Chairing the Audit Committee

1. Chairing the Audit Committee Dr Ruth Bender 9th December 2009

2. Agenda The Audit Committee Chair Forum Findings The role of the audit committee Financial literacy A changed economic environment Some recurring themes Conclusions

3. The Audit Committee Chair Forum

4. List of ACCF reports, 2005 - 2009 PHASE 1 2005 - 2008 • The Role and Function of the Audit Committee • Audit Committee Regulation: ‘Financial Literacy’ – What does it mean? • The Drivers of Audit Quality • What is an Effective Audit, and How Can You Tell? • Audit Committee Communication: What is Said, Why, How and to Whom? • The Role of the Audit Committee in Risk Management • The Role of the Audit Committee Regarding Non-Audited Information • The Audit Committee and the Credit Crunch • Risk Management in a Cost-cutting environment PHASE 2 2009 onwards • Conversation with a Regulator • Telling a Good Story • Change for the Better? r.bender@cranfield.ac.uk CBI website http://snipurl.com/tegz5 http://www.ey.com/UK/en/Issues/Audit-Committee-Chair-Forum Dr Ruth Bender

5. ACCF Phase 1 ACCF, started in April 2005, run by the CBI and Ernst & Young, jointly with Cranfield. Its aim then was “To influence the direction of regulation as it impacts audit committees” “The Forum will … act as a vehicle to develop points of view and best practice.” “This is an opportunity to contribute to the debate, influence its direction and improve the performance of your audit committee. By becoming a member of the Audit Committee Chair Forum you will be able to participate in frank, peer-to-peer dialogue discussing insights on immediate issues confronting your audit committees.” “The Forum’s agenda will be determined entirely by your views.” Dr Ruth Bender

6. Typical timeline during ACCF Phase 1 Dr Ruth Bender

7. ACCF Phase 2 From CBI website http://snipurl.com/tegz5 Dr Ruth Bender

8. ACCF Phase 2 • From 2009 the format changed. There is no discussion paper prepared. Instead, a guest speaker is invited to make a presentation, which is followed by a discussion. • Note-taking at the meeting is unchanged, and the final paper is prepared in a similar manner to previously, with review by the speaker and by EY. • Speakers have been: • Paul Boyle: Chief Executive of the Financial Reporting Council • Bill Knight and David Lindsell: Chairman and Deputy Chairman of the Financial Reporting Review Panel • Peter Williams: Chair of the Investor Relations and Markets Committee of The Hundred Group Dr Ruth Bender

9. Sources of data Dr Ruth Bender

10. In total, the ACCF meetings have been attended by 38 audit committee chairs, 16 partners or directors from Ernst and Young, and 4 senior participants from the CBI. The ACCF members chair the audit committees of FTSE 100 and some FTSE 250 companies. In addition to chairing, those with multiple directorships often sit as members of other audit committees. Their relevant experience includes being finance directors, corporate financiers, treasurers and bankers. However, some have no relevant qualification or recent experience in the field. Dr Ruth Bender

11. Findings The Role of the audit committee Who does what, and how? Evaluating audit quality Risk management Non-audited information Financial literacy A changed economic environment Some recurring themes

12. The Role of the Audit Committee Who does what, and how? Evaluating audit quality Risk management Non-audited information Dr Ruth Bender

13. The Role of the Audit Committee Who does what, and how? Evaluating audit quality Risk management Non-audited information Dr Ruth Bender

14. The role of the audit committee • To monitor integrity of the financial statements • To review the company’s internal financial controls (and its risk management systems unless monitored elsewhere) • To monitor and review the effectiveness of internal audit • To recommend (to Board) appointment of the external auditor, and approve their remuneration and terms of engagement • To review and monitor the external auditor’s independence, objectivity and the effectiveness of the audit process • To develop and implement policy on using the external auditor to supply non-audit services. • To review whistle-blowing arrangements for staff. Combined Code C3.2 Dr Ruth Bender

15. External auditor (which people?) CFO Internal auditor Committee Board Full board …. Other NEDs CoSec Chair NED NED CoChairman Other finance dept people NED Other depts within company (which – e.g. IT, tax…?) CEO Institutional shareholders Possible Audit Committee Relationships Dr Ruth Bender

