1

With technical & financial assistance from:

Caribbean Association of Indigenous Banks Inc www.caibinc.org

Audit Committee Best Practices A USA Perspective

Presented by:

Frederick D. Lipman

President

Association of Audit Committee Members, Inc.

3

INTRODUCTION TO BEST PRACTICES

Changes over time and circumstances, including applicable laws

Best practices are divided among:

• Board and audit committee structure and information flow

• Internal audit function

• Creating an ethical, law abiding culture

• Selection of independent auditor and assuring auditor independence

• Questions for management

• Identification of warning events

• Questions for auditors

4

BEST PRACTICEDirectors must either directly or through committees identify the major risks of an organization, prioritize those risks, and establish internal controls and a compliance program to help ameliorate such risks. The major risk analysis should be used to develop a committee structure within the board of directors, with each committee having an oversight role with respect to each major risk. Audit committees must identify and prioritize financial statement risks.

5

Best Practice

• Audit committees should consist solely of independent directors, with no ties either directly or through family members to management or the outside auditors, and with no other relationship with the company.

• Members must be able to read and understand financial statements and should include a financial expert.

• Audit committees should be authorized to retain its own consultants for second opinions and legal advice.

• Audit committees should adopt a charter and annually review and evaluate charter and committee operations.

6

BEST PRACTICEAudit committees must have their own information pipeline into the company, separate from the information provided to them by management and the independent auditors, in order to fulfill their fiduciary duties. An internal auditor reporting to the board of directors or its audit committee can fulfill this function.

Audit committees cannot solely rely upon the outside auditors for information.

7

BEST PRACTICE

Establishing an effective internal audit function, reporting to the audit committee, is probably the most important thing that can be done by an audit committee. The internal auditor must be hired and compensated by the audit committee of the board of directors. The primary responsibility of the internal auditor should be to assist the board of directors to perform its fiduciary duty to monitor management. Other operational duties may be assigned to the internal auditor by management, but these other duties should not interfere with the primary responsibility of the internal auditor. Internal auditing services may be outsourced.

8

BEST PRACTICEMeet separately with the head of internal audit, without management present, to determine the adequacy of the staffing and funding of the internal audit function.

BEST PRACTICEPlay an active role in reviewing and approving the annual internal audit budget and services.

BEST PRACTICEQuestion the head of internal auditing, without management present, on significant risk areas within the business.

9

BEST PRACTICECompensate the internal auditor without regard to cost savings or efficiencies uncovered in the internal audit process, based solely on the quality of the services rendered by the internal auditor.

BEST PRACTICEBe certain that the internal auditor and the independent outside auditor are fully exchanging information and are otherwise coordinating with each other.

10

BEST PRACTICEThe chairman of the audit committee and the head of internal audit should exchange cellular numbers.

BEST PRACTICEThe audit committee and the head of the internal audit department must prevent any interference by management, as occurred in WorldCom, according to the Second Interim Report of Dick Thornburgh, dated June 9, 2003 (Thornburgh Report), in the financial statement audits.

11

BEST PRACTICECreate an ethical, law abiding culture within the organization without discouraging entrepreneurial risk taking. A key element of such a culture is the tone at the top of the organization.

Management must receive incentives to help create such a culture since the costs are short-term and the benefits are long-term.

12

BEST PRACTICEAt a minimum, the audit committee should require the company to adopt a written ethics policy, distributed to all employees, that contains the name and address of the person on the audit committee (typically the chair or to the internal auditor) to whom complaints should be directed and provides a procedure for the submission of anonymous complaints concerning questionable accounting or auditing matters. According to a 2004 survey by the Association of Certified Fraud Examiners, fraud is detected 40% of the time by tips.

13

BEST PRACTICESIn addition to the outside auditors, the chief executive officer, and the chief financial officer, the audit committee should consider interviewing at least once a year these persons:

• Controller and assistant controller (e.g., ask if there are any accounting policies or procedures with which they are uncomfortable)

• Head of sales (e.g., ask if there are any side deals with any customers, channel stuffing, so-called round-trip sales, etc.)

