May 2008 Examinations Strategic Level Paper P3 – Management Accounting – Risk and Control Strategy Question Paper 2 Examiner’s Brief Guide to the Paper 15 Examiner’s Answers 16 The answers published here have been written by the Examiner and should provide a helpful guide for both tutors and students. Published separately on the CIMA website (www.cimaglobal.com/students) from mid-September is a Post Examination Guide for the paper which provides much valuable and complementary material including indicative mark information. © The Chartered Institute of Management Accountants. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recorded or otherwise, without the written permission of the publisher.

Management Accounting Pillar

Strategic Level Paper

P3 – Management Accounting – Risk and Control Strategy

22 May 2008 – Thursday Morning Session Instructions to candidates

You are allowed three hours to answer this question paper.

You are allowed 20 minutes reading time before the examination begins during which you should read the question paper and, if you wish, highlight and/or make notes on the question paper. However, you will not be allowed, under any circumstances, to open the answer book and start writing or use your calculator during the reading time.

You are strongly advised to carefully read ALL the question requirements before attempting the question concerned (that is, all parts and/or sub-questions). The question requirements are contained in a dotted box.

ALL answers must be written in the answer book. Answers or notes written on the question paper will not be submitted for marking.

Answer the ONE compulsory question in Section A on pages 2 to 4. The question requirements are on page 4.

Answer TWO questions only from Section B on pages 5 to 9.

Maths Tables and Formulae are provided on pages 10 to 13.

The list of verbs as published in the syllabus is given for reference on the inside back cover of this question paper.

Write your candidate number, the paper number and examination subject title in the spaces provided on the front of the answer book. Also write your contact ID and name in the space provided in the right hand margin and seal to close.

Tick the appropriate boxes on the front of the answer book to indicate which questions you have answered.

P3 –

Ris

k an

d C

ontr

ol S

trat

egy

© The Chartered Institute of Management Accountants 2008

SECTION A – 50 MARKS [the indicative time for answering this Section is 90 minutes] ANSWER THIS QUESTION. THE QUESTION REQUIREMENTS ARE ON PAGE 4 Question One MFT is a publicly listed company, which operates a chain of 74 restaurants throughout the country. The company has built a reputation for quality dining at affordable prices. The business model operated by MFT is to maximise the number of customers within each restaurant’s seating capacity and to maximise the amount of money spent by each customer on food and alcohol. Restaurant management Each restaurant has a manager. Many of these managers have been with MFT for a long time and are well known to senior management. MFT’s Head Office allows managers considerable autonomy in the management of their restaurants. The restaurant manager decides on the menu for his or her restaurant, orders food and alcohol from Head Office and promotes the restaurant locally. Pricing is the responsibility of each restaurant manager. Price variations depend on location, competition and menu. Each restaurant operates a paper-based, order-taking system. One copy of the order is passed to the kitchen; the other is priced and given to the customer at the end of the meal. About 80% of customers pay their bill by credit card and about 20% pay in cash. The restaurant manager must control costs by balancing staff levels with customer demand. The manager must also minimise food wastage, for example by promoting daily specials. A market research consultancy carries out annual customer satisfaction and brand recognition surveys for each restaurant. Central support MFT’s Head Office is responsible for strategic planning, financial management, and legal and governance issues. It also provides marketing support for each restaurant and purchases all food and alcohol through central purchasing arrangements. Sub-contractors are used to deliver fresh food to each restaurant daily. Alcohol is delivered direct by suppliers. Food and alcohol can be signed for by any employee when the deliveries are made to restaurants. Alcohol is stored in a locked storeroom. Financial management MFT exercises strict financial and reporting controls. Each day, restaurant managers must report the value of sales to Head Office and deposit cash receipts to a central bank account. Each week, restaurant managers must report the number of customers served each day and submit an inventory of unsold food and alcohol to Head Office. The cost of food and alcohol is charged to each restaurant. Staff salaries, based on manual time records, are paid by Head Office into employee bank accounts. Incidental expenses are paid by restaurant managers using a corporate credit card. This permits local payments for advertising, menu printing and so on. The rental and utility costs for each restaurant are paid by Head Office. A weekly profit statement showing the performance of the restaurant is sent from Head Office to the restaurant manager. Accompanying the report is a comparison against the budget for that restaurant and the average results for all restaurants. Information received by each restaurant manager includes income, gross and operating profits, seating capacity utilisation and spend

