Friend or Foe - Will Regulation Make the Treasurer's Life Any Easier?

Following the much publicised corporate collapses and scandals of the past
few years, it is little wonder that there have been a multitude of reports and
new standards issued from various governments and other regulatory authorities,
supposedly, to combat the possibility of future recurrences. There is a regional
flavour to such regulation, ranging from laws to regulations and recommendations,
which make it hard for investors to see whether the root causes of the corporate
failures have really been addressed.

The most notable and wide-ranging corporate governance initiative of late is
the Sarbanes-Oxley Act, passed as law in the US in July 2002. Although US legislation,
the law and pursuant actions by the Securities and Exchange Commission (SEC)
and newly formed Public Company Accounting Oversight Board (PCOAB) covers a
significant number of SEC registrants resident outside the US, including Europe.
But what has been happening in Europe? Are the Europeans intent on following
a similarly severe and prescriptive approach, or will it be a case of achieving
more with less?

There have been significant developments in the European corporate governance
agenda for some years now. Cadbury issued a report in 1992, in response to the
collapse of Barings Bank affecting companies listed on the UK stock exchange.
This emphasis on corporate governance was extended following the issuance of
the Greenbury and Turnbull reports, and the UK now has Smith and Higgs’s
reports on the table. In Germany, meanwhile, there is KonTraG, the German government’s
law attempt at dealing with its own domestic crises. And so it goes on, each
country having its own flavour, scope and mechanism of implementation, each
in response to demands from investors in the local markets.

The EU has said that, rather than apply another layer of governance on top
of all of this, it will instead focus on promoting a harmonisation of rules
across the different countries and bodies. Indeed, a degree of consistency already
exists, with most codes focusing on the role of audit committees, non-executives
and Boards with regard to their independence, financial expertise and need to
focus on internal controls and risk management systems.

Establishing The Ground Rules

Given that the treasury activities of companies are not only focused on managing
risk but are also considered to be areas giving rise to significant operational
risks, including potential exposure to losses or manipulation, much of what
is regulated relates directly to how these activities should be managed, controlled
and reported. Table 1 highlights the emphasis new regulations put on internal
control, risk management, increased disclosure and financial accuracy.

In practice, although the various rules are far from homogenous, their effect
is to enshrine in regulation many of the processes and policies that are already
required by best practices in treasury management.

Although each of the national and regional frameworks has their own specific
requirements, broadly speaking Table 1 shows that:

• The Board/management should maintain a sound system of internal control
  and risk management systems.
• The audit committee, Board or risk management committee should ensure a
  formalised review of risk management systems and internal controls is conducted.
• The Board must report the findings of the review of internal controls and
  risk management systems in the annual financial statements.
• Management are legally (and in some cases with severe consequences for non-compliance)
  responsible for the accuracy and completeness of the financial statements.
• Financial statements will be required to provide increased levels of disclosure
  and transparency.
• Material changes in the financial status of a company should be reported
  in real-time.

So What Are The Treasurer’s Responsibilities In All This?

While the burden of personal responsibility in law rests with the members of
the Board and the audit committee, from a practical perspective, there has to
be some delegation to treasurers. Since certain key information in company reports
(see Figure 1) come from or are controlled by treasury, a significant level
of internal control and risk management systems are expected in a company’s
treasury activities.

Therefore, given their responsibilities and need to attest to financial accuracy,
risk management and control, Boards and audit committees are likely to become
more interested in treasury activities. Hence, the treasurer must also document
and attest internally to the adequacy of treasury related financial information
and related control processes.

Before they can do this, however, they will need to assess exactly where they
are now and what controls need to be in place before preparing to fix the identified
gaps.

Where Are We Now?

Evidence of where we are now is provided by recent research from PricewaterhouseCoopers
(PwC) Europe. Its treasury surveys over the past three years show that, although
most Boards do get involved with setting, approving and reviewing treasury policies,
less than 10% then go on to take responsibility for monitoring compliance with
these policies. This role is, instead, left to the group treasurer, CFO or external
auditor.

More worrying perhaps, about 23% of treasuries surveyed still do not have formal
policies/procedures against which compliance can be measured. And even where
policies and procedures manuals do exist they often do not cover all of the
treasury functions, especially in satellite treasury centres, where potential
risks may more easily go unnoticed.

Surprisingly, only 36% conducted internal audit reviews of centralised treasury
processes. Although, on the positive side, more than half of those surveyed
have formal committees to review treasury and financial risk.

Finally, more than 50% of companies surveyed which have not already implemented
IAS 39 or FAS 133 are planning to implement one of the standards, most within
the next year. This is seen as leading to better and increased disclosure, improved
internal control and is expected to have an impact on treasury risk management
policies.