• Tax manager (e.g., ask if there are any aggressive tax strategies being pursued by the company, best practices, etc.)

14

BEST PRACTICES (Continued)• Internal auditor

• Inside counsel and outside counsel

• Head of disclosure committee

• Corporate governance officer

• Head of Human Resources

• Head of information technology, corporate development, purchasing

15

BEST PRACTICEAudit committees should carefully consider whether more intensive and extensive audits are required on the eve of insider sales of significant amounts of stock. If this policy is adopted, the audit committee should adopt a policy requiring written notice of insider sales several months before the actual date of such sale so as to arrange the necessary audits.

BEST PRACTICEIn rare situations in which the audit committee elects to approve a conflict of interest, an ongoing independent monitoring mechanism must be established by the audit committee. This mechanism may include more intensive or extensive audits by the independent auditor, possibly supplemented by oversight by the internal auditor. The results of both the independent auditor and the internal auditor oversight should be reported directly to the audit committee.

16

BEST PRACTICEIf short sellers take a significant position in the company stock, the audit committee should investigate whether the short sellers know something they do not.

BEST PRACTICEIf there are other warning events, the audit committee should authorize the auditor to conduct more intensive and extensive audits. Since almost no company consistently meets earnings projections, audit committees may wish to use a certified fraud examiner to supplement the auditor.

17

BEST PRACTICE

The outside auditor should be hired and compensated solely by the audit committee. The audit committee should obtain written assurances from the outside auditor of their independence. To the extent that the outside auditor uses independence rules other than U.S. SEC independence rules, the audit committee should be informed as to why the SEC independence rules could not be satisfied.

18

BEST PRACTICENonaudit services performed by the auditor should not exceed 100 percent ofaggregate of audit services and audit-related services.

BEST PRACTICEDo not use the auditor for tax planning and tax preparation services.

19

BEST PRACTICES• As noted, the engagement letter from the auditor should

contain a representation that the auditor is and will remain independent throughout the audit engagement.

• Conduct a robust discussion with the auditor of his or her independence at least once a year.

• After each assignment of nonaudit work to the auditor, the auditor should be required to represent to the audit committee that the nonaudit service does not impair his or her independence. (An exception may be made for routine nonaudit services, such as tax return preparation.)

• Care must be taken before hiring former employees of the auditing firm as company employees to be certain that the new employee will not impair the auditor’s independence. The human resources department should be required to notify the audit committee prior to any such hires.

20

BEST PRACTICEIf you elect to use the auditor for tax planning services, do not purchase tax shelters or aggressive novel tax strategies from the auditor.

BEST PRACTICEAudit committees should not permit members of the audit team to be compensated for selling nonaudit services.

BEST PRACTICEThe auditor should not be permitted to perform personal tax or other work for management. Potential conflicts of interest can arise that can be harmful to all parties (e.g., Sprint).

21

BEST PRACTICE

The audit committee should ask the auditor the following 4 questions (per Warren Buffett):

1. If the auditor were solely responsible for the company’s financial statements, would they have been prepared in any way different than the manner selected by management?

2. If the auditor were an investor, would he have received the information essential to a proper understanding of the company’s financial performance during the reporting period?

3. Does the auditor know of any operational facts that caused the company’s sales or profit to move significantly from one quarter to the next?

4. Is the company using the same internal audit procedure that would be followed if the auditor himself were CEO?

22

BEST PRACTICEThe audit committee must determine on a case-by-case basis whether any of the accounting treatments preferred by the independent accounting firm should be adopted by the company and what the overall effect would be of such adoption. If the audit committee decides not to adopt a recommendation of the registered accounting firm, the reasons for the rejection should be carefully documented by the audit committee, with the assistance of counsel.

23

Contact Information for

Frederick D. Lipman

Frederick D. Lipman, Esq.Blank Rome LLPOne Logan Square

18th & Cherry StreetsPhiladelphia, PA 19103-6998

Telephone: 215-569-5518Fax: 215-832-5518

E-Mail: lipman@blankrome.com