EFFECTIVE INTERNAL AUDITING & INTERNAL CONTROLS FOR GOOD CORPORATE GOVERNANCE

1. EFFECTIVE INTERNAL AUDITING & INTERNAL CONTROLSFOR GOOD CORPORATE GOVERNANCE Presenter Claire Gomez Miller CIA CRMA FCCA Chief Audit Executive The National Gas Company of Trinidad & Tobago Limited

2. AGENDA –EFFECTIVE INTERNAL AUDITING AND INTERNAL CONTROLSFOR GOOD CORPORATE GOVERNANCE • Overview & Global Definitions of Corporate Governance • Internal Auditing – 100% Focus on Controls, Risk & Governance • Standards for Effective Internal Auditing & Controls - Institute of Internal Auditors & COSO • Responsibilities of Board of Directors, Board Audit Committee, Management & Internal Auditors for Effective Control of Risks • Examples of Governance Risks that must be controlled for Good Governance • Effective Internal Auditing & Controls for Good Corporate Governance – Factors that make an Internal Audit Function Ineffective • Internal Audit Independence • Pillars of Good Corporate Governance - Working Together for Strong Governance CGM

3. SHARE HOLDER COMPANY LAW BOARD OF DIRECTORS BOARD AUDIT COMMITTEE INTERNAL AUDIT EXTERNAL AUDITORS Company Secretary & Corporate Secretariat FUNCTIONAL BOARD OPERATIONS COMMITTEE BOARD FINANCE COMMITTEE BOARD HUMAN RESOURCE COMMITTEE BOARD TENDERS COMMITTEE CORPORATE MANAGEMENT CEO/PRESIDENT & EMT CONTRACTS: SHAREHOLDERS; EMPLOYEES; SUPPLIERS; CUSTOMERS; CREDITORS. T&T CITIZENS NATIONAL LAWS & REGULATIONS GLOBAL REGULATIONS CGM

4. GLOBAL DEFINITIONS OF CORPORATE GOVERNANCE • Corporate or Organizational Governance • Common elements present in most definitions of Corporate Governance describe it as “the policies, processes, and structures used by organizations to direct and control its activities, achieve its objectives, and protect the interests of its diverse stakeholder groups in a manner consistent with appropriate ethical standards.” • The INSTITUTE OF INTERNAL AUDITORS defines Corporate Governance as“The combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives.” CGM

5. GLOBAL DEFINITIONS OF CORPORATE GOVERNANCE BELGIUM: "Corporate governance" refers to the set of rules applicable to the management and control of a company. It is the duty of the board of directors to manage the company's affairs exclusively in the interests of the company and all its shareholders, within the framework of the laws, regulations, and conventions under which the company operates.” {Belgium Commission on Corporate Governance, Corporate Governance for Belgium Listed Companies, December 1998} CGM

6. GLOBAL DEFINITIONS OF CORPORATE GOVERNANCE AUSTRALIA: “Corporate governance is the system by which companies are directed and managed. It influences how the objectives of the company are set and achieved, how risk is monitored and assessed, and how performance is optimized.” {The Australian Stock Exchange Corporate Governance Council, Principles of Good Corporate Governance and Best Practice Recommendations, March 2003} CGM

7. GLOBAL DEFINITIONS OF CORPORATE GOVERNANCE CANADA: "Corporate governance" means the process and structures used to direct and manage the business and affairs of the corporation with the objective of enhancing shareholder value, which includes ensuring the financial viability of the business. The process and structure define the division of power and establish mechanisms for achieving accountability among shareholders, the board of directors and management. The direction and management of the business should take into account the impact on other stakeholders such as employees, customers, suppliers, and communities.” {Canada’s Toronto Stock Exchange Committee on Corporate Governance, Dey Report, December 1994} CGM

8. 1.1e)GLOBAL DEFINITIONS OF CORPORATE GOVERNANCE JAPAN: “The nature of supervision by a present-day board of directors, having independent directors at the heart of its activities, is the undertaking of appropriate monitoring from the aspect of fulfilling the duties entrusted to them, while motivating the executive managers and employees with an appropriate compensation system in order to encourage independence. The balancing of this supervision (from the standpoint of the shareholders) with management (the administration of the company business) is called governance. Governance, which is the primary role of the independent director, is to ensure the introduction and correct functioning of the internal audit and compensation systems. Corporate governance is a scheme for ensuring that the executive managers, who have been placed in charge of the company, fulfill their duties.” {Japan Corporate Governance Committee, Corporate Governance Forum of Japan, Revised Corporate Governance Principles, revised October 2001.} CGM

9. GLOBAL DEFINITIONS OF CORPORATE GOVERNANCE UNITED KINGDOM: “Corporate governance is the system by which companies are directed and controlled. Boards of directors are responsible for the governance of their companies. The shareholders' role in governance is to appoint the directors and the auditors and to satisfy themselves that an appropriate governance structure is in place. The responsibilities of the board include setting the company's strategic aims, providing the leadership to put them into effect, supervising the management of the business, and reporting to the shareholders on their stewardship. The board's actions are subject to laws, regulations, and the shareholders in general meeting.” {United Kingdom - Report of the Committee on the Financial Aspects of Corporate Governance (Cadbury committee), December 1992.} CGM

