Tag Archives: COSO

Culture and Governance; The Weinstein Company, Uber, Fox, WFB and Others

Posted on by

Each of the four above listed businesses, and others, have been in the news for issues relating to culture and governance, and other related matters. The legal structures of these four businesses differ significantly, from privately held, to privately held but with high value and reputation venture capital, to publicly held. I have blogged about the new COSO enterprise risk management (ERM) framework, and that the first of the five major components pertains to culture and governance, and the fifth of the five major components pertains to communicating and reporting.

Would the news about these businesses have been different if COSO ERM had been implemented and followed? Perhaps, perhaps not. We might also ask about and evaluate the executive officers; board, board committees and director oversight; the responsibilities of in-house counsel; the actions of the chief compliance officer (if any); how internal audit (if any) might have been helpful; whether issues came or should have come to the attention of the external auditor (including, for example, during the audit planning phase, or even during a more limited review engagement); workplace practices and policies; and perhaps the actions or inactions of the regulatory agencies (if any).

Culture and governance carry with them the potential to affect value (both positive and negative, and for both financial and reputation value), liability, and damages, not only for the business, but, of course, also for victims (and erroneously accused as we have also seen those situations), and for the executive officers and other management, the board and the directors, HR, the chief compliance officer, in-house legal counsel, the chief of internal audit, the partner running the external audit, the employees for their jobs and possible investment and pension holdings, creditors who have loaned money to the business, founders, owners and investors, customers, consumers, and other stakeholders. And these issues apply not only to public and private businesses, but also to nonprofits and governmental entities, and to the people who are involved in and with them.

It isn’t surprising that actions and events occur that are different than reasonably and primarily anticipated (that is the nature of risk management), and that negative and detrimental events also occur, sometimes without legal fault or liability. However, it is somehow also more disappointing to hear that possible or actual problems were known or might have been known to exist for a length of time without being addressed and remedied.

That’s all. I don’t have any personal knowledge about these specific situations other than what I read in the news. And I’m not casting fault, culpability or liability – each situation needs to be internally and/or externally investigated and evaluated by qualified people with the requisite experience, knowledge, demeanor and approach (i.e., objectively and prudently, and where necessary and prudent by people who are independent and without conflict or bias). Often times (practically always) the situations and facts are different (sometimes better, and sometimes worse) than first thought. And then there is always the prospect for litigation to establish responsibilities and rights, liability, causation, damages and remedies including recovery of damages.

We do seem to be seeing an uptick in discussions about the culture and governance of businesses (private, public, and nonprofit) and government – we’ll see if it lasts, and if more specific expectations develop including greater design, implementation and oversight of culture and governance controls.

Please note that the comments in my blog posts are my own, and are not by no one else, and do not apply or related to any particular or specific person, business or other entity, or situation.

* * * * *

 

Discussions About The New COSO ERM Framework And Related Topics

Posted on by

By: David Tate, Esq., Royse Law Firm, Northern and Southern California (Silicon Valley/Menlo Park Office) http://rroyselaw.com/

I have pasted below four links in which the authors discuss enterprise risk management (ERM) and risk management, the new COSO ERM framework, and some aspects of internal audit.

I appreciate what the authors are discussing; however, my preference would have been to have more defined tasks or requirements in the new COSO ERM framework (I use the word “requirements” broadly because generally there is no mandated risk management framework that must be followed, although for some industries and businesses there are some risk management requirements that are mandated by law and which must be followed).

It is clear that whatever risk management framework or process a business uses will remain largely discretionary based on the business judgment of management and the board, and that in fact might be better for possible liability purposes; however, it is my belief that people and businesses usually will implement policies or processes or procedures (other than, for example, for how to design, develop and manufacturer a product or service that they provide) if they are required to follow or adopt certain specific requirements by law, statute, regulation, or rule, or perhaps as required by the expectations of the community or stakeholders. That having been said, we are where we are on this. And it is now also generally accepted (and in some instances mandated) that a business will adopt and implement risk management, the board will oversee risk management, sometimes audit committees and/or risk committees are required to be involved in or oversee risk management, and in some businesses the board will delegate risk management oversight to a committee of the board, to the extent that risk oversight can be delegated (I would maintain that the board still must oversee risk management with the help of the committee and that the board cannot delegate its overall responsibility to oversee risk management).

