With the FSB conducting more supervisory visits to Financial Services Providers, and with those visits being more vigorous and in depth, you could soon be receiving a letter from the Supervision Department advising you that they will be paying you a visit sooner than you think.

 

Receiving such a letter normally puts FSPs into a spin; some cases for good reason. However, as with all such things, a little preparation goes a long way.

 

If you are running a business which is perceived by the regulator to have a higher risk rating i.e. collecting client premiums, hedge funds etc. the likelihood of a visit is much greater than for a ‘regular’ adviser . However, this won’t be the case if you’re on the regulatory radar screen for some reason or another. Examples of this would be late submission of compliance reports or financial statements, or an excessive number of complaints, or even one serious complaint.

 

So, there you sit in your office, with the FSB coming in two weeks’ time - what should you get ready?

Drives financial results and enhance business performance

 

Events over the last decade have fundamentally shifted the way organisations think about risk.  As a result, companies around the world have made substantial investments in personnel, processes and technology to help mitigate and control business risk. The question does remain as to whether these investments will be able to prevent the next catastrophic event and whether companies are getting a return on their investments and are focusing on the risks that matter according to research conducted by Ernst & Young.

 

Yusuf Dukander, Project Director: Financial Services at the South African Institute of Chartered Accountants (SAICA) believes that the risk management and governance landscape will see an evolution towards better quality oversight by management and supervisory practices embedded in many organisations across diverse industries – worldwide calls for businesses to have more supervisory authority.

 

Lance Tomlinson, Ernst & Young’s Assurance Leader for Africa, says effectively managing risk can enhance a companies’ performance, stating that companies with more mature risk management practices outperform their peers financially. “We found that companies with the most mature or sophisticated risk management practices generated the highest growth in a number of financial ratio’s including revenue, Earnings Before Interest, Taxes, Depreciation and Amortization (EBITDA), EBITDA to economic value and return on invested capital. The study revealed that sophisticated risk management creates value, mitigates risk and optimises cost.

 

ERM might be viewed by many business owners as a stand-alone governance compliance, however; it should be seen as an integral part of an organisation’s strategy. Companies that effectively embed risk management practices into planning and performance management are more likely to achieve strategic and operational objectives.

 

Tomlinson advises that organisations need to effectively assess risks across the business and drive accountability and ownership. “It is critical for management to demonstrate the organisation’s strength of risk management to investors, business analysts and regulators.”

 

Dukander adds, the concept of risk governance can also be viewed as balancing the needs of all stakeholders with the risks associated inherent in the business. It also prompts management to adopt a culture of more risk reporting in an effort to drive profitability and the sustainability of an organisation well into the future.

 

The Ernst & Young survey, which assessed 137 global institutional investors reveals that 82% respondents were willing to pay a premium for companies that demonstrate successful risk management. Meanwhile, 61% will not invest where there is evidence of poor risk management and 41% would withdraw investment where there is a perceived lack of appropriate risk management.

 

Tomlinson says that for companies to derive financial value from ERM, they need to identify and understand the risks that matter. It is also important for organisations to differentially invest in risks that are mission critical to the company.

 

Dukander proclaims that fear is possibly one of the major driving forces behind the accelerated investment in Governance, Risk Management and Compliance (GRC). “Today, companies operate in a more volatile risk environment than ever before. They face increased demands for more timely and insightful information from stakeholders who will not tolerate risk management failure.”

 

In a survey among companies across Europe, the Middle East, India and Africa, Ernst & Young found that nearly 70% of organizations are highly reliant on their GRC activities as a safeguard against failure. Interestingly, however, this spending and dependency is not matched by the value that business leaders think they currently get from GRC. Over two-thirds of all respondents indicated that more work was needed to enhance their GRC functions.

 

External stakeholders are more dissatisfied with the quality of GRC than companies’ own operational management and business leaders, with 79% or respondents stating that they believe companies’ GRC functions need to be enhanced.

 

Dukander confirms that the principles of GRC and ERM are critical to any business whether it operates locally or internationally. “The practice of ERM is developing locally with the Financial Services Board and the Reserve Bank moving towards this direction. The Financial Services sector has seen ERM form part of regulations such as Basel III and Solvency Assessment Management.”

South Africa’s top 100 companies listed on the JSE have made positive progress in their corporate reporting initiatives, yet there remain areas for improvement, according to a report released by Professional Services Firm PwC.

Zubair Wadee, a director at PwC says: "Most companies appear to be comfortable disclosing those matters that have traditionally been a focus area, such as reporting related to audit committees, but appear to be less comfortable in addressing newer areas of governance introduced in the third King Report on Governance for South Africa, 2009, such as IT governance.”

The purpose of PwC ‘s ‘Moving from principle to practice: Corporate reporting survey’ is to assess reporting by entities both in terms of the King III Report, which became effective for all companies listed on the JSE with financial years commencing on or after 1 March 2010, and selected benchmarks arising from current developments in integrated reporting. The survey process involved an analysis of the integrated reports of the top 100 companies on the JSE for their financial periods beginning on or after 1 January 2011. The study focuses on pivotal areas contained in the King III Report, such as boards and directors; ethical leadership; the governance of information technology; the audit committee; compliance with law and rules; and integrated reporting.

South Africa was the first country to mandate integrated reporting for all listed companies. An integrated report brings together the material information about a company’s strategy, governance, performance and prospects in a way that reflects the commercial, social and environmental context in which it operates.

