Future Students, Alumni & Visitors

Archive for the ‘Audit Committee’ Category

Mandatory Tendering of UK Audits – A Better Approach Was Missed

Last week, the Competition Commission in the UK issued a provisional decision requiring audit committees of large companies to tender bidding for the external audit every five years, among other reforms (see here).

Make no mistake: this is a major change and will shake up the cozy relationships some audit firms may have with their clients. Even this change is more significant than what was expected (I would have predicted 9-12 years). The Competition Commission is serious.

Here is what listed companies and the big 4 audit firms will argue: Five-year tendering is a one-sized fits all approach that does not address audit quality and imposes high switching costs. And there are unintended consequences.

They are entirely correct, and there would have been a better approach.

First, why are they correct? The academic evidence is that auditor rotation (assuming a good tendering process results more often than not in a different firm doing the audit) likely does not improve audit quality. Second, five years is therefore arbitrary. Third, a new auditor will need to climb a learning curve, and this is a costly investment for a company, not to mention the actual audit committee time in overseeing the tendering process. Fourth, a company will be forced to tender when they may be very satisfied with the auditor’s independence and quality of their work and reporting.

A far better approach would have been to address the heart of the issue: assess audit quality and act on the results.

An objective, robust annual evaluation of the external auditor, involving a 360 review by the board, the audit committee, and reporting senior and financial management of the company, with results disclosed to shareholders, would have been a much better approach.

The reluctance by boards to assess auditors in this fashion essentially forced regulation.

We see the same reluctance by boards to assess directors, act on results, and report to shareholders. Regulators in Europe and Asia are therefore imposing term limits on directors, at about 9 years. This is also arbitrary and can force a good director off a board or keep a poor director. Term limits may even come to North America. There are articles in the mainstream press about “zombie” directors and directors whose terms exceed 40 years.

Boards need to step up and address their own performance and that of their advisors. Regulators have shown they will act in the absence of self-governance and boards may not like it when they do.

Does your Audit Committee Need a Reset?

I was recently asked to speak to audit committee members in Niagara-on-the-Lake on best practices for audit committees. See my slides here. I was particularly critical of how audit committees and boards oversee risk. Risk systems in many companies are immature. Look at BP, Wal-Mart, JP Morgan, HSBC, News of the World, Barclays, SNC Lavalin and MF Global. These are all risk management failures, which are turn are governance failures.

There is good reason for risk management failure.

Proper risk management requires internal controls to mitigate risk. (Internal controls are processes and procedures such as segregation of duties, documentation, authorization, supervision, physical safeguards, IT security and prevention of management override.) No one likes to be controlled. Risk management is not intrinsically profit-making. Therefore there is an inherent aversion to risk management by management.

This is why regulators now are targeting boards with greater risk governance obligations because only the board has the authority to control management. Recent bank governance guidelines in Canada require much stronger risk oversight by boards and audit committees. Recent Ontario Securities Commission guidelines offer advice to boards and audit committees with operations in emerging markets, coming out of the Sino-Forest debacle.

There is a strong bias for audit committees to oversee many risks, not just financial. No regulation mandates this however. Audit committees should not oversee risks that they are not qualified to oversee.

Here are a dozen broader questions to determine whether your Audit Committee needs a reset.

1. Do your board and board committees have coordinated coverage, assurance and reporting over all material enterprise risks, both financial and non-financial?

2. For any non-financial risks that your Audit Committee may oversee, do the skills and experiences on the committee match the oversight?

3. Has the Audit Committee proposed a written risk appetite framework, approved by the board, which translates into explicit limitations and thresholds throughout the organization?

4. Are there any acute risks that you do not understand, or over which management is capable of overriding existing controls?

5. Do all Audit Committee members have tenure on the board for fewer than nine years? (Exceeding nine years is a red flag for lack of independence.)

6. Does your independent external audit firm have tenure for fewer than nine years? (This is also a red flag for lack of independence.)

7. If your company operates in an emerging market, do you have one Audit Committee member with direct experience operating in this market?

8. If your company has over 300 employees and it is a financial institution, or over 600 employees for any other type of company, do you have an effective internal audit function reporting directly to the Audit Committee?

9. Has your Audit Committee benchmarked the company’s risk management and internal control framework against best practices, using an independent external advisor?

10. Do you have an effective risk function that reports directly to the Audit Committee or board of directors?

11. Does your Audit Committee understand fraud implications of accounting policies, methods for making estimates, and compensation metrics?

