Organizational Governance

1. Organizational Governance The Role of the Accountant

2. Presentation Objectives • The meaning of good governance • The IIA’s governance model • Participants and players • Specific Internal Auditing activities • Steps for embracing Internal Audit’s role

3. What is the AC’s Role in Governance? • Oversight of financial reporting • Risk management • Internal control • Compliance • Ethics • Management • Internal auditors • External auditors

4. Key Issues of Concern • Financial Accuracy • Risk Management • Control Assessment • External Auditor Oversight • Effective Use of Internal Auditing

5. State Charter Shareholders Board of Directors Management Employees 0 The Corporation’s Hierarchy of Authority Figure 4-1

6. Shareholders(ownership) Board ofDirectors Management(control) 0 Separation of Ownership from Control Precorporate Period Corporate Period Owners(ownership) Managers(control) Figure 4-2

7. Corporate Governance Defined • Corporate Governance is the process and structure used to direct and manage the business and affairs of the corporations with the objective of enhancing shareholder value, which includes ensuring the financial viability of the business. • The process and structure define the division of power and establish mechanisms for achieving accountability among shareholders, the board and management.

8. Corporate Governance Defined • Cadbury Committee: Corporate governance is the system by which companies are directed and controlled.

9. What is Corporate Governance? Policies, processes, and structures used by an organization to direct and control its activities, to achieve its objectives, and to protect the interests of its diverse stakeholder groups in a manner consistent with appropriate ethical standards.

10. Definitions of Corporate Governance • “Corporate governance deals with the ways in which suppliers of finance to corporations assure themselves of getting a return on their investment.” • The Journal of Finance, Shleifer and Vishny [1997, page 737].

11. Definitions of Corporate Governance • "Corporate governance - which can be defined narrowly as the relationship of a company to its shareholders or, more broadly, as its relationship to society -….", from an article in Financial Times [1997].

12. Definitions of Corporate Governance • "Corporate governance is about promoting corporate fairness, transparency and accountability." • J. Wolfensohn, president of the Word Bank, as quoted by an article in Financial Times, June 21, 1999.

13. Definitions of Corporate Governance • "Corporate governance is a field in economics that investigates how to secure/motivate efficient management of corporations by the use of incentive mechanisms, such as contracts, organizational designs and legislation. This is often limited to the question of improving financial performance, for example, how the corporate owners can secure/motivate that the corporate managers will deliver a competitive rate of return." - www.encycogov.com, Mathiesen [2002

14. Definitions of Corporate Governance • "Corporate governance is the system by which business corporations are directed and controlled. The corporate governance structure specifies the distribution of rights and responsibilities among different participants in the corporation, such as, the board, managers, shareholders and other stakeholders, and spells out the rules and procedures for making decisions on corporate affairs. By doing this, it also provides the structure through which the company objectives are set, and the means of attaining those objectives and monitoring performance", OECD April 1999. OECD's definition is consistent with the one presented by Cadbury [1992, page 15].

15. Definitions of Corporate Governance • “Some commentators take too narrow a view, and say it (corporate governance) is the fancy term for the way in which directors and auditors handle their responsibilities towards shareholders. Others use the expression as if it were synonymous with shareholder democracy. Corporate governance is a topic recently conceived, as yet ill-defined, and consequently blurred at the edges…corporate governance as a subject, as an objective, or as a regime to be followed for the good of shareholders, employees, customers, bankers and indeed for the reputation and standing of our nation and its economy.” • Maw et al. [1994, page 1].

16. In Essence … Corporate Governance is essentially a function of leadership and direction within an organisation; appropriate risk management and control over its activities; and the manner in which meaningful disclosure relating to its activities is made to shareholders and other stakeholders. - King II Report, 2002, South Africa

17. Governance Ensures: That the Organization: • Complies with society’s legal and regulatory rules • Satisfies the generally accepted business norms, ethical precepts, and social expectations of society • Provides overall benefit to society and enhances interests of stakeholders • Reports fully and truthfully to its owners, regulators, other stakeholders, and general public to ensure accountability for its decisions, actions, conduct , and performance

18. Best Practice from a Global Perspective Four elements of governance: • Managing, including board responsibility • Supervision • Internal control • Transparency.

