Corporate Governance – Boards, Audit and Risk Reporting - Nabarro
Corporate Governance – Boards, Audit and Risk Reporting - Nabarro
Corporate Governance – Boards, Audit and Risk Reporting - Nabarro
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
International Financial Regulation ReviewISSN 2047-4733Source: International Financial Regulation Review: News Archive > 2012 > Latest Developments >Analysis > <strong>Corporate</strong> <strong>Governance</strong>: <strong>Corporate</strong> <strong>Governance</strong> <strong>–</strong> <strong>Boards</strong>, <strong>Audit</strong> <strong>and</strong> <strong>Risk</strong> <strong>Reporting</strong><strong>Corporate</strong> <strong>Governance</strong><strong>Corporate</strong> <strong>Governance</strong> <strong>–</strong> <strong>Boards</strong>, <strong>Audit</strong> <strong>and</strong> <strong>Risk</strong> <strong>Reporting</strong>By Alasdair Steele, Partner, <strong>Nabarro</strong> LLP, LondonIn September 2011, the Financial <strong>Reporting</strong> Council (FRC) published reports on “<strong>Boards</strong> <strong>and</strong> <strong>Risk</strong>” 1 <strong>and</strong>“Effective Company Stewardship” 2 . Both of these reports highlighted the finding of research carried outby the FRC <strong>and</strong> give an indication of some of the FRC's agenda for 2012.——————————————————————————————1 Financial <strong>Reporting</strong> Council, <strong>Boards</strong> <strong>and</strong> <strong>Risk</strong>: A summary of discussion with companies, investors <strong>and</strong>advisers (September 2011)http://www.frc.org.uk/images/uploaded/documents/<strong>Boards</strong>%20<strong>and</strong>%20<strong>Risk</strong>%20final.pdf2 Financial <strong>Reporting</strong> Council, Effective Company Stewardship: Next Steps (September 2011)http://www.frc.org.uk/images/uploaded/documents/ECS%20Feedback%20Paper%20Final.pdf——————————————————————————————Report on <strong>Boards</strong> <strong>and</strong> <strong>Risk</strong>This report focused on the way in which company boards assess, manage <strong>and</strong> report on the risksaffecting their businesses. The main conclusions reached by the FRC were:• the focus on risk by boards has increased greatly;• a limited review of the Turnbull Guidance 3 (Internal Control: Revised Guidance for Directors) isrequired to reflect the role of a board as set out in the UK <strong>Corporate</strong> <strong>Governance</strong> Code 4 ; <strong>and</strong>• there is a need to share more widely the ways in which boards are developing to assess <strong>and</strong>address risk.——————————————————————————————3 Financial <strong>Reporting</strong> Council, Internal Control: Revised Guidance for Directors on the CombinedCode.(October 2005)http://www.frc.org.uk/documents/pagemanager/frc/Revised%20Turnbull%20Guidance%20October%202005.pdf4 Financial <strong>Reporting</strong> Council, The UK <strong>Corporate</strong> <strong>Governance</strong> Code (June 2010)http://www.frc.org.uk/documents/pagemanager/corporate_governance/uk%20corp%20gov%20code%20june%202010.pdf——————————————————————————————Copyright 2012, The Bureau of National Affairs, Inc.Reproduction or redistribution, in whole or in part, <strong>and</strong> in any form, without express written permission, is prohibited except aspermitted by the BNA Copyright Policy. http://www.bna.com/corp/index.html#V1
International Financial Regulation ReviewISSN 2047-4733The UK <strong>Corporate</strong> <strong>Governance</strong> Code states that “the Board is responsible for determining the nature <strong>and</strong>extent of the significant risks it is willing to take” <strong>and</strong> “should maintain sound risk management <strong>and</strong>internal control systems” 5 .——————————————————————————————5 UK <strong>Corporate</strong> <strong>Governance</strong> Code, Main Principle C.2——————————————————————————————<strong>Risk</strong> awareness, management <strong>and</strong> monitoringThe FRC found that there is now greater awareness <strong>and</strong> discussion of risk than there had been a fewyears ago, but that there were doubts as to the extent to which this has fed through to lead to betterpractices. One aspect which is stressed in the report, <strong>and</strong> important to keep in mind when framingdiscussions around risk, is that better risk decision-taking should not automatically mean less risk-taking.<strong>Risk</strong>-taking is an inherent aspect of running a business. <strong>Risk</strong> management is really all about boardshaving a better underst<strong>and</strong>ing of the risks involved in what their companies are doing <strong>and</strong> then takingdecisions consciously <strong>and</strong> monitoring those risks.As to how to assess <strong>and</strong> monitor risks, one of the themes which comes through from the FRC's report isthat there is a general acceptance that one size does not fit all. Therefore while it may be an appropriatemanagement mechanism in financial sector companies <strong>and</strong> some other industries which involvedsignificant health <strong>and</strong> safety, environmental or regulatory risks, to have a specific board risk committee,for the majority of other businesses, it was unlikely to be necessary. <strong>Risk</strong> in these types of business willbe addressed either by the board itself or in the various sub-committees which they have for matters suchas compliance.As between the roles of management <strong>and</strong> the