Professor Mervyn King, Chairman of the International Integrated Reporting Committee and non-executive Chairman of PwC’s Business School, says: “Integrated thinking is a revolution in management and board behaviour. The outcome of integrated thinking is the integrated report. All companies depend on a variety of resources and stakeholder relationships to create value and to sustain value creation.

“The world has changed and so must corporate reporting. The users of corporate reports need to make an informed assessment that the company will sustain value creation. The only way in which to do this is by means of a concise and clearly understandable integrated report.”

Wadee says: “There is an increased global focus by investors, regulators, markets and other interested stakeholders on the integrated reports that are being released by listed South African companies. They will be looking at the quality of reports and the trends as they start to evolve.”

Boards and disclosure

The study shows that there is room for improvement in reporting on the actual performance of the board and its committees. Although the board was cited in many cases as a formality, it was not possible to ascertain whether it was actually engaged in any of the listed activities of committees.

While the classification of board members in terms of independence was well disclosed overall, the process of assessing the stated independence of directors was not always adequately explained by companies.

The majority of companies (85%) reported on directors’ remuneration, keeping in line with the requirements for listed companies contained in the King III Report.

Ethical leadership and corporate citizenship

Most entities tended to shy away from reporting on the more progressive areas of the King III Report, for example, the disclosing of actual performance in terms of ethics.

The study suggests that the measurement of the effect of corporate citizenship initiatives is an area in which entities could improve by attaching statistics or financial investments to specific initiatives. ‘Something as simple as disclosing the number of families in a community that could have been affected by an entity’s actions could improve an integrated report,” says Wadee. One of the trends that is evident from the survey is that companies dedicate a significant amount of effort to reporting comprehensively, while not always considering whether those items that have been reported upon are material to the users on the report.

IT governance

As with other areas that are new to King III, most companies provided very little information about the governance of information technology. “This is concerning given the ubiquitous nature of IT in the operations of most entities,” he says. Only two-thirds of all entities surveyed indicated that the governance of IT is a board’s responsibility, while only a handful discussed the importance of IT in relation to the strategy of the company or discussed the implementation of an IT governance framework.

Audit committees

The role of the audit committee has increased significantly in the wake of the King III Report and it appears that most companies have understood the importance of this committee and are being seen to comply with the requirements of the report. There has been an increased focus on ensuring that the appropriate number of non-executive directors serves on the committee (more than 80%). Furthermore, most companies describe the role of the audit committee in risk management.

However, almost a third of audit committees did not provide adequate information relating to the audit committee’s oversight role in the implementation of a combined assurance model, or the appointment and performance review of the chief audit executive.

A refreshing trend has emerged whereby 82% of reports disclosed how the audit committee discharged its duties during the financial period under review. Wadee says that a potential focus area in future will be the appointment of a chief audit executive for internal audit by the audit committee, and oversight of this individual’s performance.

Risk governance

An overwhelming percentage of companies (90%) disclosed their key risks and how they were mitigated. However, only 25% of entities disclosed their risk appetite. “This is disappointing as most companies would presumably have this information readily available.

“While it is encouraging that the vast majority of boards of directors accepted responsibility for risk management and have disclosed how risk management has been aligned with the strategy of the company and integrated into the daily activities of the company, it is concerning that less than two-thirds reported on their assessment of the effectiveness of risk management,” says Wadee. Furthermore, less than a quarter of companies surveyed disclosed who the chief risk officer was.

Internal audit

The majority of companies reported that they had an internal audit function in place. However, the study shows there is some room for improvement in terms of reporting on how the internal audit reports to the audit committee (currently 85% of companies disclose this).

Laws and regulations

The majority of companies provided very little information about compliance with laws, rules, codes and standards. Wadee says that this is concerning, given that all companies operate within legal frameworks that could potentially have a detrimental effect both financially and from a reputational perspective for entities that do not comply with them.

Integrated reporting and disclosure

While most companies explained their vision and objectives in their reports, less than two-thirds of organisations surveyed disclosed the performance measures management uses to monitor the success of its actions. Furthermore, only half of integrated reports disclosed performance targets and the organisations’ achievement in respect of these targets.

Given that most entities express the desire to grow, the report finds it surprising to note that only half of the companies surveyed explain the key underlying external drivers for current and future growth. Also of concern is the neutrality and balance of the disclosures that companies provide. In 85% of reports surveyed, companies disclosed a positive effect, while less than a third of organisations disclosed any negative aspects.

Responsibility for sustainability reporting is also not clearly defined in almost a quarter of reports. Although all of the companies surveyed had a sustainability report, only 43% obtained assurance over the key elements of sustainability reporting, with half of these being assured by the external auditor.

An emerging trend is for companies to produce a separate sustainability report that does not form part of the integrated annual report, while incorporating material sustainability aspects into the integrated report. Although it is encouraging to note that entities value sustainability enough to devote an entire report to it, in some cases the integrated report does not contain enough information about sustainability issues to satisfy the criteria of the King III Report, says Wadee.

Wadee says: “While companies have made positive strides in moving towards integrated reporting, it has been an evolutionary rather than a revolutionary process. There are clear leaders in this field of reporting who have embraced the concept wholeheartedly, while others are taking a more cautious and reactionary approach, driven by what the leaders in this space are doing. Overall the effect is a positive one – reporting in South Africa is moving in the right direction.”

Listen to the podcast of Prof. Mervyn King's presentation of the findings to the survey!