Audit Committee Handbook Audit Committee Institute 2017 Edition www.kpmg.ie/aci “An audit committee is essentially an oversight committee, for it is management who are responsible for the internal controls and the fnancial statements. The committee, however, has to satisfy itself, on behalf of the board and ultimately the shareholders that key controls are operating, that ethical practices are being reinforced, that key accounting estimates and judgements are being properly made and that internal and external audits are effective.” Audit Committee Institute Audit Committee Handbook Contents About the Audit Committee Institute The Audit Committee Institute (ACI) champions outstanding governance to help drive long-term corporate value and enhance investor confidence. Through an array of programs and perspectives in over 40 countries worldwide, ACI engages with directors and business leaders to help articulate their challenges and promote continuous improvement. Drawing on insights from KPMG professionals and governance experts worldwide, ACI seeks to provide actionable thought leadership – on risk and strategy, talent and technology, globalization and compliance, financial reporting and audit quality, and more – all through a board lens. Introduction 4 8 Example questions around 204 identifying and assessing risk Chapters 9 Example risk summary and 206 1 Guiding principles for audit 6 register committees 10 Internal control and risk 210 2 The regulatory landscape - Ireland, management disclosures and Global 10 11 Example whistle-blowing policy 218 3 Building and sustaining an audit 28 committee 12 Internal audit sourcing options 222 4 Monitoring the corporate 68 13 Specimen internal audit plan 224 reporting process 14 Internal audit activities – key 230 5 Risk management and internal 86 steps in the annual audit cycle control systems 15 Specimen internal audit report 232 6 Fraud and misconduct 108 16 Evaluation of the internal audit 236 7 Internal audit 116 function 8 External audit 128 17 How to conduct an audit tender 247 9 Communication with 152 18 Evaluation of the external auditor 271 shareholders 19 Example policy on employment 280 of former employees of the external auditor Appendices 20 Example policy on the provision 281 1 The global regulatory landscape 158 of non-audit services by the 2 Example audit committee terms 164 external auditor of reference 21 Specimen audit management 286 3 Potential audit committee topics 184 letter 4 Audit committee meeting planner 186 22 Specimen audit committee 288 statement 5 Private session with the auditor 192 23 Audit committee disclosure 298 6 Audit committee self assessment 194 checklist 7 Specimen year-end timetable 203 4 Audit Committee Handbook Introduction This Audit Committee Handbook draws on insights and learnings from ACI’s interaction with thousands of audit committee members, audit and governance professionals, and business leaders in over 40 countries worldwide over more than 10 years. Audit committees have, in many ways, run the gauntlet – through corporate accounting scandals at the start of the millennium and the expanding responsibilities, the dot-com bubble of the late 90s, the 2007–2008 fnancial crisis and the subsequent reforms throughout the world, corruption investigations in global companies, and the dramatic escalation and impact of cybersecurity attacks. The insights gained and lessons learned have clearly set a high bar for audit committees (and boards), and the accelerating speed and complexity of doing business will, no doubt, keep pushing that bar higher. Technology and innovation, globalisation and geopolitical turbulence and other disruptive forces are shaping a risk and regulatory landscape that few could have envisioned 15, 10, or even fve years ago. By and large, we see audit committees adapting to these changes and challenges – refning their agendas and oversight processes and, in some cases, reassessing their skills and composition. Keeping pace will require agendas that are, focusing on what is most important, allocating time for robust discussion and, perhaps most importantly, understanding the tone, culture, and rhythm of the organisation. Audit Committee Institute 5 Foreword The Audit Committee Handbook is intended to be a practical, user-friendly reference for both new and seasoned audit committee members, and for management and audit teams that work with the audit committee. To that end, the Audit Committee Handbook covers the fundamentals – e.g., basic requirements and responsibilities and key areas of oversight – and offers insights into the current challenges and leading practices shaping audit committee effectiveness today. It is written to serve as a resource for both listed and unlisted companies in the private and public sectors. While written to be relevant globally, there are specifc sections tailored for the Irish landscape. Of course, no one size fts all; the practices discussed in this Audit Committee Handbook should be considered in the context of each country’s and audit committee’s needs and circumstances. Nevertheless, certain guiding principles underlie the effectiveness of every audit committee and the right principles can help to ensure that company specifc practices are applied effectively. Some of the issues covered in the Audit Committee Handbook – e.g., cybersecurity and the impact of emerging technologies, economic volatility and big data – are clearly matters that require the full board’s attention. These and other broader issues are included, however, as the audit committee has an important role to play (at least as a catalyst) in helping to ensure that key issues – particularly those related to risk and compliance – are being addressed appropriately. The appendices at the back of the book are intended to provide practical support to audit committees. Soft copies of each of the