Integrated Assurance

Risk Governance Beyond Boundaries

Vicky Kubitscheck

• Publisher: Routledge
• Year: 2016
• ISBN:
  9781317115328
• Edition: 1
• Topic: Business
• Subtopic: Insurance
• Index: Business

The need for assurance is never more acute than in times of turbulence and uncertainty. The events following the financial market crisis demonstrate the catastrophic consequence of risk taking that exceeds the board's appetite, and of not joining up risk intelligence for sound decision making. Boards and senior management alike consistently seek the 'one truth' about risk exposures and strength of controls but are continuing to grapple with the challenge. Much has been written about assurance and the governance of risks, but mainly by those who provide it - such as internal auditors, accountants and information security technologists - for the purpose of advancing their professional practices. Less is written for or by those in governance who need assurance for the effective discharge of their responsibilities. Regulations do not usually go beyond acknowledging its importance and rely on those in the boardroom to get it right. Studies have consistently shown the link between weak corporate governance and corporate failures. The lack of reliable assurance has often been a factor. Assurance, as an integral part of corporate governance, cannot be taken for granted. It requires conscious action across the organisation. It is time to rethink assurance beyond its usual functional boundaries, to focus on what matters to the business and how discussions in the board room can be better supported by more joined up assurance. This book provides practical guidance for those who need that support as well as those who deliver assurance.

PART I
INTRODUCTION – THE CASE FOR INTEGRATED ASSURANCE: GOVERNANCE IN THE NEW ORDER

---

Chapter 1
Corporate Governance on Trial

---

In this opening chapter we consider, in the first two sections, the role of ineffective assurance and information – particularly over risk taking in the breakdown of corporate governance that contributed to the financial crisis of 2008 and major corporate failures. Risk taking and its assurance is further discussed in Chapters 2 and 3. In section two of this chapter, we also highlight the different truths which boards should be alert to when seeking assurance. We consider in the last section of the chapter the emerging trend in regulation for a more holistic and integrated values based approach to corporate governance that is multidimensional in its consideration of risks. This sets the scene for Chapters 4–6 where we spotlight those key elements of corporate governance that refer to transparency, accountability and assurance in a new order.

Corporate Governance – The Dog that didn’t Bark?

Surprises in the boardroom are seldom welcomed, even when good things happen, especially when this is due to luck and associated with a near miss event. Good or bad, an outcome of an event that was within reasonable expectation is more acceptable – and manageable – than one which totally blindsided the board. We know bad things happen in life. In any complex systems which include life, and in business, things do not always go as planned. When they do go wrong, particularly in business, the people at the helm are held to account. Board members who speak regularly about wanting no surprises in the boardroom are essentially referring to the need for effective alert systems. Could they be referring to a dog in the boardroom called corporate governance that barks?

The call for better corporate governance has reached new heights since the global financial crisis, triggered by the credit crunch, which started to reverberate across the financial markets and world economies in 2008. It proved to be one of the biggest surprises that ever surfaced in virtually every boardroom in the corporate and non corporate world. The quality of assurance expected by key stakeholders of major organisations in the financial market system was found wanting as the crisis unfolded. One notable example was contained in the Financial Crisis Inquiry Commission report in the US which stated that ‘Throughout the summer of 2007, both Federal Reserve Chairman Ben Bernanke and Treasury Secretary Henry Paulson offered public assurances that the turmoil in the subprime mortgage markets would be contained’. It went on to say that ‘Days before the collapse of Bear Stearns in March 2008, SEC Chairman Christopher Cox expressed “comfort about the capital cushions” at the big investment banks’.¹

Whether or not these assurances were appropriate given the mood of the economic and political climate at the time, the crisis exposed the weaknesses in the accessibility and quality of information, judgement and also the credibility of the decision makers. The same report stated that ‘just before Lehman’s collapse, the Federal Reserve Bank of New York was still seeking information on the exposures created by Lehman’s more than 900,000 derivatives contracts’. How does a board seek assurance of the level of risks that is being taken by the firm in such a situation? When should the alerts have started? What kind of management controls were really in place? How credible was the assurance provided by management’s attestation of the internal controls for financial reporting required under the Sarbanes Oxley Act?²

