Disclosure, corporate social responsibility and stakeholders

Question 1

What is the difference between disaster recovery planning and business continuity planning?

Answer 1

A disaster recovery plan is a plan of what needs to be done immediately after a disaster to recover from the event. The disaster is of a nature unconnected with the company’s business and outside the control of management. Examples of disasters are:
* natural disasters, such as major fires or flooding or storm damage to key installations or offices;
* IT disruptions; and
* major terrorist attacks.

Business continuity planning goes beyond procedures that should be taken in an emergency, such as a fire or explosion
in a building. It is intended to establish, in advance, a plan of what a company needs to do to ensure that its key products

and/or services continue to be delivered in the longer-term, i.e. a plan for the sustainability of the business. A business continuity plan should be developed from the disaster recovery planning and the risk management process. It should seek to make the company ready to take advantage of the longer-term threats to the business, thus giving the company competitive advantage over competitors who are not planning for the future sustainability of their business.

It is important for the board to be involved in both disaster recovery and business continuity planning as both are critical to the on-going activity of the business.

Question 2

What is the difference between triple bottom line reporting and integrated reporting?

Answer 2

The difference is that triple bottom line reports describe the organisation’s non-financial performance, both positive and
negative, in areas such as the environment, society and governance.
Integrated reports, on the other hand, combine financial and non-financial information and are usually targeted at
investors.

Question 3

How can company mislead the market in financial reporting? (5)

Answer 3

A company can misreport their financial numbers to improve its financial position through:
* policies - the adoption of accounting policies that give a more flattering picture of the company’s position.
* early profits - claiming that revenue or profits were earned earlier than they were. This can happen when a company has a contract for several years. Revenue from the contract can be accounted for in the first year instead of being spread over the life of the contract.
* spv - taking debts off the company’s balance sheet. This can be achieved by transferring these debts to other companies (special purpose vehicles).
* loan - disguising money from loans as operating income so that the company’s reported cash flow from operating activities is increased.
* over-valuing the company’s assets.

Question 4

You are the company secretary of a clothing retail business and as the person responsible for risk, you have been asked to complete the risk register for the following risk, which has been related high. Propose a treatment and a method of measuring the effectiveness of the treatment: theft of clothes from the store.

Answer 4

Treatment – security tags on each item.
Monitoring – stock auditors carrying out regular audits.

Question 5

What is a safe harbour?

Answer 5

This means a director will be liable only in relation to statements in directors report (which includes the business review), the directors’ remuneration report and summary financial statements, which are untrue or misleading and are made in bad faith or recklessly or when there is deliberate and dishonest concealment of material facts. Also, that liability is only to the company and not to any third party.
This safe harbour addresses the concern of directors over liability for negligence when making, for example, forward- looking statements in the reports, in particular, the strategic report. The directors’ liability is limited to the company rather than to third parties.

Question 6

What is risk appetite and risk tolerance?

Answer 6

Risk appetite is the level of risk that an organisation is willing to take in the pursuit of its objectives. It should be set by the board who should review its level regularly as the business environment changes.

Risk tolerance is the amount of risk that an organisation is prepared to accept in order to achieve its financial objectives.
It is expressed as a quantitative measure. For example, in banks, the value at risk (VaR) for a portfolio.

Question 7

What are some of the major problems with traditional corporate reporting? (7)

Answer 7

• Annual reports have become so detailed and extensive that many are totally inaccessible to the average reader.
• Annual reports present the historic performance and activities of the company over the previous financial year.
• Annual reports tend to focus on the financial performance of the company excluding information on non-financial
  matters.
• Some intangibles are excluded – such as good corporate governance, brand recognition, good reputation and sound risk management.
• Some costs are excluded – e.g. the environmental costs of using up natural resources that can never be
  regenerated, and of the impact of carbon emissions on climate change are excluded from financial accounting.
• Different reports are prepared for different users, for example, sustainability report and corporate governance report. Each of these reports tries to meet the demands of a particular stakeholder group. These reports are often not connected as they are developed by different departments within the organisation that are not talking to each other. The result is that they end up showing each stakeholder group a different aspect of the organisation.
• By focusing on financial reporting only, organisations have been pushed into short-termism as they strive to meet
  the requirements on a quarterly or six-monthly basis of the markets.

