Charles Garbowski Senior Director Research March 16, 2007

1. R E S E A R C H ACI Second AnnualGlobal Audit Committee Survey K P M G L L P Charles GarbowskiSenior DirectorResearchMarch 16, 2007

2. Objectives And Methodology

3. Objectives • Gauge input from Audit Committee Members regarding trends in: • Audit Committee risk oversight responsibilities • Audit Committee processes • Issues affecting Audit Committees • Composition / background of Audit Committees and their members • Relationships with other company functions / executives • Assess differences in Audit Committee processes, issues, and trends based on global region

4. Methodology • Analysis based on 1,343 electronic and paper surveys conducted November 2006 – February 2007 in the following global regions: • Americas (567 respondents) • Europe (563 respondents) • Africa (86 respondents) • Asia (126 respondents) • Other / unspecified international (1 respondents) • Findings compared to the results of a survey of global Audit Committee members conducted November, 2005 – January, 2006

5. Methodology • Americas: • Brazil • Canada • Mexico • U.S. • Europe: • Belgium • Cayman • France • Germany • Ireland • Italy • Liechtenstein • Luxembourg

6. Methodology • Europe (Contd.): • Netherlands • Poland • Spain • Switzerland • U.K. • Africa: • Namibia • South Africa • Zambia

7. Methodology • Asia: • Australia • China • Hong Kong • India • Malaysia

8. Methodology • Respondents are all Audit Committee Members of at least one company • U.S. respondents are all Audit Committee Members of at least one public company • Respondents were asked to respond based on the largest company (by revenue) for which they serve as an Audit Committee Member • U.S. respondents were asked to respond based on the largest public company for which they serve as an Audit Committee Member • For international companies in which a Supervisory Board fulfills the Audit Committee role, respondents answered based on the Supervisory Board’s Audit Committee activities

9. Overview

10. Overview • Risk management, internal controls are the top priorities for Audit Committee members • Across global regions • Audit Committees are overseeing various aspects of their companies’ information technology • Believe AC and Boards could be doing more in the area of IT risk oversight • As in 2006, Audit Committees generally believe they are effective, but could do better • Many Audit Committee members still lack complete confidence in their Chief Audit Executive

11. Overview • Chief Audit Executives are typically audit professionals not slotted for line management positions • AC members believe this is appropriate • Even more so than in 2006, Audit Committees are generally pleased with their extra-committee interactions • External Auditor is gaining prominence with Audit Committees • High satisfaction with external auditor communications • Along with BOD, tops in providing constructive AC suggestions • CFOs attend AC meetings most often • Outside legal counsel, non-AC Directors, Tax attend least • Audit Committee Member time commitment still varies by region • As in 2006, most work 100 hours or less per committee

12. Key Findings

13. Key FindingsThe Audit Committee And Risk Oversight • Audit committee’s highest priorities: • Risk management (6 in 10) • Internal controls (6 in 10) • Accounting judgments and estimates (half) • Risk management, internal controls are top 2 in all global regions: • Americas rates internal controls highest • The other 3 regions rate risk management highest RISK MANAGEMENT, INTERNAL CONTROLS ARE THE TOP PRIORITIES FOR AUDIT COMMITTEE MEMBERS, ACROSS GLOBAL REGIONS

14. Key FindingsThe Audit Committee And Risk Oversight • Audit Committees have primary oversight responsibility for various areas of information technology, in particular: • IT compliance and controls (two thirds) • Business continuity (half) • The top choice in Africa (8 in 10) • Information security and privacy (just under half) • Only 2 in 10 don’t have responsibility for any of these • 1 in 3 are not satisfied that their Audit Committee devotes sufficient agenda time to IT risk oversight • Only 1 in 10 very satisfied • Trend similar across global regions AUDIT COMMITTEES ARE OVERSEEING VARIOUS ASPECTS OF THEIR COMPANIES’ INFORMATION TECHNOLOGY; NOT SATISFIED WITH THEIR ATTENTION TO IT RISK

15. Key FindingsThe Audit Committee And Risk Oversight • Few are very satisfied with Board’s IT risk oversight: • Business continuity (1 in 5) • IT compliance and controls (less than 1 in 5) • Information security / privacy (less than 1 in 5) • These areas rated low across global regions AUDIT COMMITTEES ALSO BELIEVE THEIR BOARDS COULD BE DOING MORE IN THE AREA OF IT RISK OVERSIGHT

16. Key FindingsAudit Committee Evaluation Of Committee / Processes • As in 2006, Audit Committees rate themselves at least somewhat effective overall • Nearly half indicate room for improvement • Somewhat effective (4 in 10) • Needs improvement (just under 1 in 10) • Americas members rate their Audit Committee effectiveness highest AS IN 2006, AUDIT COMMITTEES GENERALLY BELIEVE THEY ARE EFFECTIVE, BUT COULD DO BETTER