16. Examples of audit committee involvement Dr Ruth Bender

17. Ranged in number per year from 3 to 13 Attended by just the NEDs … or attended by the whole board CEO has no input into the papers … or s/he does External auditors sometimes/always attend Internal auditors sometimes/always attend White space meetings Audit committee meetings vary a lot Dr Ruth Bender

18. How do you know you’re doing a good job? Formal evaluations – using checklists, interviews, discussions, outside consultants… It’s very subjective For both training and evaluation, you need to be very sure of what you are meant to be doing in the first place How well are audit committees doing? The Combined Code states that there should be an annual evaluation of the performance of the board and its committees… Dr Ruth Bender

19. “… bottom line is whether you feel, having looked management in the eye … at the end of the day you get a warm feeling.” “It’s a litmus test. When you ask the questions do you get defensiveness or open behaviour?” “It’s subjective and gut-feel. How much trust you have in management” “It’s easier to judge failure than it is to judge success really. You know if its not working.” What is an ‘effective’ audit committee? Dr Ruth Bender

20. Audit committee chairs get a lot of knowledge from being on more than one committee. This transmits ‘best practice’. They see a lot of advantages in multiple appointments. Q: Is that how ‘best practice’ is arrived at? A: It’s certainly how ‘common practice’ is arrived at. I suppose it’s probably not whether it gets us to ‘best’; it certainly gets us to ‘better’. Multiple directorships Dr Ruth Bender

21. The importance of trust All interviewees and participants stressed the importance of the ACC-CFO relationship Dr Ruth Bender

22. The Role of the Audit Committee Who does what, and how? Evaluating audit quality Risk management Non-audited information Dr Ruth Bender

23. One of the duties of the audit committee “… review and monitor the external auditor’s independence and objectivity and the effectiveness of the audit process, taking into consideration relevant UK professional and regulatory requirements.” The Combined Code (2006: C.3.2) Dr Ruth Bender

24. What do the auditors do? If you’re not turning up the carpet; who’s turning up the carpet? Dr Ruth Bender

25. What makes an effective audit? “You can answer it in the negative. What is not an effective audit? If you know what is not an effective audit you can see what is. It’s not lots of hassle from the FRC [Financial Reporting Council]; the FD in prison; the chairman of the audit committee close to prison! If something goes wrong you know it’s not effective … but if there was no underlying wrong, you might never know the audit was not effective.” “It’s hard to know in real time if it was an effective audit. You only know historically if it was not. … Therefore, all you can do is judge: are they showing the characteristics of an effective audit?” Dr Ruth Bender

26. Was the audit effective? (1) If the problem is later uncovered, this is evidence, in hindsight, that the audit was not effective. (4) The audit detects the problem – effectiveness is demonstrated Yes Was there an underlying problem? (2) No direct evidence to demonstrate that the audit was not effective (3) No direct evidence to demonstrate that the audit was effective No No Yes Was the audit effective? Dr Ruth Bender

27. The pyramid of audit effectiveness The effective audit The effective audit team The effective audit firm Dr Ruth Bender

28. The effective audit The effective audit team The effective audit firm The pyramid of audit effectiveness: The Firm • Culture and leadership • Quality of people • Rigorous processes • Training and evaluation • Reward Comment from mtg with Paul Boyle about the newly-published reports of the Audit Inspection Unit: What do we do about them? Do we quiz our audit partners about them? Or is it on the FRC agenda to monitor these over time and start to challenge the rate of improvement, if improvement is needed. … Is the onus on the FRC rather than on the individual audit committees to make of it as best they can? Dr Ruth Bender

29. The effective audit The effective audit team The effective audit firm The pyramid of audit effectiveness: The Team • Is the team competent? • Do its members have knowledge of the industry? • Do they show sound judgement? • Are they objective? • Do they have integrity? Dr Ruth Bender

30. The effective audit The effective audit team The effective audit firm The pyramid of audit effectiveness: The outcome • The financial statements presented a true and fair view. • Useful areas for improvement in the company’s procedures were highlighted. • Work was completed to schedule, and with minimal disruption to the company. • The ‘boilerplate’ (i.e. all of the relevant checklists and disclosures) was covered. • The financial statements were satisfactory to the FRC, or the audit committee was made aware of instances where they might not be acceptable, and had taken an informed decision thereon. Dr Ruth Bender

