Key responsibilities
Deloitte Framework for Audit Committee effectiveness
1
2. Key responsibilities
Risk assessment and oversight Risk oversight has taken on increased importance not only for Audit Committees but also for the full Supervisory Board. Many boards are reconsidering the risk governance structure and which committees have the expertise to oversee particular risks. Risk oversight is a key responsibility of the board. Audit Committees are responsible for financial risks and for overseeing the process of identifying and addressing those risks. However, the responsibility for other risks can be moved to other board committees that have the appropriate expertise, for instance, human resource and compensation risks (e.g. excessive bonuses) can be overseen by the Compensation Committee. Nonetheless, the full board has the ultimate responsibility for risk oversight and should discuss the organization’s most material risks regularly. The Corporate Governance Code requires the Audit Committee to discuss the company’s risk assessment and risk management policies with management. Although it is the responsibility of senior management to assess and manage the company’s risks, the Audit Committee should focus on areas of major financial risk exposure and discuss the guidelines and policies for addressing these areas. The requirement relates specifically to financial risks, but these risks are often a consequence of other sources of risk. These may include strategy, operations, and compliance with environmental, health, safety, legal, and regulatory requirements.
2
Many Audit Committees have taken the lead in overseeing the company’s overall risk management program. When the Audit Committee is considering the effectiveness of the company’s enterprise risk management - the process of planning, organizing, leading, and controlling activities to minimize the effect of downside risk on the organization - they should ask the following questions: • What are the company’s policies and processes for assessing and managing major financial risk exposures on an integrated, enterprise-wide basis? • What are the key risks, vulnerabilities, and plans to address them? • Has the company defined its risk appetite with the board’s input and approval? • How capable is the company in preparing for, responding to, and recovering from major financial risk exposures? Such a risk assessment is not an annual event, but more of a continuous assessment in which actual developments, such as liquidity/access to capital and funds, changes to law and regulations and changes to accounting principles also play an important role. It is therefore important that the risk assessment is not only challenged between management and Audit Committee, but also with internal and external auditors.
Fraud and internal control over financial reporting In conjunction with risk oversight, the Audit Committee should determine that the company has programs and policies in place to prevent and identify fraud. It should work with management to oversee the establishment of appropriate controls and antifraud programs and to take the necessary steps when fraud is detected. The Audit Committee should also be satisfied that the organization has implemented an appropriate ethics and compliance program and established a complaints procedure. Audit Committee members should be aware of three main areas of fraud: • Financial statement fraud, which includes intentional misstatements in or omissions from financial statements • A sset misappropriation, which may include theft of money, inventory theft, payroll fraud, or theft of services • Corruption, which may include schemes such as kickbacks, shell companies, bribes to influence decision-makers, or manipulation of contracts.
One way the Audit Committee can help in overseeing the prevention and detection of financial statement fraud is by monitoring management’s assessment of internal control over financial reporting (ICFR). To oversee ICFR successfully, the Audit Committee must be familiar with the processes and controls management has put in place and understand whether they were designed effectively. The Audit Committee should work with management, the internal auditors, and the external auditors to gain the knowledge needed to provide appropriate oversight. Oversight of financial reporting and internal controls leading practices: • Understand accounting and financial reporting issues relevant to the company and how management addresses them, such as fair-value accounting and related assumptions • Anticipate and understand how pending financial reporting and regulatory developments may affect the company, and particularly its talent needs • Understand key controls and reporting risk areas as assessed by the external and internal auditors, and financial management, as well as mitigating controls and safeguards • Increase oversight of corporate taxes, an area where high-risk and high-value decisions are made as a result of the significant judgment involved.
Deloitte Framework for Audit Committee effectiveness
3
Ethics and complaints A culture that embraces the importance of ethics and compliance can be established only if employees, officers, and directors understand the requirements of the code of ethics. Management of ethics and compliance programs is important, of which a robust code of ethics or conduct is an important component. The Supervisory Board and the Audit Committee should consider whether the Audit Committee should be involved in this aspect of corporate governance.
Communication and training are key in fostering an ethical culture.