12. At each Audit Committee meeting, do you meet separately with each of: the CFO; the internal audit function; the risk function; and the independent external auditor, without any member of management present?

When I asked for a show of hands during my lecture, not a lot of hands went up for many of the above types of questions.

If you answered yes to all questions, or even almost all, you likely have a truly outstanding audit committee. You may even wish to apply for a governance award, here.

If you cannot answer yes to the majority of these questions, you have work to do.

Join me in my next blog where I will ask if your Compensation Committee needs a reset.

Regulators turning up anti-bribery heat on corporate boards: But will practices change?

Russia is one of the most corrupt nations in the world (see a recent anti-corruption story on Russia by the New York Times). It ranks 143rd of all 182 countries on Transparency International’s corruption perception index, with a score of 2.4. Canada ranks the 10th least corrupt country in the world with a score of 8.7. New Zealand is the least corrupt country globally, ranking first with an overall score of 9.5. The US ranks 24th and the UK 16th, with scores of 7.1 and 7.8 respectively. See the “Full Table and Rankings,” where countries can be searched via the table. Lower rankings and higher scores mean the country is perceived as being less corrupt.

Prime Minister Harper visited China, India and Brazil to enhance trade with these countries, which are also some of the most corrupt nations in the world, ranking in at 95th, 75th and 73rd respectively. Libya, which involved the alleged Montreal-based SNC Lavalin bribes of some $56 million, comes in at 168. Within these countries, the governments themselves are the net beneficiaries of much of the corruption, so these politicians are far from motivated to impose reform.

Is it realistic to expect that Anglo-American nations, such as the US, UK and Canada, can impose “Western” will on the very way business is done, and has been done, in some countries for centuries? And if things will not or perhaps cannot change, should home country boards of directors be held responsible for systemic local corruption that may be beyond their control?

Regulators are taking corruption and the role of boards and senior management very seriously. The Securities and Exchange Commission and Department of Justice recently released 130 pages of guidance (see the PDF and other coverage here and here) on the Foreign Corrupt Practices Act (“FCPA”). The US has had the FCPA since 1977. Enforcement and penalties have gone up dramatically in recent years. The UK Bribery Act, from 2010, has some of the most stringent bribery laws in the world. In Canada, we have The Corruption of Foreign Officials Act (since 1999) and the recent guideline from the OSC for issuers operating in emerging markets (see the PDF).

Emerging economies are future markets for Canadian companies. The Prime Minister has a vision for Canada to be an energy supplier superpower. For this to happen, Canada will shift its trade to markets with 100s of millions or billions of consumers and much higher growth rates than our current major trade partner, the US, which could be coping with austerity due to its debt for years to come. Harper was in India last week to boost trade.

What is clear is that there is an enormous disconnect between the home country regulations now being imposed, and host country actual practices on the ground.

What should boards that have operations in emerging market jurisdictions do? Six things. First, if you are doing business in such a market, you need a director with extensive on-the-ground experience at the board table, who can tell you and management what the hotspots are. You should move a board meeting to the jurisdiction once a year so directors can get a first hand look. Second, boards must make it crystal clear to management that if the company is not going to bribe, management must walk away from certain business. And the board must support this and not have incentives that promote bribery. Third, the internal controls over financial reporting must be as strong in the emerging market as it is in the home market. Investment and resource commitments need to be made. Fourth, boards must have their own experts to scrutinize off-balance sheet and related-party transactions and complex structures; validate and assure internal controls; and provide foreign language document translation. Fifth, local auditors should have the same oversight, scrutiny, and as necessary direct contact with the audit committee that the home auditors have. Lastly, there needs to be zero tolerance by the board communicated to each employee and supplier. The UK is even banning facilitating payments, which are regarded as a “tip,” as these may be bribes in disguise.

Companies and politicians are feeling the pain, including on Canadian shores. The Wal-Mart bribery probe has widened beyond Mexico to include China, Brazil and India. The RCMP is investigating the SNC Lavalin bribery allegations, on which I advised a law firm suing the company. I blogged about Sino-Forest, a case of alleged Chinese fraud by a Canadian-listed company. In Quebec, the corruption inquiry has cost the Mayors of Montreal and Laval their jobs and this is only the beginning. There are allegations of kickbacks in cash that may reach other more senior politicians. And Ontario is not immune either. A senior Canadian director remarked that Ontario has a reputation for being “the best place to carry out a stock fraud in the industrialized world.”

