Governance and reporting. How can boards navigate their way through a changing regulatory landscape?

Transcription

1 Governance and reporting How can boards navigate their way through a changing regulatory landscape?

2 Governance and reporting How can boards navigate their way through a changing regulatory landscape? Boards and in particular Audit Committees continue to face increasing challenge in managing risk, ensuring the maintenance of robust internal controls and providing reliable This snapshot highlights for Audit Committees: New accounting requirements: An overview of the high level requirements and potential implications, challenges and opportunities associated with the next wave of new accounting requirements including Cyber security: Audit committees role in setting the tone for enhancing cyber security The new audit report: Insights from companies that have implemented the new long form audit report early ASIC public audit inspection report: What ASIC s public audit inspection report really says about audit quality and how the corporate regulator is now User pay funding: What are some of the implications of the proposed user pay funding for companies in Australia? corporate governance knowledge and experience, gained across all markets and geographies. We use this to support instruments, direct and indirect taxes, foreign currency, subsidiaries, joint ventures, provisions, disposals and impairment. Whatever your requirements, we assemble multi-disciplinary teams that can address your most complex issues, using our proven global methodology and deploying the latest, high-quality auditing tools and perspectives. Navigating accounting change While there are no new major standards applicable for effective on or around the same time: AASB 15 Revenue from Contracts with Customers AASB 9 Financial Instruments AASB 16 Leases This makes for a crowded implementation timeline. Although the headline implementation dates of way away, the impact on many businesses will be The leases standard alone is expected to bring USD$3 trillion onto balance sheets globally. The choices around transition options and the interrelationships and linkages between the three standards, means that Boards will implications and properly model the available choices Questions the Board should consider A Board s perspective on accounting change encompasses a broader context than the mere change itself. Questions to ask include: Do the new rules offer a solution to a problem? Do they affect contract negotiations? How should communications to the market be planned? What impact will these changes have on our What impact will they have on covenants and remuneration structures? In contrast, management s perspective may be quite different. Finance teams are more commonly focused on the time, cost and effort involved with the work; and in understanding the modelling options; and managing the implementation. 2 Governance and reporting How can boards navigate their way through a changing regulatory landscape?

3 We are already observing some boards beginning to ask these types of questions. It is reasonable for Boards to can address these questions as and when required. In general, under the new standards, entities will need to exercise more judgement and will likely have to make more estimates than they do today. Even entities that do need to validate that assertion. The devil is in the detail and it is an ineffective and potentially risky option to just do a high level review at the accounting policy level. Furthermore, entities will also need to identify any necessary changes to policies, procedures, internal controls and systems to ensure that their operations and arrangements are appropriately evaluated in light of the new standards. They will also need to plan for the something that should not be left until the last minute. While some entities will be able to implement the an understanding of the impacts, providing early communication to stakeholders and planning ahead are crucial factors for a successful implementation. Early preparation is the key to a smooth transition. of new technology What is the Audit Committee s role in setting the tone for enhancing security? The potential impact of cyber crime requires cyber security to be viewed as a business risk, rather than a simple IT issue. A cyber-attack may affect a business s puts its reputation on the line. While businesses worldwide have increased the priority of cyber security risk, their focus has been primarily on protecting their information by preventing breaches. Unfortunately, the current threat environment is such that it is only a matter of time before all businesses will suffer a major cyber breach. To adequately address these likely large and complex breaches, it is necessary for companies to develop a strong, centralised response framework as part of the enterprise risk management strategy. A centralised, enterprise-wide cyber breach response the wide variety of stakeholders that must collaborate to resolve a breach. It needs to be run by someone who is: Equipped with in-depth legal, compliance and technology experience Able to manage the day-to-day operational and tactical response The CBRP goes beyond the capacity of a traditional and oversight role, the CBRP can help ensure that an organisation s business continuity plan: Is appropriately implemented and enforced among all internal stakeholders Can centrally manage all breach-related inquiries received from external and internal groups In short, it provides guidance to all lines of business involved in the response, sets a level of understanding about what information is critical for senior leaders to know as well as when and how to express it. It also allows continuous reaction with precision and speed as a breach continues to unfold over days, weeks or even months. Committee or the Audit Committee will be given the responsibility to oversee Information Security risks. What should Audit Committees do? In our experience, Audit Committees operating in this capacity should leverage detailed information on the company s control processes to better understand what level of oversight is necessary and whether management has the right people and processes in place. The Audit Committee can then establish whether action plans are aligned with the company s level of maturity in managing security risks and determine where more attention may be required, such as sectors where risks and the potential for damages are highest. Governance and reporting How can boards navigate their way through a changing regulatory landscape? 3

