Introduction
In 2014 the Financial Reporting Council (FRC) made changes to the UK Corporate Governance Code (the Code) implementing certain recommendations of the Sharman Inquiry. The Sharman Inquiry was set up as a result of the financial crisis of 2008 and the unexpected failure of businesses that had been thought to be rock solid. Previous reporting on the ongoing viability of a company’s business had focused on the concept of ‘going concern’ when preparing company accounts.
The going concern concept is an accounting concept underlying financial reporting. Under the going concern concept it is assumed that the company will continue for the foreseeable future and it is not the intention to, nor is there the need to, liquidate the company or cease trading.
Reporting on going concern continues to be a requirement of the Code. However, the major innovation made to the Code in 2014 was to require companies to report on a longer term assessment of their business, to ensure boards focus on longer term viability (the Viability Statement). In this way it is hoped that shocks and surprises of the sort experienced during the financial crisis are reduced for the market and shareholders.
The Code Requirements
There are four requirements of the Code bound up with ensuring a sound assessment of a company’s business. These are:
C.1.3 In annual and half-yearly financial statements, the directors should state whether they considered it appropriate to adopt the going concern basis of accounting in preparing them, and identify any material uncertainties to the company’s ability to continue to do so over a period of at least twelve months from the date of approval of the financial statements.
C.2.1 The directors should confirm in the annual report that they have carried out a robust assessment of the principal risks facing the company, including those that would threaten its business model, future performance, solvency or liquidity. The directors should describe those risks and explain how they are being managed or mitigated.
C.2.2 Taking account of the company’s current position and principal risks, the directors should explain in the annual report how they have assessed the prospects of the company, over what period they have done so and why they consider that period to be appropriate. The directors should state whether they have a reasonable expectation that the company will be able to continue in operation and meet its liabilities as they fall due over the period of their assessment, drawing attention to any qualifications or assumptions as necessary.
C.2.3 The board should monitor the company’s risk management and internal control systems and, at least annually, carry out a review of their effectiveness, and report on that review in the annual report. The monitoring and review should cover all material controls, including financial, operational and compliance controls.
The FRC published in 2014 accompanying guidance to the Code changes – FRC Guidance on Risk Management, Internal Control and Related Financial and Business Reporting 2014 (the FRC Guidance). The fact that this guidance covers risk management, internal control and financial reporting on going concern and viability, highlights the view that the concepts of risk, control and viability are interlinked. You cannot report on going concern or longer term viability without a thorough assessment of the business risks a company faces and the internal controls that the company has put in place.
UK Corporate Governance Code 2014
1) Risk (C.2.1) Robustly asses principle risks and explain how they are being managed or mitigated.
2) Internal Control (C.2.3) Monitor risk management and internal control systems and carry out a review of their effectiveness.
3) Going Concern (C.1.3) State whether it is appropriate to adopt the going concern basis of accounting and identify any material uncertainties to their ability to do so.
4) Viability Statement State whether the company will be able to continue in operation and meet the liabilities.
What do Companies need to do?
It is important that Main Market companies understand the true nature of the impact of the latest changes to the Code. Whilst the wording changes on risk, internal control and going concern are not extensive their impact is significant. The board processes associated with reviewing the risk management framework generally and the principal risks and uncertainties in particular, as well as those associated with the internal control review and the going concern assessments, do not need to be replaced.
However the changes to the Code and the introduction of the requirement to produce a viability statement are designed to provide a new and wider-ranging level of rigour throughout these processes. Boards and Audit/Risk committees will need to work with their management colleagues to understand the new requirements and allocate sufficient time, both inside and outside the boardroom, to the enhanced levels of analysis, review and reporting.
Assessment of Risks
Companies are required under the Code to make a robust assessment of principal risks and to explain how these risks are being managed or mitigated. The FRC Guidance makes it clear that an assessment of risks is required in order to make the viability statement and that these risks should be based on risks that would threaten the survival of the business.