10. SHARE HOLDER COMPANY LAW BOARD OF DIRECTORS BOARD AUDIT COMMITTEE INTERNAL AUDIT EXTERNAL AUDITORS Company Secretary & Corporate Secretariat FUNCTIONAL BOARD OPERATIONS COMMITTEE BOARD FINANCE COMMITTEE BOARD HUMAN RESOURCE COMMITTEE BOARD TENDERS COMMITTEE CORPORATE MANAGEMENT CEO/PRESIDENT & EMT CONTRACTS: SHAREHOLDERS; EMPLOYEES; SUPPLIERS; CUSTOMERS; CREDITORS. T&T CITIZENS NATIONAL LAWS & REGULATIONS GLOBAL REGULATIONS CGM

11. INTERNAL AUDITING: 100% FOCUS ON CONTROLS, RISK & GOVERNANCE “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” CGM

12. The Standards – Mandatory Element UnderInternational Professional Practices Framework International Standards for the Professional Practice of Internal Auditing Mandatory Non mandatory Strongly recommended IPPF = https://global.theiia.org/standards-guidance/Pages/Standards-and-Guidance-IPPF.aspx Institute of Internal Auditors INC CGM

13. COSOINTERNAL CONTROL-INTEGRATED FRAMEWORK • COSO Internal Control-Integrated Framework guides the work of Internal Auditor when evaluating an organization’s internal control system. • Originally formed in 1985, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a joint initiative of five private sector organizations and is dedicated to providing thought leadership through the development of frameworks and guidance on enterprise risk management (ERM) internal control and fraud deterrence. • COSO’s sponsoring organizations are the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), The Institute of Internal Auditors (IIA), and the Institute of Management Accountants (IMA). www.coso.org. CGM

14. INTERNAL CONTROL Control: Any action taken by management, the board, and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved. Management plans, organizes, and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved. Control Processes: The policies, procedures, and activities that are part of a control framework, designed to ensure that risks are contained within the risk tolerances established by the risk management process. Control Environment: The attitude and actions of Board and Management regarding the significance of control within the organization. It provides the discipline and structure for the achievement of the primary objectives of the system of internal control, and includes elements of: • Integrity and ethical values. • Management’s philosophy and operating style. • Organizational structure. • Assignment of authority and responsibility. • Human resource policies and practices. • Competence of personnel. CGM

15. BOARD OF DIRECTORS & THE EFFECTIVE CONTROL OF RISKS • Risk is defined as anything that prevents the achievement of objectives; therefore to achieve its Objectives, a Company must manage its Risks. BOD must • Ensure Company has effective, ongoing process to Identify, Measure & Proactively Manage & Control Business Risks; • Provide Risk Tolerance Levels that support effective Risk Taking by Management. • Have on its Agenda • a report on High Risk issues that pose potential liability to • Company • Directors • Shareholders • the Management & Control of those risks. CGM

16. EFFECTIVE CONTROLS IN THE MANAGEMENT OF RISKS RISK MANAGEMENT IS CONFORMANCE AND PERFORMANCE. •  Risk Management seeks to balance the required conformance of corporate governanceand healthy risks-taking for performance improvement. •  Managers must avoid the downside of financial & reputational loss whilst managing the upside actions that increases financial performance. Managing the Upside of Risk: • risk is inherent in business; • nature and extent may differ between size and type of organisation • company takes risks in order to pursue opportunities to earn returns for its owners; • striking a balance between risk and return is key to maximizing shareholder wealth. Managing the Downside of Riskrequires a combination of conformance and performance; • Use of Conformance Frameworks • Establishment of Controls CGM

17. BOARD AUDIT COMMITTEE • BOARD AUDIT COMMITTEE is responsible for: • monitoring, overseeing, and evaluating the duties and responsibilities of management, the internal audit activity, and the external auditors as those duties and responsibilities relate to the organization’s processes for controlling its operations and managing its risks. • determining that all major issues reported by the internal auditing department, the external auditor, and other outside advisors have been satisfactorily resolved. • reporting to the full Board all-important matters pertaining to the organization’s controlling and risk management processes. CGM

18. MANAGEMENT’S RESPONSIBILITY • Controlling & risk management are functions of management and are integral parts of the overall process of managing operations. • As such, it is the responsibility of managers at all levels of the organization to: • Identify and evaluate the exposures to loss which relate to their particular sphere of operations. • Specify and establish policies, plans, and operating standards, procedures, systems, and other disciplines to be used to minimize, mitigate, and/or limit the risks associated with the exposures identified. • Establish practical controlling processes that require and encourage directors, officers, and employees to carry out their duties and responsibilities in a manner that achieves the five control objectives outlined in the preceding paragraph. • Maintain the effectiveness of the controlling processes they have established and foster continuous improvement to these processes. CGM

