INSTITUTE OF DIRECTORS

Mr Norman Murray, Audit Firm Governance Working Group, Chartered Accountants Hall, PO Box 433, Moorgate Place, London EC2P 2BJ. 9 February 2009 Dear Mr Murray, Audit Firm Governance: Evidence Gathering Consultation Paper Thank you for giving the Institute of Directors (IoD) the opportunity to respond to the Audit Firm Governance Consultation Paper, published by the Audit Firm Governance Working Group in October 2008. This paper presents our response. Issues surrounding auditing are of considerable interest to the United Kingdom business community in general and to the IoD in particular. We are therefore pleased to participate in the consultation and present our response to the questions posed below. About the IoD Founded by Royal Charter in 1903, the IoD is an independent, non-party political organisation of 50,000 individual members. Its aim is to serve, support, represent and set standards for directors to enable them to fulfil their leadership responsibilities in creating wealth for the benefit of business and society as a whole. The membership is drawn from right across the business spectrum. 92% of FTSE 100 companies have IoD members on their boards, but the majority of members, some 70%, comprise directors of small and medium-sized enterprises, ranging from long-established businesses to start-up companies. Initial observations We agree that there is merit in increasing the range of choice outside of the big four audit firms. This involves increasing the confidence that investors have in the second-tier firms, and the capacity that these firms have to carry out some of the larger company audits. Achieving this objective should be a priority for the audit profession, and institutional investors should push for this. 1

We would highlight two key questions that should be addressed when considering the future of audit company governance. Firstly, what measures might increase confidence in the second-tier of audit firms? Here are a few suggestions: Public liability policies for the second tier firms that are at the same level as the larger firms, and for this to be included in the background statements. FRC examination of the quality of audit work undertaken by the entire spectrum of tier one and two firms. Publication of their annual rating of audit firms on their website. Clearly specified and practised value statements by second tier firms. Clarity and transparency in the organisation of the audit practice of second tier firms, including the publication of technical reviews relating to their audit activities. The overall governance of the audit practice should be transparent, and directed by the equivalent of a board of partners. This should include independent non-executives (although, given the ownership pattern of LLPs, not an independent chair). Secondly, what are the things that are likely to give greater confidence to the wider public? Reduce significantly the reliance of audit firms on non-audit work. Currently this is averaging four times the audit fee for the top FTSE-100 clients. Best practice should dictate that clients should not pay more in non-audit fees to their auditor than they pay for audit services. A better governance structure. Greater capacity to withstand claims through greater levels of professional indemnity insurance. Although the audit firms make clear in their letter of engagement that they report to the shareholders alone, and are not offering an opinion to outside stakeholders, this needs to change. The audited accounts should be relied upon by all relevant stakeholders. Response to specific consultation questions Stakeholders of firms that audit public interest entities 1. Which groups of stakeholders do you think the Audit Firm Governance Code should primarily serve and in what ways, if any, do they have differing interests? Currently, audit firms limit their report to the shareholders of the company. In our view, this is inadequate and unrealistic if confidence in audit firms is to be restored. 2

The purpose of a code should be to provide reassurance to all those groups that have a significant interest in the proper functioning of audit firms. Such groups are likely to include: Investors in public interest entities; The boards of public interest entities, particularly members of audit committees; Other stakeholders in public interest entities, including creditors, suppliers, and employees; The government and regulatory authorities; Owners of the audit firm themselves, whether they are partners, members of a LLP, or (potentially in the future) external shareholders of a limited company. All of these stakeholder groups share an interest in the long-term sustainability of auditing firms, and therefore in the maintenance of high standards of governance. Although it is not the focus of the current consultation, good governance principles are potentially applicable to all types of audit firm, not just those auditing public interest entities. Such firms would also benefit from having their own code of best practice, which could be tailored to their specific needs and smaller size, and implemented on a voluntary basis. Risk management 2. What approach should a Combined Code-style Audit Firm Governance Code adopt to risk management and internal control? As the accounting profession is fully aware, the risk assessment and control process is fundamental. It is unrealistic for audit firms to use the letter of engagement as a tool to absolve them from much of the responsibility of the audit. It is appropriate for any code to adopt a similar approach to that taken in the Combined Code and the associated Turnbull Guidance. It is not obvious that the internal control and risk management challenges faced by audit firms are fundamentally different from those of other types of enterprise. 3. To what extent do the firms face unique issues in discussing their principal litigation and claims risks without causing damage to the sustainability of the firm? Audit firms face significant litigation risks, but they are not unique. Many other types of enterprise are subject to a high level of litigation risk. Audit firms must recognise that if they fail to embrace transparency regarding their business risks, the proposed governance code will achieve very little in relation to its ultimate objective: the reassurance of stakeholders. A fundamental prerequisite for the effective operation of the comply or explain principle is a high level of transparency to stakeholders. 3