In my view, the components and principles outlined in the new COSO ERM framework are essentially only broad in nature, which allows for each business to decide how to design and implement, etc., enterprise risk management based on the business judgment of management and the board of that particular business, in light of the business’ mission, core values, business objectives, strategies, and views and evaluations of related risks.

Let me also say this, I do appreciate that the first of the five core components in the new COSO ERM framework is Governance and Culture, and that the fifth of the five components is Information, Communication, and Reporting which also includes principle 19 (Communicates Risk Information) and principle 20 (Reports on Risk, Culture, and Performance). I believe that including governance, culture, communication and reporting (if they are adopted – remember, no specific framework is mandated) will help to move ERM and risk management to a more visible position. And, it is my belief, based on recent business, nonprofit, and governmental entity shortcomings and failures, that governance, culture, communication and reporting need to be moved more front and center. In fact, COSO listed governance and culture as the first of the five core components because governance and culture can be central to the entirety of the entity’s ERM.

The following are the links to the four enterprise risk management, etc., discussions that I mentioned at the beginning of this post, and below those links I have copied and pasted from my September 7, 2017, post in which I discussed the new COSO ERM framework and which you can also read at http://wp.me/p75iWX-aQ 

The following are the links to the four additional discussions:

https://wordpress.com/read/feeds/254243/posts/1619082863

https://iaonline.theiia.org/2017/Pages/COSO-ERM-Getting-Risk-Management-Right.aspx

https://normanmarks.wordpress.com/2017/09/29/should-you-adopt-the-updated-coso-erm-framework-my-assessment/

https://www.protiviti.com/US-en/insights/bulletin-vol6-issue8?utm_medium=social&utm_source=ProSocial

COSO ERM Framework – Enterprise Risk Management – Integrating with Strategy and Performance (five components, and twenty principles)

I.  Governance and Culture Component:

Supporting Principles:

  1. Exercises Board Risk Oversight
  2. Establishes Operating Structures
  3. Defines Desired Culture
  4. Demonstrates Commitment to Core Values
  5. Attracts, Develops, and Retains Capable Individuals

II.  Strategy and Objective-Setting Component:

  1. Analyzes Business Context
  2. Defines Risk Appetite
  3. Evaluates Alternative Strategies
  4. Formulates Business Objectives

III.  Performance Component:

  1. Identifies Risk
  2. Assesses Severity of Risk
  3. Prioritizes Risks
  4. Implements Risk Responses
  5. Develops Portfolio View

IV.  Review and Revision Component:

  1. Assesses Substantial Change
  2. Reviews Risk and Performance
  3. Pursues Improvement in Enterprise Risk Management

V.  Information, Communication, and Reporting Component:

  1. Leverages Information and Technology
  2. Communicates Risk Information
  3. Reports on Risk, Culture, and Performance

Enterprise Risk Management (ERM) and internal controls work together and should complement each other. The following is the broad outline of the COSO 2013 Internal Control Framework.

Sarbanes-Oxley section 404 requires public company management and its external auditors to attest to the design and operating effectiveness of a company’s internal control over external financial reporting. Internal controls should also be designed and implemented for private company, nonprofit and governmental entities.

COSO 2013 Internal Control Framework – 5 Components, and 17 Principles

1.  Control Environment Component:

Mandatory Principles

  1. Demonstrate commitment to integrity and ethical values.
  2. Board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
  3. Management establishes, with board oversight, structures and reporting lines and appropriate authorities and responsibilities in the pursuit of objectives.
  4. Demonstrate commitment to attract, develop and retain competent individuals in alignment with objectives.
  5. Hold individuals accountable for their internal control responsibilities in the pursuit of objectives.

