Corporate governance, its codes and the audit committee

Shareholders own a company, but directors run it. That gap is the root of every governance problem. Directors may take decisions that suit themselves, and shareholders cannot watch them. Good governance is the set of rules and habits that close the gap, and the audit is one of its main tools. The audit committee is the part of the board that connects the two.

This topic covers what corporate governance is and why it needs regulation, why public oversight matters, the split between directors’ and auditors’ responsibilities, the Nigerian codes, how jurisdictions differ in their treatment of audit, and the audit committee: its make-up, its duties and its effect on the audit. Examiners ask about the composition rules and the lists of duties, so learn the numbers and the heads of each list.

What corporate governance is

Corporate governance is the way in which companies are managed and controlled. It looks in particular at the role of directors and their responsibilities to shareholders and other stakeholders. A company is unusual because ownership is divorced from management. The directors manage the business and make the important strategic decisions. The shareholders finance the company and own it.

Directors are therefore the agents of the shareholders. As agents they should take decisions in the shareholders’ best interests, and they should be accountable to the shareholders for how they have used the company’s resources.

Why regulation is needed

Company law regulates some aspects of governance. But the basic legal rules proved too weak to protect shareholders from losses in a number of corporate scandals caused by directors. More specific regulations and guidelines were then introduced. They differ between countries: some have detailed rules and others none. The syllabus says you do not need detailed knowledge of the governance rules of each country for this paper.

Why public oversight and governance principles matter for audit

Public oversight of the audit and assurance profession, together with governance principles, brings six benefits:

1. Better audit quality. Best practice is followed, so audit scope and plans are well designed and carried out, and standards are followed to safeguard company assets.
2. Market information. Users learn how good each firm’s work is and whether it is fit for purpose. Companies can get information before they appoint a practitioner and so get value for money.
3. Lapses are found and fixed. Weaknesses in practice are identified and communicated to practitioners, who can correct them and avoid repeating past mistakes.
4. Focus on the key risks. Practitioners concentrate on the vital risk areas, and those areas are monitored and mitigated.
5. A basis for investigation and discipline. The guidelines give a standard against which to investigate and discipline compromises in audit and assurance quality. This prevents repeats by other firms and drives continuous improvement.
6. Compliance. It helps ensure that practitioners’ activities follow policies, laws, regulations and ethical standards.

Directors’ and auditors’ responsibilities

In all corporate reporting there is a basic split of roles.

International Standard on Auditing (ISA) 210 treats it as good practice to set out the relative responsibilities of directors and auditors for governance matters when the terms of the engagement are agreed.

Codes of corporate governance in Nigeria

There are two codes to know for this paper. Detailed knowledge of them is not required here.

How jurisdictions differ in dealing with audit

Whatever the country, an audit is expected to produce a comparable report that supports credible financial reporting, transparency and sound internal control. The syllabus identifies these points of difference and common ground:

• Auditor independence is in both national and international law, to prevent conflicts of interest. The United States (US) Sarbanes-Oxley Act 2002 has a rule on auditor independence and on non-audit services. National laws also contain rules on conflicts of interest and on permitted non-audit services, and these must fit the International Ethics Standards Board for Accountants (IESBA) Code.
• Accountability of those charged with governance. Some jurisdictions have a complex regulatory environment and laws that hold those charged with governance to account for misleading reports. The laws set sanctions and penalties for failing to set up mechanisms to prevent fraud and error, to keep good internal control and to report accurately. Under Sarbanes-Oxley and under national laws, Chief Executive Officers and Chief Financial Officers must certify the accuracy of the financial report.
• Local business practice. Laws reflect how business works in each country. Local laws can conflict with international standards, so auditors must keep up with both and find ways to bring local law and international standards into line to support credible reporting.
• Technology. Use of technology such as blockchain and artificial intelligence varies between countries. Auditors must assess what it means for financial reporting and train and retrain. This is a heavy burden for small practitioners with little money, so national and international rules encourage practitioners to form partnerships and pool resources.
• Culture. Standards aim to promote cross-border investment and meet stakeholders’ needs, but national laws that guide one jurisdiction can challenge multinational entities and their auditors. Cultural differences must be managed to prevent problems in communication and compliance, while keeping the integrity of the audit.
• Liability. While protecting investors and the public, auditors owe a duty of care and skill. There is professional liability for negligence, including sanctions and fines.
• Resources and records. A shortage of competent professionals means that the information available for audit can differ between jurisdictions. Entities must keep accurate, complete records so that financial reporting is not delayed.

The audit committee

What it is and why it exists

In many countries, listed companies must or are expected to have an audit committee. In Nigeria, section 404(2) and (3) of Companies and Allied Matters Act 2020 (CAMA 2020) require every public company to set one up. The audit committee is a sub-committee of the board, and it reports to the main board.

All members must be financially literate, and at least one must belong to a professional accounting body in Nigeria established by an Act of the National Assembly.