4. Do you agree that the Audit Firm Governance Code should focus on risk management and internal control of the firm as a whole including its non-audit business and, if not, what alternatives would you propose? Yes, absolutely. It should cover the activities of the entire firm. However, see our comments above regarding the need for limitation of non-audit work for audit clients. International structures of the firms 5. In the case of a UK firm that is part of a regional or an international structure, should the Audit Firm Governance Code specify the level at which it is applicable or should the firm be given some discretion to determine the level at which it applies the Code, explaining why this level has been chosen? Ideally, the code should be applied to audit groups in their entirety, cutting across national borders. To the extent that it is only possible to apply the code to UK subsidiaries of international groupings, full disclosure should be made of the degree of autonomy enjoyed by the UK firm. In particular, the UK firm should provide details of the extent to which it is able to determine its own strategy and risk profile. 6. Do you think that the Audit Firm Governance Code should contain code principles and/or code provisions covering an audit firm s dependence on, and exposure to the risks of, other network members and how it ensures consistent quality and application of auditing standards? Yes, absolutely. See answer to previous question. Governance structures and independent non-executives 7. In principle, do you think that the Audit Firm Governance Code should support the appointment of independent non-executives by the firms and, if so, what might it say on the number or proportion of non-executives and their position, role and responsibilities in a firm s governance structure? Yes. However, there are two prerequisites for the effective functioning of independent non-executives in an audit firm environment: They must have power. They should enjoy the same voting rights as other members of the audit firm s main decision-making body, and they must be sufficient in number to be able to exercise a significant influence over decisionmaking. As with the Combined Code, the appropriate number of independent non-executives is likely to vary according to the size of the firm. They must be subject to some kind of potential liability. Just as the prospect of personal liability (albeit mitigated by professional indemnity insurance) focuses the minds of independent directors on company boards, this must also be true of independent non-executives of audit firms. 4

Without these prerequisites, the stakeholders of audit firms will have little confidence in the ability or motivation of non-executives to exert a significant influence over audit firm governance. 8. Other than matters related to auditor independence, are there any barriers, regulatory or otherwise, to the appointment of independent non-executives to firms? With regard to regulatory barriers, we have no comment. However, it will be important that independent non-executives have appropriate financial experience if they are to exercise effective oversight, and advise on strategy. In addition, we do not believe that these people should be former partners of accounting firms. This reduces the size of the potential pool of relevant candidates; it may be quite difficult to find candidates of sufficient calibre and expertise to fulfil the role. 9. What other governance structures and models are there that provide for independent oversight which might be considered by the Audit Firm Governance Working Group? A model that is worthy of examination is the newly created governance structure of NHS foundation trusts, where independent oversight of the board is undertaken both by independent non-executive directors and a board of governors. Scope of firms to be covered 10. In order to determine which firms the Audit Firm Governance Code applies to, should the definition of a public interest entity be based upon the narrower listed company market definition used for transparency reporting purposes or the wider definition used by the AIU or some other definition? We have no particular recommendation in respect of this question. However, we would stress that a governance code should have broader objectives than simply reducing the risk of failure of the largest audit firms. It should provide a governance framework for as many audit firms as possible, and help steer them towards fulfilling their long-term mission and goals. 11. Do you think that a distinction should be made between firms that would be required to apply the Audit Firm Governance Code and firms that would be encouraged to apply it on a voluntary basis and, if so, where should that distinction be drawn? Yes. The main Audit Firm Governance Code will probably be a disproportionate governance blueprint for smaller audit firms that are not involved in the audit of public interest entities. Implementation of the code should be voluntary for these firms. Furthermore, smaller audit firms may benefit from an alternative set of (voluntary) governance principles, which are tailored to their smaller size and reduced complexity. Implementation and monitoring 5