17. Key FindingsAudit Committee Evaluation Of Committee / Processes • General satisfaction, with room for improvement in the following (similar to 2006): • Time and attention devoted by AC to its duties • Approach used to establish AC agenda • Americas respondents generally more positive about their processes in these two areas • Current self-evaluation approach • Lowest satisfaction of the three

18. Key FindingsCommittee Relationship With Internal Audit • 3 in 10 still have some doubts about whether Chief Audit Executive would report senior management controversies to Audit Committee • Asia members least confident in their Chief Audit Executive • Less than 6 in 10 are very confident • Only 4 in 10 are very satisfied with the effectiveness of their IA function • Somewhat satisfied: half • Not satisfied: Just under 1 in 10 • Trend similar across global regions MANY AUDIT COMMITTEE MEMBERS STILL LACK COMPLETE CONFIDENT IN THEIR CHIEF AUDIT EXECUTIVE

19. Key FindingsCommittee Relationship With Internal Audit • Globally, AC members believe Chief Audit Executive should report to the Audit Committee functionally • Trend similar across regions • CEO, CFO administratively • Asia cites CEO most • Most (8 in 10) do not plan to use Chief Audit Executive as stepping stone to line management • Two thirds say this is appropriate • Across regions, majority agree CHIEF AUDIT EXECUTIVES ARE TYPICALLY AUDIT PROFESSIONALS NOT SLOTTED FOR LINE MANAGEMENT POSITIONS; AC MEMBERS BELIEVE THIS IS APPROPRIATE

20. Key FindingsRelationship With Other Parties • Satisfaction with executive support inched up in many areas • Still highest for CFO, Chief Audit Executive • Many still expect more from their outside counsel • Lowest rated in all regions • ACs rate CFO executive sessions most productive (nearly 8 in 10 rate very productive, among those who hold sessions regularly) • Chief Audit Exec (7 in 10) • External audit partner (two thirds) • CEO (6 in 10) • In-house general counsel sessions the lowest (just under half) • Many do not hold regular executive sessions with in-house counsel • Almost all do with CFO/external auditor EVEN MORE SO THAN IN 2006, AUDIT COMMITTEES ARE GENERALLY PLEASED WITH THEIR EXTRA-COMMITTEE INTERACTIONS

21. Key FindingsRelationship With Other Parties • Two thirds of Audit Committee members very satisfied with the communication between them and their external auditor • Nearly everyone else somewhat satisfied • Americas most satisfied • Globally, BoD and external auditor still top two in providing constructive suggestions to improve audit committee • External auditor (previously a distant second) has closed gap • Now leads in Americas, Africa EXTERNAL AUDITOR IS GAINING PROMINENCE WITH AUDIT COMMITTEES GLOBALLY

22. Key FindingsRelationship With Other Parties • Over 9 in 10 say CFOs almost always attend AC meetings • Followed by Chief Audit Executive (8 in 10) • External audit partner is third (two thirds) • Outside legal counsel, Non-AC Directors, Tax Directors attend least • Some differences in attendance by region CFOs ATTEND AC MEETINGS MOST OFTEN, FOLLOWED BY CHIEF AUDIT EXEC AND EXTERNAL AUDIT PARTNER

23. Key FindingsAudit Committee Time Commitment • As in 2006, 3 in 4 expect to spend 100 hours or less fulfilling their Audit Committee member role in upcoming year • Over a third still expect to spend less than 50 hours • Americas AC members most likely to spend over 100 hours on their AC duties • Globally, the frequency of Audit Committee meetings is slightly down: • 2006: 6.5 per year • 2007: 6.0 per year • Americas Audit Committees meet most often AUDIT COMMITTEE MEMBER TIME COMMITMENT STILL VARIES BY REGION; AS IN 2006, MOST WORK 100 HOURS OR LESS PER COMMITTEE

24. Key FindingsAudit Committee Time Commitment • Average number of face-to-face meetings is flat • 4.8 (4.9 in 2006) • Average number of teleconferences is down • From 1.6 to 1.2

25. Key FindingsComposition / Background And Other Practices • Similar to 2006, most Audit Committees have 3 – 4 members • Africa has the largest Audit Committee size (4.9) • Americas (4.0) • Asia (4.0) • Europe (3.9) • Audit Committee split regarding the practice of memorializing its self-evaluation in writing • Trend similar across regions

26. Detailed Findings

27. Audit Committee’s Oversight Responsibility Priorities: Risk Management, Internal Controls, Accounting Judgments n = 1319 Multiple Responses Allowed Q10. Which areas of oversight will be the highest priorities on your audit committee agenda for 2007? (Select three)

28. Differences In Priorities - By Region Multiple Responses Allowed Contd.. Q10. Which areas of oversight will be the highest priorities on your audit committee agenda for 2007? (Select three)

29. Differences In Priorities - By Region Multiple Responses Allowed Q10. Which areas of oversight will be the highest priorities on your audit committee agenda for 2007? (Select three)

30. Two Thirds Say Audit Committee Primary IT Oversight Responsibility: IT Compliance / Controls n = 1290 Multiple Responses Allowed Q20. For which of the following areas of information technology (IT) does your audit committee have primary oversight responsibility?