Similar questions could be raised in the case of the bail out³ of the US insurance giant, American International Group Inc. (AIG) in 2008. Prior to the bottom falling out of AIG, how did the board assure itself that the risks taken by management were acceptable and within their expectations? For example, when the senior executive at AIG advised the board that the credit default swaps (CDS) protection they had sold to banks would never go into default (characterising them as ‘gold’ and ‘free money’), how was the assertion monitored, verified and reported? As CDS were unregulated, and with no mandated capital requirements or regulatory filings, was management reporting of the multimillion dollar CDS business sufficient and open? Was the board further aware that, unlike banks and hedge funds, AIG had no form of reinsuring itself against the protection it was selling to the banks and hedge funds in respect of their CDS holdings? Was the board aware that CDS sold with subprime mortgage loan exposure was amounting to $61.4bn? Did the board and management rely wholly on the AAA rating assurance of the CDS provided by the credit agencies at outset?

Many such questions were asked by the numerous post crisis inquiries and studies. I have stopped counting the number of reviews, committees and inquiries that have been initiated by each nation since the global financial crisis. The International Federation of Accountants⁴ (IFAC) lists no less than 17 international organisations that have set up dedicated resources for addressing the issues relating from the global financial crisis. The list includes organisations such as the European Commission, HM Treasury in the UK, the International Monetary Fund, the Global Public Policy Committee (Standards Working Group), the Basel Committee of Banking Supervision, the Financial Stability Forum, the United Nations Development Policy and Analysis Division and the World Bank.

Without exception, the inquiries concluded dramatic breakdown of corporate governance as one of the main contributory factors of the crisis. The Financial Crisis Inquiry Commission has gone one step further than other inquiries by concluding that the turmoil was avoidable. It said in its report that:

The crisis was the result of human action and inaction, not of Mother Nature or computer models gone haywire. The captains of finance and the public stewards of our financial system ignored warnings and failed to question, understand, and manage evolving risks within a system essential to the wellbeing of the American public. Theirs was a big miss, not a stumble.⁵

The report suggests that the financial crisis was predictable had the captains and stewards acted on early signs and warnings.

A similar conclusion was reached by the US Senate Permanent Sub Committee on Investigations on the US’s largest corporate bankruptcy at the time, Enron. The Subcommittee stated that the failure of the board to heed warning signs and to ask an ‘awful lot of questions’ in the months leading to the collapse of Enron contributed to its demise. According to its report on ‘The Role of the Board of Directors in Enron’s Collapse’, the Subcommittee stated that:

it identified more than a dozen red flags that should have caused the Enron Board to ask hard questions, examine Enron policies, and consider changing course. Those red flags were not heeded. In too many instances, by going along with questionable practices and relying on management and auditor representations, the Enron Board failed to provide the prudent oversight and checks and balances that its fiduciary obligations required and a company like Enron needed. By failing to provide sufficient oversight and restraint to stop management excess, the Enron Board contributed to the company’s collapse and bears a share of the responsibility for it.

By failing to challenge and seek appropriate assurances from management, the Subcommittee said that the Enron Board had transformed the company from a ‘well-respected and award-winning company to a disgraced and bankrupt enterprise in less than 3 months’.⁶

An obvious question, articulated appropriately by Senator Joseph Lieberman⁷ who chaired the Senate Government Affairs Committee at a hearing in May 2002, is ‘why all that experience, and so much more, accomplished so little for shareholders of Enron’. Pulling no punches, Lieberman stated in his testimony that he thought the directors not only lacked diligence but were also greedy by profiting from their positions and ‘toasted marshmallows over the flames … even as those flames shook our economy and engulfed the dreams of thousands of dedicated Enron employees who lost not only their jobs but their retirement security’. Lieberman goes on to say that ‘The flagrant failure of Enron’s board of directors is a warning we must heed’.