board with regard to risk assessment <strong>and</strong> control,management are primarily responsible for identifying operational risks <strong>and</strong> bringing them to the attentionof the board, as well as for implementing the board's policies on a day-to-day basis. The board howeverremains responsible for assuring itself that management's responsibilities are being carried outeffectively. There are a number of ways in which a board can do this, including ensuring that there isclear allocation of responsibility <strong>and</strong> accountability to individuals within management (including asbetween the senior executives) <strong>and</strong> then following up with direct board contact with those individuals.Other approaches used have ranged from board committees meeting regularly with the relevantmanagers to requiring managers to certify the effectiveness of the risk controls to the board <strong>and</strong> bringingin external advisers to review the position. In each case, the approach depended on the nature of thecompany, its size <strong>and</strong> business.Different views are expressed between the identification of risks <strong>and</strong> the management of risks. Theboard's involvement in identifying risks is likely to be more focused on identifying risks relating to thecompany's strategy <strong>and</strong> external risk (such as regulatory change) while the identification of operationalrisks is seen as lying mainly with management. However, no such distinction is drawn when it comes tomanaging risk, where the board needs to focus on the risks which might cause the most damage to thecompany, including reputational risks, however they may arise.Assessing risk is also becoming considerably more developed, with boards now considering both grossrisks (risks before any mitigation policies, such as disaster plans, were effected)<strong>and</strong> net risks (the riskafter the mitigation policies are effected). By looking at both the gross <strong>and</strong> net risk, at both the individualrisk level <strong>and</strong> across all risks, the board should be able to determine an aggregate appetite for risk whichcan then be used to set reporting levels where management should report incidents <strong>and</strong> risks to theCopyright 2012, The Bureau of National Affairs, Inc.Reproduction or redistribution, in whole or in part, <strong>and</strong> in any form, without express written permission, is prohibited except aspermitted by the BNA Copyright Policy. http://www.bna.com/corp/index.html#V2
International Financial Regulation ReviewISSN 2047-4733board. This reporting mechanism needs to balance the need to consider the velocity of risk (the extent towhich relatively small individual matters may escalate into something much more serious) against theprovision of too much information (where every minor matter is reported to the board).<strong>Risk</strong> reportingHow boards report on risks is an area where there is a divergence of views between investors <strong>and</strong>companies. Investors believe there is significant scope for improving the reporting of risk whilecompanies remain concerned that they will be disclosing commercially sensitive information or thatdisclosing the risks may heighten the likelihood of their occurring. Suggestions in the FRC report on howthe position could be improved include:• commenting on risk matters throughout the annual report where relevant, rather than having ast<strong>and</strong>alone section;• reporting on risk by reference to the strategy <strong>and</strong> business model of the company, rather thannecessarily specifically to the company's operations;• reporting on how key risks are managed; <strong>and</strong>• reporting on changes in risk exposure, particularly as a result of changes in strategy or thecompany's business model.While the FRC will pick on various aspects of the contents of the report when it reviews the UK <strong>Corporate</strong><strong>Governance</strong> Code in 2012, the main activity which will follow from this report is a review of the TurnbullGuidance to ensure that it reflects the way in which the UK <strong>Corporate</strong> <strong>Governance</strong> Code links strategy<strong>and</strong> risk as well as changes in the general corporate environment. This review is expected to take placethis year.Report on Effective Company StewardshipThe FRC's paper on Effective Company Stewardship focuses on the role of audit committees <strong>and</strong> the wayin which information is presented by companies. The FRC recognises a number of principles in itsapproach to financial reporting <strong>and</strong> the respective roles of boards, audit committees <strong>and</strong> auditors asfollows:• companies themselves are responsible for preparing financial reports <strong>and</strong> providing the relevantinformation, not the auditors;• companies, through their interaction with investors, are better placed than auditors to know whatinformation investors want <strong>and</strong> regard as material. <strong>Audit</strong>ors are not in a position to know this orto make decisions which are properly management decisions as to what information is material<strong>and</strong> should be provided;• if more emphasis is put on auditors providing information in the financial report, this is likely tolead to more boilerplate <strong>and</strong> less focus on the individual business <strong>and</strong> run a risk of theintroduction of st<strong>and</strong>ardised language;• all those involved in preparing financial reports, ie companies, audit committees <strong>and</strong> auditors,must ensure that the information is complete, neutral, free from error, fair <strong>and</strong> balanced;Copyright 2012, The Bureau of National Affairs, Inc.Reproduction or redistribution, in whole or in part, <strong>and</strong> in any form, without express written permission, is prohibited except aspermitted by the BNA Copyright Policy. http://www.bna.com/corp/index.html#V3
