Corporate Governance - How we've got where we are and what's next
Author:
Niall O'Shea
It is probably only a slight exaggeration to say that we have had a new corporate governance code after each series of major corporate scandals over the last fifteen or so years. This article considers why the current corporate governance requirements arose and where the trends in governance codes are going.
While the term ‘corporate governance’ was rarely encountered before the late 1980s, the underlying problem of the separation of ownership and control in public companies had been recognised long before this by Adam Smith in 1776. He warned that the directors of … [public] companies, … being the managers of other people's money [rather] than of their own, … cannot … be expected [to] …watch over it with the same anxious vigilance [as owners] … watch over their own… Negligence and profusion, therefore, must always prevail, more or less, in the management of the affairs of such a company. 1
The so-called principal-agent problem - that of better aligning the interests of agents (i.e. directors and senior management) with those of their principals (i.e. shareholders) - is a central concern of what today is called ‘corporate governance’.
CORPORATE FAILURE AND UNREST
There have been a number of spectacular corporate failures in the relatively recent past. WorldCom's acquisition of Intermedia Communications in 2000 for US$6bn is widely cited as an example. This deal was approved by the WorldCom board despite the fact that:
4WorldCom had spent no more than 90 minutes looking over the books of Intermedia;
4no board member received any documents or analysis to support the transaction; and
4some directors received less than two hours notice for the 35 minute conference call to approve the offer.
A director subsequently said of the acquisition that ‘this was one big boo-boo’ while another said ‘we paid US$6 billion and got nothing in return’. 2 , 3
WorldCom was not on its own. The USA also had Enron, Tyco, Conseco and Adelphia, to name but a few corporate scandals, Europe had Skandia, Parmalat and Swissair, while Japan had scandals at Mitsubishi Motors and Seibu Railway.4 Moving closer to home, in the early 1990s alone, the UK had BCCI, Guinness, Polly Peck and Maxwell, as well as controversy over directors pay. Ireland has also had its own issues.
SO, WHAT IS ‘CORPORATE GOVERNANCE’?
According to the OECD, ‘corporate governance involves a set of relationships between a company's management, its board, its shareholders and other stakeholders… [It] also provides the structure through which the objectives of the company are set, and the means of attaining those objectives and monitoring performance are determined’. 5
Since the early 1990s, as a direct result of the extent and frequency of the corporate scandals occurring, there has been a plethora of reports issued on corporate governance in each continent, with separate corporate governance type reports / codes currently in issue in more than
50 countries.6
Sir Adrian Cadbury, Chairman of the Committee on the Financial Aspects of Corporate Governance, remarked that during the 1990s, corporate governance ‘moved from an arcane technical term to figuring on the agenda of the G8 summit’.7
WHAT GUIDANCE
IS AVAILABLE?
Irish / UK listed companies
Irish / UK listed companies have been provided with guidance on corporate governance in the reports by Cadbury (1992), Rutteman (1994), Greenbury (1995), Combined Code (1998), Turnbull (1999), Smith (2003) and Higgs (2003), together with the revised Combined Code (2003) and the revised Turnbull Guidance (2005).
The 2003 Combined Code, the code against which Irish/UK companies are currently required to ‘benchmark’ their corporate governance, was derived from the 1998 Combined Code, the Smith report (on audit committees) and the Higgs report (on non-executive directors).
In general, as each code issued, the requirements have become more prescriptive/stringent. For example, while the Cadbury report recommended that the roles of chairman and chief executive be separated, the Combined Code went further to require that the chief executive should not go on to become chairman of the same company.
While the Combined Code has been appended to the Stock Exchange's Listing Rules, it does do not form part of the Listing Rules themselves. Consequently, it is not a requirement for a listed company to comply with the provisions of the Combined Code. Listed companies are only required to:
a) state how the company has applied the principles set out in the Combined Code; and
b) state whether or not the company has complied with the provisions set out in the Code, giving reasons for any non-compliance.
This is referred to as a ‘comply or explain’ philosophy.
A recent survey by the Association of British Insurers (ABI) found that only 46% of FTSE 100 companies state that they are fully compliant with the revised Combined Code.8 However, there was a high level of compliance in specific areas of the Code, such as 96% for the appointment of a senior independent director.
Irish State bodies
Listed companies are not the only entities to have been subject to governance codes. The Code of Practice for the Governance of State Bodies, issued in 2001, sets out the corporate governance principles that the Irish government expects its State bodies to adopt. The Code of Practice has many features in common with the Combined Code. Although compliance with the Code of Practice is mandatory, a State body may obtain Ministerial approval to exempt it from certain provisions of the Code of Practice.