2.  Risk Assessment Component:

Mandatory Principles

  1. Specify objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
  2. Identify risks to the achievement of its objectives across the entity and analyze risks as a basis for determining how the risks should be managed.
  3. Consider the potential for fraud in assessing risks to the achievement of objectives.
  4. Identify and assess changes that could significantly impact the system of internal control.

3.  Control Activities Component:

Mandatory Principles

  1. Select and develop control activities that contribute to the mitigation of risks to the achievement of objectives and acceptable levels.
  2. Select and develop general control activities over technology to support the achievement of objectives.
  3. Deploy control activities through policies that establish what is expected and procedures that put policies into action.

4.  Information & Communication Component:

Mandatory Principles

  1. Obtain or generate and use relevant, quality information to support the functioning of internal control.
  2. Internally communicate information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
  3. Communicate with external parties regarding matters affecting the functioning of internal control.

5.  Monitoring Activities Component:

Mandatory Principles

  1. Select, develop and perform ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
  2. Evaluate and communicate internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

The Business Judgment Rule

The business judgment rule also is relevant on these topics (from Tate’s Excellent Audit Committee Guide). The business judgment rule provides a director with a defense to personal liability, holding that as a general principle of law, a director, including a director who serves as a member of a board committee, who satisfies the business judgment rule has satisfied his or her duties. Thus, the business judgment rule provides one standard of care, although other standards may very well also apply to specific tasks and responsibilities. The business judgment rule provides a very good overall approach for directors and audit committee members to follow, although the rule itself is lacking in specific detail. In some states the business judgment rule is codified by statute while in other states the rule is established by case law (see, i.e., Cal. Corp. Code §309 for California corporations, Del. Gen. Corp. Law §141 for Delaware corporations, in addition to relevant case law). The rule also applies to directors as board committee members.

The Business Judgment Rule

In summary, as a general principle the business judgment rule provides that a director should undertake his or her duties:

-In good faith, with honesty and without self-dealing, conflict or improper personal benefit;

-In a manner that the director reasonably believes to be in the best interests of the corporation and its shareholders; and

-With the care, including reasonable inquiry, that an ordinarily prudent person in a like position with like expertise would use under similar circumstances. The rule itself doesn’t require a particular level of expertise, knowledge or understanding; however, as you might be aware, public company audit committee members do have such a requirement, and you can at least argue that, depending on the facts and circumstances, a board or committee member should have or should obtain a certain unspecified level of knowledge or understanding to be sufficiently prepared to ask questions, evaluate information provided, and make decisions.

Reliance Upon Other People Under the Business Judgment Rule

In the course and scope of performing his or her duties, a director must necessarily obtain information from and rely upon other people. An independent director is not involved in the day-to-day operations of the business. The director provides an oversight function. Pursuant to the business judgment rule, a director is entitled to rely on information, opinions, reports or statements, including financial statements and other financial data, prepared or presented by any of the following:

-Officers or employees of the corporation whom the director reasonably believes to be reliable and competent in the relevant matters;

-Legal counsel, independent accountants or other persons as to matters that the director reasonably believes are within the person’s professional or expert competence; or

-A committee of the board on which the director does not serve, as to matters within that committee’s designated authority, so long as the director acts in good faith, after reasonable inquiry as warranted by the circumstances, and without knowledge that would cause reliance to be unwarranted.

David Tate, Esq., Royse Law Firm, California (Silicon Valley/Menlo Park office), with additional offices in San Francisco, Los Angeles and Orange County, http://rroyselaw.com/

* * * * *

Comments re post by Norman Marks – internal audit and ERM accused of failing to hit the mark – discussion about management, boards and audit committees – David Tate, Esq., Royse Law Firm

Posted on by

I have provided below a link to a post by Norman Marks, in which Norman discusses and in part compares or contrasts internal audit and ERM. Norman’s post is a good, worthwhile read.