Question 8

Give three examples of why a company would choose to voluntarily report on its CSR activities. (9)

Answer 8

• reputation of brand
• ethical considerations
• innovation and learning
• employee motivation
• risk management or reduction
• access to capital/increased shareholder value
• economic considerations
• strengthened supplier relationships
• market position improvement
• improved relations with government
• cost savings

Question 9

Explain the difference between downside and upside risk?

Answer 9

Downside risk is the risk of something bad happening that affects an organisation’s ability to meet its strategic objectives. Examples are a fire or an IT breakdown. Upside risk is where an organisation performs better than expected, which creates its own risks – for example, the take-up of a product being more than anticipated which could lead to a risk that the product will not be available, and the organisation may be seen as unreliable.

Question 10

What areas should be covered in a cybersecurity policy?

Answer 10

The cybersecurity policy should inform employees and other authorised users of the company’s technology the requirements for protecting that technology and the information it contains from a cyberattack. The policy is usually made up of three parts:
* Physical security of the technology. This section explains the importance of keeping the physical asset secure – locking doors, surveillance, alarms etc.

• Personnel management. This section explains to employees how to conduct their day-to-day activities – password management, keeping confidential certain information, the use of the internet, the use of memory sticks etc. Some organisations go as far as restricting access to the internet and sealing the ports of computers for UBS devices in an attempt to stop viruses and malware from being introduced into their systems.
• Hardware and software. This section explains to the technology administrators what type of technology and software to use and how networks should be configured to ensure they are secure. Due to the technical nature of this part of the policy, boards may wish to get independent advice on the recommendations of management in this area.

Question 11

What changed to create an interest in the social responsibility of companies?

Answer 11

By the late 1980s, society was becoming more and more concerned with the behaviour of corporations and their lack of concern for the communities within which they operated. There was a belief by some that short-term profits were being focused on to the detriment of long-term profitability and sustainability, not just of the organisations but also of
society as a whole. In 1991, a theoretical debate on ‘doing well by doing good’ was started by the Porter hypothesis that the financial benefits from innovation induced by CSR more than offset the engagement and compliance costs. There has also been a growing recognition since the early 1990s that the reputational impact of a good CSR rating is positive as the outside world sees the organisation as decent, trustworthy, and good to its employees, the community and the environment. Evidence shows that this increases the financial returns for an organisation’s investors.

Question 12

Briefly describe the four areas over which the audit committee would typically have responsibility?

Answer 12

The FRC in their ‘Guidance on Audit Committees’ provides information about the role and responsibilities of the audit committee. These include:

Annual reports and other periodic reports

Internal control and risk management systems

Internal audit

External audit

Question 13

What is the audit committee’s relationship with shareholders?

FRC Guidance on Audit Committees, para 80

Answer 13

The FRC Guidance on Audit Committees states that the audit committee has a role in ensuring that shareholder interests are properly protected in relation to financial reporting and internal control.

In carrying out this role the audit committee should:
* consider the clarity of its reporting and be prepared to meet investors; and
* develop for inclusion in the annual report, a separate report describing the work of the audit committee in discharging its responsibilities, which should be signed by the chair of the audit committee.

The chair of the audit committee should be present at the annual general meeting to answer questions on the separate section of the annual report describing the audit committee’s activities and matters within the scope of the audit committee’s responsibilities.

Question 14

List four common failures of boards in relation to risk management. (10)

Answer 14

• Failure to take responsibility for risk at the board level.
• Failure to see the importance of risk to the organisation as a whole.
• Failure to capture the major risks of the organisation.
• Failure to consider the integrated nature of risk.
• Failure to put in place the appropriate control or other mitigants for risk.
• Failure to manage reputational risk.
• Failure by the board to map out clearly, often in a risk manual, who has responsibility for what at what level of the organisation.
• Failure to consider, decide or articulate effectively the risk appetite for the organisation.
• Failure to obtain and share timely and good quality information can lead to heightened risk within an organisation.
• Failure of the board to appropriately challenge management on the proposals brought to the board can create risk.