Those responsible for overseeing ethics and compliance should work with management to determine that the company’s code of ethics or conduct complies with the applicable requirements. Companies may update the code in response to new issues or situations. When appropriate, legal counsel should be consulted on modifications to the code. Usually, standards require the Audit Committee to oversee legal and regulatory compliance, so in many cases the Audit Committee will be involved in oversight of the code of ethics. Communication and training are key in fostering an ethical culture. The code should be available to everyone in the organization, perhaps through inclusion on the company’s intranet site and in the orientation manual. Some companies require individuals to sign an annual representation noting that they have read and understand the requirements of the code. Those responsible for overseeing ethics and compliance should work with management to establish a process for reporting and addressing violations promptly. Common standards require the Audit Committees of listed companies to establish procedures for: • Receiving, retaining, and addressing complaints regarding accounting, internal controls, or auditing matters, whether from internal or external sources as well as reporting a range of compliance matters, including code of conduct violations • The confidential, anonymous submission of employee concerns regarding questionable accounting or auditing matters.
4
The Audit Committee should work with management to determine that more than one person in the company is aware of questions or complaints received from third-party vendors, in e-mail, or through other submission vehicles. Responsibility for investigating questions or concerns and reporting back to the Audit Committee often falls on individuals in the ethics and compliance, internal audit, legal, or risk management departments. Complaints should be categorized and analyzed by root cause, and recommendations should be made to the Audit Committee on how to reduce the risk of similar complaints in the future. The Audit Committee also should be provided with an ongoing analysis of the progress of complaint resolution. Reports should be given to the Audit Committee regularly in accordance with standing instructions. Some complaints may warrant immediate communication to the Audit Committee, such as those involving senior management and significant amounts. The Audit Committee should establish a schedule for reporting to the board of directors. A hotline monitored by an independent third party is preferred. However, if the hotline is administered internally, operators should have specific training on where to direct questions or complaints, including those related to human resources. The company website is a natural vehicle for communicating the procedures to individuals outside the organization.
Deloitte Framework for Audit Committee effectiveness
5
Tax planning In accordance with the requirements of the Corporate Governance Code, the Audit Committee’s responsibilities include supervision of the company’s: • tax planning • tax related risk management, controls and procedures; and • tax accounting, position and disclosures.
Most Audit Committees do invite the company’s tax director and/ or external tax advisors to report on the status of the company’s tax planning activities, including the related risks, opportunities, exposures and disputes, at least on an annual basis. The Audit Committee may decide to engage its own tax advisors for an assessment of the company’s tax policies and tax planning activities.
Although a clear definition is not provided, “tax” as used by the Code is generally considered to include not only corporate income tax, but also all other taxes, such as value added tax and social security taxes.
As part of the company’s ongoing risk management activities, management assesses existing tax risks, and identifies and executes mitigating actions. In addition, the company will have implemented systems and procedures to comply with tax regulations in the jurisdictions it operates in. In general, embedding tax compliance procedures in the company’s ongoing operational and control procedures is likely to enhance their effectiveness.
To ensure effective execution and supervision, many companies have developed written tax policies, which also cover tax planning activities that are usually aligned with the company’s operational and financial objectives. Given the risks associated with aggressive tax planning, and increased public interest in corporate social responsibility, potential reputational damage is high. As a consequence, Audit Committees increasingly focus on sustainable effective tax rates, rather than opportunistically low effective tax rates. In general, alignment with the company’s financial and operational objectives and activities is likely to improve the sustainability of tax rates and reduce the risks. In this respect the Audit Committee should pay particular attention to the use of offshore and special purpose entities for tax planning purposes. 6
Both the general trend towards transparency and recent developments of IFRS have had a significant impact on tax disclosures in the annual financial statements. Companies are not only required to report on their actual tax positions, but also on deferred positions, risks and uncertainties, which may have a significant impact on their financial performance. With respect to tax related disclosures, the Audit Committee should assess if the company’s disclosure is in accordance with the information provided to the Audit Committee. Most Audit Committees discuss the company’s tax accounting and disclosure with the external auditors. In addition, Audit Committees increasingly require detailed periodical reporting by the company’s tax director. Such detailed reporting addresses known tax exposures and actual tax positions per jurisdiction, including;
• progress of tax filings (years still to be filed) • open and/or uncertain tax positions (that may be subject to revision by the local tax authorities) • progress and results of tax audits; and • tax disputes. This information is not only relevant to assess the quality of tax disclosures, but also provides valuable feedback on the effectiveness of the company’s tax compliance procedures. IT policies and governance Information technology (IT) is essential for managing the transactions, information and knowledge necessary to initiate and sustain economic and social activities. In most enterprises, IT has become an integral part of the business and is fundamental to support, sustain and grow the business. Successful enterprises understand and manage the risks and constraints of IT. As a consequence, boards of directors understand the strategic importance of IT and have put IT governance firmly on their agenda. Increasingly, management is realizing the significant impact that IT can have on the success of the enterprise. Successful enterprises understand the risks and exploit the benefits of IT. Management needs to extend governance to IT and provide the leadership as well as the organizational structures and processes that ensure that the enterprise’s IT sustains and extends its strategies and objectives. IT governance is not an isolated discipline. It is an integral part of overall enterprise governance. The need to
integrate IT governance with overall governance is similar to the need for IT to be an integral part of the enterprise. The overall objective of IT governance is to understand the issues and the strategic importance of IT, so that the enterprise can sustain its operations and implement the strategies required to extend its activities into the future. IT governance aims at ensuring that expectations for IT are met and IT risks are mitigated. With respect to IT governance, the Audit Committee should consider asking the following questions: To Uncover IT Issues • How often do IT projects fail to deliver what they promised? • Are end users satisfied with the quality of the IT service? • Are sufficient IT resources, infrastructure and competencies available to meet strategic objectives? • What has been the average overrun of IT operational budgets? • How often and how much do IT projects go over budget? • How much of the IT effort goes to firefighting rather than enabling business improvements? To Find Out How Management Addresses the IT Issues • How well are enterprise and IT objectives aligned? • How is the value delivered by IT being measured? • Is there an up-to-date inventory of IT risks relevant to the enterprise?