There are many good writers on these topics – you will also note that there are disagreements between knowledgeable professionals. Just for example, as Norman notes, ERM or enterprise risk management is a management function (I would say a management, board and audit committee function) whereas internal audit is independent; however, there has been for sometime considerable discussion about the role of internal audit and whether it can be or should be or has been expanded in ways that could make it less independent or less of an audit function and more of an advisory function in some circumstances – internal audit endeavors to make itself more valuable and needed as a function and department.

I don’t get into the discussions about whether internal audit should or should not be less independent or more advisory – instead, if internal audit is not being sufficiently utilized I primarily attribute that to one or both of two reasons which can be interrelated: (1) either internal audit needs to do a better job selling to management, the board and the audit committee how internal audit can help, or (2) particularly the board and the audit committee need to be more educated or convinced about how internal audit can help them to satisfy their oversight duties and responsibilities (I can help you with reason (2)).

If you are interested in risk management and enterprise risk management you are aware that COSO is still updating its ERM framework. If you aren’t interested in risk management or ERM but you are a board and/or audit committee member you definitely should be interested as it or parts of it are part of your oversight duties and responsibilities.

COSO has said that its updated ERM function should be out mid-2017, in other words, soon. This is a big deal. Whereas risk management professionals will extensively evaluate and comment about the new framework from an ERM perspective, and although I am also a CPA, I will primarily evaluate the framework from a legal perspective and what the new framework will or may require of management, the board and the audit committee in satisfaction of their duties and responsibilities. Add to this the COSO 2013 updated internal control framework, and the changes that are being made to audit procedures and the audit report, in addition to increasing disclosures about events, practices and procedures not just numbers, and you have a significantly changing environment in terms of management, board and audit committee duties and responsibilities.

That’s all for now. Below is the link to Norman Marks’ new blog post – read his post – it covers more about internal audit and ERM than the title indicates. David Tate, Esq., Royse Law Firm (see below for firm practice areas), Menlo Park, California office, with offices in northern and southern California. The following is a link to my other blog, about trust, estate, and elder, etc., disputes, litigation and difficult or contentious administrations: http://californiaestatetrust.com.

Here is the link to Norman’s post:  https://normanmarks.wordpress.com/2017/07/15/internal-audit-and-erm-accused-of-failing-to-hit-the-mark/

David Tate, Esq. (and CPA, California inactive). Royse Law Firm, Menlo Park Office, California (with offices in both northern and southern California).

Royse Law Firm – Practice Area Overview – San Francisco Bay Area and Los Angeles Basin, http://rroyselaw.com/

  • Corporate and Securities, Financing and Formation
  • Corporate Governance, D&O, Boards and Committees, Audit Committees, Etc.
  • Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  • International
  • Immigration
  • Mergers & Acquisitions
  • Labor and Employment
  • Disputes and Litigation (I broke out these areas because they are my primary areas of practice)
  •             Business
  •             Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  •             Trade Secrets, NDA, Financial & Accounting Issues, Fraud, Lost Income, Royalties, Etc.
  •             Privacy, Internet, Hacking, Speech, Etc.
  •             Labor and Employment
  •             Mergers & Acquisitions
  •             Real Estate
  •             Owner, Founder, Investor, Board & Committee, Shareholder, D&O, Lender/Debtor, Etc.
  •             Insurance Coverage and Bad Faith
  •             Investigations
  •             Trust, Estate, Conservatorship, Elder Abuse, Etc., and Contentious Administrations
  •             Dispute Resolution and Mediation
  • Real Estate
  • Tax (US and International) and Tax Litigation
  • Technology Companies and Transactions Including AgTech, HealthTech, etc.
  • Wealth and Estate Planning, Trust and Estate Administration, and Disputes and Litigation

New COSO Updated ERM Framework – Coming Soon – End of June, Perhaps – Could Be Very Important

Posted on by

Just a heads up, a source has suggested that the new long-anticipated COSO (Committee of Sponsoring Organizations of the Treadway Commission) ERM update might finally be out at the end of June. COSO is spending a very long time (since October 2014) preparing and vetting this “update” of the 2004 Enterprise Risk Management — Integrated Framework. COSO’s sponsoring organizations are the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), The Institute of Internal Auditors (IIA), and the National Association of Accountants (now the Institute of Management Accountants [IMA]), and the Commission includes representatives from industry, public accounting, investment firms, and SROs (exchanges).