Table 1: Treasury relevant corporate governance regulations

Country	Report	Relevant section
UK	Smith Report (Jan 2003) – audit committees – combined code guidance	Section 5.6 “The audit committee, in the absence of other arrangements, such as a risk committee, should assess the scope and effectiveness of the systems established by management to identify, assess, manage and monitor financial and nonfinancial risks.” Section 5.7 “Management is responsible for the identification, assessment, management and monitoring of risk, for developing, operating and monitoring the system of internal control and for providing assurance to the Board that it has done so. Except where the Board or a risk committee is expressly responsible for reviewing the effectiveness of the internal control and risk management systems, the audit committee should receive reports from management on the effectiveness of the systems they have established and the results of any testing carried out by internal and external auditors.” Section 5.8 “Except to the extent that this is expressly dealt with by the Board or risk committee, the audit committee should review and approve the statements included in the annual report in relation to the internal financial control and the management of risk.”
UK	Higgs Report (Jan 2003) – review of the role and effectiveness of nonexecutive directors	D.2 “The Board should maintain a sound system of internal control to safeguard shareholders’ investments and the company’s assets.” D3.2 “Audit committee…to review the company’s internal financial control system and, unless expressly addressed by a separate risk committee or by the Board itself, risk management systems.”
France	Bouton Report (Sept 2002) – promoting better corporate governance in listed companies	Requirement to bring together information on market risks (interest, exchange rate, equity, credit, commodities) in a specific note to the financial statements. In the event of a material exposure to interest rate, foreign exchange or commodity price risks, disclosing indicators of sensitivity to these risks and specifying methods and assumptions used to calculate these indicators.
Germany	KonTraG (control and transparency in business) Report	Risk management; Boards of public limited companies are obliged to ensure that adequate risk management and internal revision systems exist in their own companies.
EU	High Level Group of Company Law Experts (Nov 2002)	Section 5.0 “The audit committee should monitor the company’s internal audit procedures and its risk management system, it should meet regularly with those responsible for these systems and consider to what extent the findings of the risk management system should be reported in the company’s financial statements.” Section 4.3 “Responsibility for the probity of financial statements should be attributed, as a matter of EU law, to all Board members on a collective basis. This responsibility should extend to all statements made about the company’s financial position, as well as to all statements on key non-financial data.”
US	Sarbanes-Oxley Act (July 2002)	Section 302 Requires, among other things, that CEOs and CFOs (or persons performing similar functions) certify quarterly and annual reports to the SEC, including making representations about the effectiveness of specified internal controls. Section 404 Internal Control Report on effectiveness of internal controls and procedures for financial reporting. Section 409 Requirement for real-time disclosure of information concerning material changes in the company’s financial condition or operations.

What Can We Conclude?

From these statistics, it would appear that for a significant proportion of
Boards, there is some doubt as to their ability to properly monitor their treasury
related activities.

Taking this to its natural conclusion, without confidence in the controls and
effectiveness governing treasury and other parts of the business, how can the
Board certify with confidence the cash, debt, investment and other figures contained
in their financial statements and provide assurance that operational risks have
been adequately mitigated?

What Steps Do European Treasurers Need To Take Next?

To enable the treasury, and hence the Board and audit committee, to prepare
for the new corporate governance codes, treasurers should consider the following:

1) To comply with the need to have a system of sound internal control and risk
management:

• Formalise policies, procedures and controls. These can neither be measured
  nor their effectiveness reported on until they have been formalised and fully
  implemented.
• Streamline, centralise and/or automate processes. This will help to reduce
  the number of controls and level of documentation needed.
• Use payables/receivables factories or in-house banks, allowing better control
  and standardisation of processes.
• Consider outsourcing. This allows a quick adoption of an already set up
  structure of controls and reporting systems which should have already been
  audited (probably with a SAS 70-type review), and would continue to be audited
  by both the outsourcer and the outsource service provider.

2) To comply with the need for formal review and statement on effectiveness
of controls:

• External reviews and advice can help to identify and plug gaps, as well
  as provide declarations on the effectiveness of internal controls. For example,
  PwC’s Internal Controls Workbench (a web-based workbench to help document
  and assess internal controls frameworks) can facilitate such a review, as
  it provides a detailed list of expected treasury (and other) controls.
• Develop a closer, more informed relationship with the Board, audit committee
  and risk management committee. More education is generally needed at Board
  level as to treasury risks and more reporting of compliance with Board-approved
  policies.

3) To comply with the need for increased disclosure, transparency and public
trust:

• Establish a culture of control. Even after the adoption of internal controls
  and systems, there is no guarantee that errors will not still occur. The mere
  fact that controls are formally in place does not mean they are functioning
  properly, as evidenced by many of the well-known treasury controls failures
  (not least the debacle at Allied Irish Bank’s Allfirst division, where
  most of the expected controls were formally in place). A culture of control
  and corporate integrity must be prevalent, and this requires, among other
  things, the right ‘tone at the top’.
• Implement International Accounting Standards (IAS). This will help improve
  disclosure, credibility, comparability and transparency, therefore improving
  public trust in financial statements. Although IAS 39 may be unpopular with
  treasurers in respect of some of its detail, the basic principles are, again,
  consistent with the principles of best practice in treasury internal control.
• Set up treasury committees. These should have Board involvement and can
  be used to help both set monitor review policies and compliance. Indeed, with
  their skill-set, treasurers are well placed to become involved in the firm’s
  risk management committees.

4) Finally, to comply with the need to report accurate financial statements
and real-time material changes to them:

• Real-time disclosure of material changes to a company’s financial
  condition or operations will require real-time systems.
• Treasury systems that link directly into AP/AR or ERP’s are better
  placed to identify such material changes in a timely manner.

Figure 1: Treasury input to financial reporting & control

Raising The Stakes

For most treasurers these issues are very much business as usual. However,
now that the corporate governance agenda has raised the stakes at Board and
audit committee level, there is an opportunity to shine the spotlight on treasury.
With this increased focus should also come the commitment of funds, resources
and management attention to deliver the level of internal control, which is
no longer simply considered best practice but is becoming increasingly enshrined
in law and regulation.