
Paper P1: Governance, risk and ethics
108 © Emile Woolf Publishing Limited
Responsibilities of the audit committee for financial controls
The UK Combined Code also states that a responsibility of the audit committee
should include the review of the company’s internal financial controls.
The audit committee is in a good position to carry out a review of these controls,
because of the discussions it has with the company’s external auditors and internal
auditors. For example, the external auditors produce a ‘management letter’ at the
end of the audit, making recommendations for improvements in financial controls.
The audit committee should discuss these recommendations with the auditors and
management, to establish whether the recommendations have been implemented
(and if not, why not).
Board responsibilities for the internal control system and risk management
However, the internal control system extends beyond financial controls. It includes
not only financial controls, but also operational controls and compliance controls. In
addition to internal control, there is also the system of risk management – how the
company identifies, analyses and deals with business and strategic risks,
environmental risks, and so on.
The UK Combined Code states that there should be a board responsibility to review
the company’s internal control and risk management systems. This responsibility
for review should be carried out by:
the audit committee, or
the full board, or
a risk committee consisting entirely of independent non-executive directors.
The Combined Code does not suggest how the board, the audit committee and the
risk committee (if there is one) should carry out their responsibilities for the review
of internal controls and risk management.
The need for a review of internal control and risk management by the board is also
recognised in the Singapore Code of Corporate Governance. Its guidelines are
similar to the provisions in the UK Code:
The audit committee should review the adequacy of the company’s internal
financial controls, operational and compliance controls, and also the risk
management policies and systems that have been established by management
(collectively, all internal controls).
The audit committee should ensure that a review of the effectiveness of the
internal controls is carried out at least annually. This review should be carried
out by the company’s internal auditors, public accountants or a combination of
internal auditors and public accountants. (If public accountants are used, and
these are the company’s external auditors, the audit committee must be satisfied
that the independence of the public accountants will not be compromised by any
other relationship they have with the company.
The board should include a comment on the adequacy of internal controls and
the risk management system in its annual report and accounts.
Internal control and risk management, and the responsibilities of the board and
management, are dealt with in more detail later in this text.