Question 15

What is the purpose of financial reporting and how is that purpose different from in listed companies (9)

Answer 15

Below is a list of users of a company’s financial reporting and why they find it of interest.
* investors - dividends, profit
Potential investors are interested in the ability of the company to generate net cash flows for dividends, distributable profits, or an increase in the share price, and to assist the decision to buy, hold or sell equities. They are also interested in assessing the stewardship or accountability of management.

• cash flow - Creditors are interested in the amounts, timing, and uncertainty of future cash flows that will give rise to interest, repayment of borrowings, and/or increases in the prices of debt securities. They are interested in the security of their debt.
• pay a debt - suppliers are interested in the fact that the entity may be able to pay a debt, when it comes due, for goods or services provided to the entity.
• stability - employees are interested in the stability, profitability, and growth of their employer, which gives rise to the continuing ability to pay salaries, wages, and other employment-associated benefits.
• supply - customers are interested in ensuring the continued supply of goods or services, especially if these customers have a long-term association with or are dependent on the company.
• taxation - governments are interested in the efficient allocation of economic resources, determining and applying taxation to
  the entity and/or for preparing national statistics.
• compliance - regulators are interested in being able to assess that the company is complying with all of the laws, regulations, standards and codes applicable to it.
• activity - the public has variable interests – including the assessment of the company’s prosperity, activities and ability to continue participating in the local economy and in local activities.
  The financial reporting requirements for listed companies are more rigorous than those for private companies. This is due to the fact that listed companies also have to be accountable and transparent to their shareholders. This is due to the separation of ownership and control between the shareholders and the board of the company whom the shareholders appoint to manage the company on their behalf.

Question 16

What matters should the company secretary consider when handling insider information? (5)

Answer 16

Managing insider information is a major part of the company secretary role. The following are some of the matters that the company secretary may consider when handling insider information:
* Confidentiality of board papers. Extra care should be taken when distributing paper board packages. This might mean using double envelopes, anti-tear envelopes, and even hand delivery rather than email or courier. If documents are made available electronically through a board portal, the company secretary should make sure the system is as secure as possible, for example, by encrypting documents.
* Careful consideration may have to be given to securing the computers used to prepare the papers to be included in the package. If shared drives are used or computers are networked, the company secretary should know who has access to these drives and networks. If a password is needed to access certain drives, the company secretary should know that usually the administrator of the system (often an IT person or sometimes an outsourced person) can access the drive/folder. It has been known in highly sensitive transactions for the papers to be prepared and kept on an offsite server usually maintained by the company’s law firm.
* Confidentiality of board discussions. The company secretary should consider the following:
– Is the room in which the board is meeting soundproof?
– Can anyone see into the room from outside? Especially, if a PowerPoint presentation is made, will it be visible?
– Some listed companies even check for listening devices and coat windows so that no one can see in to ensure
confidentiality.
* Insider lists. These lists are often required by regulators for listed companies, although they can be used by any company involved in a commercially sensitive project. To control the spread of confidential information, insider lists contain the names of people, internally and externally, who are aware of the project. Only those on the list can discuss the project. If someone else needs to be consulted, they have to be added to the list. The company secretary is often the holder of the insider lists.
* The communication plan for the project. The company secretary may be asked on behalf of the board to work with management to produce a communication plan for the project. This will indicate who should be communicated to, how, and when. If the company is listed or is a regulated business, then any regulations for communications should be reflected in the plan. For example, a listed company may have to make a regulatory announcement before it can release information to others.

Question 17

Define narrative reporting.

Answer 17

Narrative reporting describes the additional non-financial information which is included in companies’ annual reports providing a wider, and some would argue a more meaningful, picture of the company’s business, its strategy, and future prospects.

Question 18

Why is it important for companies to think in an integrated way?

Answer 18

Integrated thinking considers things in a balanced way to allow the effective and efficient utilisation of the capital resources available to an organisation when developing strategy or decision making. These capitals are growing rare and therefore costs to the organisation are growing. It is important for an organisation to manage resources in the most effective way.

Question 19

Why should boards routinely monitor and review the organisation’s systems of risk management and internal controls?

Answer 19

The existence of risk management and internal control systems does not, on its own, indicate that risk and internal controls are being managed effectively within an organisation. The board (or audit committee) should, on an ongoing basis, monitor and review the systems to ensure that they:
* remain aligned with the organisation’s strategic objectives;
* address the risks facing the organisation;
* are being developed, applied and maintained appropriately for the organisation.

