Seizing the opportunity

Corporate Reform Requirement

Internal Audit activities

Supporting initial readiness

Supporting ongoing requirements

Directors’ declaration on internal controls (FTSE 350)

An explicit statement by Directors on the effectiveness of internal controls and the basis for that assessment to be included in the Annual Report.

• Perform a gap assessment against the new requirements to help management understand key gaps that need to be addressed as part of relevant compliance, controls, and assurance transformation programmes.
• Review and understand the impact to existing processes and controls, including the need for new controls to address new or existing risk areas not adequately covered by existing assurance.
• Assess whether all subsidiaries and entities that meet the definition of (Public Interest Entity) have been completely captured within the organisation’s gap assessment.

• Internal Audit functions should clearly define their assurance role to support the declaration on internal controls, taking into consideration other assurance providers, Internal Audit’s’ role in supporting the attestation should clearly align with the AAP.
• Assess the adequacy and effectiveness of the governance, risk and controls framework to confirm ongoing compliance. Where areas of non-compliance are identified, action plans should be agreed and followed up.
• Assess the design and operating effectiveness of new and existing controls including:

o Financial reporting controls;

o Operational controls;

o Fraud controls; and

o IT general controls.

Audit & Assurance Policy (Large PIEs)

A policy is to be developed covering key reporting data and information, explain the nature of assurance to be obtained and rationale for this determination.

• Develop a current state gap analysis and an implementation roadmap for the Audit and Assurance Policy (AAP) by:

o Conducting a series of workshops with key stakeholders to develop a strawman for the AAP including all the key elements to be captured.

o Reviewing key documentation, including an assessment of the current assurance map to determine gaps and areas of efficiencies, as well as adaptability of the AAP.

• Produce a roadmap to include clear actions and activities that need to be addressed in developing a robust AAP.

• Review the AAP on an ongoing basis to confirm it remains up to date and relevant.
• Provide assurance over the adequacy of new and existing policies and procedures including the AAP.
• Perform an assurance mapping exercise to clearly outline what assurance is to be provided.
• Alongside other assurance providers, deliver independent assurance over key risk areas in line with the AAP requirements.

Directors’ obligations in relation to fraud

Directors will have to disclose and explain activities taken to prevent and detect fraud within the Annual Report.

• Perform an enterprise-wide fraud risk assessment. The assessment should consider the key fraud risks faced across your organisation.
• Review key anti-fraud strategies and policies to confirm they are in place, up to date and covering key risk areas.
• Assess the appropriateness of the process in place to identify and prioritise potential fraud risks.

• Identify key fraud risks (using results from risk assessments) and confirm:

o Appropriate anti-fraud controls have been implemented. Where control gaps are identified, action plans should be put in place to mitigate such gaps; and

o Perform testing to confirm key controls are operating effectively.

• Assess the appropriateness of responsibility and accountability of those charged with governance on the prevention and detection of fraud.
• Review the anti-fraud training programme to confirm appropriate training is provided and tailored for high-risk positions such as HR, finance and procurement.
• Perform fraud-culture surveys to assess employees’ understanding of key anti-fraud policy requirements.
• Assess the process to detect and report fraud risks and management overrides.

Resilience Statement (Large PIEs)

A statement to report on matters which could materially challenge resilience over the short and medium term.

• Perform a gap assessment against requirements. Where gaps are identified, action plans should be agreed to mitigate those gaps.
• Support the assessment of the completion of actions identified as part of the gap assessment to improve resilience.

• Perform ongoing assessments to challenge assumptions and inputs into the resilience statement, against the evolving business activities.
• Review actions taken to improve resilience to confirm appropriateness; and
• Assess compliance with the key disclosed controls and activities.