Clearly, more work needs to be done. Canada’s corruption ranking on Transparency International may go down in 2012 instead of up.

Bribery, Cyber-Security and Derivatives: Is Internal Audit up to the Task?

Do internal auditors have the resources, skills and authority necessary to do their job? I wonder. I was asked recently to be an expert witness in an alleged bribery case. Internal audit is one of the first places I look to when assessing governance failure because they are the eyes and ears of the board.

I asked a question recently at two auditing conferences I spoke at. How many auditors use Twitter? In both cases, only one hand went up. Yet we know cybercrime is widespread, is under-reported, and management may not even know it is happening. It is a top concern of boards. How can internal auditors assure internal controls – not only over cyber-security but social media – when they themselves may be technically illiterate? IT literacy and data mining were two of the top skills required by internal auditors in a recent survey.

What about derivatives used by traders? How many auditors understand the use of derivative products such that they can attest to the internal controls over their use? The responses I received from my audiences were not encouraging.

What about corruption risk? How do auditors treat working notes, delegation to foreign auditors, language barriers, and do they even understand foreign practices? Do they visit the jurisdiction or audit from an office in Canada? The OSC came out with a scathing report recently about emerging market risks, chastising not just boards but the audit and underwriting professions.

What about fraud? Evidence from the conference board is that many whistle-blowing programs don’t work and aren’t used. Now whistle-blowers can go directly to the SEC in Washington, completely by-passing possible retaliation, flawed investigations or toxic workplaces.

Auditors cannot choose which internal controls they validate. Regulatory authorities are clear: every activity of every entity should fall within the scope of the internal audit function. This includes compensation structure of risk-takers. Combined assurance over all material risks should be undertaken.

Management may have vested interest in starving internal audit or compromising their objectivity with management responsibilities. Regulators have been clear here also: auditors, both internal and external, must maintain their independence from audited activities. They cannot assess their own work.

If the internal audit function is weak, or the chief audit executive does not have the experience or stature, or management disregards internal audit findings, this is the fault of the audit committee and the board. The audit committee should approve the head of internal audit, his/her compensation structure, the budget, work-plan and most of all the independence of the internal audit function. If the audit committee and ultimately the board does not ensure this, it is not doing its job. When or if governance failure happens, scrutiny will follow.

Derivatives May be Ungovernable

The recent loss of 2Billion dollars by JPMorgan confirms what is now a blindingly obvious governance reality. Board of directors do not understand derivatives and cannot control management’s use of them. The same may be said for regulators.

One job of a board is to identify risks and ensure a proper system of risk management. If you cannot do this, you should not be on a board. This means that a director needs to assess the adequacy of the design and effectiveness of internal controls to mitigate the risks. Of the over 300 interviews I have undertaken in my research, including directors of large banks, only one director claimed to understand complex derivatives. How can directors assess internal controls when they do not understand the very instrument itself?

Other than Jamie Dimon, CEO of JPMorgan, not a single director of the board has any experience in banking. See the roster of directors here. Even if some directors were from the sector, it is debatable whether they would still understand the complexities of these products. For a basic explanation of what derivatives are, see here. U of T Rotman professor John Hull, a derivatives expert, has stated in an email to me “There is no question in my mind that a large financial institution should have on its board people (perhaps 2 or 3) who understand derivatives and other complex financial products.” Unless bank boards that oversee derivatives are prepared to have subject matter experts on their board who can effectively question management and insist on proper risk controls, other governance or oversight structures are needed.

Not only are boards incapable of controlling derivatives, but regulators may not be any better. Warren Buffett has said “Central banks and governments have so far found no effective way to control, or even monitor, the risks posed by these contracts. In my view, derivatives are financial weapons of mass destruction, carrying dangers that, while now latent, are potentially lethal.” See Warren Buffett on Derivatives.

The question is what have we learned from 2008? Banks are bigger than ever, with most American mortgages concentrated in only a handful of banks, yet the risky bets and use of complex derivatives continue. Harvard law professor Elizabeth Warren yesterday called for a new version of the Glass Steagall Act. Yet independent Senator Bernie Saunders pronounced that Wall Street “runs” the Senate, implying that any attempt at further regulation would be forestalled. Mitt Romney has vowed to unwind Dodd-Frank on his first day as President. Look at the long list of political donations made by JPMorgan in 2011, here. And this is just one bank.

If derivatives are going to continue, regulatory conflicts of interest need to be addressed and boards need to have the directors with the expertise to oversee them.

text cloud