Auditors’ Dilemma – reporting requirements on Internal Financial Controls under the Companies Act 2013 and Clause 49 of the Listing agreement V. Venkataramanan 10 September 2014

Agenda Definitions Clause 49 of the Listing Agreement Section 134 of Companies Act 2013 International experience Perspectives and practical considerations

Definitions Internal controls An accounting procedure or system designed to promote efficiency or assure the implementation of a policy or safeguard assets or avoid fraud and error etc. Methods put in place by a company to ensure the integrity of financial and accounting information, meet operational and profitability targets and transmit management policies throughout the organization. Internal control is a process, effected by the entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance.”

Clause 49 of the Listing Agreement CEO and CFO certification that “they accept responsibility for establishing and maintaining internal controls and that they have evaluated the effectiveness of the internal control systems of the company and they have disclosed to the auditors and the Audit Committee, deficiencies in the design or operation of internal controls, if any, of which they are aware and the steps they have taken or propose to take to rectify these deficiencies.”

Clause 49 of the Listing Agreement Establishing controls Testing controls Disclosing deficiencies relating to the design or operation of internal controls Remedial steps initiated

Section 134 of the Companies Act 2013 The directors, in the case of a listed company, had laid down internal financial controls to be followed by the company and that such internal financial controls are adequate and were operating effectively. Explanation.—For the purposes of this clause, the term “internal financial controls” means the policies and procedures adopted by the company for ensuring the orderly and efficient conduct of its business, including adherence to company’s policies, the safeguarding of its assets, the prevention and detection of frauds and errors, the accuracy and completeness of the accounting records, and the timely preparation of reliable financial information

Section 134 of the Companies Act 2013 Adequacy Effectiveness Orderly and efficient conduct

Section 134 of the Companies Act 2013 Differences from Clause 49 Increase in scope – Board, management and auditors Qualitative in nature Lack of prescribed framework to complete the evaluation

International experience Sarbanes Oxley Act Applicable to listed companies only Use of COSO framework Costs and benefits Reporting of weaknesses only when there is an incident

International experience – COSO framework Five components Control environment Risk assessment Control activities Information and communication Monitoring activities

COSO 2013 framework Provides example Points of Focus to assist management in determining whether a principle is present and functioning. An effective system of internal control requires that: Each of the five components and relevant principles are present and functioning and, the five components operate together in an integrated manner. A major deficiency exists if the organization cannot conclude that these are met.

COSO framework – 2013 – 17 principles Control Environment 1. Demonstrates commitment to integrity and ethical values. 2. Exercises oversight responsibility. 3. Establishes structure, authority and responsibility. 4. Demonstrates commitment to competence. 5. Enforces accountability. Risk Assessment 6. Specifies suitable objectives. 7. Identifies and analyzes risk. 8. Assesses fraud risk. 9. Identifies and analyzes significant change. Control Activities 10. Selects and develops control activities. 11. Selects and develops general controls over technology. 12. Deploys through policies and procedures. Information & Communication 13. Uses relevant information. 14. Communicates internally. 15. Communicates externally. Monitoring Activities 16. Conducts ongoing and/or separate evaluations. 17. Evaluates and communicates deficiencies.

Proposed roadmap ICAI Guidance Note on Audit of Internal Financial Controls PCAOB AS 5 – An audit of internal control over financial reporting that is integrated with an audit of financial statements COSO 1992 and 2013 frameworks Questions still open on Applicability Timelines Framework

Perspectives and practical considerations SOX / COSO vs SA 315 ICOFR vs Internal Financial Controls Interim vs year end vs ongoing reporting What is a reportable matter? Is it “out of our syllabus”? Directors reactions and responsibilities Who will bell the cat (Management vs Internal Audit vs External auditors)? Documentation vs business benefits

Perspectives and practical considerations What would you do ? – some food for thought Known instances of non compliance ‘Minor’ illegal acts – what would be material? If you read a negative report?

Thank you