A decade of unprecedented loose monetary policy designed to stimulate the global economy has been a godsend for businesses. Cheap financing has allowed companies to invest in growth and reward shareholders with share buybacks, pushing stock markets to record highs. Recent years have been good to CEOs.
Meanwhile, increasingly sophisticated automation and a belief that financial risks were relatively well-understood, compared with some emerging audit areas, mean that many internal audit functions had put financial risk on a back burner. But accommodating financial conditions also have allowed risks to build. "In advanced economies, corporate debt and financial risk-taking have increased, the creditworthiness of borrowers has deteriorated, and so-called leveraged loans to highly indebted borrowers continue to be of particular concern," Tobias Adrian, financial counselor of the International Monetary Fund, told an audience in April 2019 at the launch of the most recent Global Financial Stability Report.
It is hardly surprising then that financial risk has moved back toward the top of the list of business risks cited by chief audit executives in the Risk in Focus 2020 report, a collaboration among IIA institutes in Belgium, France, Germany, Italy, the Netherlands, Spain, Sweden, and the United Kingdom and Ireland. Nearly one-third of respondents listed it in their top five risks. As news headlines highlight a plethora of concerning indicators — anti-globalist trade policy, weak manufacturing data, the inversion of the yield curve on various government bonds, decelerating global growth, and other recessionary signals — boards and audit committees are increasingly likely to seek assurances that financial risk is being mitigated effectively.
Coming Full Circle
The management of financial risk on a day-to-day level lies ultimately with the finance function. Called the treasury in many countries, the finance function manages the business' liquidity and monitors cash inflows and outflows, current and projected, to ensure sufficient funds are available to support the company's operations and excess cash is invested effectively. Although finance is fundamental to the success of the business, it's useful for internal auditors to remember that some board members may have blind spots in their knowledge and awareness of the basics, particularly when it comes to the company's balance sheet.
"Nonfinance directors tend to be less familiar with the balance sheet and the cash flow statement than the profit and loss (P&L). By extension, they are typically less comfortable with the balance sheet lexicon, such as the true meaning of assets, liabilities, and equity," warns Steve Giles, a course leader at the London-based Institute of Directors on its Finance for Non-finance Directors learning program. "They are aware of concepts such as 'cash is king,' but do not readily translate this to the importance of managing working capital and the cash cycle in their business." He adds that the "corporate killer" is rarely a lack of profits, but the business' inability to pay debts when they are due.
This is why internal auditors in many sectors may now be urging boards to think seriously about market conditions and financial risks. In times of growth, when markets are calm, auditors conducting routine finance audits should watch for signs that the finance function is becoming complacent or that financial risk management standards are slipping. But when rising trade tensions combine with the highest-ever levels of corporate debt, they should scrutinize all aspects of financial risk, as earnings are likely to be under pressure.
"Trade wars are bad for everybody. Their ultimate impact is a movement toward lower earnings," says Pat Leavy, CEO at FTI Treasury, a Dublin-based treasury outsourcing and audit firm. "This combined with the presence of leverage obviously increases risk, but, from an audit perspective, when we're looking at individual companies, we need to understand the data we see."
Leavy explains that although gross corporate debt has risen, internal audit should focus more on net corporate debt. The risk is lower when corporations have high debt and also high levels of cash and liquid assets — a good example is the airline industry. "The focus should be on debt repayment capability, rather than profits and earnings before interest, tax, depreciation, and amortization alone," he says. "What we're really looking at is cash generation."
Qualities of a Good Finance Function
So, what does a good finance function look like, and what should internal auditors consider when they audit it? Leavy likens the quality of the finance function to Maslow's hierarchy of motivation. At the bottom of the pyramid is the quality of the infrastructure in place to manage the function: the resources and people, the competency of those people and the quality of the technology infrastructure, including any automation, and the commitment to the processes that are in place. The next level up is the control environment, the segregation of duties, the checks and balances, the flow of information, and compliance with those safety measures.
"As you move up the pyramid, it becomes more subjective," Leavy says. "Success at the next level depends on getting the right balance between developing strategy and managing the operations." Finance functions often spend 10% of their time on strategy and 90% on managing operations and getting the day-to-day work done. "In reality, getting the treasury strategy right can have a much more significant impact on the business," he says.
