A recent report from Gartner has stated that organisations that use predictive analytics will increase their profitability by 20% by 2017. There is a great deal of focus placed on the benefit of analytics for improving profitability. Less commented on, but no less relevant, is the role that analytics can play in preventing loss – specifically, loss through fraud.

 

Current fraud detection solutions rely on recognising pre-existing fraud modalities and flagging similar events when they occur. And it’s that “when” that’s important. The fraud has already taken place by the time the event is flagged, and while this may create a neat paper trail to the perpetrator, it doesn’t do anything to prevent the fraud from occurring in the first place.

 

In addition, fraud detection solutions that rely on identifying events that are similar to previous instances of fraud can’t do anything about new methods of committing these kinds of crimes. If there’s one thing that we know about fraudulent individuals and syndicates, it’s that they are constantly looking for new ways to defraud businesses. Given this trait, it’s completely pointless to rely on a solution that only recognises the replication of historical fraud.

We need to know the future

The Integrated Reporting Committee (IRC) of South Africa welcomes the release of an international framework for an integrated report and applauds the International Integrated Reporting Council (IIRC) for its work.

 

The finalisation of the International Integrated Reporting Framework will go a long way to encourage organisations around the world to prepare an integrated report that shows their performance against strategy, explains the various capitals used and affected, and gives a longer term view of the organisation. The integrated report is regarded as the evolution of the traditional annual report because it offers a more holistic view of an organisation than financial performance alone, thus enabling investors and other stakeholders to make a more informed assessment of the organisation and its prospects.

 

South African organisations are acknowledged as among the leaders in this area of corporate reporting with many listed companies and large state-owned companies having issued integrated reports for the past three years. Integrated reporting is one of the recommendations of the King Code of Governance in South Africa 2009 (King III) and as such falls into the JSE’s listings requirements on an apply or explain basis.

 

The IRC will be reviewing the international Framework, considering its applicability in the South African context, and will communicate its view in the first few months of 2014. The IRC anticipates that it will organise a seminar on the Framework for companies and other interested parties (similar to that hosted by the IRC, JSE and IIRC to launch the Draft Framework in April this year) in Johannesburg in the first few months of 2014.  

 

Like financial statements, an integrated report is the result of certain activities that have taken place within an organisation. In the case of integrated reporting specifically, these activities relate to the way in which an organisation has executed and is planning to execute strategy.

Outsourcing has become a popular service model, particularly in the Information Technology (IT) space, as it can help to deliver greater cost efficiencies and high levels of service. However, a trend has emerged in recent years to move away from large multi-service outsource providers and towards smaller, specialist niche service providers. These niche IT outsource providers are providing a multitude of benefits to business.

 

This shift has occurred for a number of reasons, mainly due to the ability to drive greater value from outsource contracts. While each model has its own pros and cons, a more focused niche provider typically specialises in a specific area of IT outsourcing. This results in greater efficiency, better service delivery, a more granular view of the IT outsource service, and a significant reduction in the typical red tape associated with a basket of services from a single large provider.

 

Despite these benefits, larger IT outsource providers who offer a wide range of services have traditionally been popular, as they offer the perception of a ‘one stop shop’ for all of a company’s IT needs. This is an attractive concept, as it means that there is only one contract to manage for multiple services. A single contract decreases administration and the need to maintain relationships with multiple vendors. However, this single contract concept is also where the biggest detracting factor for multi-service outsourcing comes in.

 

The reality is that most large outsourcing companies only specialise in one or two areas and offer other services as an ‘add on’. This means that service levels are often inconsistent across the different services as skills levels within the provider are inconsistent. The challenge for businesses that are tied into multi-service contracts is to remove one of the services that they may not be satisfied with. This is a difficult and time consuming process and will require renegotiation of the entire contract. Engaging the services of specialised, focused service providers on the other hand, while it does require more maintenance of relationships and contracts, will ensure that service levels can be easily monitored according to specific services. If these service levels are not delivered according to the Service Level Agreement (SLA), contracts can easily be terminated and a new provider sourced.

 

While it may seem that outsourcing multiple services to a single provider will drive the greatest efficiencies, this is often not the case. Services are consolidated into a single contract and fee, which means that costs for each individual service are difficult to control. It is not possible to identify the individual cost of maintenance of each service unless the service provider is completely transparent and provides a granular breakdown.

 

With specialised contracts, this process is simplified and it is possible to easily manage and control spend on each service. This is becoming an increasingly important factor in light of King III recommendations and regulatory requirements, which require the justification of all IT spend and reporting to stakeholders on the effectiveness and value derived from each service.