19. Board Effective Governance External Audit Internal Audit Management The IIA Corporate Governance Model

20. Sound Governance Requires Synergy!!! • Boards of Directors • Management • External Auditors • Internal Auditors • Laws and Regulations

21. Board Responsibilities • Establishes the “tone at the top” • Focal point for all governance activities • Ultimate accountability • Oversees all organizational activities, but does not directly manage any of them

22. Senior Management • Establishes strategic direction and an entity’s value system (with board oversight) • Provides assurance of risk management processes, operations monitoring, measurement of operating results, and implementation of timely corrective actions

23. Operating Management • Deploys strategy, enforces internal control, and provides direct supervision for areas under its control • Accountable to executive management and ultimately the board for implementing and monitoring the risk management process and establishing effective and appropriate internal control systems

24. External Auditing • Provides independent assurance on the financial statement preparation and reporting activities in accordance with applicable regulations and accounting principles

25. Internal Auditing • Performs assessments to provide assurance that the governance structures and processes are properly designed and operating effectively as designed • Provides advice on potential improvements to governance structures and processes

26. What is Internal Auditing’s Role in Corporate Governance? • Assessor • Advisor • Advocate • Catalyst

27. IIA Standard 2130 IA should assess and make relevant recommendations for improving the governance process by: • Promoting appropriate ethics & values • Ensuring effective performance management • Providing effective communication of risk and control information • Ensuring effective coordination of activities and communication between Board, External Auditors, Internal Auditors and Management

28. Consideration of best practices and adaptation to the specific organization – focus on optimization of governance practices and structure Perform audits of design and effectiveness of specific governance-related processes Provide advice with focus on governance structure to meet compliance requirements and basic risks of organization More Structured Less Structured Internal Auditing Governance Maturity Model Allocation of Audit

29. Specific Internal Auditing Activities • Consider assessing the following: • Board Structure, Objectives, and Dynamics • Board Committee Functions • The Board Policy Manual • Processes for Maintaining Awareness of Governance Requirements • Assess performance of the board and its committees

30. Reporting on internal control • An effective system of internal control is seen as crucial for good goverance • Reporting on the effectiveness of IC is a good corporate governance requirement • The COSO Framework is considered to offer an established set of control criteria to assess the effectiveness of IC • Requirement of US Sarbanes-Oxley Act of 2002

31. The role of institutional failures in corporate governance • Many of the well-known corporate-governance failures are due to widespread institutional failures, including failures by regulators, accounting firms, and financial analysts. • Take one of these failures out of the equation, and perhaps some of the problems observed in the last ten years might not have occurred. • In particular, the incentive structures of accounting firms and financial analysts caused many of them not to provide appropriate oversight and criticism of corporate managers. • In the absence of effective monitoring of managers, bad things tend to happen to companies.

33. The Sarbanes Oxley Act consists of 11 Sections I – Public Company Accounting Oversight Board II – Auditor independence III – Corporate Responsibility IV – Enhanced Financial Disclosures V – Analyst Conflicts of Interest VI – Commission Resources and Authority VII – Studies and Reports VIII – Corporate and Criminal Fraud Accountability Act of 2002 IX – White-Collar Crime Penalty Enhancements X – Corporate Tax Returns XI – Corporate Fraud and Accountability

34. US Sarbanes-Oxley Act • Each annual report filed with the SEC has to include an internal control report • Management’s responsibility for establishing adequate IC over entity financial reporting • Management’s assessment of its continuing effectiveness • The independent auditors must attest to and report on the assessments made by company management

35. 0 Improving Corporate Governance Sarbanes-Oxley Act of 2002 (SOX) • Limits the non-auditing services an auditor can provide • Requires auditing firms to rotate the auditors working with a specific company • Makes it unlawful for accounting firms to provide services where conflicts of interests exist

36. 0 Improving Corporate Governance Sarbanes-Oxley Act of 2002 (SOX) • Enhances financial disclosure with requirements, i.e.: • reporting off-balance sheet transactions • prohibiting personal loans to executives and directors • requiring auditors to assess and report upon ICs • Audit committees to have at least one financial expert • CEOs and CFOs to certify and are held responsible for IC and financial representations • Whistle-blowers are accorded protection • Code of ethics disclosure

