Board committees, audit and internal control

Daniel Osei brings the cohort a story he has not told before. Two years ago, Northfield Components' new accounts payable clerk noticed that one supplier of steel coil always invoiced in round thousands and was paid faster than anyone else. She mentioned it to Daniel over coffee. An investigation found that the purchasing manager, a twenty-year employee whom the owners trusted completely, had for six years been approving inflated invoices from a supplier owned by his brother-in-law and sharing the difference. The losses came to about 1.4 million dollars. Northfield's external auditors had never found it, because their audit was designed to detect material misstatement in the financial statements, and the fraud was spread thinly across thousands of invoices. Nor had any control: the purchasing manager could both choose suppliers and approve their invoices.

Dr. Holloway says Daniel's case is almost a textbook example. Studies by the Association of Certified Fraud Examiners consistently find that the most common way occupational fraud is detected is a tip, usually from an employee, rather than an audit, and that the typical fraud runs for more than a year before discovery. Organizations with hotlines, surprise audits and segregation of duties detect fraud sooner and lose less. This lesson covers the board committees that do much of a board's detailed work, especially the audit committee, and the systems of internal control and audit on which they rely.

Why boards use committees

A board meeting for a day eight times a year cannot examine the accounts, the auditor's work, executive pay contracts and the qualifications of candidate directors in detail. Boards therefore delegate this work to committees of directors with relevant expertise, which meet more often, examine issues in depth and report to the full board, which keeps the final decision. Three committees are standard in listed companies. The audit committee oversees financial reporting, internal control, internal and external audit and often compliance. The compensation committee, increasingly called the human resources or people committee, oversees executive pay and often talent and succession. The nominating and governance committee recruits directors, oversees board assessments and recommends governance practices.

Many boards add committees for particular needs. Banks and insurers have risk committees, as regulators require. Companies with significant environmental or safety exposures often have health, safety and environment committees. A growing number have sustainability committees or assign sustainability to an existing committee. And boards create special committees of independent directors to handle conflicted decisions, such as a proposed purchase of the company by its controlling shareholder or management, where the board's ordinary members cannot act independently.

The audit committee

In Canada, National Instrument 52-110 requires every listed company to have an audit committee of at least three directors, each of whom must be independent and financially literate, meaning able to read and understand financial statements of the company's complexity. The committee must have a written charter and is directly responsible for overseeing the external auditor, including recommending its appointment and pay to the board and resolving disagreements between management and the auditor. It must pre-approve non-audit services provided by the auditor, review the financial statements and management's discussion and analysis before they are published, and establish procedures for receiving and handling complaints about accounting, internal control or auditing, including confidential, anonymous submissions by employees.

Beyond these requirements, an effective audit committee does several things that rules cannot specify. It meets privately with the external auditor, the head of internal audit and the chief financial officer at every meeting, so that each can raise concerns without the others present. It asks about the judgments and estimates in the accounts, such as provisions, impairments, revenue recognition and inventory valuation, which is where most misstatements occur. It considers whether management is under pressure to meet targets, because pressure is the most common driver of fraudulent reporting. And it reviews the tone set by senior management, since controls rarely survive a chief executive who signals that results matter more than how they are achieved.

The external auditor

The external auditor gives an independent opinion on whether the financial statements present fairly, in all material respects, the company's financial position and results under the applicable accounting framework. The audit is designed to provide reasonable assurance, not absolute assurance, and to detect misstatements that are material, meaning large enough to influence the decisions of users. That is why an auditor may miss a fraud like Northfield's that is small relative to the whole, though auditing standards require auditors to consider the risk of fraud and to respond to signs of it.

Auditor independence is protected by rules that limit the non-audit services an auditor may provide, by rotation of the lead audit partner, typically every seven years under Canadian independence standards, and by oversight of audit firms by the Canadian Public Accountability Board, which inspects the firms that audit listed companies. Since reporting periods ending in late 2020, auditors of companies listed on the Toronto Stock Exchange have had to describe key audit matters in their reports: the areas of most significance in the audit, such as difficult estimates, and how the auditor addressed them. Audit committees should read these closely, because they show where the auditor saw the greatest risk.

Audit committees must also decide how long to keep an audit firm. A long relationship brings knowledge of the business but risks familiarity and reduced scepticism; a change brings fresh eyes but costs and a period of learning. The European Union requires public-interest entities to rotate audit firms after a maximum period, generally ten years, extendable in some circumstances, while Canada and the United States require only partner rotation. Many audit committees tender the audit periodically even where not required, to test the incumbent's quality and price.

Internal control

Internal control is the set of processes, designed and carried out by the board, management and staff, that provides reasonable assurance about the reliability of reporting, the efficiency of operations and compliance with laws. The most widely used framework is the one published by the Committee of Sponsoring Organizations of the Treadway Commission, known as COSO, first in 1992 and updated in 2013. It has five components. The control environment covers integrity, ethical values, board oversight and the assignment of authority. Risk assessment identifies what could go wrong. Control activities are the specific actions that address those risks, such as approvals, reconciliations, segregation of duties and access restrictions. Information and communication ensure that the right people receive reliable information. And monitoring checks that controls continue to work.

Northfield's fraud succeeded because a basic control activity was missing. The same person could select a supplier, approve its invoices and confirm receipt of goods, so nobody independent checked any step. Segregation of duties, which divides incompatible tasks among different people, is one of the oldest and most effective controls. Where a small company cannot fully segregate duties, it compensates with review by a manager or owner, analysis of unusual patterns and regular rotation of responsibilities.

