Audit Committees: Building an Effective Audit Committee

1. Audit Committees: Building an Effective Audit Committee GOJ Audit Commission Workshop Presented by: Bruce Scott CIA, Partner, PwCbruce.scott@jm.pwc.com or 932-8335 15 October 2013 PwC Confidential

2. Agenda • Presentation objective • Setting up the audit committee • Audit Committees: Key Areas of Responsibility

3. Objective • This presentation is meant to help Audit Committees and their members work through their maze of responsibilities in a practical manner in order to be more effective (JBL speaker)

4. Understanding the Roles in Corporate Reporting & Governance • Management’s role: “Deals with day to day operations” • Board’s role: “Ensures proper policies & systems are in place” • External auditor’s role: “Gives an independent audit opinion” • Audit Committee’s role: • Sub committee of the main board – delegated authority • Provides the links between the groups above • Eases pressure off the Board in dealing with key reporting & internal controls issues • Coordinates the activities of the internal & external auditors

5. Key Questions for Audit Committees Given its role – there are a few key questions Audit Committees must answer: What knowledge or experience is required for the Committee’s success (to add value)? Which areas of responsibility should the Committee focus on? How should its activities be communicated and to whom?

6. The importance of getting the set-up of the Committee right Poor set-up will weaken the Committee’s ability to provide value added or effective services

7. Setting up the Audit Committee • The Charter – is a prerequisite for success and covers a range of items, including areas of responsibilities • Members must embrace the Charter (use it to guide behaviour and activities) • The mere existence of a Charter won’t change or improve governance

8. Setting up the Audit Committee • 2. Membership – the Committee is only as good as its members • Members must be capable of adding value (no nepotism!) • A diverse set of skills among members is required • A uniform view among members could lead to over-emphasis in one direction

9. Setting up the Audit Committee: • Independence : no conflicting relationships • Lack of independence means that members may not be able challenge management’s judgements • Majority of directors should be independent and be non executive in nature • Financially literate – able to read and understand primary statements – expected of all members • Financial expertise – at least one member • Member of the ICAJ or years of financial experience

10. Setting up the Audit Committee: • d. The Chairperson • Should have strong leadership qualities • Ability to promote effective working relationships • Knows the strengths and weaknesses of each member • Keeps the board well informed • Gets the agenda and timetable for meetings right!

11. Setting up the Audit Committee: • New members • Must be properly inducted on: • The entity • Management • The audit committee • The auditors • The industry • Should do their due diligence on the entity before taking on the role of member

12. Setting up the Audit Committee: • 3. Meetings • Chairman ensures that meetings are planned • b. Submit Audit Committee Papers on time (too much! or too late!) • c. Time commitment is required – be warned! • d. Meeting attendees: • Chief Auditor (each meeting) • External Auditor (each meeting) • Chief Financial Officer (each meetings?) • Other Executives (each meeting?) • Attorney (as needed?) • Human Resources (as needed)

13. Audit Committees: Areas of Responsibility (Focus) • The better these are executed – more value will be provided to stakeholders

14. Financial Reporting: Reviewing financial information: • Audit committees play a key role in reviewing financial information on behalf of the Board

15. Financial Reporting: Reviewing financial information • Members should be familiar with the relevant accounting framework (IFRS or Government Accounting Standards) • 2. Members should review the annual and monthly financial report /statements • Appropriateness of the accounting policies • Appropriateness of disclosure requirements • Committee will need 3 to 4 days to review • Discussion of the report with management and the auditors (also separately) • Think about fraudulent financial reporting (segregation of duties, lack of mandatory vacations, incentive schemes)

16. Understanding risk management and internal control • Risks are uncertain future events – both positive and negative – that have the potential to affect the achievement of an entity’s goals and objectives

17. Understanding risk management and internal control • A common feature of successful companies is the ability to navigate the many risks and uncertainties they face in pursuit of adding value

18. Understanding risk management and internal control Responsibility for the effective management of risk and control of an entity’s operations, lies with an entity’s CEO and management team

19. Understanding risk management and internal control To fulfil their oversight responsibilities, however, boards need to be certain that those responsibilities are carried out proactively, systematically and effectively

20. Understanding risk management and internal control • Audit Committee’s Responsibility re Risk • Management & Internal Control: • Be aware of the leading risk and controls frameworks (COSO, AS/NZS 4360, COSO) • Which risk management framework are we using? • Establish the tone at the top • Agree with management the entity’s risk appetite • Be informed about the entity’s risk profile and measures being taken to reduce significant risks • What are the top ten risks in the company and how are they being managed? • Understand the entity’s process for identifying and mitigating risk

21. Working with the external auditor • Audit Committee’s Responsibility re the external • auditor: • Appointment & remuneration • Ability of the firm to deliver a quality service • Industry knowledge • Access to other relevant skills sets • Understand the scope of the auditor’s work • Delivery of an opinion on the financial statements • Reliance on internal controls? • Reliance on the work of internal audit? • Request a detailed plan of the scope of work (accountability) • Fees sufficient to do the scope of work proposed?