 

Niche service providers also tend to be Small Medium Enterprises (SMEs).  They are more motivated to deliver as their livelihood hinges upon their reputation for service delivery. Terminating the services of a single service provider that is not delivering a particular service is also far easier than trying to terminate a single service from a large basket contract.  This in turn motivates the niche outsource provider to deliver better services. If a small company loses a contract, the impact is far greater than that of a large company losing a single service contract. SMEs also tend to deliver more personal interaction, more personalised service and better turnaround times, as these companies are typically more agile with more flexible processes. 

 

IT Outsourcing as a model for service delivery is here to stay and continues to grow in the current economic climate due to budget constraints and the ever-present need to deliver better services for lower IT spend. However, the one stop shop model is no longer as popular as it has been in the past and we will continue to see an uptake in services from more specialised, smaller outsourcing providers who deliver better service levels and greater cost efficiency.

Companies listed on the JSE have faced significant changes in the way they report. The Companies Act has allowed for summarised financial statements to be sent to shareholders, and the listings requirement for integrated reporting (through King III) has resulted in the traditional lengthy annual report being reduced into a concise, understandable report on material connected issues.

 

And the good news for users of company reports – who have faced increasing volumes of financial and non-financial information over the years making it difficult to distil the key information – is that the integrated reports of companies are likely to slim down even further as companies place more of their detailed topic-specific information on their websites with links from their integrated reports.

 

The Integrated Reporting Committee (IRC) of South Africa commissioned a research survey of the 2011 integrated reports of the top 100 companies listed on the JSE. The objective was to examine the status of integrated reporting in South Africa given that most listed companies have produced at least one integrated report with many releasing their second. The research survey was undertaken by the College of Accounting at the University of Cape Town.

 

Professor Mervyn King, the chairman of the IRC, says that the uptake of integrated reporting in South Africa is very encouraging and that South Africa can be proud that it is leading the world in this area. “Integrated reporting is designed to give a better and more holistic view of a company than historical financial statements alone. An integrated report shows the connections and inter-relatedness between a company’s strategy, essential resources and stakeholder relationships, risks and opportunities, performance and its future outlook.”

 

The research found that 78% of the companies had changed the name of their annual report to ‘integrated report’. Dual listed companies, in general, did not call their reports ‘integrated’, but many included integrated information. Five local companies continued to call their report an annual report.

 

Of the companies that produced an integrated report, 60% included a statement that the report had been endorsed by the board, although in many cases this endorsement should have been given more prominence in the report given its importance.

 

The research found that most companies (82%) have not yet availed themselves of the Companies Act concession to publish summarised financial statements, opting to include the full annual financial statements in their reports. This is expected to change, though, as some companies have been held back by the necessity to change their founding documents to allow for summarised financial statements.

 

There is a wide range in the length of the reports. The longest was 456 pages and the shortest was just 46 pages, with the average being 179 pages. The average length of the reports of the 18 companies that included summarised financial information was much shorter at 124 pages. The length of the summarised financial statements ranged from one page (both Kumba Iron Ore and AngloGold Ashanti) to 34 pages (Imperial Holdings) with the average length being 11 pages. This should be compared to the average length of 70 pages for the full annual financial statements.

 

40% of companies make reference in their integrated reports to the availability of detailed sustainability information that can be found either in a separate publication or online. This approach goes some way to achieving the desired conciseness of an integrated report. An area that is crucial to achieving a concise report is the company’s determination of materiality. This aims to ensure that only information important to an assessment of how the company made its money and its ability to sustain value creation is included in the report. These are crucial factors in deciding what information should go into the integrated report or should rather be included in one of the more detailed topic-specific reports. Only eight companies explained their materiality process in their reports.

 

The research found that a wide diversity exists in the nature of the integrated reports. While guidance is available there appears to be some confusion on the shape and format of an integrated report. In January 2011, the IRC issued a discussion paper on a report framework. This paper fed into the discussion paper issued by the International Integrated Reporting Council (IIRC) in September 2011. A final framework is expected from the IIRC in late 2013, with a draft framework being issued early in 2013 which will be open for public comment. The IRC has said that its future local guidance will be in line with that of the IIRC.

The researchers found that while the vast majority of companies switched to calling their reports ‘integrated’, this did not necessarily mean that the report complies with the principles of integrated reporting or that the company practises integrated thinking (connecting financial performance to the key non-financial drivers, for instance natural resources and employee stakeholder relationships, on which the performance depends).