19. MANAGEMENT’S RESPONSIBILITY Management is charged with the responsibility for establishing a network of processes with the objective of controlling the operations of the Company in a manner which provides the board of director’s reasonable assurance that: • Data and information published either internally or externally is accurate, reliable, and timely. • The actions of directors, officers, and employees are in compliance with the organization’s policies, standards, plans and procedures, and all relevant laws and regulations. • The organization’s resources (including its people, systems, data/information bases, and customer goodwill) are adequately protected. • Resources are acquired economically and employed profitably; quality business processes and continuous improvement are emphasized. • The organization’s plans, programs, goals, and objectives are achieved. CGM

20. NTERNAL AUDITORS & EFFECTIVE CONTROLS IIA STANDARD 2100 – Nature of Work: Internal Audit must evaluate and contribute to the improvement of Governance, Risk Management, and Controlprocesses using a systematic and disciplined approach. IIA STANDARD 2110 – Governance: IA must assess and make appropriate recommendations for improving the governance process in its accomplishment of the following objectives: • Promoting appropriate ethics and values within the organization; • Ensuring effective organizational performance management and accountability; • Communicating risk and control information to appropriate areas of the organization; and • Coordinating the activities of and communicating information among the board, external and internal auditors, and management. CGM

21. INTERNAL AUDITORS IIA STANDARD 2110 – Governance 2) Must evaluate the design, implementation, and effectiveness of the organization’s ethics-related objectives, programs, and activities. 3) Must assess whether the information technology governance of the organization sustains and supports the organization’s strategies and objectives. 4) Consulting engagement objectives must be consistent with the overall values and goals of the organization. CGM

22. IIA STANDARD: 2130 – CONTROL 1) Internal Audit must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement. • Must evaluate the adequacy and effectiveness of controls in responding to risks within the organization’s governance, operations, and information systems regarding the: • Achievement of the organization’s strategic objectives • Reliability and integrity of financial & operational information; • Effectiveness and efficiency of operations; • Safeguarding of assets; and • Compliance with laws, regulations, and contracts. CGM

23. bf…..IIA STANDARD: 2130 – CONTROL 3) Should ascertain the extent to which operating and program goals and objectives have been established and conform to those of the organization. 4) Should review operations and programs to ascertain the extent to which results are consistent with established goals and objectives to determine whether operations and programs are being implemented or performed as intended. CGM

24. IIA STANDARD 2010 - PLANNING The chief audit executive must establish a risk-based plans to determine the priorities of the internal audit activity, consistent with the organization’s goals.Interpretation:The chief audit executive is responsible for developing a risk-based plan. The chief audit executive takes into account the organization’s risk management framework, including using risk appetite levels set by management for the different activities or parts of the organization. If a framework does not exist, the chief audit executive uses his/her own judgment of risks after consideration of input from senior management and the board. The chief audit executive must review and adjust the plan, as necessary, in response to changes in the organization’s business, risks, operations, programs, systems, and controls. CGM 24

25. Examples of Governance Risks that must be controlled for Good Governance CGM

26. EFFECTIVE INTERNAL AUDITING & CONTROLS FOR GOOD CORPORATE GOVERNANCE • Comes from within the Board of Directors, Board Audit Committee , Executive Management and theInternal Audit Function. • Factors that make an Internal Audit Function ineffective: • Insufficient focus on Areas of High Risk & Strategic Priorities • Lack of adequate resource & compensation • Limitation of Scope • Communication Barriers between Internal Audit and BAC, Board and Senior Management • Lack of Proficiency and Care in conduct of duties – BAC or IA • Non compliance with Professional/Regulatory Standards for the practice of Internal Auditing &Corporate Governance • Conflict of Interest • Lack of independence, objectivity, integrity - Board Audit Committee or Internal Audit. CGM

27. INTERNAL AUDIT INDEPENDENCE • IIA Standard 1110 - Organizational Independence • The chief audit executive must report to a level within the organization that allows the internal audit activity to fulfill its responsibilities. • The chief audit executive must confirm to the board, at least annually, the organizational independence of the internal audit activity. • Interpretation: Organizational independence is effectively achieved when the chief audit executive reports functionally to the board. CGM

28. INTERNAL AUDIT INDEPENDENCE • Examples of functional reporting to the board involve the board: • Approving the internal audit charter; • Approving the risk based internal audit plan; • Approving the internal audit budget and resource plan; • Receiving communications from the chief audit executive on the internal audit activity’s performance relative to its plan and other matters; • Approving decisions regarding the appointment and removal of the chief audit executive; • Approving the remuneration of the chief audit executive; and • Making appropriate inquiries of management and the chief audit executive to determine whether there are inappropriate scope or resource limitations. CGM

29. All PILLARS OF GOVERNANCE MUST BE OF SINGULAR MIND IN INTEGRITY, PROFICIENCY& PROFESSIONALISM FOR GOOD CORPORATE GOVERNANCE, EFFECTIVE INTERNAL AUDITING AND CONTROLS:- The Board of Directors, Board Audit Committee, Chief Executive Officer, Company Secretary, External Auditor & the Chief Audit Executive/Internal Audit. CGM

30. CGM