The UK Government’s proposed corporate governance reforms are raising many questions for business leaders in the Defence & Manufacturing sector and beyond right now. With the change potentially coming into force by 2022, we have considered how businesses can plan and prepare for the changes needed. While this might seem a long way off, when it comes, it’s going to be big. My advice is to get ahead of it and do a few things now to pave the way to make it an easier pill to swallow later.
One client recently described UK SOx to me as ‘a beast’. And indeed the BEIS consultation itself is a big one, running to some 232 pages with 98 questions that organisations are invited to respond to. The consultation covers many aspects and the pending overhaul has been dubbed by some as ‘UK SOx’, given the parallels with the US Sarbanes Oxley regime that was introduced nearly 20 years ago – even if, in fact, the comparisons are limited and we expect the measures introduced here to be considerably lighter-touch. Let’s take a look at the Internal Controls aspect.
So where is all this likely to land in terms of internal controls? The proposals are subject to consultation until 8 July 2021, but BEIS’ stated preferred option is to strengthen the controls framework by requiring directors to carry out an annual review of the effectiveness of their internal controls over financial reporting (ICOFR) and, crucially, to make an explicit statement as to whether they consider the system to have operated effectively. This statement, or certification, is the really new part. It raises the stakes for directors in terms of responsibility. Companies will also need to explain the benchmark system that has been used, explain how they have assured themselves that it is appropriate to enable them to make the statement, and disclose any deficiencies (how they would do this is as yet undefined).
It’s worth noting that there are two further options in the consultation. One of these, in addition to directors’ making a statement, would see auditors reporting more fully on their work on a company’s controls. The second would see auditors express a formal opinion on the directors’ assessment of their controls’ effectiveness. (This third option really would be taking us into US SOx style territory.)
While we don’t know exactly what we will end up with until the consultation has run its full course and reached the legislation stage, it seems clear that there will be significant changes to internal controls requirements in the UK – and complying with these will involve a substantial amount of work.
How is the Defence and Manufacturing sector responding? One view coming through very clearly is that whatever measures are ultimately put in place, they need to be proportionate. There is a feeling that the current framework, if enforced correctly, is largely adequate – so if that’s the case, what’s the problem we’re trying to solve? We have had very few restatements here in the UK and most corporate collapses regard going concern and liquidity issues rather than controls failures.
That’s not to say that improvements can’t be made. Boards signing off on internal controls will reinforce responsibilities which should ultimately be a good thing, but the measures introduced shouldn’t be disproportionate to the problem.
While it may be a few years before businesses actually have to report under the new regime, there is a big task ahead in getting to compliance, as the changes to internal controls processes have implications right across the business. This will be a huge undertaking during a time when many organisations in the sector are feeling the pressure of the fallout from the pandemic and changed levels of demand. So other watchwords for many are ‘balance’ and ‘pace’: balancing the requirements of work on internal controls with other urgent strategic priorities, and pacing the work so that it doesn’t over-burden teams, at what is already a busy time.
Businesses need to recognise the full end-to-end process linked to their controls and test each and every one. This makes planning all the more important. The good news is that there is still some time on businesses’ side, so it will be crucial to use this time as an opportunity to get ahead.
A good starting point, right now, is to perform a gap assessment between your present state and the government’s preferred option. From this, identify the ‘no regrets’ actions you should take – enhancements that may have been on the ‘wish-list’ anyway – such as around reconciliations, risk assessments and benchmarking (the US COSO framework is the likely template).
You may also have other transformation initiatives already in train that require strong internal controls – so look at those and think about whether the BEIS proposals could be the business case for accelerating things you were looking to do anyway. In that way, you can shift the reforms from being a ‘compliance’ task to one that helps unlock efficiency and performance benefits across the business.
Tone from the top is always key as that drives an organisation’s focus. The companies that have grasped it well has realised that culture change is needed. So, make sure your whole Board is aware of the significance of the proposals and is spreading this mindset through the business far beyond the finance function. Getting this right will mean businesses can benefit from efficiency, accuracy of financial information and stronger ownership of processes and controls. .
Finally, don’t forget there is still time to respond to the consultation, either directly or through an industry forum or body.
Do not underestimate the challenge ahead, there is an opportunity now to prepare for the changes and achieve the top-level-buy in from outset. These are significant proposals but if embraced these can also be a catalyst for transformational change in the business and an opportunity.