The descriptions of principal risks should be ‘sufficiently specific that a shareholder can understand why they are important to the company’. It is clear therefore that the risks considered should be targeted and should be the main risks facing the business, not a general list of business risks. The wording change is useful because it aligns the risk assessment required under the Code to the half-yearly review of the principal risks and uncertainties, which is needed ahead of the interim and full year reporting as required by Disclosure and Transparency Rules 4.1 and 4.2.
FRC Guidance Appendix B - Longer Term Viability Statement
“The statement should be based on a robust assessment of those risks that would threaten the business model, future performance, solvency or liquidity of the company, including its resilience to the threats to its viability posed by those risks in severe but plausible scenarios.”
The risk assessment process set up by the company should include: Having the right people with clear responsibilities involved; Identifying and describing the risks; Deciding on how these risks are to be managed and mitigated; Providing the right information to the Audit Committee and the Board to allow thorough and proper assessments to be made; Open and transparent discussions by the Audit Committee and the Board.
Review of Internal Controls
For many years, boards have been required to monitor the company’s risk management and internal control systems and, at least annually, carry out a review of their effectiveness, and report on that review in the annual report. The ambit of the review of the system of internal controls has been established for some time (ever since the Turnbull Guidance was first produced in 1999).
Responsibilities
Companies should ensure that those bodies and individuals within their organisation whose role includes risk and financial reporting are fully aware of their responsibilities. The FRC Guidance sets out considerations for the exercising of responsibilities particularly for the Board.
The role of the Audit Committee
The Audit Committee’s role will be key in reviewing the risk assessment process carried out in order to enable the Board to report on risk assessment and viability. The Audit Committee will need to review, amongst other things, risk assessments, cash flow forecasts, valuation assessments and liquidity risks. They will need to consider the timeframe chosen for the viability statement. The Audit Committee should be provided with a copy of the FRC Guidance in order to assist their work.
The role of the Board
Whilst the Audit Committee has a vital role in assessing the relevant information, the Board as a whole will need to satisfy itself that there are adequate processes in place to assess whether the company is assessing risk thoroughly and operating as a going concern. The findings of the Audit Committee should therefore be presented to the Board for review and approval. The FRC Guidance sets out relevant questions for the Board to facilitate discussion and challenge by the Board.
The role of the Management
Management in finance and treasury functions should be briefed on the information the Audit Committee and Board need to review. This information will include risk assessments and identification of principal risks, how risks identified are managed and mitigated as well as sensitivity analyses, cash flow forecasts, treasury policies, existing and proposed banking facilities and whether there is any possibility that the company will breach banking covenants.
The role of the Auditor
The Listing Rules require that the company should ensure the auditor reviews the directors’ going concern and longer-term viability statements (LR 9.8.10). The auditor should: Review the documentation prepared by the directors which explains the basis of the directors’ conclusions with respect to going concern and longer term viability; and Evaluate the consistency of the going concern and viability statements with the auditor’s knowledge obtained during the audit.
Reporting
Generally, the FRC Guidance stresses that clear and concise information should be provided which is tailored to the specific circumstances material to the company. The board should bear in mind the overall requirement for the annual report to be fair, balanced and understandable.
Risk Reporting
- The process set up to assess risks and the results of this assessment should be used to inform the reporting requirements in the annual report. These include:
- Reporting on the principal risks facing the company and how they are managed or mitigated (as required by the Companies Act and the Code – C.2.1)
- Reporting on the review of risk management and internal control system (as required by the Code – C.2.3) and the main features of the company’s risk management and internal control system in relation to the financial reporting process (as required by the Disclosure and Transparency Rules)
The Going Concern Statement
Under International Accounting Standards companies are required to prepare financial statements on a going concern basis, unless it is intended to liquidate the company, cease trading or has no realistic alternative but to do so. The FRC Guidance confirms that the term ‘going concern’ in the Code refers only to the basis of preparation of the financial statements under accounting standards.
As well as confirming the going concern status of the company, the Code requires companies to identify any material uncertainties which may impact on this statement. The FRC Guidance highlights that if there are material uncertainties to disclose these must be explicitly identified and make any other disclosures necessary to give a true and fair view of the accounts.