12. Based on the assumption that the comply or explain approach will apply, to what extent do you think that the implementation of the Audit Firm Governance Code should be left to the market because owners of the firms and shareholders and directors of listed companies can be relied on to ensure that the firms apply the Code and make appropriate explanations of non-compliance? To a large extent, it will be up to the directors and shareholders of listed companies to hold audit firms accountable for their implementation of the code (through their decision-making in respect of the appointment and reappointment of auditors). However, it will also be important for a regulatory body such as the FRC to monitor at a systemic level the operation of the code, i.e. the quality of explanations, the impact of the code on governance standards, and an assessment of whether directors/shareholders are taking account of governance issues in their decision-making processes. 13. What need, if any, do you think there will be for: Audit regulations to require the firms to make comply or explain disclosures in relation to the Audit Firm Governance Code? This will be necessary. Although soft law codes permit flexibility in the implementation of governance standards, they need to be anchored in a hard law requirement to either comply or explain. This is the principle that underpins comply or explain in relation to the Combined Code. A regulatory or other body to monitor and to check either compliance with the Audit Firm Governance Code or the appropriateness of explanations of noncompliance? This will also be important. See answer to question 12. In the public sector, such a function is fulfilled by Monitor, which is the independent regulator of NHS foundation trusts. Monitor provides a traffic light assessment of the governance status of each of these trusts (based on their disclosures), which is presented on their website. Involvement of auditors appointed by the firms? This is also necessary. Verification of the disclosures relating to the code by a third party assessor will increase the confidence of stakeholders in the integrity of governance arrangements 14. Can you suggest any potential deregulatory measures to eliminate possible duplication that could be linked to the implementation of the Audit Firm Governance Code? There is no need for the code to cover areas that are already defined by hard law, i.e. legislation or regulation. The code should only cover areas of governance practice that are not embodied in existing regulation. 6

Reporting and communication 15. What measures should be taken in relation to how and where the firms disseminate information about their application of the Audit Firm Governance Code so as to enhance its usefulness? We have no specific suggestions. However, it is important that the main audience of corporate governance disclosures the directors and shareholders of public interest entities (as well as other stakeholders) have access to information on the corporate governance status of audit firms. It should certainly be presented to audit committees as part of the auditor selection process. Auditors should immediately publicise any changes in their governance status (relative to the issues defined in the code), both to their clients and to the market as a whole. A central website possibly maintained by the FRC could provide a central repository of information on the governance status of audit firms. 16. Should the Audit Firm Governance Code call for disclosure of specific matters, such as major changes in governance practices, responses to specific concerns raised by the AIU, and any other matters? Yes. Anything which changes an audit firm s status with respect to the Audit Firm Governance Code Principles and provisions should be disclosed. Regulators may also seek the disclosure of other issues not covered by the code. Areas to be covered by the Code 17. Are there principles and provisions in the Combined Code which you think are particularly relevant or inappropriate for application to the firms and are there major issues of relevance to the firms that are not included in the Combined Code? Although the principles of the Combined Code are likely to be a good starting point for the design of the Audit Firm Governance Code, it will be necessary to consider on a case-by-case basis the applicability of its detailed provisions to audit firms. It should not be presumed that the Combined Code is directly transposable into an Audit Firm Governance Code. 18. Are there any compelling reasons for departing from the Combined Code structure of preamble, principles and provisions? Once again, the Combined Code structure is a good starting point. 19. Can you provide examples, whether or not derived from the Combined Code, from other non-listed company sectors where you think that appropriate governance codes have been developed, giving information on their potential relevance to the firms? Yes. Monitor have created a code of governance for NHS foundation trusts. This is based on the Combined Code, but has been adapted to take account of the differing objectives and ownership structures of trusts in relation to private sector companies. 7

20. Do you have any other observations about matters not covered by earlier questions that you think would be useful to the Working Group in drafting the Audit Firm Governance Code? See our initial observations above. Thank you once again for inviting the Institute of Directors to participate in this consultation. We hope you find our comments useful. Yours sincerely, Dr. Roger Barker Head of Corporate Governance 8