Requirements relating to Internal Financial Controls (IFC) can be found throughout the King III report on Corporate Governance. “While there is no separate or dedicated chapter on this topic, it is raised regularly throughout - in the chapters dealing with the board of directors, audit committees, risk governance and internal audit” says Anton van Wyk, PricewaterhouseCoopers’ Risk Advisory Services leader.
King III assigns responsibility of ensuring the integrity of internal financial controls to the audit committee. “One clear observation under King III is that the oversight responsibilities of the audit committee have been significantly expanded” says Van Wyk. “As part of its risk management responsibilities, the audit committee has oversight of IFC including risks impacting financial reporting as well as and fraud and IT risks, and to reinforce the audit committee’s responsibilities with regard to IFC, the Companies Act 2008 requires this committee to deal with matters and concerns relating to IFC.”
King III requires the audit committee and the board of directors to make statements in the company’s integrated report as to the effectiveness and integrity of controls. Van Wyk explains that the board is to comment on the broader concept of internal controls, which includes IFC - and the audit committee should attest specifically as to the effectiveness of IFC, also giving details of any material weaknesses that gave rise to material loss, fraud or error, and corrective action taken. The audit committee also needs to report to the board on how it has discharged its duties regarding IFC.
To be able to arrive at these conclusions as to IFC effectiveness, Nicolas Ganz, PwC SA Director – Assurance Technical, says the audit committee will have to rely on suitable review and testing, carried out by the internal audit department on an annual basis. “There will need to be a formally documented annual review of the design, implementation and effectiveness of the company’s system of internal financial controls.”
For IFC to be effective, Ganz says a company will need a solid control framework that can identify financial reporting risks and ensure controls are there to address the risk of material misstatements. “This risk-based control framework should also ensure fair presentation of the financial statement results and disclosures in accordance with generally accepted accounting principles. A suitable control framework would be one such as COSO (Committee of Sponsoring Organisations).”
Because the internal audit function is most likely to be performing the annual IFC review for the audit committee (as part of its broader internal control assessment), van Wyk says that internal audit departments should be well positioned within the company and staffed with sufficient quality resources, including a strong Internal Audit Executive.
The resultant internal audit report on IFC does not have to be made publicly available. It also does not have to be further reviewed by the external auditors. “This differs to the US Sarbanes Oxley requirement where external auditors are required to give assurance on what management has concluded about the IFC” highlights Ganz. “This is a welcome difference as the external auditors tended to take control of and drive the review by the internal auditors, an approach which did not always accommodate management’s own requirements.”
“When concluding on the effectiveness of IFC, the audit committee should not limit itself to this internal audit report” cautions Ganz. “It should consider anything else of relevance, such as information from other assurance providers, management and external auditors.”
Van Wyk advises that the approach to IFC must be cost-efficient. “There should be a sensible balance between the cost of implementing and monitoring the IFC framework and the benefits of such a framework. Of course a strong IFC framework would be of great assistance to the external auditors and should over time through a properly maintained process, assist with reduced assurance costs.
“Also, companies have tended to erroneously spend 60% of internal audit effort on 20% of the risks. A proper IFC framework should refocus this appropriately. There will be many additional benefits such as the identification of opportunities for improvements in controls and processes, fewer control embarrassments, better quality internal and external audits, increased awareness of controls throughout the business, greater ownership and accountability, and a more relevant internal audit function. Reporting on internal control effectiveness will raise the bar for the design, documentation, and operation of financial internal control. Good internal control will ensure sustained business development.” concludes Van Wyk.
Get the latest issue of FAnews