizational objectives. It's not just about managing controls; it's about reaching a point where governance harmonizes with organizational objectives.

As I conclude this narrative, I carry with me a trove of experiences—a testament to the ever-evolving nature of governance & to the team I have supporting me, to which goes my appreciation & thanks.

If you're interested in this topic and would like to discuss it further with me kindly write me at [email protected]