4 Board and/or Audit committees should also ask and then ask for benchmarks: Do you believe that your information security gap (the difference between what you are doing and How is the company doing relative to its competitors and the industry? What measures are in place to prevent or, more importantly, detect attacks? Have management decisions associated with gaps in the security program been aligned to the company s tolerance for risk? How do you know that your limited resources are focused on areas and initiatives critical to information security success? were a year ago? How about compared to two or three years ago? Do we know what our critical assets are and how someone might be able to access them? The new audit report What can we learn from companies that have implemented early? Plus insights from our own pilot program. In December 2015, the Auditing and Assurance Standards auditing standards, that adopt the recent improvements made to the equivalent International Standards on transparent and informative reports on the companies they audit. The aim is to provide auditor s reports that An area of focus within the new standards is the in the auditor s report. These are matters that, in the auditor s professional judgement, were of most the current period. The expanded auditor s report will become a requirement for listed entities from December 2016 or June 2017, depending on the entity s year end. There has been debate in the profession as to whether In our view, it would be generally inappropriate to of the standards and the audit opinion is on the overall or matters. In the UK, where the enhanced auditor s report is already business as usual, it is a requirement of the standard to include discussion on scope and materiality. This is not a requirement of the Australian standard. EY has been running a pilot program where audit and drafted an enhanced auditor s report. These reports to ensure the requirements of the standards were met and presented to management/audit Committee s for Revenue IT systems ASIC public audit inspection report What it really says about audit quality and how reporting issues? ASIC has been subject to criticism in reviews over the past few years. EY made a submission to the recent Capability Review which was issued in April EY suggested that ASIC refocus its capabilities, particularly in relation to audit included a review of talent and greater transparency. The report has 34 recommendations in 6 key areas: ASIC responded positively to recommendations and is looking at a Financial Services Disciplinary Panel (industry improving its ability to analyse trade data from multiple sources and identify connections in the data. 4 Governance and reporting How can boards navigate their way through a changing regulatory landscape?

5 Proposed user pay funding What are some of the implications for companies in Australia? The recent proposal to increase funding through more charges for licensing and consents provided would have introduce a levy on public companies, based on market capitalisation (for the largest companies, up to a The proposal also recommends charges for public company audit, a so called user pays funding model, likely through a levy on public company audit fees. Approximately $4.5m would be passed on to public companies via a charge to their auditors. The government asked for submissions on the user pay opposed the suggested regime. EY suggested that any change to the funding model should result in an improvement of ASIC s capability and talent, and increased accountability and transparency around its performance. The government has made no comment in relation to user pays since the end of the consultation period. ASIC Surveillance and press releases about ASIC continues its accounts surveillance program, years, ASIC issued 18 press releases inviting companies to inquiries they have made. Some companies accept ASIC s views and change in order to close down the to reporting were announced, there were 10 impairment acquisition accounting; and two for revenue recognition consistent with ASIC s focus areas that they announce ASIC s accounts surveillance program and some came ASIC s audit inspection report for ASIC issued the public report on its audit inspection program in December The report covered the 18 months ended on 30 June The theme was similar make good efforts to improve audit quality, these are yet in three primary areas: evidence obtained by the auditor 2. The level of auditors professional scepticism 3. The appropriate use of the work of experts and other auditors ASIC continues to request audit team members spend more time on the audit and require increased additional specialists such as actuaries, valuers and combine to increase the time and overall cost of an audit. ASIC s audit inspection program has made a contribution to improving audit quality and their reviews have of our own internal audit quality review program. to challenge. ASIC has questioned the professional judgement exercised by experienced auditors and /or specialists in areas we believe, are matters of professional judgement. In our view they often expect more documentation or testing than is required by auditing standards. EY believes that ASIC s inspection teams and their resulting reviews experience. The reporting process they follow is unusual with the overall report published before they have agreed overall report. on addressing targeted areas of concern, in the aim of improving audit quality as part of a far broader global in inspections throughout the world. The focus is on four years. Australia, as one of the nine founding members of IFIAR, will participate in this initiative. EY have made an investment in new audit tools and global efforts to focus on key areas of concern where the need for improvement is acknowledged. For more information, please contact a member of our team or visit our Assurance pages on ey.com Governance and reporting How can boards navigate their way through a changing regulatory landscape? 5

6 EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organisation, and may refer to one or more, of the member firms of Ernst & Young guarantee, does not provide services to clients. For more information about our organisation, please visit ey.com Ernst & Young, Australia. All Rights Reserved. APAC No. AU This communication provides general information which is current at the time of production. The information contained in this communication does not constitute advice and should not be relied on as such. Professional advice should be sought prior to any action being taken in reliance on any of the information. Ernst & Young disclaims all responsibility and liability (including, without limitation, arising from anything done or omitted to be done by any party in reliance, whether wholly or partially, on any of the information. Any party that relies on the ey.com