appendices are available on our website at www.kpmg.ie/aci. We hope this publication provides practical guidance to help audit committees identify and achieve their objectives and add value to the board, the organisation and its stakeholders. David Meagher Chairman Audit Committee Institute Ireland Partner Audit KPMG in Ireland September 2017 6 Audit Committee Handbook Chapter 1 Guiding principles for audit committees The audit committee’s ‘core’ duties – overseeing financial reporting and controls, as well as external and internal auditors – are a substantial undertaking and time commitment. In addition, many audit committees have oversight responsibilities for a range of other risks that have become increasingly complex and challenging in the current business environment – from operational and compliance risks posed by globalisation and the extended organisation (partners, suppliers, vendors, etc.) to cybersecurity and other risks related to emerging technologies. Prioritising this heavy audit committee workload continues to be a challenge for most audit committees. Audit Committee Handbook 7 Audit committees are meeting this oversight challenge by focusing on ways to improve their effectiveness and effciency – refning their agendas and oversight processes and reassessing their skills and composition. This requires agendas that are manageable (what risk oversight responsibilities are realistic given the audit committee’s time and expertise?); focusing on what is most important (starting with fnancial reporting and audit quality); allocating time for robust discussion while taking care of ‘must do’ compliance activities; and, perhaps most importantly, understanding the tone, culture, and rhythm of the organisation by spending time outside of the boardroom – visiting company facilities, interacting with employees and customers, and hearing outside perspectives. Yet, practices that work best for one organisation may not be ideal for another – especially in a corporate governance environment where corporate culture, fnancial reporting risks and governance needs can vary dramatically from entity to entity and from country to country. We believe, however, that certain guiding principles underlie the effectiveness of every audit committee. Even as specifc oversight practices evolve to address changing risks, regulatory requirements and corporate governance needs, the right principles can help ensure that practices are applied effectively – that is, by the right people with the right information, processes and perspectives. One size does not fit all. When delegating oversight responsibilities to the audit committee, each board should factor in the unique needs, dynamics and culture of the company and the board. The responsibilities of the audit committee should be clearly communicated and precisely defined. Once delegated, the activities of the audit committee – including appropriate management interaction – should have the ongoing support of the full board. De facto independence and financial literacy are fundamental. Audit committees must be in a position to challenge management and draw sufficient attention to dubious practices – even in apparently successful companies. In essence, this means that they need to understand their businesses and the substance of complex transactions, and determine that the financial statements reflect fairly their understanding. Perhaps the most important characteristic of an effective audit committee member is a willingness to challenge management; this is the essence of independence. 8 Audit Committee Handbook oF uc s on toh es ef w tih n sg iw t h teh erg atets imap tc . When delegating oversight responsibilities to the audit committee, the board needs to determine what really matters and make sure the committee focuses on those issues and devotes the proper time and attention to them. As one audit committee chair told us, “If you try to focus on everything equally, you will just get overwhelmed.” The audit committee should focus on the areas that are of most importance to the company. aM ke us er teh oc mmittee i s eg ttin g i‘ nof mr ation ’ and not uj ts data – from business and functional leaders as well as internal and external auditors. Even where audit committees comprise vigorously independent directors, they will prove ineffective unless they have both access to, and understanding of, all the relevant information. With meaningful information, the committee will be in a position to discuss and provide insight regarding the critical issues facing the business, and probe whether everyone at the table understands the risks, how the risks are being mitigated, what controls are in place, and whether the controls are working. Conis de r oh w teh oc mmittee mithg imorp ev it s eif f ic en yc and make teh mots o f it s meetin .sg To streamline committee meetings – and allow more time for discussion and questions – insist on quality pre-meeting materials (and expect pre-read materials to be read) and limit management presentations and the use of extensive slide decks. Conclude (and sometimes begin) each meeting with an executive session so that members have an opportunity to discuss important matters privately. nU detsr and tah t it ac nnot a l be done at teh of mr a l oc mmittee meetin ;sg b‘ etew en meetin ’g ow kr i s ees ntia .l One of the biggest changes in audit committee service in recent years is the degree of engagement. Today, the depth and breadth of audit committee engagement has made oversight a much more time consuming job, particularly at larger, more complex, global companies. The audit committee needs to get up and out of the corporate headquarters, seeing things and talking to people in their own offices and workplaces. It is entirely appropriate and even desirable for audit committee members – particularly the chair – to meet with members