Key aspects of the new UK Corporate Governance Code come into force from 1 January 2025 - what does this mean for Heads of Internal Audit?
In January 2024, the Financial Reporting Council (“FRC”) published its updated UK Corporate Governance Code. Many of the main aspects of the new Code come into force for accounting periods starting on or after 1 January 2025. During 2024, changes were also made to the Listing Rules by the Financial Conduct Authority (“FCA”) with the result that the Code will still apply to all companies previously premium listed but going forward will apply to all new listings in the new commercial companies category or the closed-ended investment funds category. Companies that were previously standard listed standard will not automatically transfer or be required to transfer to the new commercial companies category. For those companies, compliance with the Code will remain voluntary.
Heads of Internal Audit in companies required to comply with the Code will be most interested in those aspects that relate to risk management and internal control. Many will have already been asked to help co-ordinate the business response and to ensure that their internal audit strategy aligns with the requirements of the Code.
Risk management and internal control enhancements
From 1 January 2025 Principle O of the Code now requires that “the Board should establish and maintain an effective risk management and internal control framework and determine the nature and extent of the principal risks the company is willing to take in order to achieve its long-term strategic objectives”.
From 1 January 2026 Provision 29 of the Code applies and requires that “the Board should monitor the company’s risk management and internal control framework and, at least annually, carry out a review of its effectiveness. The monitoring and review should cover all material controls, including financial, operational, reporting and compliance controls”.
This is to be recorded in the annual report including:
· a description of how the Board has monitored and reviewed the effectiveness of the framework
· a declaration of effectiveness of the material controls as at the balance sheet date
· a description of any material controls which have not operated effectively as at the balance sheet date, the action taken, or proposed, to improve them and any action taken to address previously reported issues.
To be able to meet these requirements, companies need to have identified the material controls within its risk management and internal control framework and established a mechanism to assess their effectiveness.
The Code does not define in detail what constitute “material” controls. These are described as being company specific and therefore different for each company. However, the following areas are expected to be considered risk areas requiring a material control:
· risks that could threaten the company’s business model, future performance, solvency or liquidity and reputation (i.e. principal risks)
· external reporting that is price sensitive or that could lead investors to make investment decisions, whether in the company or otherwise
· fraud, including override of controls
· information and technology risks including cybersecurity, data protection and new technologies (e.g. artificial intelligence).
Taking the IFRS definition referred to in the Code - a material control is one that mitigates the risk that financial and non-financial information that is reported is materially incorrect. It is material if “omitting, misstating or obscuring it could reasonably be expected to influence the decisions that the primary users of general purpose financial statements make on the basis of those financial statements, which provide financial information about a specific reporting entity.” This broader definition should help businesses to determine their material controls more precisely.
Some examples of the areas where material controls are likely to be required are set out below:
EXAMPLE CONTROL AREAS
Operational - Mergers & acquisitions, Investment decisions, operational resilience, supply chain, geopolitical risk, customer experience, Cyber, health & safety
Financial - FSCP, FP&A, inventories, accounts receivable, accounts payable, liabilities
Reporting - Strategic report, risk reports, governance, financial statements, viability statement, culture, sensitivity analysis, ESG disclosures
Compliance - Economic Crime and Corporate Transparency Act (ECCTA), Bribery Act, corporate governance, Pillar 2, CSRD, Modern Slavery, GDPR
Once the material controls of the business have been identified and documented, the Board needs to determine the most appropriate means of assessing their effectiveness and for conducting its annual review of the risk management and internal control framework to support the declarations required in accordance with Provision 29.
Recommended by LinkedIn
The review should consider the risk management and internal control framework as a whole, along with an evaluation of the effectiveness of the processes for ongoing monitoring of the framework. The Board’s focus should be on reviewing material controls. The Code permits a wide range of options for conducting the review. For example, the Board can receive reports from management on the effectiveness of the established framework and the conclusions of any testing, assessment or other work carried out by the management. Alternatively the Board can rely on the testing performed by the internal audit function (if one is in place) or auditors appointed to conduct the testing on behalf of management.
What this means for Heads of Internal Audit
The FRC’s recent report - Review of Corporate Governance Reporting - noted that early adoption of the new Code requirements has been limited and that “reporting on the effectiveness of internal controls remains at an early stage.”
Nevertheless, momentum is growing for listed companies to intensify their efforts to make sure that they have taken the necessary steps to meet the requirements of the new Code. Many have already invested time in working through the key risk areas of the business and identifying and documenting their material controls.
Heads of Internal Audit are likely to have already been engaged by the Audit Committee to support the business. In our experience, the level of internal audit activity in this important area to date has depended on the assurance approach proposed by the business and the quality of process documentation.
Where the process documentation has been incomplete or the business has taken this as a controls improvement opportunity, some Heads of Internal Audit have been charged with overseeing the work undertaken by management (or by a third party on its behalf) to document the risk management and internal control framework over material controls.
The main driver of internal audit involvement is the level of assurance that the Board/ Audit Committee expects to receive from the Head of Internal Audit in respect of the Provision 29 declaration. If the Board’s primary source of assurance is to come from management (or a third party), the focus of Heads of Internal Audit will be upon understanding and assessing its impact upon the assurance that internal audit provides.
However, if the assurance to support the declaration is expected to be provided mainly by the internal audit function - its annual programme of work will need to be looked at carefully to ensure that it covers the material controls sufficiently and that accommodating this within existing or slightly increased internal audit budgets does not mean that assurance is reduced over other important areas.
Heads of Internal Audit are also likely to be asked to provide a specific opinion on the effectiveness of the risk management and internal control framework each year. Where there are known control gaps or poorly documented controls in material areas- these need to be addressed before Provision 29 comes into force.
If they have not done so already, Heads of Internal Audit therefore need to think through the impact of the new Code on their approach, audit plans and internal audit resources and to make sure that a clear way forward to implementing its requirements over the next two years has been agreed with the Audit Committee and the Board.
References
BDO - 2024 Code - Internal Controls Declaration: What you need to know
BDO - Ethics & Compliance and the Corporate Governance Code
Financial Reporting Council- UK Corporate Governance Code January 2024
Financial Reporting Council- UK Corporate Governance Code Guidance
Financial Reporting Council- Review of Corporate Governance Reporting 2024
Chartered Institute of Internal Auditors - Chartered IIA’s position and overview of UK Corporate Governance Code 2024