We’ll have to wait and see what we get with this “update,” which will either simply be a relatively unimpressive or vague tweak, or a useful, modernized, sufficiently detailed guide which might become the standard to achieve, or somewhere in between. I’m hopeful for the useful version – ERM needs a big boost – this “update” is important. I find that there really are only three ways to provide this type of boost: sponsorship and push by large or influential organizations and people, mandatory (i.e., by law, regulation or rule) adoption, or, sometimes, push and expectancy by the public.

Here is the link to the COSO website https://www.coso.org/Pages/default.aspx

Best to you, David Tate, Esq., Litigation, D&O, audit committees, etc., Royse Law Firm http://rroyselaw.com/

NEW NINTH CIRCUIT CASE – PLAINTIFF CANNOT BRING A SECURITIES CASE FOR BREACH OF THE CORPORATE CODE OF ETHICS . . . WELL, NOT SO FAST . . . .

Posted on by

On January 19, 2017, the Ninth Circuit dismissed a securities fraud case holding that the claim could not legally be brought where shareholders of Hewlett-Packard Company (“HP”) alleged that the Company CEO and Chairman violated Hewlett-Packard’s Corporate Code of Ethics after publicly touting the Company’s high standards for ethics and compliance while at the same time himself violating the provisions in the Code of Ethics. The case is Retail Wholesale & Department Store Union Local 338 Retirement Fund v. Hewlett-Packard Co. and Mark A. Hurd, Ninth Circuit Case No. 14-16433 and District Court Case No. 3:12-cv-04115-JST (Northern District of California) and you can view the case at http://cdn.ca9.uscourts.gov/datastore/opinions/2017/01/19/14-16433.pdf.

Plaintiffs’ claim was brought under §10 and Rule 10–b of the Securities Exchange Act of 1934. The Court’s decision is helpful from a defense viewpoint, but the decision shouldn’t be viewed too broadly. In summary, the Court held as follows (note: the below quotes from the case are not necessarily in the exact order in which they appeared in the Court’s decision):

“Retail Wholesale argues that the SBC [HP’s Standards of Business Conduct], bolstered by Defendants’ express promotion of corporate ethics, gives rise to a finding of material misrepresentation. Its claim is based in three factual allegations: (1) HP and Hurd actively promoted the SBC and stated that HP had zero tolerance for SBC violations; (2) Hurd’s SBC violations led to his resignation; and (3) Hurd’s resignation caused HP’s stock price to drop. The Court cannot agree that, under the facts alleged in the complaint, Defendants’ representations about ethics were materially misleading.”

“Defendants made no objectively verifiable statements during the Class Period. As one court has aptly written, a code of conduct is “inherently aspirational.” Andropolis, 505 F. Supp. 2d at 686. Such a code expresses opinions as to what actions are preferable, as opposed to implying that all staff, directors, and officers always adhere to its aspirations. See id.”

“Similarly, Hurd’s comments prefacing the SBC are not objectively verifiable. In the 2008 preface to the SBC, Hurd stated, in part,

We want to be a company known for its ethical leadership . . . .

We know actions speak louder than words. We must make decisions and behave in ways that we can be proud of, that reflect our commitment to doing the right thing . . . .

. . . . Let us commit together, as individuals and as a company, to build trust in everything we do by living our values and conducting business consistent with the high ethical standards within our SBC.”

“The aspirational nature of these statements is evident. They emphasize a desire to commit to certain “shared values” outlined in the SBC and provide a “vague statement[] of optimism,” not capable of objective verification. See Or. Pub. Emps., 774 F.3d at 606. A contrary interpretation—that statements such as, for example, the SBC’s “we make ethical decisions,” or Hurd’s prefatory statements, can be measured for compliance—is simply untenable, as it could turn all corporate wrongdoing into securities fraud.”