A number of State bodies, such as RTÉ and ESB, have indicated they support the principles and provisions of the Combined Code. In addition to complying with the requirements of the Code of Practice, they have voluntarily sought to comply with the provisions of the Combined Code that are relevant to them.
(In the UK, corporate governance guidance is available to public service organisations in The Good Governance Standard for Public Services9, although, in contrast to the Irish Code of Practice, compliance with the standard is more recommended than required).
Charities
Good Governance : A Code for the Voluntary and Community Sector, issued in 2005, sets out the key principles of good governance for the voluntary sector in the UK and is likely to be seen as best practice for Irish charities. Even though this code only issued in June 2005, a number of entities in the sector had adopted many of the principles of good governance prior to its issue. For example, during 2004, Concern had a separate chairman and chief executive, an internal audit function and an audit and finance committee. In addition, its Council (i.e. its board) had identified the major risks affecting Concern's work and ranked their likelihood and impact and satisfied itself that reasonable steps were being taken to mitigate against these risk exposures.10
Private companies
The corporate governance codes issued to date have focussed on listed companies and public interest entities, such as State bodies and charities. While private companies have not been the primary target of the codes, they have been encouraged to comply with the various provisions therein. The Cadbury report noted, for example, that while it was directed at listed companies, it encouraged as many other companies as possible to aim at meeting its requirements.
While the extent of private companies adopting Cadbury or subsequent corporate governance codes has not been surveyed in detail, the general perception is that voluntary adoption of the Cadbury or subsequent corporate governance codes to the full extent by private companies is, at best, rare (although some, for example, have an audit committee).
In practice, the ‘corporate governance disclosures’ of most private companies is limited to a number of disclosures required by the Companies Acts, such as:
4a very brief review of the business during the year;
4disclosure of total directors remuneration, split between fees, other emoluments and pensions; and
4disclosure of directors’ share interests.
Things are changing however. The Companies (Auditing & Accounting) Act, 2003 has introduced a number of corporate governance requirements for PLCs and large private companies. These are discussed further below.
THE CODES SAY ...
There are a number of common features in many of the current corporate governance codes. For example, most require, either explicitly or implicitly:
4a strong, involved board of directors;
4a balance of executive and non-executive directors, including independent non-executive directors;
4clear division of responsibilities between the chairman and chief executive;
4timely, quality information for the board;
4formal, transparent procedures for the appointment of new directors;
4balanced and understandable financial reporting; and
4maintenance of a sound system of internal control.
Is the US any different?
The US has also had a number of corporate governance reports / codes, with much of the content similar to the requirements in Ireland and the UK.
For example, similar to the position in Ireland and the UK for listed companies, the corporate governance rules for companies listed on the New York Stock Exchange require that:
4listed companies must have a majority of independent directors (i.e. directors without a material relationship with the company);
4listed companies must have nomination, remuneration and audit committees, which are composed entirely of independent directors; and
4listed companies must have an internal audit function.
However, the NYSE corporate governance rules also have some requirements that are additional to those in Ireland and the UK, including that:
4the non-executive directors must meet at regularly scheduled sessions without executive management present;
4listed companies must have a corporate governance committee to develop and recommend to the board a set of corporate governance principles applicable to the corporation; and
4the audit committee should set clear hiring policies for employees or former employees of the corporation's external auditors.
Under the NYSE rules, the company's chief executive is require to certify to the Stock Exchange each year that he/she is not aware of any violation by the company of the corporate governance rules, which is in contrast to the position in Ireland/UK, where we have a ‘comply or explain’ philosophy. Put another way, the US has rules, whereas in Ireland/UK, we have principles.
Of all of the US requirements, the 2002 Sarbanes-Oxley Act (SOx) has been the most topical and controversial.
One of the architects of the legislation, Michael Oxley, has said that some of the reforms were ‘excessive’ and could have been introduced more ‘responsibly’. He told a London conference that the legislation ‘was not a perfect document’ because it had been rushed through in the ‘hothouse atmosphere’ following the collapse of WorldCom.11
Section 404 of SOx requires:
a) management to assess whether or not the internal control over financial reporting is effective;
b) the company's auditor to evaluate and report on the fairness of management's assessment;
c) both management's assessment and the related auditors report to be included in the company's annual report filed with the SEC. Furthermore, the SEC has strongly encouraged registrants to include the internal control reports in annual reports to shareholders as well.
In practice, a) and b) above require a significant amount of documentation and testing by the company and further testing by the company's external auditors. Representatives from the big four accounting firms at an SEC roundtable to discuss SOx said the 90 clients they collectively surveyed put the cost at nearly $8m (€6.2m) on average.12 American Stock Exchange chief, Neal Wolkoff, said that ‘the effect on some businesses is overwhelming with audit fees trebling or even quadrupling’.13
As a result of the costs incurred in complying with SOx section 404, a number of non-US SEC registrants with London and European prime listings have already de-listed, or are seeking to de-list, from the US market.14
There are two significant differences between the US (SOx) and Irish / UK (Turnbull) approaches to reviewing the effectiveness of internal control systems.