In Canada, National Instrument 52-109 requires the chief executive and chief financial officer of listed companies to certify each quarter and year that they have designed disclosure controls and internal control over financial reporting, and annually that they have evaluated their effectiveness, and to disclose any material weakness. Unlike the American rules, Canadian rules do not require the external auditor to give a separate opinion on internal control, a decision regulators took to limit costs after observing the experience in the United States.

Testing controls

Auditors, internal and external, test controls by selecting samples of transactions and checking whether the control operated, for example whether each invoice in a sample was approved by an authorized person and matched to a purchase order and a receiving report. A deviation is an instance in which the control did not operate. Because a sample shows only part of the population, the tester must ask how high the true deviation rate could plausibly be, and compare that upper limit with the tolerable rate, the highest rate at which the control can still be relied on. The code below makes that calculation, then applies a second technique often used to look for fraud in payments: a test of Benford's law.

Benford's law, named after the physicist Frank Benford who described it in 1938, states that in many naturally occurring sets of numbers that span several orders of magnitude, the first digit is 1 about 30 per cent of the time, 2 about 18 per cent and so on down to 9 under 5 per cent. Invented numbers, such as fictitious invoices or amounts chosen to stay under an approval limit, often depart from this pattern. Auditors use it to point their attention, not as proof of wrongdoing.

import math
# 1. Upper limit on the deviation rate from a control test (one-sided, 95% confidence)
def upper_rate(sample, deviations, confidence=0.95):
    lo, hi = 0.0, 1.0
    for _ in range(60):                                   # bisection on the binomial tail
        p = (lo + hi) / 2
        tail = sum(math.comb(sample, k) * p**k * (1 - p)**(sample - k) for k in range(deviations + 1))
        lo, hi = (p, hi) if tail > 1 - confidence else (lo, p)
    return hi
for n, d in [(60, 0), (60, 1), (60, 3), (100, 3)]:
    u = upper_rate(n, d)
    print(f"sample {n:3d}, deviations {d}: upper limit {u:5.1%} -> {'rely' if u <= 0.05 else 'cannot rely'} at a 5% tolerable rate")

# 2. First-digit test of 600 payments to one supplier
seed = 12345
def rand():                                               # simple repeatable generator
    global seed; seed = (1103515245 * seed + 12345) % 2**31; return seed / 2**31
honest = [round(10 ** (2 + 3 * rand()), 2) for _ in range(500)]        # spread over three orders of magnitude
padded = [round(4_000 + 900 * rand(), 2) for _ in range(100)]          # invoices kept just under a 5,000 limit
payments = honest + padded
counts = [0] * 10
for x in payments: counts[int(str(x)[0])] += 1
print("digit  expected  observed")
chi = 0.0
for d in range(1, 10):
    exp = len(payments) * math.log10(1 + 1 / d)
    chi += (counts[d] - exp) ** 2 / exp
    print(f"  {d}     {exp:6.1f}    {counts[d]:4d}")
print(f"chi-square {chi:.1f} against a 1% critical value of 20.1 with 8 degrees of freedom")

sample  60, deviations 0: upper limit  4.9% -> rely at a 5% tolerable rate
sample  60, deviations 1: upper limit  7.7% -> cannot rely at a 5% tolerable rate
sample  60, deviations 3: upper limit 12.4% -> cannot rely at a 5% tolerable rate
sample 100, deviations 3: upper limit  7.6% -> cannot rely at a 5% tolerable rate
digit  expected  observed
  1      180.6     156
  2      105.7      89
  3       75.0      61
  4       58.1     136
  5       47.5      51
  6       40.2      33
  7       34.8      31
  8       30.7      22
  9       27.5      21
chi-square 118.8 against a 1% critical value of 20.1 with 8 degrees of freedom

With a sample of 60 and no deviations, the tester can be 95 per cent confident that the true deviation rate is below about 5 per cent, so the control can just be relied on at a tolerable rate of 5 per cent; a single deviation pushes the upper limit to almost 8 per cent, and three deviations, even in a sample of 100, are too many. This is why one exception in a control test is taken seriously. In the payments test, the excess of amounts beginning with 4 stands out sharply, and the chi-square statistic is far above the critical value. The pattern does not prove fraud, since a supplier could legitimately bill many amounts in that range, but it tells an investigator where to look, and it is exactly the pattern that invoices split or inflated to stay under a 5,000 dollar approval limit would create.

The three lines model and internal audit

Organizations divide responsibility for risk and control using what the Institute of Internal Auditors calls the three lines model, updated in 2020. Management, the first line, owns and manages risks in its daily operations. Specialist functions such as risk management, compliance, legal and health and safety, the second line, set policies, provide expertise and monitor. Internal audit, the third line, provides independent and objective assurance to the board on whether risk management and control are working. The governing body, usually through the audit committee, oversees all three and is accountable to stakeholders.

For internal audit to be independent, its head should report functionally to the audit committee, which approves the audit plan, the budget and the appointment or removal of the chief audit executive, even if the head reports administratively to the chief financial officer or chief executive. Internal audit's work covers not only financial controls but operations, information technology, cybersecurity, compliance and increasingly sustainability data. Smaller companies often outsource internal audit to an accounting firm other than their external auditor.

Boards also oversee risk more broadly. Canadian courts have treated the oversight of risk and compliance as part of the directors' duty of care, and the governance policy of the securities regulators recommends that boards identify the principal risks of the business and ensure that systems are in place to manage them. Regulators of banks, insurers and pension plans set more specific expectations. Many boards now approve a risk appetite statement, which defines how much risk of each type the company is willing to accept in pursuit of its goals, and review a register of principal risks at least annually.