Mr. Jonathan Bravo
International Organization of Securities Commissions
Calle Oquendo 12
28006 Madrid
Spain
By email: consultation-04-2018@iosco.org
16 July 2018
To IOSCO:
Public Comment on IOSCO Consultation Report on Good Practices for Audit Committees in Supporting Audit Quality
The International Corporate Governance Network (ICGN) is pleased to provide comments to the International Organization of Securities Commissions (IOSCO) Consultation Report on Good Practices for Audit Committees in Supporting Audit Quality.
Led by investors responsible for assets under management in excess of US$34 trillion, ICGN is a leading authority on global standards of corporate governance and investor stewardship. Our membership is based in more than 45 countries and includes companies, advisors and other stakeholders. ICGN’s mission is to promote high standards of professionalism in governance for investors and companies alike in their mutual pursuit of long-term value creation, contributing to sustainable economies world-wide. Our policy positions are guided by the ICGN Global Governance Principles1 (Principles) developed in consultation with ICGN Members and as part of a wider peer review. For more information on ICGN please see: www.icgn.org.
Before addressing the individual questions outlined in the consultation paper, we would like to make some overarching points at the outset, which are reinforced in the answers to the specific questions. ICGN is pleased that IOSCO is focused on the important role audit committees may play in audit quality. We believe that such focus, if properly applied, will improve audit quality for the benefit of investors and other stakeholders. But if the guidance fails to hit the proper topics at the correct level, it could do harm in some jurisdictions that have already progressed beyond the given guidance. ICGN’s preferred policy approach is to articulate best practices as opposed to establishing minimal baseline guidance. At ICGN we appreciate that one size does not fit all in terms of what accounts for good corporate governance. Legitimate differences can and do exist. However, we also believe that it is possible to develop basic principles of governance that have broad relevance across many jurisdictions.Throughout the consultation, we believe IOSCO sometimes adjusts guidance lower in selected jurisdictions, where existing regulations are looser or do not support good practices. We ask that you re-consider this approach. Establishing comprehensive guidance that applies regardless of jurisdiction will provide additional leverage to promote good practices in the jurisdictions that are behind in such areas.
ICGN is not new to focusing on audit quality. In ICGN Principle 7, Reporting and Audit, we state:
“Boards should oversee timely and high quality company disclosures for investors and other stakeholders relating to financial statements, strategic and operational performance, corporate governance and material environmental and social factors. A robust audit practice is critical for necessary quality standards.”
ICGN also believes that Boards are responsible for overseeing the integrity of the company’s accounting and reporting systems, compliance with internationally accepted accounting standards, the effectiveness of systems of internal control, and the independence of the external audit process.
In our Principles, we outline specific concepts on the role of audit committees. The Board should establish an audit committee comprised entirely of independent non-executive directors, with at least one member of the committee having recent and relevant financial expertise. In addition, the main roles of the audit committee should include:
a) monitoring the integrity of the accounts and any formal announcements relating to the company’s financial performance, and reviewing significant financial reporting judgements contained in them;
b) maintaining oversight of key accounting policies and accounting judgements which should be in accordance with generally accepted international accounting standards and disclosing such policies in notes to the company accounts;
c) agreeing on the minimum scope of audit as prescribed by applicable law and any further assurance the company needs. Shareholders (who satisfy reasonable thresholds of shareholding) should have the opportunity to discuss results of the completed audit;
d) assuring itself of the quality of the audit carried out by the external auditors and assessing the effectiveness and independence of the auditor each year. This includes overseeing the appointment, reappointment and, if necessary removal of the external auditor and the remuneration of the auditor. There should be transparency in advance when the audit is to be tendered so that shareholders can engage with the company in relation to the process;
e) ensuring that contracts with the auditors do not contain specific limits to the auditor’s liability to the company for consequential damages or require the company to use alternative dispute resolution;
f) assuring that a robust system of internal financial controls is in place to provide for reliable financial and operational information;
g) engaging, when appropriate, new audit firms to improve market competition and broaden the pool of credible audit service providers;
h) having appropriate dialogue with the external auditor without management present and overseeing the interaction between management and the external auditor, including reviewing the management letter provided by the external auditors and overseeing management’s response; and
i) reporting on its work and conclusions in the annual report.
Notably, the guidance provided by the Principles is not adjusted based on the status of regulations in jurisdictions.
Questions relating to the role of audit committees and audit quality (Chapter 2)
- Do you agree that audit committees can have an important role in supporting audit quality in the interests of market confidence in the quality of information in the financial reports of issuers (see Section 2.1)?
Yes, as described above, ICGN believes audit committees play a critical role in audit quality. Audit quality is delivered by three parties: the auditor, management and the audit committee; therefore, the audit committees focus should encompass overseeing this dynamic structure. Audit committees are a necessary part of the governance structure. The composition of the audit committee is important to ensure independence and relevant expertise. Finally, the audit committee should carry out particular duties that support improved audit quality and enhanced financial reporting.