22. Working with the external auditor • Audit Committee’s Responsibility re the external • auditor: • 3. Determination of the independence of the external auditor • Request declaration of independence from the auditor • Understand rotation of audit partner rules • Performance of other services by the auditor • 4. Ensuring that major control weaknesses are reported • Understand the implication of these on the financial statements • 5. Reviewing the performance of the external auditor • To be done annually • Consider firm’s capabilities, geographic audit coverage, audit approach etc

23. Understanding Internal Audit • Audit Committee’s Responsibility re the internal • auditor: • Establish strong relations with internal audit • Internal audit is a useful source of information for committee members (“eyes” & “ears”) • Have regular contact outside of audit committee meetings • Encourage a productive working relationships between the internal auditors and the external auditors • 2. Ensure that an internal audit charter exists • Clear description of the auditors mandate • Clear reporting lines of the auditor • Standards that internal audit will operate by ..IIA

24. Understanding Internal Audit • Audit Committee’s Responsibility re the internal • auditor: • 3. Resourcing the audit department • Skills: committee to understand the size and skill set of the auditors in relation to the complexity of the business environment (e.g. IT, treasury management..) • Hiring and firing the head • Outsourcing: co-sourcing or full outsourcing • 4. Understand how the auditor’s scope of work was determined • Was management involved? • Percentage of hours dedicated to each type of audit • How did the internal auditor determine what was included or excluded from the scope

25. Understanding Internal Audit • Audit Committee’s Responsibility re the internal • auditor: • 4. Understand how the auditor’s scope of work was determined • Does it include “end to end” audits? • Are fraud risks specifically covered? • 5. Understand responses to internal audit recommendations • Has management agreed with the recommendations? • Are the resolution dates reasonable to address the risks? • How long does it take the internal auditor to finalise each report? • What process is used to confirm that agreed actions have been implemented?

26. Understanding Internal Audit • Audit Committee’s Responsibility re the internal • auditor: • 6. Evaluating the effectiveness of internal audit • Important to ensure that the department is performing • Done by independent assessors at least every 5 years • The audit committee should form its own opinion even before the formal assessments are done

27. Maintaining & measuring its effectiveness The audit committee should regularly evaluate its performance against the responsibilities set out in the charter The assessment can be done individually and or collectively It is usual for the results to be reported to the board as well as being used by the audit committee for improvements

28. Maintaining & measuring its effectiveness • Audit Committee’s Responsibility re maintaining & • measuring its effectiveness • 1. Establish a training program for the members on various topics: • Business issues change rapidly and the members must be up-to-date • Accounting and financial reporting updates • Treasury operations and controls • Fraud risk • Industry updates • Training can be via bringing in external providers or via conferences or reading

29. Maintaining & measuring its effectiveness • Audit Committee’s Responsibility re maintaining & • measuring its effectiveness • 2. Emphasise the maintenance of financial literacy • If no training program is in place – have discussions with the external auditors on financial reporting developments • Attend ICAJ IFRS seminars or those put on by your external auditor • Having an executive session done (half day) by your external auditors or another provider on IFRS changes and updates

30. Maintaining & measuring its effectiveness • Audit Committee’s Responsibility re maintaining & • measuring its effectiveness • 3. Conduct individual evaluation of committee members: • The review will cover • Business knowledge • Specific areas of expertise • Objectivity and independence • Understanding the duties & responsibilities of the committee • Attendance at and contribution to meetings • Review can be done via self assessment or by an independence facilitator

31. Communicating & Reporting • Audit Committee’s Responsibility re communicating & • reporting • Communicating with management (oral presentations or reports) • Updates on major regulatory and tax changes • Updates on major frauds • Updates on the impact of internal audit report score card on performance incentives paid to management • Communication with the Board • At least an annual report to the Board but can also be quarterly – usually by the Audit Chair • Done by oral presentations or written document • Minutes of the Audit Committee meetings can also be tabled – important areas may not be highlighted in using this approach • Report includes summary of activities and recommendations

32. Communicating & Reporting • Audit Committee’s Responsibility re communicating & • reporting • Communicating with shareholders / other stakeholders (e.g. Audit Commission) • Done through the annual report and includes: • Areas covered by internal audit • Frequency of Committee meetings • Discussion interaction with internal & external auditors

33. Ethical, regulatory & compliance matters • Audit Committee’s Responsibility re ethical, regulatory • & compliance matters • If a separate compliance committee does not exist, the audit Committee usually have oversight responsibility for the area of ethics, regulatory & compliance matters

34. Ethical, regulatory & compliance matters • Audit Committee’s Responsibility re ethical, regulatory • & compliance matters • Establishment & enforcement of a Code of Conduct • The code states the company’s position of ethics & compliance issues • Employees sometimes don’t know or have easy access to policies on code and compliance issues • Bribery and its consequence • Fraud investigation procedures • Establishment of an effective compliance framework • This show how the company is meeting its obligations imposed by: • Laws, regulations, industry codes, standards of good corporate governance

35. Ethical, regulatory & compliance matters • Audit Committee’s Responsibility re ethical, regulatory • & compliance matters • 3. The Audit Committee need not know every law or regulation in detail: • Reliance is placed on the Compliance Officer if one exists or from other persons with specific responsibilities: • Legal counsel • CFO • 4. The Audit Committee oversees the whistle blowing process: • Ensures that management implements a whistle blowing system • Audit Committee takes appropriate actions when necessary and approves whistle blowing policies & frameworks

36. Summary • For Audit Committee to be more effective, • the following must apply: • The establishment of the Audit Committee (i.e. Membership, Charter etc) must be done properly • The Committee must perform well in the following areas: • Responsibility for reviewing financial statement / information on behalf of the Board • Oversight of risk management and internal controls • Working with the external auditors • Understanding and working with internal audit • Maintaining and measuring audit committee effectiveness • Communicating & reporting activities to the Board and other stakeholders • Overseeing ethical, regulatory and compliance requirements

37. Questions?