Audit / Risk Committee effectiveness Optimising the role of the Chair and iNEDs April 2017 www.moorestephens.co.uk

Overview Effective Audit Committees and Risk Committees operate as high performing teams

Ineffective team - 2015 England fail to make it out of the group stages in the Rugby Union World Cup

Effective team - 2016 England win the Six Nations and a Grand Slam

Key attributes of a high performing team Clear vision Inspiring leader Focussed discipline Working together

Clear vision … clearly defined role and remit Risk Committee (RC) Audit Committee (AC) Financial reporting External audit Internal audit Other assurance Whistleblowing Effectiveness of risk management framework Policy framework Issue / event management Internal control effectiveness Change management Risk strategy (appetite and culture) Risk identification, assessment and mitigation / management Risk management framework design Where there is overlap…. Consistent MI? Aligned view on risks and priorities? Duplication?

Inspiring leader …The role of the AC / RC Chair Significant functions Practical implications AC Chair (SIMF11): Responsibility for chairing and overseeing the performance of any committee responsible for the oversight of the internal audit function … Conducting and evidencing effective Chairmanship Evidential and proactive support for and management of Head of Internal Audit RC Chair (SIMF10): Responsibility for chairing and overseeing the performance of any committee responsible for the oversight of the risk management system … Conducting and evidencing effective Chairmanship Evidential and proactive support for and sponsorship of Chief Risk Officer

Inspiring leader … Focusing on what matters Setting and assessing culture FRC July 2016 – Corporate culture and the role of Boards Clear articulation of values; processes drive desired culture; airtime at AC / RC Sponsorship of Chief Risk Officer & Head of Internal Audit Consultation to CIIA Guidance to IA in financial services Good AC Chair/ HIA engagement; evaluation of IA effectiveness against CIIA Guidance Plans and preparation for external audit rotation with tendering firms (reduction of non-audit services) External audit responsibilities EU Audit Directive Defined approach to performance reviews; culture for continual improvement Committee effectiveness Senior Insurance Manager Regime AC / RC oversight of Change and mapping of skills / expertise needed for future business model Dynamic business models Technology trends and pace of change

Focussed discipline … Committee effectiveness Committee attributes the Chair should drive and sponsor Governance and composition   Remit and coverage Effective meetings Management information Clear position in governance & effective interaction with other Committees Independent and thoughtful challenge Clear and complete Terms of Reference (ToR) Complete coverage of ToR with appropriate frequency and depth Prioritisation and focus at meetings Meeting frequency, timing and length Relevant, reliable, timely Focussed, succinct and digestible

Working together … Committee effectiveness Committee attributes the Chair should drive and sponsor Governance and composition   Remit and coverage Effective meetings Management information Composition – mix of skills and experiences (financial reporting) Rotation, succession, induction, training Aligning AC/ RC coverage against Board strategic priorities and key risks at Board level Harnessing technical expertise to an appropriate level Balanced contribution and good attendance from members Good executive management attendance and engagement Proper preparation and time outside of formal meetings MI needs discussed and clearly defined Clearly stated purpose (for approval, noting, discussion, decision) Pre-meeting review/ discussion on papers

Summary – questions to consider Does AC / RC activity fully discharge Committee’s remit and appropriately align to strategic priorities and key risks? Annual plan on Committee meeting coverage against ToR; alignment is clear from AC / RC Chair’s Report to Board How effectively is culture defined and assessed? AC / RC dedicates airtime to discussing culture and ‘cultural’ root causes analysis Does the AC / RC assess its own effectiveness? Formal and informal assessment (eg 5 minute debrief at end of each AC / RC) Does the AC / RC take the time to ‘join the dots’ to assess the big picture? Reporting/ discussion on holistic views on governance, risk management framework, culture, root cause / themes and trends Is MI fit for purpose? AC / RC has defined its MI needs, format and frequency

Summary – questions to consider Does AC / RC Chair champion the cause of the CRO / Head of IA? Reporting lines and effective mentorship by AC / RC Chair Does the AC / RC Chair effectively monitor the match fitness of the Committee? Future business plans linked to Committee composition, expertise and training Is there appropriate planning for the EU Audit Directive? Audit rotation rules formally assessed and succession plans in place Are the AC and RC effectively co-ordinated? AC and RC Chairs in frequent dialogue outside of formal Committees; aligned view of key risks and priorities In a combined AC / RC (ARC), is the balance right between risk management and assurance? ARC agenda allocates time appropriately and MI/ ‘airtime’ is appropriately balanced between risk and assurance