- Do you have any comments on the background material on audit quality (see Sections 2.3 and 2.4)?
We believe that Section 2.3 may be too high level to provide meaningful practical guidance. There should be a more robust discussion regarding why audit quality is important. We believe the short treatment on the importance of audit quality fails to capture the heightened emphasis institutional investors have placed on audit quality in recent years. The material does not touch on communication with investors.
Section 2.4 only offers a short list of the factors influencing audit quality. We believe there are many additional factors that should be listed in the report. Section 2.4 only lists one way in which audit committees may impact audit quality (audit committees may also consider how the auditor addresses the results of inspections by independent audit regulators).
Independent audit regulators currently report too many audit failures. This would appear to point to a problem with audit quality, however, some argue it points to a problem with the quality of inspections and/or the extent to which inspection results provide the most useful picture of audit quality to stakeholders. There appears to be issues with both, therefore audit committees should do much more than consider results of inspections. The audit committee should assure itself of the quality of the audit and assure itself that proper internal controls are in place to provide for high quality financial reporting and operational decision-making. We believe that Section 2.4 fails to capture the current issues and to identify specific problems that audit committees could reasonably address. Finally, there is no movement in communication. From an investor perspective, the exact same information is communicated in a low quality audit and a high quality audit. As investors, we would like to see that changed.
- Do you have any comments on the proposed description of the roles and responsibilities of audit committees and auditors (see Sections 2.5 to 2.7)?
Like the previous sections, Sections 2.5-2.7 do not appear to include the breadth of thought that has already gone into the presentation of these issues in different contexts that would better inform this discussion. For example, the Public Company Accounting Oversight Board (PCAOB) initiated a Concept Release on Audit Quality Indicators. It is understood that the IOSCO Consultation should not be as in depth as a specific regulator’s concept release, but the IOSCO Consultation should be informed by such related work. We would like IOSCO to consider making this section more robust which would mean including more of the items identified from our Principles in a) through i) above.
Questions relating to proposed good practices (Chapter 3)
- Do you have any comments on the proposed good practices for the features of audit committees that may facilitate a committee in being more effective in promoting and supporting audit quality (see Section 3.2)?
In Section 3.2, number 2, the proposed good practices suggest that there is flexibility as to whether all of the members of the audit committee are independent non-executive directors. IOSCO cites to a 2007 report to support the proposition that there are different approaches in different jurisdictions. First, much has changed in the past 11 years, so IOSCO should turn to more recent data to determine what constitutes good practice. Next, note 2 is in direct conflict with what ICGN considers as good practice. ICGN Principles state that “The Board should establish an audit committee comprised entirely of independent non-executive directors.” IOSCO’s standard for proposed good practice allows a majority of directors on the audit committee to be non-independent. In our view, note 2 does not constitute good practice in most markets. If the majority of the audit committee is not independent, Boards would have to do much more to protect against conflicts of interest.
On the positive side, note 4 promoting ongoing training for audit committee members is an excellent add on. In this case, IOSCO adds something not in any regulation as a good practice, but it fails to follow a similar principle when it comes to independence. As an investor organization, we continuously promote Board independence in all jurisdictions.
- Do you agree with the good practices for audit committees outlined in Sections 3.3 to 3.9?
We substantially agree with the good practices outlined in Sections 3.3 to 3.9 and ask you to consider some minor tweaks to certain provisions.
The parenthetical appearing at the end of good practices (GP) 16 should be removed. The good practice promotes using the right auditor for the right job regardless of firm size. The parenthetical provides a specific example that suggests an audit partner would be compromised ethically if he is at a smaller firm, but the exact same person would not be so compromised if he is at a big firm. This makes no sense and the weight of the specificity in the parenthetical contradicts the principle embedded in GP 16 and reduces competition.
In GP 18, please consider adding a concept that potential auditors agree to report any matter that threatens their independence to the audit committee.
GP 19 includes the concept “over familiarity with management” without fully explaining what that means. GP 19 would benefit from a further explanation of the concept.
There should be a clear statement in dealing with auditors when such auditors fail regulatory inspections. GP 23 addresses general findings but is silent on what happens when there are more serious findings. We recommend that IOSCO give more attention to what good audit committee practice requires when an auditor fails a regulatory inspection. For example, the United Kingdom (UK) Governance Code requires the Audit Committee to report on audit findings and a detailed explanation as to what steps have or will be taken to address the findings. This could include replacing the auditor.
GP 25 should have a more direct statement in the last sentence. We suggest that the last sentence might read as follows: “The audit committee should require the audit firm to consult with the audit committee on any change in partners or key audit team members to ensure that audit quality is maintained.” This language eliminates the passive posture of language in GP 25 which currently reads, “may also wish to consider encouraging.”
- Do you have any additional suggestions on good practices to be adopted by audit committees (see Sections 3.3 to 3.9)?