Question 20

What concerns should an employee raise through a whistleblowing procedure? (8)

Answer 20

An effective whistleblowing procedure should allow for an employee to raise concerns about illicit behaviour, usually in one of the following areas:
* fraud;
* a serious violation of a law or regulation by the company or by directors, managers or employees within the company;
* a miscarriage of justice;
* offering or taking bribes;
* price-fixing;
* a danger to public health or safety, such as dumping toxic waste in the environment or supplying food that is unfit for
consumption;
* neglect of people in care; or
* in the public sector, gross waste or misuse of public funds.

Question 21

What is the difference between the UK and US models of risk management and internal control systems?

Answer 21

The US system separates the two systems whereas the UK model considers risk management and internal control systems jointly.

Question 22

What are the benefits of risk management to an organisation? 4/4/3

Answer 22

For operational performance:
* Increases the likelihood of achieving business objectives.
* Uses incidents to highlight the risk environment and helps management to enhance risk awareness and develop performance indicators or risk indicators to improve business performance and processes.
* Facilitates monitoring and mitigation of risk in key projects and initiatives.
* Provides a platform for regulatory compliance and building goodwill.

For financial performance:
* Protects and enhances value by prioritising and focusing attention on managing risk across and organisation.
* Contributes to a better credit rating, as rating agencies are increasingly focusing on the risk management of organisations.
* Builds investor, stakeholder and regulator confidence and shareholder value.
* Reduces insurance premiums through demonstrating a structured approach to risk.

For decision making:
* Shares risk information across the organisation, contributing to informed decisions.
* Facilitates assurance and transparency of risks at board level.
* Enables decisions to be made in the light of the impact of risks and the organisation’s risk appetite and tolerance.

Question 23

What parts of an annual report and accounts are examples of narrative reporting?

Answer 23

• the chair’s statement;
• the directors report;
• the directors’ remuneration report;
• the corporate governance report;
• the strategic report.

Question 24

3. Why do companies have external assurance of their CSR initiatives?

Answer 24

Many organisations are obtaining external assurance for their CSR initiatives and sustainability reports. These assurances provide a measure of credibility as they are performed by third parties.

Question 25

What is the responsibility of a board of directors for risk and internal controls?

Answer 25

Principle O of the UK Corporate Governance Code states that:
‘The board should establish procedures to manage risk, oversee the internal control framework, and determine the nature and extent of the principal risks it is willing to take in order to achieve its long-term strategic objectives.’
The Principle is supported by the following Provisions:

‘28. The Board should carry out a robust assessment of the company’s emerging and principal risks. The board should confirm in the annual report that it has completed this assessment, including a description of its principal risks, what procedures are in place to identify emerging risks, and explanation of how these are being managed or mitigated.

29. The board should monitor the company’s risk management and internal control systems and, at least annually, carry out a review of their effectiveness and report on that review in the annual report. The monitoring and review should cover all material controls, including financial, operational and compliance controls.’

Question 26

Why was the Corporate Reporting Dialogue established?

Answer 26

In June 2014, the Corporate Reporting Dialogue was convened by the International Integrated Reporting Council to create dialogue and alignment between the key sustainability standard setters and framework developers.
The Corporate Reporting Dialogue has already adopted a statement of Common Principles of Materiality, developed a common map of the reporting landscape and taken a common position in support of the Financial Stability Board Task Force on Climate-related Financial Disclosure. In November 2018, the Corporate Reporting Dialogue announced a project aimed at:
* aligning all current sustainability standards with the TCFD recommendations published in June 2017;
* identifying the similarities and differences between the current standards and frameworks to create even greater alignment, taking into account the different requirements of each set of standards and frameworks; and
* continuing dialogue with financial reporting standard setters towards integrating financial and non-financial reporting.

Question 27

What are the six capitals that companies need to manage effectively and in an integrated way? (6)

Answer 27

• Financial capital – money, equity, bonds, monetary value of assets, etc. that an organisation needs to operate.
• Human capital – the collective skills and experience of the people that work for the organisation.
• Manufactured capital – physical means and infrastructure needed for an organisation to provide its products and
  services, e.g. fixed assets.
• Intellectual capital – patents, copyright, designs, goodwill, brand value and knowledge accumulated, i.e. intangible assets.
• Natural capital – natural resources and energy that the organisation depends on to produce its products/services.
• Social capital – value added to an organisation by the social relationships with individuals and institutions that an organisation has developed through its stakeholder engagement.