Unfortunately, warnings of such breakdowns in the boardroom are neither new nor unique to Enron. Greed, when mixed with hubris and the desire for power,⁸ according to Hamilton and Micklethwait, forms one of the six common toxic cocktails for corporate failures. In their indepth analysis of eight specially chosen high profile case studies from around the globe that include Enron, WorldCom, Swissair and Marconi, Hamilton and Micklethwait identified that the other five interlinking root causes of corporate failure were: poor strategic decisions, overexpansion and ill-judged acquisitions, dominant CEOs, failure of internal controls and ineffectual or ineffective boards.

Nearly six years on, the indiscriminate impact of the 2008 financial crisis across nations, industries as well as private and public sectors is still unfolding. The UK Government’s Spending Review⁹ published in 2010 refers to taking decisive action for example with a 34 per cent cut in its administration budgets by 2014–2015 while the US Department of the Treasury¹⁰ announces a plan to cut 10 year deficits by 2.1 trillion US dollars from the start of 2013 to manage the long term fiscal challenges exacerbated by the economic crisis. The ultimate and full impact is still being felt by each nation’s citizens – that is all of us. In the UK, the pressure of the financial crisis has seen the disappearance of some household names – such as one of UK’s oldest stores, Woolworths, with over 800 branches nationwide and 1960s homeware icon, Habitat, as they went under administration.

The rate of corporate mortality as a direct impact of the financial crisis is not expected to slow down. The US Federal Deposit Insurance Corporation¹¹ (FDIC), which is a primary regulator and often appointed as receiver for failed banks, listed in July 2013 over 450 bank failures since 2000, the majority of which occurred since 2008. The FDIC 2010 Annual Report Highlights¹² reported that some 884 banks (12 percent of all federally insured banks) with assets totalling nearly $400 billion were on their problem list, the highest level in 18 years.

The timescale to full recovery remains uncertain as economies in Europe, the US and in Asia continue to wrestle with the challenges. It is hardly surprising that sweeping changes to the banking and financial market systems have been proposed, and are being implemented, to prevent the recurrence of another systemic market failure. Early indications are that the face of corporate governance is set to change as regulators take a more intrusive and preemptive approach to seeking assurance from boards of their effectiveness – ensuring that corporate governance is a dog that barks.

Defective Information, Intelligence and the ‘One Truth’

Being alert to relevant information and acting appropriately on them are the two pertinent lessons, as considered in the last section, from the global financial crisis and major corporate breakdowns. It would indeed be a waste of a crisis if we do not examine their practical implications for restoring confidence in boardroom practice. We should, however, first acknowledge that not all boards are as dysfunctional as those characterised by the high profile corporate disasters. Most boards seek to do well for the organisations they represent. While boards must take personal responsibility to equip themselves for the task they are, however, also reliant on the support, integrity and diligence of the organisation’s management to provide them with appropriate and timely information.

Seeking sufficient information is an art which boards must hone if they want to avoid the road to ruin – a sentiment reflected in a study by the Cass Business School. In this investigation of 18 high profile corporate breakdowns that include AIG, Arthur Andersen, BP, Cadbury Schweppes, Coca Cola, EADS Airbus, Enron, Firestone, Maclaren, Northern Rock and Société Générale, internal communication and information flow was found to be defective. In addition to improving their approach to risk management, boards and in particular non-executive directors are advised to seek ‘full information and ask challenging questions’¹³ about the underlying risks.

This is put succinctly by the UK Financial Reporting Council in its recommendations for Enhancing corporate reporting and audit that are aimed at both financial and nonfinancial companies. The proposals stated that:

The financial crisis highlighted the importance of the identification, analysis and management of risk. That is not only true in financial services. Companies in all sectors still get into trouble because of failures in this respect. Our aim is to reduce the likelihood that the message will be forgotten – as it...

Table of contents

• Cover Page
• Title Page
• Copyright Page
• Contents
• List of Figures
• List of Tables
• Acknowledgements
• Glossary of Key Terms
• Foreword
• Preface
• PART I INTRODUCTION – THE CASE FOR INTEGRATED ASSURANCE: GOVERNANCE IN THE NEW ORDER
• PART II RISK ASSURANCE BEYOND BOUNDARIES
• PART III IMPLEMENTING INTEGRATED ASSURANCE
• PART IV CASE STUDIES
• Bibliography
• Index