As noted in our Principles, we would like to see a view toward substantially greater audit committee interaction and communication with shareholders. The guidance should include a GP statement related to audit committee expectations on material environmental and social factors. There should be GP statements regarding communication with shareholders, including the audit committee’s communication in the annual report, and the audit committee’s duty in monitoring formal announcements relating to company financial performance whether based on internationally acceptable accounting principles or Non-GAAP measures.
- Would you suggest any other changes to the proposed good practices outlined in this report? If so, in what manner (see Sections 3.3 to 3.9)?
Please see responses to Question 5.
- In some cases a good practice is introduced with the words “The audit committee should take reasonable steps to ensure that” and in other case the words “The audit committee should consider the extent to which”. Is the wording used for each good practice appropriate (see Sections 3.3 to 3.9)?
The language used is fine but becomes confusing for each note that contains more than one sentence and too often there is additional introductory language within specific notes which might obfuscate the actions expected of an audit committee. For example, the last sentence in GP 25 says, “The audit committee may also wish to consider encouraging…” When the introduction is added, in plain English we have, “The audit committee should consider the extent to which: The audit committee may also wish to consider encouraging the audit firm…” The guidance should provide more direct statements.
- It is proposed to provide good practices at principles level and not to include detailed procedures to support those principles. Do you agree with this approach (see Sections 3.3 to 3.9)?
We prefer the presentation of good practices to be at the principles level without detailed procedures; however, the good practices are not limited to principles level guidance. Throughout, certain good practices are substantially weakened because the practices of particular jurisdictions are considered. In other cases, references are made to information more than a decade old to weaken good practices (see footnote 5 reference to 2007 IOSCO report, footnotes 6, 7, 9, 13, 15, 16, 17, 18, 19 and 20 references to 2002 IOSCO statement).
In the case of the 2002 Statement, the same footnote is listed in 6 and in 15 and each time states that “such principle had been settled by IOSCO.” We hope that IOSCO considers taking a fresh look at the dated report and statement. Investors are far more focused on these issues in 2018, and there have been dramatic improvements in the space over the past decade. Such improvements should inform good practices.
- Given the differing governance structures for issuers in different jurisdictions, to what extent should any final good practices report deal with the roles of the governing Board, audit committee and management in relation to financial reporting, systems and processes (see Section 3.6)?
The good practices report should deal with reporting systems and processes, otherwise, shareholders will see no difference among reporting companies. Companies with high quality audits and companies with low quality audits will reveal almost exactly the same information. Shareholders will get no information on what the audit committee actually does. Especially missing is a description of the audit committee’s wider duties in financial reporting that support audit quality. The weakest part of the good practice guidance is the absence of substantial guidance on communicating with shareholders. Therefore, we would like to see more transparency with respect to effectiveness assessments and stronger guidance on communicating with shareholders.
- What frameworks, practices, methodologies, or tools have audit committees found to be helpful in evaluating the following:
We will leave this section for audit committees. Audit committees provide very little information regarding tools used or how they conduct the business of ensuring audit quality.
Questions relating to other matters (Chapter 4)
- Should the proposed report include a section mentioning the possibility of public reporting by audit committees on how they support audit quality? If so, should such reporting be described as “voluntary” or as a “good practice” for the majority of jurisdictions where there is no mandatory requirement? Should more detailed reporting criteria be provided in any final report (see Section 4.1)?
Currently, audit committees are paid to do a job yet are not required to communicate about what they did. As long as the company continues to operate, investors are left to assume that the audit committee is doing its job. As a part of good practice, audit committees should provide robust annual reports on its work to benefit shareholders including asking the auditor for feedback and how they have assessed their own performance which includes auditor feedback.
Other comments
13. Are there any other comments that you have on the proposed good practices report and the material that may be included in any final report?
It would be positive if IOSCO were to extend its view to include the other roles assumed by audit committees that have direct and indirect impact on audit quality, including the audit committee’s significant role in overall corporate reporting. For example, an audit committee could comply with the stated good practices and provide effective oversight of the auditor and management, yet at the same time weakening its own financial reporting by supporting the presentation of inappropriate non-GAAP information in the corporate reports. Proposed good practices could address the presentation of non-GAAP information in a more robust manner.
The audit committee should engage with the company’s auditor to discuss risks or other concerns that were significant to the audit process, including any significant questions or disputes regarding accounting practices. The audit committee report should include a summary of its discussions with auditors, including how any major concerns were addressed, to enhance investor confidence in the audit process.
We hope these comments are useful in your deliberations. If you would like to follow up with us with questions or comments, please contact our Policy Director George Dallas: george.dallas@icgn.org .
Yours sincerely,
Kerrie Waring
Chief Executive Officer, ICGN
Copy: James Andrus, Chairman, ICGN Disclosure and Transparency Committee: James.Andrus@calpers.ca.gov