A key purpose is to put a buffer between the auditors and the executive directors. This lowers the risk that the auditors come under undue pressure from executive board members. For example, the auditors might fear that the company will take away their audit or non-audit work, and so be more inclined to agree with management’s views. The committee therefore helps to protect the independence of the external auditors.

Composition under CAMA 2020, s. 404(3), (5) and (6)

• The committee has five members: three members of the company and two non-executive directors.
• Members are not entitled to remuneration and are subject to re-election every year.
• Any member may nominate a shareholder for the committee by written notice to the company secretary at least 21 days before the annual general meeting.

Duties under the SEC code for public companies

The SEC code and CAMA 2020 (section 404(7)) both guide the duties. The SEC code requires them to be written down. The committee should:

1. help oversee the integrity of the financial statements, compliance with legal and regulatory requirements, the qualifications and independence of the external auditor, and the performance of internal and external audit;
2. set up an internal audit function and make sure there are other means of getting enough assurance that the internal controls are regularly reviewed;
3. make sure a full internal control framework is developed, get assurance on it, and report each year in the financial report on how effectively it operates;
4. oversee how management identifies significant fraud risks and make sure prevention, detection and reporting mechanisms are adequate;
5. at least yearly, get and review an internal audit report on the strength and quality of internal controls, with any issues and recommendations from the latest review;
6. discuss the annual audited statements and the half-yearly unaudited statements with management and the external auditors;
7. discuss policies and strategies on risk assessment and management;
8. meet separately and regularly with management, the internal auditors and the external auditors;
9. review and make sure there are adequate whistle-blowing procedures, with a summary of issues given to the chairman;
10. review with the external auditor any limits on the scope of the audit or problems met, and management’s responses;
11. review the independence of the external auditors and make sure that non-audit services create no conflict of interest;
12. protect auditor independence by setting clear policies on hiring current or former employees of the auditors;
13. consider related party transactions in the company or group;
14. use its authority to investigate any matter within its terms of reference, with resources provided to the internal auditors and access to outside advice where needed; and
15. report regularly to the board.

Objectives and functions under CAMA 2020, s. 404(7)

Subject to anything extra in the articles, section 404(7) of CAMA 2020 gives the committee these objectives:

1. ascertain whether the company’s accounting and reporting policies follow legal requirements and agreed ethical practices;
2. review the scope and planning of audit requirements;
3. review findings on management matters with the external auditor, and the departments’ responses;
4. keep the effectiveness of the accounting and internal control system under review;
5. recommend to the board the appointment, removal and pay of the external auditors; and
6. authorise the internal auditor to investigate any activity that may interest or concern the committee.

The Audit Regulation 2020 adds that an auditor may provide non-audit services only with the approval of the board of directors, after the audit committee has made its recommendation.

The Nigerian Code of Corporate Governance 2018

The FRC code calls the committee that CAMA 2020 requires (section 404(2) and (3)) the Statutory Audit Committee. It also requires a Board Audit Committee in addition. All members of the Board committee must be financially literate and able to read and understand financial statements. At least one must be a financial expert with current knowledge of accounting and financial management, able to interpret financial statements.

For private companies, the members of the committee responsible for audit should be non-executive directors, with a majority independent non-executive directors where possible. The committee should meet at least once every quarter.

The Board Audit Committee has these further responsibilities:

1. oversee management’s processes to check the integrity of the financial statements and compliance with law, and assess the qualifications and independence of the external auditors;
2. make sure an internal audit function is set up and overseen, and each quarter get and review an internal audit report with issues and recommendations from the latest review;
3. make sure an internal control framework is developed, get internal or external assurance on it, and report each year in the audited financial report on the design and operating effectiveness of controls over financial reporting;
4. oversee the process for identifying fraud risks and make sure prevention, detection and reporting are adequate;
5. discuss the interim or annual audited statements and significant reporting findings with management and the external auditors before recommending them to the board;
6. oversee financial and non-financial reporting;
7. make sure whistle-blowing policies are adequate and that reported issues are summarised for the board;
8. review with the external auditors any audit scope limits or significant matters, and management’s responses;
9. develop a policy on the nature, extent and terms of non-audit services by the external auditors;
10. review the auditors’ independence under that policy before they are appointed for non-audit work, so that there is no real or perceived conflict of interest or legal or ethical impediment;
11. protect auditor independence through clear hiring policies for employees or former employees of the external auditors; and
12. make sure a related party transactions policy is developed and that management applies it, and consider any related party transaction that arises.

At least once a year, the committee should meet the head of internal audit and the external auditors without management present. This allows an exchange of views and concerns that are not suitable for open discussion.

Applying the audit committee rules when governance fails

Exam questions rarely ask you to recite duties. They describe a company where the committee failed and ask you to evaluate the committee and suggest reforms. Use one method for every fact: name the duty, say how it was breached, and state the consequence. Then give the repair.