However, and equally important, the Court also stated:

“We note that the case may have been closer had Hurd’s sexual harassment and false expenses scandal involved facts remotely similar to those presented by the 2006 scandal [i.e., an earlier unrelated ethics problem at HP in which “A few years earlier, in 2006, a major scandal erupted when a whistleblower informed several government agencies that HP had hired detectives to monitor the phone records and email accounts of HP directors, HP employees, and journalists to find the sources of leaks of company information to the press”], as the ethical code could then have been understood as at least promising specifically not to do what had been done in 2006. Here, however, the context does not make HP’s promotion of business ethics any less subjective or vague. Further, Retail Wholesale cites to no case law suggesting that context may operate to allow a plaintiff to import an out-of-Class-Period statement into the Class Period. The strongest statement alleged in the complaint—the suggestion of a zero tolerance policy for SBC violations—was made outside of the Class Period.”

“In sum, we conclude that as there was no statement during the Class Period that was capable of being objectively false, there was no affirmative misrepresentation.”

It could be easy to read the case too broadly, and to conclude that a securities fraud claim cannot be brought for violation of the company’s code of ethics. Whether such a claim can be brought really depends on the facts and circumstances of the case. Further, and depending on the facts of each case, it might be possible that such a claim could be brought under a different legal theory such as, for example, the Foreign Corrupt Practices Act.

Thus, companies, and their officers, managing agents and directors still must be advised to know the company’s Code of Ethics, to follow the Code, and to be careful about making specific representations about following, satisfying or complying with the Code.

* * * * *

Really Massive Changes in Accounting, Auditing, Reporting and Communicating – The End Of Accounting?

Posted on by

Although I practice as an attorney, I previously practiced as a CPA and I have experienced several times over the years when there were significant changes occurring in the accounting practice and profession. But right now, I believe that I am witnessing multiple massive changes that have been long in the making. The following is a link to an Accounting Today article which does a pretty good job of discussing some of the changes, and also includes a question whether this is the end of accounting – click on the following link, CLICK HERE

It’s not like these changes are screaming at you in the headlines, but the cumulative effect is significant, new changes are continuing and will continue, and perhaps more important, the reasons for the changes are permanent.

For a long, long time the value of the audit and of the audit report have been questioned.

For a long, long time, the value of the information provided by an accounting that is prepared in conformity with generally accepted accounting principles has been questioned.

Different stakeholders also have different needs, and speed at which the flow of information is needed and expected is ever-increasing. Audited financial statements, for example, don’t tell you very much about the future investment or business generating value of the entity or of the transactions reported, or of the risks that are associated.

So now, for example, in addition to GAAP accounting we have non-GAAP accounting and reporting, we are seeing an increased ability to audit all transactions by computer software, GAAP is moving from the more detailed and specific rules based approach back to the more principles based approach that was in place when I first became a CPA, and non-GAAP measurements or criteria are becoming or should become more important such as some of the governance criteria (integrity, tone-at-the-top, culture, etc.), sustainability, transparency, risk management, and more emphasis on internal controls such as COSO.

However, I don’t agree with the suggestion or question in the title to the above linked article – it’s not the end of accounting. Traditional accounting serves a useful purpose – can you imagine what a free for all it would be without traditional accounting? There would be absolutely no checks or balances. There would be a “zero” reliability factor, and no comparability between different entities or industries.

But there is no question that the changes that have occurred and that continue to occur in accounting and auditing create both opportunities and risks for investors, financial institutions and other stakeholders, executive, financial, accounting and audit officers and professionals, boards, and audit and risk committees. The people who will excel are the people who will embrace and become expert in these changes. It’s a lifetime of learning to stay ahead and relevant.

Best to you. Dave Tate, Esq.

The following is a link to my Tate’s Excellent Audit Committee Guide, updated January 2016, CLICK HERE

Does Your Audit Committee Charter List Risk Management?

Posted on by

If you are an audit committee member of a public company your audit committee charter might and in some cases must in some manner list risk management oversight as a responsibility.

