Qualitative characteristics of information on Risk and Internal Controls needed by the Board

The information on risks and internal controls should be high quality information. This means that it enables the full information content to be conveyed to the board in a manner that is clear and has nothing in it that would make any part of it difficult to understand. Communications should be reliable, relevant and understandable. They should also be complete.


By reliable means the trustworthiness of the information: the assumption that it is ‘hard’ information, that it is correct, that it is impartial, unbiased and accurate. Even In the event of conveying bad news.

By relevant means not only that due reports should be complete and delivered promptly, but also that anything that that should be brought to the board’s attention, should be brought to the board’s attention while there is still time for them to do something about it.

Not all directors possess the technical and nautical knowledge of senior operating personnel of the company. It is therefore particularly important that information conveyed is understandable. This means that it should contain a minimum of technical terms that have obvious meaning to operating managers but may not be understandable to a non-specialist. All communication should therefore be as plain as possible within the constraints of reliability and completeness.

By complete means that all information that the directors need to know and which the operating managers have access to, should be included, regardless of
any inconvenience that it may cause to one or more colleagues.



**********

The importance for the board of directors to have all the information

The importance for the board of directors to have all the information relating to key operational internal controls and risks

1. In the first instance, the information provided enables the board to monitor the performance of the company on the crucial issues. This includes compliance, performance against targets and the effectiveness of existing controls. By being made aware of the key risks and internal control issues at the operational level, the board can work to address them in the most appropriate way.


2. The board also needs to be aware of the business impact of operational controls and risks to enable the board to make informed business decisions at the strategic level. If the board is receiving incomplete, defective or partial information then they will not be in full possession of the necessary facts to allocate resources in the most effective and efficient way possible.


3. The board has the responsibility to provide information about risks and internal controls to external audiences. Best practice reporting means that directors have to provide information to shareholders and others, about the company’s systems, controls, targets, levels of compliance and improvement measures and hence quality information are needed to achieve this.




***********

Advantages and Disadvantages of Risk Committee made up of NEDs

The UK Combined Code, for example, allows for risk committees to be made up of either executive or non-executive members.

Advantages of non-executive membership

1. Separation and detachment from the content being discussed is more likely to bring independent scrutiny. Sensitive issues relating to one or more areas of executive oversight can be aired without vested interests being present.

2. Non-executive directors often bring specific expertise that will be more relevant to a risk problem than more operationally-minded executive directors will have. The NEDs, being from different backgrounds, are likely to bring a range of perspectives and suggested strategies which may enrich the options open to the committee when considering specific risks.


Disadvantages of non-executive membership (advantages of executive membership)

1. Direct input and relevant information would be available from executives working directly with the products, systems and procedures being discussed if they were on the committee. Non-executives are less likely to have specialist knowledge of products, systems and procedures being discussed and will therefore be less likely to be able to comment intelligently during meetings.

2. Non-executive directors will need to report their findings to the executive board. This reporting stage slows down the process, thus requiring more time before actions can be implemented, and introducing the possibility of some misunderstanding.



***********

Importance of independence of Auditor

The auditor must be materially independent of the client for the following reasons:


1. To increase credibility and to underpin confidence in the process. In an external audit, this will primarily be for the benefit of the shareholders and in an internal audit, it will often be for the audit committee that is, in turn, the recipient of the internal audit report.


2. To ensure the reliability of the audit report. Any evidence of lack of independence (or ‘capture’) has the potential to undermine all or part of the audit report thus rendering the exercise flawed.


3. To ensure the effectiveness of the investigation of the process being audited. An audit, by definition, is only effective as a means of interrogation if the parties are independent of each other.



***********

Framework for assessing risk

Risk is assessed by considering each identified risk in terms of two variables:

– its hazard (or consequences or impact) and,
– its probability of happening (or being realised or ‘crystallising’).

The most material risks are those identified as having high impact/hazard and the highest probability of happening. Risks with low hazard and low probability will have low priority whilst between these two extremes are situations where judgement is required on how to manage the risk.


In practice, it is difficult to measure both variables with any degree of certainty and so it is often sufficient to consider each in terms of relative crude metrics such as ‘high/medium/low’ or even ‘high/low’. The framework can be represented as a ‘map’ of two intersecting continuums with each variable being plotted along a continuum.




***********

Contribution of Risk Committee

Evaluate the contribution that a risk committee made up of non-executive directors could make to shareholders’ confidence in the management of an organistion


Risk committees are considered best practice by most corporate governance regimes around the world for a number of reasons. A risk committee made up of non-executive directors could provide an independent viewpoint on the company’s overall response to risk, and to challenge the CEO’s attitude. A risk committee can help increase the confidence in a number of ways:


Determining overall exposure to risk
The committee can pressure the board to determine what constitute acceptable level of risk, bearing in mind the likelihood and the risks materialising and the company’s ability to reduce the incidence and impact on the business.

Monitoring the overall exposure to risk
Once the board defined acceptable risk levels, the committee should monitor whether the company is remaining within these levels and whether earnings are sufficient given the levels of risks that are being borne.

Reviewing reports on key risks
There should be a regular system of reports to the risk management committee covering areas known to be of high risk, also one-off reports covering conditions and events likely to arise in the near future. This should facilitate monitoring of risk.

Monitoring the effectiveness of the risk management systems
The committee should monitor the effectiveness of the risk management systems, focusing particularly on effective management attitudes towards risks and the overall control environment and culture. A risk committee can judge whether there is an emphasis on effective management or whether insufficient attention is being given to risk management due to the pursuit of higher returns.



************

Appointment of Internal Auditors from Inside or Outside

In practice, a decision such as this one will depend on a number of factors including the supply of required skills in the internal and external job markets. In constructing the case for an external appointment, however, the following points can be made.

Primarily, an external appointment would bring detachment and independence that would be less likely with an internal one.

Firstly, then, an external appointment would help with independence and objectivity (avoiding the possibility of auditor capture). He or she would owe no personal loyalties nor ‘favours’ from previous positions. Similarly, he or she would have no personal grievances nor conflicts with other people from past disputes or arguments.


Some benefit would be expected from the ‘new broom’ effect in that the appointment would see the company through fresh eyes. He or she would be unaware of vested interests. He or she would be likely to come in with new ideas and expertise gained from other situations.


Finally, as with any external appointment, the possibility exists for the transfer of best practice in from outside – a net gain in knowledge for the company.




***********