Other information in the annual report: governance, management commentary and risk reporting

The financial statements are the audited core of an annual report, but most readers start elsewhere: the chairman’s letter, the directors’ report, the risk section, the highlights page. These parts are written mostly by management, are largely narrative, and are not all audited. A good analyst knows what each part should contain, what it is for, and how it can mislead.

This topic covers the content of an annual report, mandatory and voluntary disclosures, governance reports under the Nigerian Code of Corporate Governance 2018 (NCCG), the chairman’s report, management commentary and the International Financial Reporting Standards (IFRS) Practice Statement on it, risk reporting, and the other financial information that often sits beside the statements: summaries, highlights, key performance indicators and trends.

The earlier topics covered the statements themselves. The next topics cover corporate social responsibility, sustainability and integrated reporting.

Key terms in plain English

Syllabus check

This topic covers parts of three syllabus areas:

• A1(f) evaluating disclosures on corporate governance policies and the chairman’s report in the annual report;
• D1(c) appraising the nature and validity of information in annual reports, including voluntary disclosures;
• D2(d) and (e) assessing the economic environment and strategy from the chairman’s and chief executive’s reports, management commentary, governance disclosures and financial highlights, and making inferences while allowing for the limits of the information.

IFRS Practice Statement 1 has a topic of its own later in the course. Here you learn the basics of management commentary.

CAMA 2020 and the annual report

The Companies and Allied Matters Act 2020 (CAMA 2020) sets what the directors must put in front of shareholders.

What is in an annual report?

Annual reports describe what the company did over the year and how it performed. Besides the audited statements, they contain numerical or narrative and financial or non-financial information. Narrative is often easier to read than notes to the accounts, but it is less tightly regulated. Companies file the report with the Corporate Affairs Commission (CAC), and listed companies also report more often, as the interim reporting topic explains.

Mandatory and voluntary disclosures

• Mandatory by law: an annual report and accounts presented to shareholders, with the contents of the directors’ report and the statements set by company law and the financial reporting standards.
• Mandatory by regulators or stock exchange: SEC and FRC rules require listed companies to include a corporate governance statement and a chairman’s report. Stock market rules also cover announcements such as profit warnings and takeover proposals.
• Voluntary: an operating and financial review, a social and environmental report, a corporate social responsibility report, financial summaries and KPIs.

Why companies disclose voluntarily:

• public relations and marketing
• to persuade regulators that compulsory rules are unnecessary
• a genuine belief in accountability to society and the environment
• to improve communication with shareholders

Limits: the company decides what to include and what to leave out, and information is often presented in a positive light, so it may not be fully reliable.

Governance reports

Institutional investors use governance information to make better decisions. A corporate governance statement for a listed company often runs to five or six pages. In Nigeria the FRC unified the sector codes into the Nigerian Code of Corporate Governance 2018, which took effect in January 2019. It has six pillars, 28 principles and four intended outcomes: stronger business integrity, rebuilt public trust and confidence, easier trade and investment, and business sustainability.

The SEC requires every quoted company’s annual report to include a governance statement showing the strength of its structures, policies and practices.

General content

1. Board composition, with the names of the chairman, CEO and non-executive directors.
2. The roles and responsibilities of the board, including matters reserved for the board and those delegated to management.
3. How board appointments are made, and the induction and training of directors.
4. The evaluation of the board, its committees and each director, with a summary of results.
5. Directors standing for re-election and their biographies.
6. The composition of board committees, with names of chairs and members.
7. The roles of the committees and how they discharged them.
8. The number of board and committee meetings and attendance.
9. The code of business conduct and ethics, if any.
10. Human resource policies, employee relations and employee share schemes.
11. Sustainability policies and programmes, such as anti-corruption, community service and environmental protection.

Statement of compliance, accounting and risk

The board states how far it complies with the code. It also gives assurance that an effective internal audit function exists and that risk management and compliance systems are operating effectively, explains any rejection of the audit committee’s recommendation on the external auditor, and covers sustainability initiatives and related party transactions.

The report must also cover the directors’ responsibility for the statements, accounting policies and reasons for changes, a statement that the business is a going concern, executive and non-executive directors’ pay, and the board’s opinion on the effectiveness of risk management.

The chairman’s report

The chairman is a non-executive director who runs the board but not the day-to-day business. The SEC requires a chairman’s statement that gives a balanced, readable summary of the year’s performance and the outlook, reflecting the collective view of the board.

It is usually one or two pages with no mandatory content. But typically covers comments on results, an overview of trading and the business, a governance overview, corporate responsibility and sustainability, markets and the environment, and an outlook.

Comply or explain

In the European Union and the United Kingdom, major companies must follow a recognised governance code or explain why not. The principle is the same idea in a looser form: the company chooses, but must be open about its choice.

Management commentary

Management commentary is extra information that complements the financial statements. It is provided by management and expresses management’s view, and much of it is narrative. The International Accounting Standards Board (IASB) says it should include numbers as well as words. In the European Union companies must include a business review, which is a form of management commentary, sometimes called an operating and financial review.

The IFRS Practice Statement on management commentary is not mandatory. It offers a framework that can be adapted to local law. It describes management commentary as a report that accompanies IFRS statements and gives historical and forward-looking comment on financial position, performance and cash flows, and a basis for understanding management’s objectives and strategies.