31. African Audit Committee Primary IT Oversight Responsibility: Business Continuity May Not Add Up To 100% Due To Rounding Q20. For which of the following areas of information technology (IT) does your audit committee have primary oversight responsibility?

32. 1 in 3 Not Satisfied That AC Devotes Sufficient Agenda Time To IT Risk Oversight; Only 1 in 10 Very Satisfied n = 1231 Q21. How satisfied are you with that your audit committee devotes sufficient agenda time to the oversight of IT risk?

33. Trend Similar Across Regions Q21. How satisfied are you with that your audit committee devotes sufficient agenda time to the oversight of IT risk?

34. Low Satisfaction With Board’s IT Risk Oversight n 1221 1244 1212 May Not Add Up To 100% Due To Rounding Q22. How satisfied are you with your board’s oversight of the following IT risks?

35. Satisfaction With Board’s IT Risk Oversight – Americas n 501 511 507 May Not Add Up To 100% Due To Rounding Q22. How satisfied are you with your board’s oversight of the following IT risks?

36. Satisfaction With Board’s IT Risk Oversight – Europe n 519 532 509 May Not Add Up To 100% Due To Rounding Q22. How satisfied are you with your board’s oversight of the following IT risks?

37. Satisfaction With Board’s IT Risk Oversight – Africa n 83 81 78 May Not Add Up To 100% Due To Rounding Q22. How satisfied are you with your board’s oversight of the following IT risks?

38. Satisfaction With Board’s IT Risk Oversight – Asia n 118 120 118 May Not Add Up To 100% Due To Rounding Q22. How satisfied are you with your board’s oversight of the following IT risks?

39. Audit Committee EvaluationOf Committee / Processes

40. As In 2006, ACs Rate Themselves At Least “Somewhat Effective”; But Nearly Half Indicate Room For Improvement % Saying Effective2006 – 95%2007 – 92% May Not Add Up To 100% Due To Rounding Q25. How would you rate the overall effectiveness of your Audit Committee?

41. Americas Rate Their Audit Committee Effectiveness Highest May Not Add Up To 100% Due To Rounding Q25. How would you rate the overall effectiveness of your Audit Committee?

42. Nearly All At Least Somewhat Satisfied With Time/ Attention Devoted To AC Duties; Opportunity To Improve Remains % Satisfied2006 – 93%2007 – 91% May Not Add Up To 100% Due To Rounding Q8. How satisfied are you that the Audit Committee devotes an appropriate amount of time and attention to its duties?

43. Americas Most Satisfied With Time/ Attention Devoted To AC Duties May Not Add Up To 100% Due To Rounding Q8. How satisfied are you that the Audit Committee devotes an appropriate amount of time and attention to its duties?

44. As In 2006, AC Members At Least Somewhat Satisfied With Approach Used To Establish AC Agenda; Room To Improve % Satisfied2006 – 91%2007 – 92% May Not Add Up To 100% Due To Rounding Q9. How satisfied are you with the approach used to establish the Audit Committee’s agenda/work plan?

45. Americas Most Satisfied With Approach For Establishing Audit Committee Agenda / Work Plan May Not Add Up To 100% Due To Rounding Q9. How satisfied are you with the approach used to establish the Audit Committee’s agenda/work plan?

46. Most Respondents Only “Somewhat Satisfied” That AC’s Self-Evaluation Approach Enhances Its Effectiveness Among Those With A Self-Evaluation Process % Satisfied2006 – 93%2007 – 92% Q26. How satisfied are you that your Audit Committee’s current self-evaluation approach enhances its effectiveness?

47. Trend Similar Across Regions Among Those With A Self-Evaluation Process May Not Add Up To 100% Due To Rounding Q26. How satisfied are you that your Audit Committee’s current self-evaluation approach enhances its effectiveness?

48. Committee Relationship With Internal Audit

49. 3 In 10 Still Have Some Doubts Whether Chief Audit Exec Would Report Sr. Management Controversies To AC Among Those With Internal Audit Function % Not very confident 2006 – 31%2007 – 30% Q16. How confident are you that your company’s Chief Audit Executive would report any controversial issues involving senior management to the Audit Committee?

50. Asia AC Members Least Confident In Chief Audit Executives Among Those With Internal Audit Function May Not Add Up To 100% Due To Rounding Q16. How confident are you that your company’s Chief Audit Executive would report any controversial issues involving senior management to the Audit Committee?