Firstly, SOx covers only financial controls while Turnbull covers all controls including those of an operational and compliance nature in addition to internal financial controls.
Secondly, while SOx requires a public statement that controls are effective, Turnbull does not, only requiring companies to disclose that they have conducted the effectiveness review.
What about other countries?
The position in other countries, particularly in the more developed economies, is broadly similar.
There are corporate governance codes currently in issue in, for example, Australia, Belgium, Brazil, Canada, China, Denmark, Finland, France, Germany, Greece, Hong Kong, India, Italy, Japan, Russia, Singapore and South Africa, to name but a few countries.
THE CODES: HAVE THEY MADE A DIFFERENCE?
Taking audit committees as an example, many of the larger listed Irish companies and State bodies had appointed audit committees prior to the Cadbury report -organisations such as AIB, Bank of Ireland, CRH, ESB and RTÉ. However, subsequent to issue of the various corporate governance codes, companies have begun expanding the extent of their corporate governance disclosures, disclosing, for example, which directors are considered independent of the company, who is the senior independent director etc.
Looking at the current corporate governance practices of AIB, Bank of Ireland, and CRH (the three largest listed Irish companies ) together with those of ESB and RTÉ, the author's employer, each currently has:
4a separate chairman and chief executive;
4a chairman who is not a previous chief executive of the company;
4more non-executive than executive directors;
4an audit committee of independent, non-executive directors, which includes at least one director with recent, relevant financial experience ;
4an internal audit function; and
4a statement in the annual report confirming that the directors have reviewed the effectiveness of the system of internal control.
Consequently, it is reasonable to conclude that the codes have improved Irish corporate governance practices, at least superficially.
Moving across the water, again looking at audit committees, only approximately two-thirds of the top 100 UK listed companies had audit committees in 1992 prior to the issue of the Cadbury report. By June 1995, every FTSE 100 company had an audit committee and only 5 of the mid 250 companies did not have an audit committee .15 While as recently as a decade ago, audit committees were found in only a handful of the largest capital markets, they are now a regular feature in a majority of the world's major economies, including Australia, Canada, Hong Kong, Singapore, Germany and South Africa.16
Despite the ever increasing corporate governance requirements, corporate scandals have continued to occur. For example, in the US, in early October 2005, the former chief executive at Refco, which went public earlier this year, was charged with securities fraud and the company's stock subsequently suspended. Federal prosecutors said that he used several companies to hide roughly $430 million in bad debt, almost three-quarters of the $583 million the company raised in its stock offering.17
Consequently, a number of commentators have raised concerns about deficiencies in the current codes. For example, the Financial Times recently highlighted that ‘the question of how to run a board is not one to which a new chairman will find many quick answers in the corporate governance codes written in the past decade or more. The matter of which directors are needed around the boardroom table is similarly sill one left largely to individual chairmen’.18
Another recently published study 19 identified a number of a number of remaining weaknesses in current corporate governance practices, principally:
4most national corporate governance guidelines propose a ‘one size fits all’ approach;
4there is a lack of strategic direction in much of board practice;
4board selection, appraisal, remuneration and development often lack integration and professionalism; and
4there is often a lack of in-depth know-how in auditing, risk management, communication and evaluation at board level.
WHAT’S NEXT?
Companies (Auditing & Accounting) Act, 2003
The Companies (Auditing & Accounting) Act, 2003 included a number of well publicised corporate governance requirements, including a requirement for:
4PLCs to establish an audit committee;
4large private companies to either establish an audit committee or state in the directors' report within the annual report the reasons why it has decided not to establish an audit committee; and
4an annual compliance statement from directors in the annual report, dealing with the company's compliance with tax law, company law and all other enactments that may materially affect the company's financial statements.
At the time of writing however, neither requirement had yet been ‘commenced’ (i.e. the commencement order required to bring this legislation into force has not yet been signed).
Interestingly, the requirement for an audit committee in the Act made no reference to the qualifications of its members, in contrast to the Combined Code which requires at least one member of the Audit Committee to have recent relevant financial experience.
The requirement for an annual compliance statement has met with particular resistance as directors were somewhat uncomfortable with its broad scope and the absence of a materiality level for obligations under tax and company law. For example, IBEC's Director-General, Turlough O'Sullivan, commented that ‘the compliance statement requirement is excessively demanding on business and if implemented in its current form, would have further seriously undermined our competitiveness with another unnecessary and costly layer of bureaucracy’.20
As a result of widespread resistance to it, An Taoiseach referred to the directors' compliance statement to the Company Law Review Group. While, at the time of writing, the extent of any changes to be made to the Act has not been announced, some reduction in the scope of the compliance statement is envisaged.
