UK Corporate Governance Code reform

The board is ultimately responsible for establishing and maintaining an effective system of risk management and internal control; monitoring the system and reviewing its effectiveness (via the audit committee or similar body). To enable this, organisations need to articulate a clear strategy to drive their risk, controls and assurance processes; ensure they have appropriate coordination, commissioning and oversight arrangements in place - ideally defined in a ‘Four Lines of Defence’ model; and assign accountability for implementing their framework effectively.

A comprehensive risk management programme ensures that the framework is risk-led and focused on material areas, therefore meaning it is proportionate.

The focus of the Code’s annual declaration is on material controls. It is logical that these would be the controls that address material risks, therefore first identifying those material risks as part of a risk management programme is essential. This would involve performing a robust risk assessment to identify the areas of reporting most at risk of being wrong and would have the most material impact on the business if they were wrong, along with identifying material compliance and operational risks to the business.

At a practical level, companies will be familiar with financial reporting materiality through the audit process, and all companies with a mature risk management programme will have a process to assess, determine and disclose their principal risks: in effect, they are therefore already assessing material compliance and operational risks. Increasingly, companies are now also responding to new legislation in areas such as sustainability reporting which involves, among other things, a requirement to conduct materiality assessments over non-financial information.

Each material financial, reporting, operational or compliance risk could have a potentially large number of controls to mitigate that risk. To ensure a strong yet proportionate assessment process, businesses should identify the controls they consider most effective in addressing those risks; in other words, their ‘material’ controls.

The FRC has indicated that boards should use their judgement to define what a material control is. In brief, therefore, organisations will need to consider which control, or controls, they consider the most effective at reducing the level of residual risk associated with any material risk to a tolerable level. This control, or controls, would therefore be considered ‘material.’ We have provided our own guidance on how organisations can determine what is a material control.

Material controls, once identified, should be clearly documented and reviewed to ensure they are designed to a sufficient level of detail, and that they mitigate the relevant risk effectively. In order to determine this, management should consider elements such as the objective of the control; the level of precision it will be performed to; whether an appropriate team member performs the control and how frequently the control operates; whether the control relies on a system-driven element; and whether sufficient evidence is being retained to support ongoing monitoring and assurance.

In assessing and documenting their controls, organisations should not only focus on process controls, but also entity level controls and IT controls around systems and reports that support material processes or controls. In doing so they can develop a holistic picture of the risk and controls framework in place across their business, and the level of coverage it provides.

Boards should consider the level and mix of process and assurance, both internal or external, which they consider sufficient (for those that follow the Code, to support their annual declaration). They will need to consider how much they are comfortable relying on self-certification of controls design and operation, how much they want independent testing and assurance (internal or external), and what the nature, extent and quality of that assurance is.

As well as determining their own desire for assurance, organisations should consider whether there are areas of reporting or operational or compliance risk which they will be required or could be expected to have assurance over by third parties, such as shareholders, regulators or other stakeholders. Where this is the case, these requirements should be factored into assurance planning.

At a practical level, organisations should ensure that the results of monitoring, review and other assurance activities across the four lines of defence are reported in an integrated way to provide a ‘big picture’ view of whether material risks are being managed effectively, and to identify any material weaknesses to be reported.

For those that follow the Code, the basis for the Board’s annual declaration should draw on this, setting out how they have monitored and reviewed their systems over the reporting period, and how the board can be content that their conclusion regarding the effectiveness of the systems is appropriate.