Viva Voce

Alfred Wong on Risk Management in University

Mr. Alfred Wong

Director of Internal Audit

The Internal Audit Office (IAO) was established in 1994 at CUHK, the first of its kind among local universities. The Director of Internal Audit, Mr. Alfred Wong, had had many years of experience in accounting (a profession he has the honour of sharing with Confucius) before joining CUHK five years ago. In commensuration with the shifting conception and focus of internal audit practice, Mr. Wong has been patiently and programmatically bringing the concept of risk management to the University community.

Confucius was an accountant? Says who?

Says Mencius. The Chinese word for ‘accountant’ first appears in Mengzi which records that ‘Confucius was once keeper of stores, and he then said, “My calculations must be all right. That is all I have to care about.”’

Internal audit has often evoked the image of a tax officer poring over every invoice and document in an office. How true is it?

This traditional approach is rather adversarial and has few positive impacts on the resources, morale and performance of the organization under audit. In recent years, the profession has generally embraced the equation IA = f (RM, CG, IC) as the definition of internal audit.

Please explain.

It states that internal audit (IA) is a function of three things, namely, risk management (RM), corporate governance (CG) and internal control (IC). It’s not just adding things up and scrutinizing the small prints.

Isn’t it the aim of internal audit to quantify value into money terms?

This value-for-money approach emphasizes only the financial aspect of performance but is hard to apply to a public institution like CUHK. Our missions and heritage, for example, cannot easily be measured or quantified in terms of monetary value.

How would you liken internal audit?

Internal audit should be independent but interwoven into an organization’s structure and culture so as to check how well it is doing or responding to the changes in its environment. It functions like the lymph node in the human body which detects and prevents potential harms to its general well-being.

What role does internal audit play in higher education?

Since the publication of UGC’s report on local funded universities in 2015 (the Newby Report), transparency and risk management in tertiary institutions have become more prominent. The internal audit outfit becomes necessary and instrumental in identifying risks pertaining to the operation of a university and managing and controlling them.

How does risk management work at CUHK?

As seen in the diagram, internal audit helps the Colleges, Faculties and Departments identify their frontline risks and report to management. It also helps to convey any institutional risks perceived by management from top down. As such, it is the conduit of communication between the head and the arms, ensuring agility and adaptability of an organic whole.

What changes does that cause to the work of IAO?

Instead of looking at money-for-value-ness and accountability, IAO’s work has become more risk-based. Our aim is to promote and uphold a risk-conscious culture on campus. We find ourselves doing more and more outreaching work at committees and other units to help them see the risks and think of how to mitigate them.

How will IAO develop?

We’re a very small office but our tasks are important to the University as a whole. Our limited resources require us to be always prudent and cautious in delivering our services.

Mementos from your father and children can be seen in your office. You must be close.

Yes. Each generation has a thing or two to learn from the preceding one as well as the next, as I have personally and so gratefully found out.