On the money : time to revisit financial risk

A decade of unprecedentedly loose monetary policy designed to reflate the global economy has been a godsend for businesses. Cheap financing has allowed companies to invest in growth and reward shareholders with share buybacks, pushing stock markets to record highs. Recent years have been good to chief executives. Meanwhile, increasingly sophisticated automation and a belief that financial risks were relatively well understood, compared with some emerging audit areas, mean that many internal audit functions have put financial risk on to a back burner. But accommodative financial conditions have also allowed risks to build.

“In advanced economies corporate debt and financial risk-taking have increased, the creditworthiness of borrowers has deteriorated, and so-called leveraged loans to highly indebted borrowers continue to be of particular concern,” Tobias Adrien, financial counsellor of the International Monetary Fund, told an audience in April at the launch of the most recent Global Financial Stability Report.

It is hardly surprising then that financial risk has moved back towards the top of the list of business risks cited by heads of internal audit in the Chartered IIA’s Risk in Focus 2020 report. Nearly a third (30 per cent) of respondents listed it in their top five risks. As news headlines highlight a plethora of concerning indicators⁠– anti-globalist trade policy, weak manufacturing data, the inversion of the yield curve on various government bonds, decelerating global growth and other recessionary signals – boards and audit committees are increasingly likely to seek assurances that financial risk is being effectively mitigated.

Full circle

The management of financial risk on a day-to-day level lies ultimately with the treasury function, which manages the business’s liquidity and monitors cash inflows and outflows, current and projected, to ensure sufficient funds are available to support the company’s operations and excess cash is invested effectively. Although finance is fundamental to the success of the business, it’s useful for auditors to remember that some board members may have blind spots in their knowledge and awareness of the basics, particularly when it comes to the company’s balance sheet.

“Non-finance directors tend to be less familiar with the balance sheet and the cashflow statement than the P&L. By extension, they are typically less comfortable with the balance sheet lexicon, such as the true meaning of assets, liabilities and equity,” warns Steve Giles, a course leader at the Institute of Directors on its Finance for Non-Finance Directors learning programme. “They are aware of concepts such as ‘cash is king’, but do not readily translate this to the importance of managing working capital and the cash cycle in their business.” He adds that the “corporate killer” is rarely a lack of profits, but the business’s inability to pay debts as and when they fall due.

This is why internal auditors in many sectors may now be urging boards to think seriously about market conditions and financial risks. In times of growth, when markets are calm, auditors conducting routine treasury audits should watch for signs that the treasury function is becoming complacent or that financial risk management standards are slipping. But when rising trade tensions combine with the highest ever levels of corporate debt, they should scrutinise all aspects of financial risk, as earnings are likely to be under pressure.

“Trade wars are bad for everybody. Their ultimate impact is a movement towards lower earnings,” says Pat Leavy, chief executive at FTI Treasury, a treasury outsourcing and audit firm. “This combined with the presence of leverage obviously increases risk, but, from an audit perspective, when we’re looking at individual companies we need to understand the data we see. Gross corporate debt is up, but the part of the equation we need to look at is net corporate debt. If corporations have high debt but also high levels of cash and liquid assets – the airline industry is a good example – then the risk is lower. So the focus should be on debt repayment capability, rather than profits and EBITDA alone. What we’re really looking at is cash generation.”

What does good look like?

So, what does a good treasury look like and what should internal auditors consider in their audit of the function? Leavy likens the quality of a treasury to Maslow’s hierarchy of motivation. At the bottom of the pyramid is the quality of the infrastructure in place to manage the function: the resources and people, the competency of those people and the quality of the technology infrastructure, including any automation, and the commitment to the processes that are in place. The next level up is the control environment, the segregation of duties, the checks and balances, the flow of information and compliance with those safety measures.

“As you move up the pyramid it becomes more subjective. Success at the next level depends on getting the right balance between developing strategy and managing the operations. Very often you see that ten per cent of time is spent on the strategy and 90 per cent of time is spent on managing the operations and getting the day-to-day work done, managing operational change and so on,” Leavy says. “In reality, getting the treasury strategy right can have a much more significant impact on the business.”

Treasuries often operate in isolation from the business and can be reactive. Ideally, they should be proactive and able to anticipate and be part of the corporate decision-making process. In this kind of treasury function, the group treasurer moves up the value chain, working directly with the chief financial officer and risk committee to help define and achieve the corporate strategy. 