Deloitte Framework for Audit Committee effectiveness
7
To Assess IT Governance Practices • Is the Management Board regularly briefed on IT risks to which the enterprise is exposed? • Is IT a regular item on the agenda of the Management Board and is it addressed in a structured manner? • Does the Management Board articulate and communicate the business objectives for IT alignment? • Does the Management Board obtain regular progress reports on major IT projects? In addition to the oversight of IT governance, the Audit Committee should consider the effectiveness of application controls and general computer controls, such as; • business continuity planning • backup and recovery procedures • segregation of duties • change management procedures • access protection; and • the quality and protection of business critical information. The Audit Committee should discuss the resources and capabilities of the internal audit function to perform IT audits, and the planned coverage of IT audits. Similarly, the Audit Committee should discuss with the external auditors to which extent IT experts are involved in the audit program, and the planned coverage of IT audits by the external auditors. The observations of the internal auditors and the external auditors will provide valuable input to conclude on the overall effectiveness of the applications of IT.
8
Sources and references
Commitment to effective corporate governance Deloitte has a number of programs and initiatives that demonstrate its commitment to helping boards and Audit Committees enhance their effectiveness and overall corporate governance.
References • NBA, De Raad van Commissarissen als opdrachtgever van de accountant (Betrekking hebbende op OOB), adviesrapport, september 2011
Center for Corporate Governance The Deloitte Center for Corporate Governance is a resource for executives, directors, and the governance community on the latest and most relevant corporate governance trends, regulations, and leading practices. The center generates research and roundtables on current boardroom issues and conducts a monthly Dbrief webcast series on governance topics. The Center for Corporate Governance website at www.corpgov.deloitte.com offers timely, relevant, and balanced governance information for boards of directors, senior executives, investors, and others interested in governance.
• Nederlandse Code Corporate Governance
Governance services Deloitte governance services include board evaluations, board and committee practice benchmarking, and in-the-boardroom director development programs. Services draw on the full range of Deloitte’s experience in areas critical to board effectiveness. To learn more, contact your Deloitte partner or e-mail us at jbune@deloittte.nl
• Deloitte US, Audit Committee Resource Guide, 2011 • Deloitte the Netherlands, Maatwerk in Governance Services, 2012 • ...and inspiration from various other sources. For further information please feel free to contact your personal Deloitte contact partner or: Huub Wieleman at hwieleman@deloitte.nl Jan Buné at jbune@deloitte.nl Eric de Weerdt at edeweerdt@deloitte.nl If you would like to receive the appendices in a Word template so that you could edit/save them, please send an e-mail to commissarissen-agenda@deloitte.nl
Deloitte Framework for Audit Committee effectiveness
9
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Deloitte provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries. With a globally connected network of member firms in more than 150 countries, Deloitte brings world-class capabilities and high-quality service to clients, delivering the insights they need to address their most complex business challenges. Deloitte’s approximately 195,000 professionals are committed to becoming the standard of excellence. This publication contains general information only, and none of Deloitte Touche Tohmatsu Limited, its member firms, or their related entities (collectively, the “Deloitte Network”) is, by means of this publication, rendering professional advice or services. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. No entity in the Deloitte Network shall be responsible for any loss whatsoever sustained by any person who relies on this publication. © 2012 Deloitte The Netherlands - Second edition