Question 28

Who is responsible for detecting fraud in a company?

Answer 28

BoD

The external auditors’ report provides an opinion on compliance with the law and accounting standards, and whether the accounts that have been prepared by the board present a true and (in some cases) fair picture of the financial reality of the company. They are not responsible for detecting fraud or errors in the organisation’s financial statements.

Question 29

Why is there a greater focus on the longer-term in organisations?

Answer 29

By focusing on the long-term sustainable success of the company, organisations should generate value for shareholders and contribute to wider society.

Question 30

Explain the difference between CSR, corporate citizenship and sustainability.

Answer 30

There is no one definition of CSR. Some organisations understand it as purely charitable giving, others as an integral part of their business models and hence strategic planning. Others combine their environmental activities with CSR. The type of involvement in CSR by organisations will depend on their operational activities, their understanding of CSR, and the philosophy and values of their organisation.

The term corporate citizenship has a wider definition than CSR. Corporate citizenship describes how companies should act in the same way as the citizens of the countries in which they operate, that is, to meet the countries’ legal, social, ethical and economic responsibilities expected of its citizens. This requires companies to balance the financial needs of its shareholders with the societal need of the countries within which it operates.

The term sustainability refers to an organisation focusing on its long-term survival. It requires organisations to balance their current requirements for operating their businesses, without compromising the needs of future generations. In doing this, CSR obviously plays a part in ensuring the long-term survival of the organisation – this is often why the two terms are linked.

Question 31

What are the GRI Standards and why are they important?

Answer 31

common language
The GRI (GLOBAL REPORTING INITIATIVE) Sustainability Reporting Standards (GRI Standards) were introduced for reports and other materials published on or after 1st July 2018. The GRI Standards are the first and most widely adopted global standards for sustainability reporting.
GRI Standards create a common language for organisations and stakeholders, with which the economic, environmental, and social impacts of organisations can be communicated and understood. They have been designed to enhance
the global comparability and quality of information on these impacts, thereby enabling greater transparency and accountability of organisations.

Question 32

Why is it important to set CSR targets and link them to executive pay?

Answer 32

To be able to report on their CSR activities organisations need to be able to set non-financial targets and measure their
progress against targets.
Using targets as part of the performance criteria in bonus and incentive schemes for senior executives ensures that CSR needs within companies are taken seriously and that targets are actively worked towards.
However, boards in the absence of CSR metrics have retained the right to reduce incentive awards in cases of substantial damage to the company’s business or reputation resulting from an event that has had a negative effect on the environment, society or the organisation’s long-term sustainability. For example, an oil spill where inadequate precautions tied to the activities of senior executives can be shown.

Question 33

What should the company secretary do to minimise boardroom disputes? (9)

Answer 33

The company secretary can take the following steps to minimise boardroom disputes:
1) clear roles - ensure that the roles of the board members have been set out in a clear and concise way in their appointment letter.
2) induction - on appointment, a comprehensive induction programme should be held to ensure that there is no misunderstanding as to what is expected from the board members.
3) manual - there is a board charter/governance manual setting out what the roles of the board, board committees and senior management team are.
4) delegation of authority to the CEO is clearly documented.
5) proper flows of information to and from the board. The board requires sufficient information to make informed
decisions. Management require prompt communication of board decisions.
6) in agenda development, ensuring that there is plenty of time allowed for discussion, debate and deliberation of the matters brought to the board.
7) advising the chair to agree with the board ground rules for behaviour, attire etc. during board meetings.
8) creating the right environment within the boardroom for calm, effective meetings and decision making. This can include:
– Shape of the table
– Seating arrangements
– Lighting and heating
– Make sure there are plenty of breaks
– Being prepared to break a tense situation by advising the chair to take a break, asking for clarity for the minutes etc.
9) encouraging the creation of a good culture within the board. This can be achieved by building relationships and trust between board members. Giving plenty of opportunity for board members to get to know each other through lunches or dinners, annual board retreats, board trainings etc.