If you are a nonprofit, private business or company, or governmental entity, and if you have an audit committee charter, your charter also might list risk management oversight, and if it doesn’t, then that oversight is the sole responsibility of the entire board.

In relevant part for example the NYSE Listed Company Manual states under Audit Committee Additional Requirements that the audit committee’s purpose in part at a minimum must be to:

  1. Assist board oversight of (1) the integrity of the listed company’s financial statements, (2) the listed company’s compliance with legal and regulatory requirements, (3) the independent auditor’s qualifications and independence, and (4) the performance of the listed company’s internal audit function and independent auditors (if the listed company does not yet have an internal audit function because it is availing itself of a transition period pursuant to Section 303A.00, the charter must provide that the committee will assist board oversight of the design and implementation of the internal audit function); and
  2. Discuss policies with respect to risk assessment and risk management.

And under related Commentary with respect to risk assessment and management: While it is the job of the CEO and senior management to assess and manage the listed company’s exposure to risk, the audit committee must discuss guidelines and policies to govern the process by which this is handled. The audit committee should discuss the listed company’s major financial risk exposures and the steps management has taken to monitor and control such exposures. The audit committee is not required to be the sole body responsible for risk assessment and management, but, as stated above, the committee must discuss guidelines and policies to govern the process by which risk assessment and management is undertaken. Many companies, particularly financial companies, manage and assess their risk through mechanisms other than the audit committee. The processes these companies have in place should be reviewed in a general manner by the audit committee, but they need not be replaced by the audit committee.

The Listed Company Manual also states that each listed company must have an internal audit function.

And under related Commentary with respect to the internal audit function: Listed companies must maintain an internal audit function to provide management and the audit committee with ongoing assessments of the listed company’s risk management processes and system of internal control. A listed company may choose to outsource this function to a third party service provider other than its independent auditor. While Section 303A.00 permits certain categories of newly-listed companies to avail themselves of a transition period to comply with the internal audit function requirement, all listed companies must have an internal audit function in place no later than the first anniversary of the company’s listing date.

Further, General Commentary to Section 303A.07 states: To avoid any confusion, note that the audit committee functions specified in Section 303A.07 are the sole responsibility of the audit committee and may not be allocated to a different committee.

From an audit committee member perspective, here’s the issue that I have with risk management oversight – it’s whether the audit committee and the board primarily, and possibly other necessary stakeholders or people involved, really have reached an understanding about what that “risk management” oversight means, both in terms of substantive risk oversight areas that are (and therefore also that aren’t) included in your oversight responsibilities, and exactly what you are expected to do to satisfy that oversight? And then, how those areas and responsibilities are described in the charter. Without clarification the term “risk management” is or can be vague and potentially extremely broad.

As risk management oversight has grown, or you might say, exploded, in importance for the board and its committees, over the past several years I have regularly received materials from risk management professionals discussing and disagreeing about exactly what risk management is, what terms and criteria to use, and how to go about performing risk management. I’m not trying to duplicate their efforts. But risk management can be a complicated area requiring a substantial investment of oversight effort and time. Obviously it’s an important area for the board, and for an audit committee or risk committee to which that oversight has been delegated. Even with delegation to a committee, the board should still maintain risk management oversight.

And risk management also is an area that relates to other areas of oversight such as internal controls (COSO 2013), personal safety, anonymous reporting processes and investigations, compliance with laws, and other areas.

You as an audit committee member, and other stakeholders need to understand what is involved, and what is expected of you, so that hopefully, to the extent possible (because it isn’t possible to avoid all surprise or unexpected situations) the important possible risks or surprises and related processes that are under your oversight have been and are being evaluated, addressed (designed and implemented), monitored and updated as necessary, including what to do and how to act to mitigate and remedy the situation if a surprise or unexpected situation does occur.

You can find additional discussions on this blog and on Tate’s Excellent Audit Committee Guide, the January 3, 2016, version of which can be found at http://wp.me/p75iWX-q

Wishing you the best.

Dave Tate, Esq. and CPA licensed in California (inactive), San Francisco and California

DTatePicture_Square