Finance functions often operate in isolation from the business and can be reactive. Ideally, they should be proactive and able to anticipate and be part of the corporate decision-making process. In this kind of finance function, the group treasurer moves up the value chain, working directly with the chief financial officer and risk committee to help define and achieve the corporate strategy.
Where Audits Focus
Similarly, Leavy says, finance audits tend to focus on the lower (although essential) rungs — operations controls and governance — and less on the finance function's strategy and how it enables the overarching corporate strategy. His points are echoed by Angela O'Hara, who spent five years as group assurance and risk director at an FTSE 100 chemicals and technology company before recently stepping into a director role. She also sits on the finance and general purposes committee of the Royal Veterinary College. O'Hara says limited resources meant that the finance audit she oversaw was outsourced and focused almost entirely on the basics.
"That audit looked at processes and governance, but not at the impact of the financial risks in the business and the treasury's role in relation to those risks," she explains. Auditors assessed how well the finance function managed bank accounts, and whether it reviewed the business' credit rating and funding arrangements regularly, as well as access rights for critical systems, the payment and processing platform, and foreign exchange (forex) trading. "But it didn't look at, for example, whether there had been a forex gain or loss, what led to that, and whether there should be changes to the roles and responsibilities associated with that," she says.
O'Hara says it is common for internal audit to assess how a function is set up, but there is additional value to add in assessing that function's effectiveness and what it means for the business. Reviewing structure, governance, policies, procedures, and key controls is fundamental. But, building on that, internal audit needs to challenge the function and its assumptions, even if it is not an expert on forex hedging or financing strategies.
"It's not a case of suggesting that what the treasury is doing is incorrect, but of raising questions that need to be considered in a rational and objective manner," Leavy adds. "And also of considering alternative approaches that might be more suitable and being open to that dialogue."
Alistair Smith, U.K. internal audit, risk, and control director at EDF Energy, says the transactional and frequent nature of finance activities makes them suitable for automation. However, in organizations using this kind of technology, internal audit should consider how key person risks and segregation of duties are managed. Another key risk, especially in long-established finance teams, is over-familiarity with the business, which can lead to "passive checking" of approvals for things like setting up new bank accounts. The best finance functions also will be able to provide metrics to demonstrate how they add value, whether through their forex hedging strategy or by optimizing financing.
Internal audit may not be able to predict whether the economy will go into recession, but there are more mundane matters that should be well-understood and managed. Changes to International Financial Reporting Standards (IFRS) accounting standards, for example, can catch finance functions off guard in companies that are required to comply with them.
IFRS 15, which came into effect in January 2018, requires that businesses subject to IFRS recognize revenues only when they are collected and not when customer contracts are signed, a change that has affected the top lines of high-profile companies. IFRS 16, which went live in January 2019, also has caused some turbulence. The new standard requires that payments made on operating leases — used for property and equipment in asset-heavy industries — must for the first time be reported as a liability on balance sheets. In September, FTSE 100 construction rental business Ashstead reported a huge jump of £1.4 billion ($1.8 million) in its net debt to £5.2 billion ($6.8 million) in the second quarter, well over half of which directly resulted from the accounting switch.
"The one we are coming across more and more is IFRS 9 on the impairment of intercompany loans," Leavy cautions. "There may be a requirement to calculate potential credit losses and include that as a repairment charge on intercompany debt. So suddenly there can be a movement on the P&L as the result of an accounting amendment, and intercompany lending is a bread-and-butter issue for every large corporation with an international footprint."
Another consideration for global businesses is the finance function's strategy of cash pooling, whereby the debit and credit balances of numerous subsidiaries' accounts are aggregated, allowing them to centralize group liquidity management. This can improve the interest terms they are offered when they raise finance and optimize cash flow within the group.
Certain jurisdictions, however, place restrictions on the strategy. "Not-ional cash pooling," a virtual rather than physical concentration of cash, is prohibited in Argentina, Brazil, Chile, India, Mexico, Sweden, Turkey, and Venezuela, in favor of physical pooling. India has even stricter rules that forbid cross-border physical pooling. Internal audit departments working across geographically diverse businesses should bear in mind the complications that can arise from subsidiaries that may sit outside of the pool.
"You need to look at those outliers as well as at the big risks," O'Hara says. "Clearly there is a big gross risk in the central treasury function, but each of the outliers could impact the P&L."
A version of this article first appeared in the November 2019 issue of Audit & Risk, the magazine of the Chartered Institute of Internal Auditors. Adapted with permission.