Work to do with Turnbull 2

The recent review of the Turnbull guidance on internal controls, led by HSBC FD Douglas Flint, has left a perception that there is virtually no change in the requirements, according to Martyn Jones, national technical partner at Deloitte. In reality, he says, there are three significant changes. This briefing is based on notes compiled by him.

1. There is now a requirement to give explicit confirmation that necessary actions have been, or are being, taken to remedy any significant failings or weaknesses identified from the review of the effectiveness of internal control.

Previously, there was merely an expectation that the board should consider whether necessary actions were being taken promptly to remedy any significant failings or weaknesses. There was no corresponding requirement or recommendation to publish detail on the outcome of the internal control review process except to disclose the process applied to deal with material internal control aspects of significant problems disclosed in the annual report and accounts.

2. Previously, the Turnbull guidance stated that the board “may wish” to provide additional information in the annual report to assist understanding of the company’s risk management processes and system of internal control.

This has now been amended to state that the annual report and accounts “should include” such high level information as the board considers necessary to assist shareholders’ understanding of the main features of the company’s risk management processes and systems of internal control. Deloitte’s recent review of 50 internal control statements revealed that only 60% had a description of the risk management processes and of internal control.

3. The preface to the revised Turnbull guidance now emphasises that the directors should review their application of the guidance on a continuing basis.

There should, therefore, be evidence of more than a one-off review of internal control for periods to which the revised guidance applies.

Difficulties

Jones says that the change in point 1 above, in particular, may give rise to various difficulties:

• The revised Turnbull guidance is applicable for periods commencing on or after 1 January 2006, but some boards may decide that they can adopt it early ­ for, say, 31 December 2005 year-ends with simple ‘boilerplate’ disclosure.

• Some boards will not want to imply that they have had any significant failings or weaknesses in internal control, and may, therefore, state this rather than giving a confirmation of actions. In reality, this new requirement has been introduced partly to force boards to consider properly the results of their review of the internal control system.

• Listed companies, which are also SEC registrants, might, in stating that significant failings or weaknesses are being dealt with, imply to the SEC that they may have material weaknesses in the controls relating to financial reporting that the CEO and CFO have not properly disclosed, or which have not been dealt with in the auditors’ report.

This is against the backdrop of section 397 of the Financial Services and Markets Act 2000, which makes it a criminal offence to make a statement which is known to be misleading, false or deceptive in a material respect. The maximum sentence for directors for this offence is seven years in prison, or a fine or both.

Don’t go early

Given these changes, directors should be discouraged from going early with a statement of compliance with the revised Turnbull guidance. They should also give very full consideration to the issue presented by point 1 above. Deloitte suggests a form of wording that may help manage the directors’ risk and to avoid making any unequivocal statement providing open ended assurance:

“The board confirms that the actions it considers necessary has been taken to remedy such failings and weaknesses, which it has determined to be significant from its review of the internal control. This has involved considering the matters reported to it and developing plans and programmes that it considers are reasonable in the circumstances. [The board also confirms that it has not been advised of material weaknesses in that part of the internal control system that relates to financial reporting].”

The final sentence in square brackets is suggested for inclusion certainly by SEC registrants, but potentially also by non-registrants.

Members of the board or the audit committee should also consider the following questions.

• What is regarded as ‘significant’ for the purpose of this disclosure? Is it justifiable?
• Should significant failings and weaknesses identified in the previous year, or earlier periods, be included for consideration by the board when making their statement of confirmation of actions taken?

• What indicators and sources of evidence have been examined to check whether there are significant failings or weaknesses?
These might include:
­ internal audit reports;
­ confirmations from key department heads and from management of significant subsidiaries and divisions;
­ reports by regulators;
­ internal correspondence;
­ history of past problems.

• Has consideration been given to whether an identified failing or weakness has also affected or could also affect other areas of the business?

• Is someone allocated to each identified significant failing or weakness to ensure that it is properly managed and reported upon?

• Is there sufficient documentation of the plans and remedial programmes in respect of the rectification of significant failings and weaknesses? Has there been adequate follow-up on this plan? Is separate assurance work necessary?

• Have proper key risk indicators and project reporting measures been put in place for each identified significant failing or weakness?

• Are the heads of internal audit and the director of risk management satisfied with the proposed disclosure?

• Are there sufficient board papers on this issue as a whole?

• How are these matters to be kept under review on a continuing basis?