Wider strategies that earn marks in the same kind of question: engage a forensic accountant or governance expert for an independent review of the root cause, strengthen the finance function and use governance, risk and compliance software to control documentation, investigate why management downplayed the auditors and discipline where needed, reset the tone from the top, record every significant auditor observation in the management letter and obtain management’s response, and adopt a policy on rotation of auditors and professionals.

The rules in more depth

Why the audit committee protects independence

The auditor is appointed by shareholders but dealt with day to day by management, who also pay the fee and may offer other work. That is a self-interest and intimidation risk. If the auditor reports to a committee of non-executives and shareholder members, who recommend appointment, removal and pay, a disagreement with the executives no longer puts the auditor’s fees at risk.

The private meeting once a year gives the auditor a safe channel to raise concerns.

Statutory and Board audit committees compared

Numbers: the nomination deadline

If the annual general meeting is on 28 June, a nomination for the audit committee must reach the company secretary in writing at least 21 days before. Counting back, 28 − 21 = 7, so the notice must be received on or before 7 June. A letter dated 10 June gives only 18 days (28 − 10), which is too late.

Worked example: is this audit committee valid?

1. Composition. Section 404(3) of CAMA 2020 requires five members: three members of the company and two non-executive directors. Sahel has the numbers the wrong way round, with three non-executive directors and two shareholders. It must change the mix to three shareholders and two non-executive directors.
2. Remuneration. Members are not entitled to remuneration. The sitting allowance of ₦100,000 per meeting is not permitted and should stop.
3. Professional qualification. At least one member must belong to a professional accounting body in Nigeria established by an Act of the National Assembly, and all members must be financially literate. No member qualifies on the first point, so one must be replaced or added.
4. Nomination deadline. Notice must be given at least 21 days before the AGM. The AGM is on 28 June, so the last date is 7 June. The letter of 10 June is 18 days before and is out of time.
5. Conclusion. The committee does not meet section 404 of CAMA 2020. The board should correct the composition, stop paying members, add a qualified accountant, and treat the late nomination as invalid for this AGM. Members must also be re-elected annually (section 404(3)).

How to score full marks

• Composition questions: state every number. Five members, three members of the company, two non-executive directors, no remuneration, annual re-election, 21 days’ notice, financial literacy, at least one professional accountant. Each is a mark.
• Duties questions: group the points. Use headings such as financial reporting, internal control and risk, internal audit, external audit and independence, and reporting to the board. Examiners credit a clear point under each head. Do not try to recall all fifteen SEC-code duties in the order given.
• Say which source each duty comes from. CAMA, the SEC code, the Audit Regulation 2020 or the Nigerian Code of Corporate Governance (NCCG) 2018. Mixing sources is a common loss of marks.
• For “impact on audit” questions, lead with independence. Explain the buffer idea, then name two or three duties that protect the auditor: reviewing audit scope, recommending appointment and removal, approving non-audit services, and private meetings.
• For jurisdiction questions, give a point and a consequence. For example: laws reflect local business, so local law may conflict with international standards, so auditors must harmonise them.
• Scenario questions: test each rule in turn. Compare each fact with the rule, state the breach and give the fix. Show date workings.
• Time. Spend time in proportion to the marks and leave time to read the scenario twice.

Common mistakes in the exam

• Saying the audit committee has three non-executive directors and two shareholders. It is the other way round.
• Saying committee members may be paid. Section 404(3) of CAMA 2020 says they are not entitled to remuneration.
• Saying the nomination notice is 14 days. It is at least 21 days before the AGM.
• Saying the audit committee prepares the financial statements. Directors do, and the committee oversees.
• Confusing the Statutory Audit Committee under CAMA with the Board Audit Committee under the NCCG 2018.
• Saying the CBN code is optional. For banks it is mandatory.
• Saying the SEC code binds every private company. Other companies are encouraged only.
• Giving the NCCG commencement date as 2018. The code was issued in 2018 and started on 1 January 2019 according to the syllabus.

Quick revision

• Corporate governance: how companies are managed and controlled; directors are agents of shareholders and accountable to them.
• Law alone was inadequate after scandals, so codes were added. Detailed codes are not required for this paper.
• Directors: financial statements, internal controls, access, representations. Auditors: review and report.
• Codes: CBN (banks, mandatory); SEC (public companies, 2003 and 2011); FRC NCCG 2018 (from 1 January 2019 in the syllabus; the commencement notice is dated 15 January 2019; harmonising).
• Audit committee (section 404): every public company (s. 404(2)); five members, three company members and two NEDs, no pay and annual re-election (s. 404(3)); financially literate with one professional accountant (s. 404(5)); 21 days’ written notice of a nomination (s. 404(6)).
• Purpose: a buffer to protect auditor independence. Duties: oversight of financial reporting, internal control, fraud risk, internal and external audit, independence, related parties, reporting to the board.
• NCCG 2018: Statutory Audit Committee plus a Board Audit Committee; financial expert; quarterly meetings; annual private meeting with internal and external audit.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.