Internal audit: filling the board's assurance gap: how can directors get assurance on the information they receive from management?

• Author: Marks, Norman

Directors have received excellent, new guidance on improving corporate governance and the effectiveness of boards. For example the National Association of Corporate Directors (NACD) published their "Key Agreed Principles to Strengthen Corporate Governance for U.S. Publicly Traded Companies" and related White Paper series, and The Committee of Sponsoring Organizations of the Treadway Commission (COSO) issued "Enterprise Risk Management, The Role of the Board of Directors" and "Strengthening Enterprise Risk Management for Strategic Advantage."

[ILLUSTRATION OMITTED]

While there is apparent agreement that more should be expected of boards and their members, how can directors meet these expectations when they have only so much time to allocate to board meetings and related materials?

Directors can meet with executives and operating management, look them in the eye, and ask penetrating questions. They can demonstrate professional and appropriate skepticism, and challenge the answers they receive on operational, legal, ethical, and common sense points of view. But is this enough for directors to be comfortable that the oversight they are providing is effective and defensible?

Consider the results of KPMG's "2009 Public Company Audit Committee Survey." Directors were asked: "How concerned are you that your board's ability to provide effective oversight is hampered by the quality, timeliness, and credibility of the information it receives?" 42% were 'somewhat concerned' and 33% were either 'concerned' or 'very concerned'.

When it comes to boards' ability to provide oversight of risk management, similar results were obtained in two studies by PricewaterhouseCoopers (PwC). In 2009, a PwC partner reported that: "We recently surveyed global CEOs, and 92% of them said risk information was either important or critical to their business's success. By contrast, only 23% felt they had adequate information to address those risks. If that is the gap at the CEO level, then the gap at the board level is probably even wider."

Audit committees have help when it comes to oversight of the financial statement process. In addition to a formal management certification, the external auditors review not only the statements themselves, but (for larger U.S. companies) the controls over the financial reporting process.

But how can directors get assurance on the information they receive from management, on which they base their monitoring of corporate operating and...