Welcome to the new Independent website. We hope you enjoy it and we value your feedback. Please contact us here.

A directors' game of Russian roulette

A report on the effectiveness of the internal control of auditing reveals many issues still to be resolved, writes Isobel Sharp
The auditing profession's standard setting body, the Auditing Practices Board, is about to issue a discussion paper on "Internal financial control effectiveness". To those who thought enough trees had already been sacrificed to provide guidance on internal control, first reactions might be to enjoy a long yawn. But for preparers, auditors and users of company annual reports, what the paper's publication will illustrate is that there is perhaps more unresolved than resolved on the subject.

When the Cadbury Report was published in December 1992, a three-fold recommendation on internal control matters was made stating that the accountancy profession, in conjunction with representatives of accounts' preparers, should take the lead in developing:

na set of criteria for assessing effectiveness;

nguidance for companies on the form in which directors should report; and

nguidance for auditors on relevant procedures and the form of their report.

The first recommendation has been met. In December 1994, aneight-page document, "Internal control and financial reporting", was published. Thus was the first misunderstanding created. The 1992 Cadbury Code required directors to report on "the effectiveness of the company's system of internal control". But what the December 1994 paper requires is less. The directors report on a subset of internal control and in terms that they have considered their effectiveness. However, there is no obligation to comment further on the results of that review.

The second misunderstanding was that the new guidance would be relatively easy to implement. Other recommendations of the Cadbury Report had been straightforward - for example, either the company had an audit committee or it did not. But internal financial control is proving more difficult to come to terms with. Matching a company's procedures with the 21 criteria set out in the guidance and then determining whether all the criteria have been met is proving a time-consuming process. And many directors are nervous about making public statements regarding the adequacy of the procedures, only to have to reportlater losses which might have been avoided if the system had been different.

With the benefit of hindsight, it is unfortunate that the working party that produced the December 1994 guidance did not also give an illustration of the form of report the directors should make - the second of the three Cadbury recommendations. While the report clearly sets out what the directors should state as a minimum, a picture of what is expected would communicate more quickly and effectively and might have avoided the misunderstanding that reporting on internal control can be handled as succinctly as other Cadbury-inspired disclosures.

But these are only starters. What this new paper from the Auditing Practices Board is set to demonstrate is that there are many unresolved issues on internal control reporting. The paper will be presumably written primarily for auditors, but, to meet the third recommendation, the issues will be equally important for directors now. For example, how many procedures must the company implement before it can say it has met any particular criteria? Do those procedures have to be applied throughout the group? If they are in operation worldwide, should they be observed with the same degree of diligence?

For a number of issues it is easy to suggest that the US study "Internal control - integrated framework", published by the Committee of Sponsoring Organisations of the Treasury Commission (Coso), provides guidance. But the UK report is more ambitious than its US equivalent; for example, it expects reporting on financial information used within the business and also that used externally while the latter deals solely with external information.

It is worth noting that the Coso report was published after a five-year study involving hundreds of individuals, including corporate executives, legislators, regulators, consultants, auditors and academics. The UK process was a David to that Goliath, but the consequence may be that a disproportionate burden is falling now on UK companies.

While the debate continues on internal control matters, attention is now being paid to the setting up of a Cadbury Mark II Committee. Agenda items are discussed widely. But attention should also be paid to the mechanics.

First, there has been a feeling over the past two or three years that there have been too many cooks each baking a tier on the same cake but not necessarily following the same recipe. While it is wholly appropriate that those with the expertise are involved in the process, there may be a case for clearer leadership on corporate governance matters.

Second, this committee should have, or have access to, better resources than its predecessor. Third, it should follow the policy of an incremental approach to improving governance, checking that proposals are achievable in theory and in practice and are wanted by those with a legitimate interest in corporate governance matters.

Otherwise, directors are being encouraged to play annually a game of Russian roulette.

The writer is technical partner at Binder Hamlyn, part of the Arthur Andersen worldwide organisation.