International Financial Regulation ReviewISSN 2047-4733• auditors must exercise professional judgement, adopting a challenging or appropriately scepticalapproach to key issues, matters <strong>and</strong> assumptions;• companies <strong>and</strong> their auditors must be comfortable that the annual report, taken as a whole, is fair<strong>and</strong> balanced; <strong>and</strong>• greater transparency should not automatically lead to more information but should lead to a betterquality of reporting.Narrative <strong>Reporting</strong>The FRC intends to work with the Department for Business, Innovation <strong>and</strong> Skills in its review of narrativereporting as the FRC develops its own proposals. The FRC acknowledges a general need to improvethe quality <strong>and</strong> relevance of narrative reporting generally, with the emphasis being on improving thequality <strong>and</strong> reducing boilerplate disclosures. With this in mind, the FRC is going to be reviewing whetherit will be possible to create meaningful narrative supporting st<strong>and</strong>ards which can be applied on a “complyor explain” basis but without leading to more legalistic reporting.The FRC does not propose to pursue earlier proposals to increase the ability to report on information ontheir websites only by reducing the requirements for the printed annual reports in light of widespreadopposition. However, it is encouraging companies to look at improving access to annual reports usingavailable technologies.Strategy, <strong>Risk</strong> <strong>and</strong> Going ConcernAs part of its review of the Turnbull Guidance referred to above to reflect risk aspects, the FRC will alsobe reviewing the Turnbull Guidance <strong>and</strong> UK <strong>Corporate</strong> <strong>Governance</strong> Code to ensure that in future reports,companies focus on primarily on strategic risks(as opposed to those arising naturally such as earthquakedamage)<strong>and</strong> the major operational risks inherent in their businesses, <strong>and</strong> how they address <strong>and</strong> managethese risks.Role of the <strong>Audit</strong> CommitteeThe fundamental role of an audit committee is to oversee the integrity of a company's financial affairsfrom the effectiveness of its internal controls to the fair presentation of its results in its financial report. Itperforms this oversight function behalf of the whole board, as all directors are equally responsible for thecontents of the financial reports. The FRC would like to see greater transparency of the work undertakenby audit committees in the financial reports of companies, both so as to inform investors of the work beingcarried out <strong>and</strong> to allow audit committees to learn from the practices of others.The FRC is therefore proposing reviewing the UK <strong>Corporate</strong> <strong>Governance</strong> Code <strong>and</strong> related Guidance for<strong>Audit</strong> Committees 6 so that:• the audit committee's remit is extended to include reviewing the whole of the company's annualreport to ensure that it provides all necessary information for investors to assess the company'sfinancial performance <strong>and</strong> prospects <strong>and</strong>, taken as a whole, is fair <strong>and</strong> balanced;• the audit committee will report first to the full board setting out:——————————————————————————————6 Financial <strong>Reporting</strong> Council, Guidance on <strong>Audit</strong> Committees. (December 2010_Copyright 2012, The Bureau of National Affairs, Inc.Reproduction or redistribution, in whole or in part, <strong>and</strong> in any form, without express written permission, is prohibited except aspermitted by the BNA Copyright Policy. http://www.bna.com/corp/index.html#V4
International Financial Regulation ReviewISSN 2047-4733http://www.frc.org.uk/images/uploaded/documents/Guidance%20on%20<strong>Audit</strong>%20Committees%202010%20final1.pdf•——————————————————————————————• issues considered, how they were addressed <strong>and</strong> key judgements made;• their basis for concluding that the annual report is fair <strong>and</strong> balanced; <strong>and</strong>• their views on the effectiveness of the external audit <strong>and</strong> the appointment orre-appointment of the company's auditors; <strong>and</strong>• the full report of the audit committee to the board is included in the company's annual report.