Some of the companies stated in their reports the benefits they had received from integrated reporting, including:

• Santam integrated report 2011

“Integrated reporting has improved our awareness of the opportunities for stakeholder engagement that could benefit the business and contribute to sustainability.” 

 

The research survey made no attempt to evaluate the quality of the 2011 integrated reports issued by the listed companies.

A new method of integrated accounting and reporting will allow companies to place a monetary value on the environmental effects of their products, says professional services firm PwC.  “A paradigm shift is required by companies in the way they currently do business and account for all costs and report to stakeholders. The importance of comprehensive stakeholder reporting has been brought to the fore in the wake of the recent economic uncertainty, social disparity and environmental degradation,” says Jayne Mammatt, an Associate Director within PwC’s Sustainability and Integrated Reporting Department.

 

There are signs that at least some institutions worldwide are taking the issue of sustainability reporting seriously. Sports and lifestyle firm Puma, with the support of PwC and Trucost, recently launched the results of its first product level Environmental Profit & Loss (EP&L) accounts, which place a monetary value on the environmental impact of products. “The accounting method is designed to give a better understanding of the environmental impact of the company and boost its competitive position in industry,’ says Mammatt. Currently accounting practices do not make recognition for the lost value of natural systems destroyed by the industry and as a result they are not protected by market forces.

 

The results compare the environmental impact from cradle to grave of a conventional shoe and T-shirt with more suitable alternatives and illustrate how a sustainable approach to production reduces the impact on the environment by a third compared to conventional products. The analysis focused on the environmental effects caused by greenhouse gas (GHS) emissions, waste and air pollution, as well as the use of natural resources such as water and land along the entire value chain from the generation of raw materials and production processes to the consumer phase when customers wash, dry, iron and finally dispose of the products.

 

Mammatt says: “By putting a value on even one product’s environmental impacts, it brings into sharp focus the debates over commodity pricing, natural resource scarcity and supply. Even as an emerging methodology, it challenges conventional business thinking – and consumers’ views – on how we measure and monitor the embedded environmental value and impacts of what we buy.

 

She says that the EP&L accounting method is the way in which integrated reporting is likely to head in the future. Mammatt anticipates that companies in South Africa will follow suit, particularly in the light of stricter regulations, rising energy prices and widespread resource scarcity. “Although it’s a novel field for financial accounting, it is a significant step for companies that are likely to be followed, given the requirements of the King III Report on Governance and the JSE Listing Requirements relating to integrated management and reporting.”

South Africa has an excellent corporate governance regime, with a raft of laws, codes and guidelines designed to enforce compliance with the highest global ethical standards.

 

“At its heart, ethical business practice is about accountability,” says Kevin Phillips, MD of idu Software. If I am the director of a business, I am in effect managing the money of the shareholders in that business – and I have a duty to manage it with care, skill and honesty, and to account for my actions. That is what a “fiduciary duty” is – to uphold the trust people place in us when they give us charge of their cash. The principle is ancient (the word “fiduciary” comes from the Latin), but nowadays it is also enshrined in statutory as well as common law. Directors who fail in this duty now face criminal prosecution and even prison time.

Decision support, or business intelligence (BI), has been a major driver for CIOs for many years. The current focus on "big data" and social media analytics is a logical extension of inward facing analysis capability to allow decision making and using the wealth of information available on the web.

Most BI sales, and projects, are delivered on the premise that any decision is better than no decision. Decision makers need information in order to make a decision and it is crucial to look for not only BI tools to assist with contextualising information but also advise and services to maximise the most out of the tool, including big data.　 Big data’s three dimensions – volume, velocity and variety – represent an extreme view of the challenges faced in any data analytics project.　 The question is: How do we consolidate multiple data sources, with varying levels of quality, and deliver analysis that is timely and relevant?

Analytics projects are tricky to say the least. The CEO needs his report out within an hour but the data quality means that the numbers cannot be generated. So IT works around the problem – maybe they ignore the records that do not hold information in the right format, or they substitute invalid values with valid ones.

More than often, the data is ‘fudged’.　 The inputs are manipulated so that the outputs we need can be generated while they are still relevant. The problem is not that this is done purposely but is rather a necessary evil and by product of working in an imperfect world.　 Most of the time, it will not have a significant impact on decision making, except when it does.