Turnbull review group
Following a review of the Turnbull Guidance on internal control, the Financial Reporting Council has produced revised Turnbull Guidance.21 The review group noted that it received little encouragement from investors to recommend SOx 404 style disclosures and accordingly, it endorsed retention of the flexible, principles-based approach of the original guidance. Only limited changes have been made to the original guidance, the primary change being a requirement for Boards to confirm in the annual report that necessary action has been or is being taken to remedy any significant failings or weaknesses identified from their review of the effectiveness of the internal control system. The new guidance will take effect for financial years beginning on or after 1 January 2006.
EU
The European Commission is in the process of revising the fourth and seventh Company Law Directives. There are some concerns that the Turnbull guidance currently applicable to Irish/UK companies could be overtaken by less flexible EU legislation, akin to SOx. However, the current European internal markets commissioner, Charlie McCreevy, expressed the view earlier this year that he was opposed to silly regulation ‘which overloads business with piles of forms and reporting obligations and ties them up in rolls of red tape’.23 This was taken by many as a criticism of SOx type regulation.
Bertrand Collomb, the spokesman for the European Corporate Governance Forum, has said that ‘in the field of corporate governance a principle-based approach in general is the right way to give Member States and companies the flexibility they need’ . (SOx is a rules based approach, whereas the Turnbull approach is an example of principle-based approach). Similarly, Fédération des Experts Comptables Européens
(FEE) has said that it is ‘not convinced about the usefulness of introducing across the EU
published effectiveness conclusions on internal control over financial reporting as required by section 404 of the Sarbanes-Oxley Act’.24
So, in summary, at least in the short term, the corporate governance regime for Irish/UK companies is likely to remain relatively unchanged (ie a principles based system), with the exception of the introduction of the directors' compliance statement.
1 Cited by Jensen, Michael C. and William H. Meckling. "Theory of the Firm: Managerial Behaviour, Agency Costs and Ownership Structure". Journal Of Financial Economics, October 1976
2 Trigaux, Robert. "A $66-million-per-minute-decision". St. Petersburg Times 11 June 2003
3 Moules, Jonathan and Peter Thal Larsen. "Pictures emerge of silence that crippled WorldCom". Financial Times 10 June 2003
4 Lorange, Peter. "Positions of power demand a fine balance". Financial Times 19 May 2005
5 Organisation for Economic Co-operation and Development. OECD Principles of Corporate Governance, 2004, pp. 11
6 "Index of codes" www.ecgi.org/codes/ all_codes.php
7 Chambers, Andrew. Corporate Governance Handbook. Tolleys. 2002. p50
8 Association of British Insurers, News Release, 12 October 2005
9 The Independent Commission for Good Governance in Public Services The Good Governance Standard for Public Services, January 2005
10 Concern Annual Report. 2004, p 68
11 Tucker, Sundeep and Andrew Parker. "Sarbanes-Oxley reforms 'go too far', says author" Financial Times. 8 July 2005
12 McAuley, Tony. "Control freaks". CFO Europe. May 2005
13 Liz Fisher, Bob Reynolds and Alice Nixon. "Ebbers' legacy". Accountancy Magazine. September 2005. Page 28
14 Bush, Tim. Divided by common language, ICAEW. June 2005, p 5
15 Chambers, Andrew. The Corporate Governance Handbook Tolleys. 2002, pp 561-562
16 PricewaterhouseCoopers. Audit committees- good practice for meeting market expectations July 2003, p 8
17 "Another one bites the dust" New York Times, 16 October 2005
18 Edgecliffe-Johnson, Andrew. "A bid to get everyone on board" Financial Times, 27 September 2005. p 16
19 Hilb, Martin, "New Corporate Governance: From Good Guidelines to Great Practice". Corporate Governance: An International Review, Vol. 13, No. 5, pp. 569-581, September 2005
20 "IBEC welcomes review of Directors' Compliance Statement". Press release 21 April 2005 www.ibec.ie
21 Internal Control: Revised Guidance for Directors on the Combined Code. Financial Reporting Council 13 October 2005
22 McCreevy, Charlie. "Regulation - Right and Wrong" Speech at Dublin Castle, 5 April 2005
23 European Corporate Governance Forum. Press release. 23 June 2005. "Corporate governance : European forum makes progress on common approach to responsible company management"
24 Fédération des Experts Comptables Européens. Press Release 31 March 2005. "Europe's Accountants Urge Robust Debate on Risk Management and Internal Control in EU"
Niall O'Shea is the Head of Internal Audit in RTÉ. The views expressed are personal and not necessarily those of RTÉ.