FIFA Needs Internal Audit Now

Since several key FIFA officials were indicted by the U.S. Justice Department in May, hardly a day has gone by without more bad news for the beleaguered organization. Last week, Coca-Cola became the first major FIFA sponsor to call for reforms at the sport’s governing body.

In a July 9 letter, the company urged FIFA to submit to an independent, third-party commission as the most credible way for it to approach its reform process. On July 17, McDonalds joined Coca-Cola and asserted, “We believe FIFA internal controls and compliance culture are inconsistent with expectations McDonald’s has for its business partners throughout the world.” The McDonald’s statement added that FIFA, “should implement meaningful changes to restore trust and credibility with fans and sponsors alike. The world expects concrete actions and so does McDonald’s.”

These developments present yet more wake-up calls for the scandal-plagued organization that, by all appearances, has ignored a sea of red flags warning of major problems with its internal control processes. Whether FIFA responds to these high-profile demands from two of its premier sponsors remains to be seen.

Last week, representatives of the U.S. Soccer Federation had their turn in the hot seat over the FIFA corruption scandal. The CEO of the U.S. organization, which is affiliated with FIFA, was grilled at a Senate Commerce subcommittee hearing about what the U.S. organization knew or should have known about alleged bribery, corruption, and racketeering at FIFA.

Senators Richard Blumenthal (D-Conn.) and Steve Daines (R-Mont.) were particularly strong in their criticism of U.S. Soccer Federation leaders who, they said, should have raised questions about ongoing allegations of corruption.

Blumenthal summed up what many believe when he said, “U.S. Soccer had a responsibility to know. Either it knew or it should have known.”

That, for me, gets to the crux of the entire scandal. I cannot imagine that someone, somewhere in the vast global sports behemoth did not raise questions about the veracity of persistent and widespread allegations of corruption and abuse and the legal, financial, and reputational risks they presented.

What has become clear since the indictments were handed down by the U.S. Department of Justice is that the processes FIFA had in place to provide assurance on governance practices and protocols failed. Simply put, I have seen no evidence to suggest that an effective internal audit function exists — or has ever existed — at FIFA.

According to FIFA’s 2014 Governance Report, the organization’s Compliance Unit is characterized as the unit “. . . to which FIFA has entrusted its compliance function, assuming responsibility for risk assessment, the Internal Control System, internal audit tasks, and compliance management tasks.” The unit is overseen by the directors of the Finance and Administration and Legal Affairs Advisory divisions.

On paper, the Compliance Unit appears to have had the scope and authority to carry out investigations that should uncover corruption and fraud, even enjoying propertied “unrestricted right of access to and inspection of any organizational unit of FIFA,” according to the governance report.

Additionally, FIFA’s Audit and Compliance Committee has oversight of financial and compliance matters. Among other things, the committee is charged with monitoring FIFA’s financial and compliance matters and reviewing the effectiveness of risk management.

Though not optimum, the compliance unit and audit and compliance committee arrangement could have fostered a degree of oversight of compliance, controls, and risk management within FIFA. But the history of corruption allegations and recent U.S. indictments of seven top-ranking FIFA officials on corruption and racketeering charges suggest otherwise.

One of the most glaring weaknesses in FIFA’s governance and control structure for me, has been the lack of an internal audit function dedicated exclusively to an internal audit mission on behalf of the audit committee and executive management. A unit that includes “compliance management tasks” alongside “internal audit tasks” falls vastly short of a 21st century model that organizations like FIFA should be embracing. For FIFA, the road back must include a strong independent internal audit function!

While an adequately staffed and resourced internal audit function can help an organization accomplish its objectives, it cannot succeed without adherence to professional standards. Two key components apparently missing from FIFA’s internal audit structure are 1) an internal audit charter that is consistent with the Definition of Internal Auditing, the Code of Ethics, and the International Standards for the Professional Practice of Internal Auditing (Standards), and 2) the position of head of audit or chief audit executive (CAE).

FIFA’s internal audit charter should outline a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control, and governance processes within the organization. The CAE adds credibility and objectivity to nurture the function. Most importantly, FIFA needs a CAE who will be the embodiment of the courage required to battle against entrenched interests often at the heart of corruption and fraud.

Sadly, FIFA has yet to unveil any plans to review its governance practices or adopt new protections, but there may be hope. Earlier this month the regional body that oversees the sport in North and Central America and the Caribbean (CONCACAF), which includes the U.S. Soccer Federation, adopted a series of reform proposals dealing with corporate governance, fraud prevention and compliance, and transparency.

The long list of reforms includes creating a chief compliance officer, requiring a number of executive committee members to be independent from the sport, and implementing a whistleblower hotline administered by the CONCACAF audit committee.

It is encouraging to me that pressure is finally growing for FIFA to get its governance house in order. How it responds to this pressure — whether it submits to outside reform or circles the wagons as it has done in the past — will tell a great deal about the organization’s commitment to fix its problems.

I’d like to hear your views on FIFA’s internal control processes and whether you believe a clearly identified titular head of audit is a must for an effective internal audit function.