It helps users understand risk exposures and how they are managed, resources that are not in the statements, and the effect of non-financial factors. A decision-useful commentary should include information on:

• the nature of the business;
• management’s objectives and strategies;
• the most significant resources, risks and relationships;
• the results of operations and prospects; and
• the critical performance measures and indicators that management uses.

Risk reporting

Risk management is a governance matter. The board should safeguard the company’s assets and shareholders’ investment, and a risk report lets shareholders judge how seriously risk is taken. The International Corporate Governance Network (ICGN) guidelines say the board sets the risk strategy and oversees the system, management designs and runs it, and shareholders assess how well the board oversees risk.

International Financial Reporting Standard (IFRS) 7 requires disclosure of credit, liquidity and market risk, but a risk report should be broader than financial risk. Typical principal risks include climate change and energy transition, geopolitical events, competition, reserves replacement, major project delivery and cybersecurity.

Nigerian rules

As ICAN teaches the SEC rules:

• the board of every public company sets up a risk management committee
• risk management is part of accounting policies
• notes disclose the material effect of unmitigated risk on profitability and the strategies for preventing risks

()

Five components of effective risk reporting

Other financial information

• Financial summaries give key figures from the statements. There is no fixed format, and figures should be traced back to the statements. They give an overview, but real understanding needs the full statements and industry knowledge.
• Financial highlights are what the company thinks is important. They may include performance statistics and key events, and may be used to push a particular agenda.
• KPIs can be financial (return on capital employed, gross margin) or non-financial (market share, quality scores). There are few standard definitions, so best practice defines the calculation and explains the numbers.
• Trends over five or ten years show direction. They can include revenue, profit, earnings per share, share price and headcount.

The rules in more depth

Why narrative needs scepticism

Because management writes it, narrative tends to emphasise good news. Check it against the statements: does the chairman’s “record year” match the profit and the cash flow? Does the risk section mention the risks that the notes or the audit report hint at?

Why the audit does not cover everything

The auditor reads other information for consistency with the statements, but it is not audited. Risk disclosures required by IFRS 7 are audited if they are in the statements, or if the company puts them in the risk report and labels them as part of the statements.

Why governance disclosure is not the same as good governance

A long statement can describe a weak board. Look for substance: independent directors, committee work, evaluation results and what happened when the board disagreed with the audit committee.

Why definitions of KPIs matter

If one company calculates a KPI differently each year, trends mislead. A company should say how a KPI is calculated and keep the method fixed.

Worked example: reading a report critically

1. Check the headline numbers.
   Revenue growth = (600 − 545) ÷ 545 = 10.1%.
   Profit growth = (84 − 75) ÷ 75 = 12.0%.
   The highlights are arithmetically right.
2. Look for what is left out. Profit before tax after the fine is ₦84 million. Before the fine it would be ₦104 million. The highlights say nothing, so users may think the profit growth was “clean”, or they may wonder about the compliance failure behind the fine. The omission makes the highlights selective.
3. Trace to the statements. The summary figures can be agreed to the audited statements, which is good practice. The fine can be found only in the notes.
4. Governance. The NCCG-style statement should give the number of meetings and each director’s attendance. Without it, shareholders cannot judge how active the board and committees were.
5. Risk. A fine suggests a control or compliance weakness. The risk report should say what happened and what was done, and the audit committee should review it under s. 404(7)(d) of CAMA 2020.
6. Conclusion. The report is accurate on the figures it chooses, but is not balanced. Recommend adding the fine and its cause to the highlights and commentary, adding attendance records, and explaining the remedial steps.

How to score full marks

• Split mandatory from voluntary and say who requires each item.
• For governance questions, use the list: composition, roles, appointments and training, evaluation, committees, meetings and attendance, ethics code, human resources, sustainability, compliance statement.
• For management commentary, give the five content areas and the three features: management’s view, complements the statements, looks ahead.
• For risk, use the five components and the Nigerian SEC rules.
• Evaluate, do not just list. State a weakness, say why it matters (transparency, investor confidence, regulatory sanction) and recommend a fix.
• Link to the numbers. Check summaries and highlights against the statements.

Common mistakes in the exam

• Treating narrative information as audited.
• Saying governance statements are voluntary for listed Nigerian companies.
• Calling the Practice Statement on management commentary a mandatory standard.
• Writing about financial risk only and forgetting operational, strategic and cyber risks.
• Listing weaknesses without implications or recommendations.
• Accepting highlights and KPIs without asking how they are defined and what is left out.

Quick revision

• Mandatory: law, SEC, FRC, exchange. Voluntary: operating and financial review, social and environmental reports, summaries, KPIs.
• Governance statement: composition, roles, appointments, evaluation, committees, meetings, ethics, human resources, sustainability, compliance.
• NCCG 2018: six pillars, 28 principles, four outcomes.
• Chairman’s report: balanced summary of performance and outlook.
• Management commentary: management’s view, complements statements, forward-looking. Five content areas.
• Risk report: agenda, assessment, response, communication, governance.
• CAMA 2020: ss. 377(1), 385, 374(6), 404(7)(d), 405.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.