SEC Serves as Catalyst

The primary catalyst for the revitalized audit committee, however, has been the reforms prompted by the U.S. Securities and Exchange Commission to improve the accountability, independence and qualifications of audit committee members. The new reforms, which became effective earlier this year, require audit committees to be composed of at least three independent, financially literate directors, one of whom must have experience in accounting, financial reporting and finance.

Audit committees must also annually review and assess a formal written charter. The charter usually includes four fundamental oversight responsibilities: overseeing the financial reporting process; assessing the processes related to the company’s risks and internal control environment; evaluating the internal and external audit processes; and providing an avenue of communication between the board, management, internal audit and external audit.

Effective oversight recognizes that “financial reporting” is the culmination of a process. Therefore, audit committees need to concentrate on the major components as well as the participants with whom they interact with during that process. The key elements can be summarized as follows:

• Business and financial-reporting risk assessment;
• Accounting systems to capture information;
• Systems of internal control, including an authoritative and influential “tone at the top” by both management and the audit committee;
• Evaluation and interpretation of data;
• External as well as internal reporting of financial information. Internal reporting encompasses information used to make business decisions, including resource allocation and compensation programs; external reporting includes financial statements and quarterly reports for shareholders and other external users.

Three-Legged Stool

The participants in the financial reporting process constitute a “three-legged stool” of responsible disclosure and active oversight, laying the foundation for financial integrity and greater accountability. The three “legs” are management (including internal audit), the independent external auditor and the audit committee. As mentioned earlier, audit committees are often charged with overseeing and monitoring the activities of the internal audit department.

Organizations are not required by law to have internal audit departments, although most well-established public companies do maintain some type of internal audit function. Some of the factors to consider when evaluating whether an internal audit department would benefit your company include:

• The complexity of the business and reporting structure;
• Whether financial operations are centralized or decentralized;
• The company’s geographic diversity—local, nationwide or global;
• Whether the company is involved in acquisitions, business combinations or other complex transactions.

Do you feel your company's internal audit committee is well equipped to identify exceptions to internal controls that could result in significant financial reporting errors? Source: KPMG

Do you think your company's internal audit would report controversial issues to the audit committee that directly or indirectly involve senior management? Source: KPMG

Internal Reliance

The more complex the organization or internal control structure, the greater the likelihood that an internal audit department would benefit the company. An increasing number of real estate companies are adding internal audit departments as they evolve toward a more corporate-like entity.

One of the first steps in evaluating an existing internal audit department is to consider the resources available and how these resources are being used. Because audit committees may rely heavily on internal audit for insights and information, they need to ask a few pivotal questions to help them determine if, in their oversight of the financial reporting process, they can effectively rely on the internal audit function. These questions include:

• Does internal audit have access to the appropriate internal or external resources?
• Does its mission establish internal audit as an essential element in the internal control environment?
• Does internal audit address the significant financial reporting risks the company is facing?
• Is the work of internal audit relevant to the financial reporting process?

The focuses of internal audit departments differ, and an approach that may bring value to one company may not be appropriate for another. Internal audit departments may be structured to focus on a variety of areas including risk identification and assessment, internal control compliance, process improvement (operational type audits), or support of management though special projects. It is important for audit committee members to understand the resources available to internal audit, where they are spending their time, and whether their efforts are designed to monitor and improve the financial reporting process.

At a recent Audit Committee Roundtable, sponsored by KPMG’s Audit Committee Institute, 76 percent of the participants agreed or strongly agreed that their internal audit department was well equipped to identify exceptions to internal control policy or procedures that could result in significant financial reporting errors. A total of 16.2 percent was unsure and 7.8 percent did not agree.

An equally important question for audit committee members to ask themselves is, “Will internal audit bring controversial issues that directly or indirectly involve senior management to the attention of the audit committee?”

Lending Support

During KPMG’s Audit Committee Roundtables there were many discussions concerning the appropriate reporting lines for the chief audit executive (director of internal audit) and his or her relationship with the audit committee. We suggest that the administrative reporting lines of the chief audit executive, although important, are not nearly as critical as an established structure to ensure a direct reporting line between internal audit and the audit committee.

The chief audit executive is in the unique position of being employed by management yet expected to review its conduct. The “Report and Recommendations of the Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committees”—commonly known as the Blue Ribbon Report—encouraged audit committees to have mechanisms in place to foster confidential exchanges and “independent communication and information flow between the audit committee and the internal auditor.”

The purpose is to improve the effectiveness of both. Audit committee members need to establish that they can rely on the resources and judgment of the internal audit function. Elements of this relationship may include:

• A periodic review of the internal audit work plan;
• Frequent executive sessions between the audit committee and the chief audit executive;
• Input from the audit committee on the annual review and compensation of the chief audit executive;
• The audit committee’s approval before the termination of the chief audit executive.

Audit committees can employ a host of methods to assess and support the internal audit departments of the companies they serve. Examples include reviewing the internal audit charter, budget and staffing on a regular basis to reinforce the committee’s support of the department’s efforts.

In the current environment of corporate governance, audit committees have attracted greater focus as reforms designed to bolster their independence and accountability have taken hold. In the wake of these reforms, all public companies—including real estate companies—need to address the emerging challenges faced by audit committees if they are to protect shareholder interests. By supporting and empowering the internal audit function, audit committees can help maintain an appropriate level of corporate accountability for public companies.