37. Sarbanes Oxley Act of 2002 • Spurred by the spate of corporate scandals (Enron, Global Crossing, WorldCom, etc.) Congress passed the SOX • Key Provisions • establish an independent accounting oversight board, funded by public companies; • increase funding for SEC enforcement of existing laws and regulations; • prohibit independent auditors from providing certain non-audit services; • require accounting firms to rotate lead partners on audit clients every five years;

38. Sarbanes Oxley Act of 2002 (Contd.) • require independent Board audit committees; • specify that audit committees hire, fire and oversee auditors; • ban certain company loans to executives; • ban sales of company stock by executives during pension plan “blackout” periods; • provide greater protections for whistle blowers; • lengthen the time investors have to file lawsuits for securities fraud;

39. Sarbanes Oxley Act of 2002 (Contd.) • increase penalties for securities fraud, document shredding and other white collar crimes; • redirect funds from SEC enforcement actions to investors victimized by securities fraud; • require more complete and timely information for investors; and • require CEOs and CFOs to certify accuracy of financial reports, subject to civil and criminal penalties.

40. Certification of SEC reports by executives • Chief executive and chief financial officers of US listed companies have to certify annual and quarterly reports filed with the SEC. This means that they: • reviewed the reports and, based on their knowledge, there are no untrue statement or omission of material fact, and the statements fairly present the Company’s financial condition. • also certify that they evaluated the effectiveness of disclosure controls and procedures. • confirm that disclosures have been made to auditors and audit committee of all significant deficiencies in internal control or any fraud that involves employees with significant role in internal control.

41. Statutory audit and governance • The independent auditor’s assurance plays a central role in corporate governance • Auditing (multinational) group accounts is more complicated than individual accounts, as subsidiaries are working in different legal environments and involves intra-group reconciliations. Moreover, it adds time pressure • The auditor of group accounts is responsible for any error in the group audit, even if such an error has arisen because of a mistake by the auditor of a subsidiary

42. International audit • Multinationals tend to have an exclusive auditor (large audit firm) for all their subsidiaries • The conduct of an international audit is usually guided by the set of international auditing rules put out by the International Federation of Accountants (IFAC) • The audit report should specify what auditing rules have been followed by the auditor

43. Audit independence • The value of an audit depends partly upon the technical skills of the auditor and partly upon his independence and ethical qualities • Independence issues: • Restrictions on the type of non-audit services that an auditor is allowed to provide to audit clients • Employment of former audit firm employees by the audit client • Periodic audit partner rotation • Limits to the audit appointment

44. Reporting on internal control • An effective system of internal control is seen as crucial for good goverance • Reporting on the effectiveness of internal control as a governance requirement • COSO Framework is considered to offer an established set of control criteria to assess the effectiveness of ICs • US Sarbanes-Oxley Act of 2002

45. Internal control and risk management • Effective risk management should enable companies to take risks with more confidence and in a rational and informed manner • Those charged with corporate governance are expected to systematically identify, evaluate and respond to company risks • COSO’s Enterprise Risk Management – Integrated Framework (2004)

46. Enterprise risk management -Definition “Enterprise risk management is a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.” Source: COSO, Enterprise Risk Management – Integrated Framework, 2004

47. Enterprise risk management • COSO sees internal control as a subset of risk management • Other risk management devices include transferring risk to third parties, risk-sharing, contingency planning and consciously excluding activities deemed too risky • Risk disclosure requirements may empower shareholders to use disclosures to bring companies to adopt more elaborate risk management standards

48. Audit committee • Independence is an essential quality for audit committee members • The audit committee should provide a quasi-independent forum where those concerned with checking the effectiveness and quality of the company’s accounting and control should be able to meet and discuss with shareholder representatives (independent directors) and raise issues of concern

49. Audit committee roles • Oversee the financial reporting process • Monitor the effectiveness of the system of internal control (and possibly of the enterprise risk management system) • Act as an intermediary between the board of directors and the external auditors and internal auditors as well.

50. Detailed Audit Committee Responsibilities Some detailed audit committee responsibilities include: • Ensuring that financial statements are understandable, transparent, and reliable. • Ensuring the risk management process is comprehensive and ongoing, rather than partial and periodic.