Similarly, Leavy adds, treasury audits tend to focus on these lower (although essential) rungs – operations controls and governance – and less on the treasury’s strategy and how it enables the overarching corporate strategy.

His points are echoed by Angela O’Hara. She spent five years as group assurance and risk director at a FTSE 100 chemicals and technology company, before recently stepping into a director role. She also sits on the finance and general purposes committee of the Royal Veterinary College. She says that limited resources meant that the treasury audit she oversaw was outsourced and focused almost entirely on the basics.

“That audit looked at processes and governance, but not at the impact of the financial risks in the business and the treasury’s role in relation to those risks. So it assessed whether the treasury was managing bank accounts well, whether the business’s credit rating and funding arrangements were regularly reviewed, access rights for critical systems, the payments and processing platform and forex dealing. But it didn’t look at, for example, whether there had been a forex gain or loss, what led to that and whether there should be changes to the roles and responsibilities associated with that.”

She adds that it is common for internal audit, regardless of the audit target, to assess how a function is set up, but that there is additional value to add in assessing that function’s effectiveness and what it means for the business. Reviewing structure, governance, policies, procedures and key controls is fundamental but, building upon that, internal audit needs to challenge the function and its assumptions, even if it is not an expert on forex hedging or financing strategies. 

“It’s not a case of suggesting that what the treasury is doing is incorrect, but of raising questions that need to be considered in a rational and objective manner,” Leavy adds. “And also of considering alternative approaches that might be more suitable and being open to that dialogue.”

Alistair Smith, UK internal audit, risk and control director at EDF, says that the transactional and frequent nature of treasury activities makes them suitable for automation. However, in organisations using this kind of technology, internal audit should consider how key person risks and the segregation of duties are managed. Another key risk, especially in long-established treasury teams, is over-familiarity with the business, which can lead to “passive checking” of approvals for things like setting up new bank accounts. The best treasuries will also be able to provide metrics to demonstrate how they add value, whether through forex hedging strategy or by optimising financing.

Standard deviation

We may not be able to predict whether the UK economy will go into recession, but there are more mundane matters that can and should be well understood and managed. Changes to IFRS accounting standards, for example, can catch treasuries off guard.

IFRS 15, which came into effect in January 2018, requires that businesses recognise revenues only when they are collected and not when customer contracts are signed, a change that has affected the top lines of high-profile companies. IFRS 16, which went live in January this year, has also caused some turbulence. The new standard requires that payments made on operating leases, used for property and equipment in asset-heavy industries, must for the first time be reported as a liability on balance sheets. In September, FTSE 100 construction rental business Ashstead reported a huge jump of £1.4bn in its net debt to £5.2bn in the second quarter, well over half of which was the direct result of the accounting switch. 

“The one we are coming across more and more is IFRS 9 on the impairment of intercompany loans,” cautions Leavy. “There may be a requirement to calculate potential credit losses and include that as a repairment charge on intercompany debt. So suddenly there can be a movement on the P&L as the result of an accounting amendment, and intercompany lending is a bread and butter issue for every large corporation with an international footprint.”

Another consideration for global businesses is the treasury strategy of cash pooling, whereby the debit and credit balances of numerous subsidiaries’ accounts are aggregated, allowing them to centralise group liquidity management. This can improve the interest terms they are offered when they raise finance and optimise cash flow within the group.

Certain jurisdictions, however, place restrictions on the strategy. So-called “notional cash pooling”, a virtual rather than physical concentration of cash, is prohibited in Argentina, Brazil, Chile, India, Mexico, Sweden, Turkey and Venezuela in favour of physical pooling, while India has even stricter rules, forbidding cross-border physical pooling. Internal audit teams working across geographically diverse businesses should bear in mind the complications that can arise from subsidiaries that may sit outside of the pool.

“You need to look at those outliers as well as at the big risks,” says O’Hara. “Clearly there is a big gross risk in the central treasury function, but each of the outliers could impact the P&L.”

The Chartered IIA runs a course on Auditing the Treasury Function and online training on Accounting and Finance Risks and Controls and an Introduction to Accounting Ratios. Visit iia.org.uk/training-and-events for details and to book a place.

This article was first published in November 2019.