<strong>Audit</strong> <strong>and</strong> the role of auditThe FRC has considered again the role of the auditor <strong>and</strong>, as set out above, concluded that it is theprimary role of a company <strong>and</strong> its directors <strong>and</strong> audit committee to prepare <strong>and</strong> provide the informationfor inclusion in the financial report. The auditor's role is then to review <strong>and</strong> challenge the adequacy <strong>and</strong>accuracy of that information.In line with this principle, the FRC is proposing reviewing the reporting of auditors in their reports to auditcommittees <strong>and</strong> in their audit reports to increase the transparency of their actions. The FRC specificallynotes that its revisions are not intended to affect the underlying work undertaken by auditors, only itstransparency. The revisions will affect the auditing st<strong>and</strong>ards relevant to:• auditor's reporting to audit committees under ISA (UK & Irel<strong>and</strong>) 260) 7 , in particular to ensurethat the report gives the audit committee all the information needed to underst<strong>and</strong> what theauditors have relied on in reaching their audit opinion. The FRC expects to see increasedreporting on the effectiveness of the company's systems of control, how judgements onmateriality have been arrived at <strong>and</strong> the appropriateness fo the company's accounting policies;<strong>and</strong>• audit reports under ISA (UK & Irel<strong>and</strong>) 700 8 to give greater transparency , including whether theauditors have identified any matters in the annual report which are inconsistent with theinformation provided to them or contained in the financial statements.——————————————————————————————7 International St<strong>and</strong>ard on <strong>Audit</strong>ing(UK & Irel<strong>and</strong>) 260, Communication with those charged withgovernancehttp://www.frc.org.uk/images/uploaded/documents/ISA%20_UK%20<strong>and</strong>%20Irel<strong>and</strong>_%20260.pdf8 International St<strong>and</strong>ard on <strong>Audit</strong>ing (UK & Irel<strong>and</strong>) 700 (Revised), the <strong>Audit</strong>or's Report on FinancialStatements(March2009)_http://www.frc.org.uk/images/uploaded/documents/ISA%20700%20Web%20Optimized.pdf——————————————————————————————Copyright 2012, The Bureau of National Affairs, Inc.Reproduction or redistribution, in whole or in part, <strong>and</strong> in any form, without express written permission, is prohibited except aspermitted by the BNA Copyright Policy. http://www.bna.com/corp/index.html#V5
International Financial Regulation ReviewISSN 2047-4733<strong>Audit</strong>The FRC has noted the various examinations of the audit market by the House of Lords Economic AffairsCommittee <strong>and</strong> the European Commission, as well as the Office of Fair Trading's decision to refer theaudit market to the Competition Commission , although the FRC generally is opposed to regulatoryintervention as being the best means to address the competition <strong>and</strong> market issues being identified.——————————————————————————————Office of Fair Trading, Statutory <strong>Audit</strong>: Market investigation reference to the Competition Commission ofthe supply of statutory audit services to large companies in the UK(October 2011)http://www.oft.gov.uk/shared_oft/markets-work/oft1357MIR——————————————————————————————There are two main aspects which the FRC considers as directly within its remit. The first is the auditappointment process <strong>and</strong> the length of time some auditors hold office (some of which have lasted morethan half a century). The FRC is not generally in favour of a m<strong>and</strong>atory rotation of audit requirement butis proposing amending the UK <strong>Corporate</strong> <strong>Governance</strong> Code <strong>and</strong> related Guidance for <strong>Audit</strong> Committeesto require companies to put the audit out to tender at least every 10 years (or explain why not) <strong>and</strong> torequire audit committees to explain why they did or did not put the audit out to tender <strong>and</strong> chose tore-appoint the existing auditor or appoint a new one.The second aspect which the FRC considered is the extent to which audit firms are permitted to providenon-audit services to audit clients. The position was last reviewed <strong>and</strong> the st<strong>and</strong>ards amended inDecember 2010, when the majority view was that auditors should be permitted to provide such services.The FRC believes it is too soon to judge whether the changes introduced in December 2010 have had theintended effect <strong>and</strong> will continue to monitor the situation.Next StepsThe FRC expects to consult on the amendments to the UK <strong>Corporate</strong> <strong>Governance</strong> Code, relatedGuidance to <strong>Audit</strong> Committees <strong>and</strong> Turnbull Guidance during the first half of 2012, with a view to anyamendments coming into effect later in the year.Alasdair Steele is a corporate partner at <strong>Nabarro</strong> LLP, specialising in UK <strong>and</strong> cross-bordercorporate finance, including public <strong>and</strong> private M& A, strategic investments <strong>and</strong> primary <strong>and</strong>secondary equity issues, as well as regularly advising on consortia <strong>and</strong> corporate joint venturearrangements, particularly in the infrastructure sector. He regularly advises quoted companies<strong>and</strong> financial intermediaries on the UKLA Listing Rules <strong>and</strong> Disclosure Rules, the ProspectusRules, the AIM Rules, the Takeover Code, corporate governance matters <strong>and</strong> general companylaw. Telephone: +44 (0) 20 7524 6422; E-mail a.steele@nabarro.com.Copyright 2012, The Bureau of National Affairs, Inc.Reproduction or redistribution, in whole or in part, <strong>and</strong> in any form, without express written permission, is prohibited except aspermitted by the BNA Copyright Policy. http://www.bna.com/corp/index.html#V6