Question 34

Why might an organisation decide to have a risk committee? (4)

Answer 34

In some cases, the audit committee may be overwhelmed by its other duties covering financial reporting and internal controls or may not have the necessary skill set required for the governance of risk. In these cases, the board may decide to establish a separate risk committee.
The size of the organisation and the sector the organisation is operating in may also determine whether responsibility for reviewing internal controls and risk management is dealt with in the same board committee, the audit committee, or whether two separate committees, one for audit and the other for risk, are established.
Banks and other large financial institutions normally have separate risk committees due to the complexity of their risk exposure. A growing number of listed non-financial companies, for example in the oil industry, are also finding it useful to establish a separate risk committee. The benefits of a separate risk committee are:
* It can focus solely on reviewing the organisation’s risk management and providing assurance to the board that risk management and the processes for the control over risk are effective.
* It can give the board advice and make specific recommendations on risk appetite, the organisation’s risk tolerance
and strategies to manage risk.
* It can provide input into strategy formulation by helping the board to understand the key risks facing the organisation and the opportunities available to the organisation by managing those risks.
* The composition of the committee is not restricted by the requirements of the corporate governance code. An audit committee is required to be composed of all independent directors. A separate risk committee can have executive directors and non-board members to strengthen the skills and experience of the committee.

Question 35

Give three reasons why companies initiate CSR activities (5)

Answer 35

Organisations have realised that they can use CSR activities for the following:
* To obtain competitive advantage.
* To reduce risk, especially reputational risk.
* To attract human capital.
* For innovation.
* For sustainability.

Question 36

What are the six principles of the Ministry of Justice Guidance on the UK Bribery Act 2010?

Answer 36

• Proportionate procedures. The procedures of a commercial organisation to prevent bribery should be proportionate to the risk of bribery that it faces and the nature and scale of its commercial activities.
• Top-level commitment. Top-level management should be committed to preventing bribery and should foster a culture in their organisation in which bribery is considered unacceptable.
• Risk assessment. There should be periodic, informed and regular assessment by organisations of the nature and extent of potential bribery by people associated with it.
• Due diligence. There should be due diligence of third party intermediaries and local agents who will act on behalf of the organisation, with a view to identifying and mitigating bribery risk.
• Communication (including training). Commercial organisations should seek to ensure that policies against bribery are embedded and understood, by means of communication and training that is proportionate to the bribery risk that the organisation faces.
• Monitoring and review. There should be monitoring and review of the procedures designed to prevent bribery, and improvements should be made when weaknesses are detected.

Question 37

List the responses to risk.

Answer 37

• avoidance
• reduction
• transfer
• acceptance

Question 38

Who are the main governance players that support the board with their risk management responsibilities? (7)

Answer 38

The governance players responsible for risk are:
* The board.
* Audit and, if separate, risk committees.
* company secretary.
* CEO.
* Chief Risk Officer.
* Internal Auditor.
* All management and staff.

Question 39

How does an audit report become modified?

Answer 39

If an external auditor has issued a modified audit report it is a serious issue, as it implies there are potentially grave concerns about the financial statements and the financial condition of the company.

It also implies that the external auditor and the board of the company could not agree on the application of accounting policies and hence the content of the financial statements. There are three types of modified audit opinion:
* A qualified audit opinion which is given when, in the opinion of the external auditor, the financial statements would
give a true and fair view except for a particular matter, which the external auditor explains.
* An adverse opinion which is given when the external auditor considers that there are material mis-statements in the accounts and that these are ‘pervasive’. In effect, the external auditor is stating that they believe that the information in the financial statements is seriously incorrect.
* A disclaimer of opinion which is given in cases where the external auditor has been unable to obtain the information that they need to give an audit opinion.

The lack of information means that the auditor is unable to state that the financial statements give a true and fair view, and that there may possibly be serious mis-statements that the external auditor has been unable to check.

Question 40

Describe what is required for a win-win CSR partnership.

Answer 40

There can be many factors which aid a win-win partnership, including:

having clear reasons to collaborate,

having core people entirely committed to the partnership,

having simple and credible goals,

having a facilitator, incentivising workers, flexibility and

having a clear exit strategy planned.