31. Evaluating audit quality by proxy “ People often don’t realise just how impossible the role of the NED is. … It does come down to making judgements about what you’re hearing people saying. That’s terribly unscientific.” • Buying a service is always difficult, as is evaluating, after the event, whether that service has been carried out successfully • The published audit report is a standard document, giving no indication of quality • Impression management by auditors includes their written reports to the committee, and their oral presentations Dr Ruth Bender

32. How audit committees assess audit effectiveness

33. What does ‘good’ look like? “Do I feel comfortable that the senior management and the auditors have an open dialogue?” “You start with the presumption that the auditor is doing a good job, and appraise to see if there’s any sign that it isn’t.” “It’s three people [senior management, auditors and audit committee] who’ve all got a vested interest in getting the right result.” “The big word is ‘assurance’. You’re trying to seek assurance that what’s presented is a set of data that has integrity.” Dr Ruth Bender

34. The Role of the Audit Committee Who does what, and how? Evaluating audit quality Risk management Non-audited information Dr Ruth Bender

35. Whose job is risk management? • Risk is a Board responsibility. The boundaries of the audit committee lie somewhere below Strategic risk and above detailed Internal Control … but no agreement as to where they lie. • Risk appetite is a Board responsibility – but it is difficult to know what this is. • Financial, operational and strategic risks need to be managed in different ways. • A minority view that only financial risk is part of the audit committee’s responsibility. • Too much focus on risk management processes could lead to complacency, and not understanding the risks themselves. • Executives have the main role in risk management. • A fundamental aspect of risk management is the corporate culture, which is set from the top. (Bender, R. (2008). Risk Management: What do Independent Directors Do?, Ernst & Young, London) Dr Ruth Bender

36. The Role of the Audit Committee Who does what, and how? Evaluating audit quality Risk management Non-audited information Dr Ruth Bender

37. Non-audited information Price-sensitive disclosures such as the preliminary statement of results, interim statements, and the investor presentations, where the tone of the disclosure is often as significant as the content • There are few regulations, and a wide variety of practices • The preliminary statement is reviewed by the audit committee or the board, although timing varies • The level of review of interim statements varies • The investor presentation (script and/or slides) is not always reviewed • Boards need to ensure that appropriate processes are in place for each type of disclosure • Formal guidelines would be of use Dr Ruth Bender

38. What is financial literacy? Is it the same as accounting literacy? Does the audit committee chair need to be financially literate? Do members? Financial Literacy Dr Ruth Bender

39. Financial literacy? Dr Ruth Bender

40. “It would be a shame if everyone had to be financially literate. You may miss an important flow of information and get a one-dimensional approach.” “How can anyone have [recent and relevant experience] with regards to IFRS? … Anyone who’s been retired more than 2-3 years will have no idea – unless they’re seriously nerdy – about international accounting standards.” “I feel that I’m as up to date as I need to be. Even though I’m ten years from banking. Had I not had audit committee experience during those ten years, I would feel very exposed.” Dr Ruth Bender

41. Sometimes arranged by the Company secretary, often at the individual NED’s discretion Make use of seminars put on by Big 4 firms Some committee chairs keep track; others don’t There is a need for CPD. Some audit committee chairs acknowledge this more than others Passive training is listening to what the professionals provide. Active training is commissioning something specific. Most appears to be passive. Training the audit committee Dr Ruth Bender

42. The audit committee and the credit crunch Risk management in a cost-cutting environment Conversations with regulators A changed economic environment Dr Ruth Bender

43. What changed as the economy deteriorated? • Agreement that financial services companies are different • More focus on going concern and the realism and reliability of forecasts • More meetings with Treasury and other departments • Need for Internal Audit to focus on financials, despite pressures to become internal consultants • Wisdom of the ‘elder statesmen’ • Need for a culture of integrity Dr Ruth Bender

44. Some recurring themes Dr Ruth Bender

45. Some recurring themes throughout the ACCF meetings • Complexity of IFRS and the difficulty of understanding financial statements • Boundaries of the role of the audit committee and its growing responsibilities • Different interpretations of the role of the audit committee • Importance of culture and trust rather than just having proper processes in place – ‘Tone from the Top’ Dr Ruth Bender

46. Conclusions Every audit committee complies with the regulations; every audit committee operates in a different way. Governance is not about process, it is an attitude of mind. Culture and behaviour are more important than following rules.

47. Questions? r.bender@cranfield.ac.uk