This new wording is important because it requires companies, in addition to the normal cash-flow and funding assessment that has often been provided to support the going concern basis of preparation of the financial statements, to also undertake a proper assessment of the underlying assumptions. If there is any significant uncertainty about these assumptions, the new requirements create an obligation to disclose what these are.
The Viability Statement
The Viability Statement must cover the following items:
- How the company has assessed the prospects of the company;
- Over what period this assessment has been made and why it is considered appropriate;
- Whether the directors have a reasonable expectation that the company will be able to continue in operation and meet its liabilities as they dull due over the chosen period;
- Any qualifications or assumptions used as necessary.
- In order to achieve this various steps have to be gone through starting with the identification of and review of the company’s principal risks as set out above. Following this the directors will need to:
- Select an appropriate timeframe – the FRC Guidance does not specify a timeframe but gives a clear indication that it should be a lot longer than a year and points out that the longer the time period the more uncertain the assessment that there is a reasonable expectation that the company will be able to continue in operation will be. In selecting a timeframe companies should consider the sector the company operates in, the extent to which any risks have crystallised and the company’s planning timescales. Many companies have a five-year business plan and it would make sense for companies to start with this, but directors should also consider longer periods. Whatever period is chosen explaining in the statement the rationale behind this choice is key.
- Make the assessment of the company’s prospects – The FRC Guidance specifies that this assessment should ‘include sufficient qualitative and quantitative analyses’. The importance of stress and sensitivity analysis for different scenarios is also highlighted.
- Consider the risks to solvency and liquidity over the selected time period – directors are encouraged to think broadly as to matters which may affect the company’s future performance. This will require companies to consider new aspects of risk. Previously board assessments of risk have concentrated on the impact and probability of risk, which has tended to focus minds on the high impact and high probability quadrant of the risk matrix. The new requirements focus minds more on the catastrophic scenarios which may not be high probability (indeed will not be) but will have high financial impact because of the speed at which the situation escalates and the knock-on financial effects. The sort of scenarios this assessment may well have in mind are those experienced by Lonmin and TalkTalk in recent months and years.
- Consider any qualifications or assumptions to be included in the statement – the FRC Guidance states that these should be specific to the company rather than generic and cross-refer to disclosures elsewhere rather than repeat information.
- At this stage there is a lot of uncertainty about what the viability statement will look like and where it should be placed in the annual report. The first annual reports fulfilling this requirement will be published very soon (December 2015) and by the spring of 2016, it will be clear how companies are adopting it. Given the forward-looking assessment implied by the viability statement, it is important that the statement is positioned such that it can benefit from the safe harbour provisions set out in s463 of Companies Act. It may be appropriate to include the viability statement alongside the section on principal risks and uncertainties in the Strategic Report.
Prism Perspective
The FRC consultation which preceded the introduction of the new Code changes acknowledged that whilst the previous Code contained requirements for boards to report on risk, internal control and going concern, those requirements were not joined up, which was exposed by the failures of the global financial crisis.
The new changes are designed to remedy this and therefore a holistic approach to risk, control and going concern/viability reporting is the real intention behind these changes. Consequently, to approach the changes appropriately, the specific requirements need to be considered in the context of the wider business model, strategy and macro-economic environment.
Directors and Audit Committees need to build on existing risk management systems, which should already be in place, to enable reporting requirements on risk, internal controls, going concern and viability to be made. The new requirement for a longer term view of the company’s prospects should have the benefit of focusing directors’ attention on the medium to long term as well as on the short term, and assisting companies to track, monitor and plan for any foreseeable difficulties.
It is important that Boards and Audit/Risk committees work with their management colleagues to understand the new requirements, and allocate sufficient time, both inside and outside the boardroom, to the enhanced levels of analysis, review and reporting that are now required. The viability statement is not a document that can be produced at the last minute before the annual report is signed off by the board.
Useful Sources FRC: Guidance on Risk Management, Internal Control and Related Financial and Business Reporting 2014
Prism Cosec November 2015 http://prismcosec.com/