Decisions need to be based on an evaluation of the ‘best information available’. It is when poor information is presented as good information that the waters get muddy. Are business decisions being made based on truth, or based on truthiness?

According to Stephen Colbert, "Truthiness is what you want the facts to be, as opposed to what the facts are. What feels like the right answer, as opposed to what reality will support."

If information has been significantly manipulated to provide a report surely the decision maker deserves to understand this. What is the level of confidence in the underlying data? Was key information missing, or did it vary widely and inconsistently from the previous quarters numbers? Could this have been an error in translation or amalgamation?

Legislation and regulations such as King III, the Basel Accords and the Solvency and Asset Management regime all recognise that key indicators such as financial forecasts or risk models can only be accurate within the margin of error supported by the underlying data – and seek to ensure that the public is protected against risk by penalising companies and individuals that cannot provide a measure of the quality of the data supporting key public metrics.

Common sense suggests that we need to give our business leaders similar protection by providing an indicator of confidence on all reports linked to the quality of the supporting data. If they need to make a decision based on gut feeling, surely this is better than making a decision based on truthiness?

Too many South African organisations that have suffered a catastrophe go on to develop self-managed and self-monitored risk management systems in the belief that these will prevent future disasters.

Unfortunately, “organisations that implement and monitor their own crisis management systems often ignore the very errors and weaknesses that should act as early warnings of catastrophe” says Anita Leong, Consultant, Marsh Risk Consulting.

In the recent explosion at the Amuay refinery in Venezuela, early reports are indicating that there were plenty of warnings in the form of smaller accidents and spills that any third party risk assessment would have picked up right away. However, to those involved in the day-to-day business of such a large operation, those incidents had become the norm.

In the 2010 case of an oil pipeline owned and operated by Enbridge Incorporated, spilling crude oil into an ecologically sensitive area near the Kalamazoo River in Marshall, Michigan, USA, it emerged that:

• if Enbridge’s own safety procedures had been followed the magnitude of the spill would have been dramatically reduced,
• Enbridge’s internal safety monitoring were defined by a ‘culture of deviance’ in which personnel had developed an operating culture in which not adhering to safety protocols was normalised,
• Enbridge’s internal crack assessment process was technically inadequate, increasing the risk of rupture.

The investigation concluded that for the regulator to have delegated so much authority to the regulated to assess and correct their own system risks was tantamount to the fox guarding the hen house.

Cases like this lead South Africa’s own King 3 Report to specify that in the interests of long term sustainability, the Board is responsible for governance of risk and disclosure, while management responsibilities include implementation, monitoring, and continual improvement of the risk management plan. Importantly, the report “recommends external auditing to provide assurance - along with the material aspects of this sustainability reporting which includes integrity assessment to improve and maintain the organisation’s integrity” says Leong.

The Report goes on to recommend independent auditing because of “the impartiality and absence of conflict of interest provided by third party appraisal” adds Leong.

During times of normal catastrophe-free operation in-house risk management procedure is often ignored, delayed, or postponed. This is not the case with third party assessments which follow a documented scope and timeline, regularly addressing key issues to be acknowledged and re-assessed in future planned assessments.

In order to provide competent third party risk assessment and meet King 3 recommendations, Marsh Risk Consulting uses only trained and qualified auditors familiar with required and evolving legislation and standards. These deliver robust monitoring, auditor controls and accountability.

What this means in practice is that for an incident to be managed effectively and efficiently, organisations should have emergency response andcrisis management plans in place whichoutline the actions required by specific individuals in dealing with an incident,along with escalation protocols, and the criteria differentiating an emergency from a crisis.Specific “business recovery plans should also be developed to enable an organisation to continue with operations, following a disruptive incident” adds Leong.

Moreover, it is imperative that staff is trained to manage emergency situations, crisis management and business continuity. Competent third party managed risk management programmes should also outline the necessary actions and communications required to ensure a swift response is delivered by appropriate operational, tactical and strategic personnel. “Exercises and tests are also required to ensure plans are fit for purpose and to evaluate staff's response to an incident” says Leong.

Further toaiding in operational efficiency, third party administered risk management plans will assist with the protection of an organisations brand.

Certainly, “the kind of reputational damage that BP, for instance, suffered as a result of the 2010 Gulf oil spills will live with BP for generations - arguably costing far more than the physical loss, damage, legal fees and immediate reparations” concludes Leong.

Integrated reporting and disclosure

Prof. Mervyn King presents the findings of PwC‘s ‘Moving from principle to practice: Corporate reporting survey’.