Question 41

What does the board need to consider when deciding what structures to put in place to fulfil its responsibilities for risk and internal control? (3)

Answer 41

The board has overall responsibility for the systems of risk management and internal controls within an organisation. To enable the board to carry out this responsibility, it needs to ensure that the appropriate structures are put in place at the proper levels within the organisation to manage risk. In deciding what these structures should be, the board needs to consider the following:
* Whether risk and internal controls should be considered by the whole board or be delegated to a committee of the board.
* If delegating to a committee, whether risk and internal controls should fall under one committee, the audit committee, or into two separate committees, the audit committee for internal controls and the risk committee for risk.
* The division of responsibility between itself and management for risk management.

Question 42

What is the purpose of the audit committee?

Answer 42

The audit committee is key to ensuring that an organisation has robust and effective processes relating to financial reporting, internal controls, risk management and ethics. The committee is also the main oversight body for the internal and external auditors.

Question 43

What is the purpose of an external audit?

Answer 43

to make sure that the financial statements of the company can
be relied upon.

Question 44

What are the challenges with determining a company’s sustainability?

Answer 44

Sustainability requires the balance of current needs against future needs. The challenge with this is determining:
* The current and future needs.
* The time period to be considered when looking at future generations.
* Who the sustainability should be for (e.g. the company, the country or the world).

Question 45

What matters should be included in the audit committee report?

Answer 45

The FRC Guidance on Audit Committees

Question 46

4. What is an environmental profit & loss account?

Answer 46

An EP&L allows a company to measure in euro value the costs and benefits it generates for the environment, and in turn
make more sustainable business decisions.

Question 47

What are the main categories of risk?

Answer 47

• financial risks
• operational risks
• compliance risks
• strategic risks:
  – people risks
  – marketplace risks
  – ethical risks
  – reputational risks
  – suppliers/outsourcers risks
  – environmental risks
  – political risks

Question 48

How can a company protect an external auditor’s independence?

Answer 48

The UK Corporate Governance Code gives the audit committee the responsibility for reviewing and monitoring the independence and objectivity of the external auditors. The UK FRC Guidance on Audit Committees suggests various measures an audit committee should take in carrying out this role. These include the following:
* The committee should seek reassurance that the auditors and their staff have no familial, financial, employment, investment or business relationship with the organisation that could adversely affect their independence or objectivity.
* The committee should seek information annually from the audit firm about its policies for maintaining independence
and monitoring compliance with relevant requirements.
The company should consider, as another measure for protecting auditor independence, rotating auditors. This can be done in one of two ways:
* rotation of audit partner; and
* rotation of audit firm.
The audit committee should also meet with the auditors at least one per year as part of the annual audit process without management present to ensure that the auditors are not being intimidated by management.

Question 49

Why did companies give up responsibility for the welfare of their employees?

Answer 49

Some believe that following World War II, the advent of free education and the National Health Service in the UK saw the state take over from companies the responsibility for the well-being of the workforce. This in turn led to companies focusing more on making profits and achieving growth to help economic recovery after the war than on acting in the interests of society at large.

Question 50

2. What areas should a whistleblowing policy and procedure cover? (6)

Answer 50

Typically, a whistleblowing policy and procedures would cover the following:

• purpose, scope and coverage;
• procedures for reporting a matter;
• what happens when communication is received from a whistleblower;
• anonymity of the whistleblower;
• communication with the whistleblower; and
• protection of the whistleblower.

Question 51

In what way is financial reporting connected to corporate governance?

Answer 51

it involves the concepts of accountability and transparency

Question 52

What matters should the annual review of the effectiveness of the systems of risk management and internal controls cover?

Answer 52

The FRC Guidance on Risk Management, Internal Control and Related Financial and Business Reporting, states that the annual review of effectiveness should consider:
* the company’s risk appetite;
* the desired culture within the company and whether this culture has been embedded within the organisation;
* the operation of the risk management and internal control systems, covering design, implementation, monitoring
and review and the identification of principal risks;
* the integration of risk management and internal controls with the company’s business model, strategy and business planning processes;
* the changes in the nature, likelihood and impact of principal risks;
* the company’s ability to respond to changes in its business and the external environment;
* the extent, frequency and quality of management’s reporting on the organisation’s risk management;
* the issues dealt with by the board throughout the year under review;
* the effectiveness of the company’s public reporting processes.