P3 2 May 2008

per customer. MFT defines gross profit as that which is controllable by the restaurant manager, after deducting the cost of food and alcohol, staff salaries and local payments. The non-controllable expenses of rent and utilities and allocated corporate costs are deducted to arrive at operating profit. The restaurant manager is paid a bonus based on the gross profit earned by his or her restaurant. Restaurant profitability The gross profit for MFT as a whole is 35% of sales income, but there is considerable variation between the 74 restaurants. The performance of 5 to 7 restaurants is of concern. The average sales mix comprises approximately 70% food and 30% alcohol. The gross profit is approximately 30% on food and 50% on alcohol. No restaurant spends more than 1% of sales on local purchases. Audit and Control MFT’s internal auditor designed the management control and reporting system used by the company. The internal auditor takes a systems approach to auditing and ensures that the weekly management reporting and end-of-year financial reporting is accurate and on time. MFT has recently received the management letter from its external auditors following the completion of the year-end statutory audit. The auditors have identified a number of risks and have made the following suggestions: 1. There is considerable variation in spend per customer and gross profit margins between

individual restaurants. This may be the result of poor restaurant management and/or malpractice. Internal audit should spend more time on checks on individual restaurants that are under-performing compared to the company average. This would allow improvements to be made by utilising best practice from better-performing restaurants.

2. The manual order-taking process has potential for errors in terms of the kitchen fulfilling an order and in pricing. There is also the possibility that the proceeds of bills paid in cash will not be paid into MFT’s bank account. MFT should consider a computerised order-taking system in all of its restaurants to eliminate errors, mis-pricing and cash losses.

3. Inventory may be taken by staff for personal use. As most of the value of inventory is alcohol, the suggested computerised order-taking system would also provide a perpetual inventory for alcohol, resulting in more physical control and better management information.

4. Employee time records may not be accurate and employees may be claiming for working longer hours than they have actually worked. MFT should consider an automated time recording system whereby employees enter a code when starting and finishing work.

5. The customer satisfaction and brand awareness survey shows considerable customer dissatisfaction and a negative brand perception in a few areas in which MFT has restaurants. Management should identify the causes and rectify this situation.

6. Restaurant managers may use their corporate credit cards improperly, for example to make personal purchases or to purchase local food and alcohol contrary to corporate guidelines. Credit cards could be replaced with a small petty cash float to eliminate this possibility.

7. There is a risk of short-delivery of food and alcohol by sub-contractors and suppliers when any employee can sign for the delivery, as the quantities and condition may not be checked. This can lead to significant stock losses. All deliveries should be checked as to quality and quantity by the restaurant manager.

May 2008 3 P3

Required: (a)

(i) Construct a 2x2 likelihood/consequences matrix according to whether they

are high, medium and low. (4 marks)

(ii) Explain, with examples, an appropriate response for each of the risk

categories. (4 marks)

(iii) Apply the matrix to categorise each of the seven risks identified by MFT’s

auditors and state your reasons. (11 marks)

(Total for Part (a) = 19 marks)

(b) As the sole internal auditor within MFT, write a report recommending to the Audit

Committee which of the external auditor’s suggestions should be adopted and which should be rejected. Give reasons to support your recommendations.

(26 marks including 5 marks for report style)

(c) Explain the ethical issue faced by the internal auditor when responding to the

external auditor’s report. (5 marks)

(Total for Question One = 50 marks)

P3 4 May 2008

SECTION B – 50 MARKS [the indicative time for answering this section is 90 minutes] ANSWER TWO QUESTIONS ONLY Question Two CSX is a distribution company, which buys and sells small electronic components. The company has sales of $200 million per annum on which it achieves a profit of $12 million. Central Warehouse Department The company has a large Central Warehouse Department employing 100 staff over 2 shifts. The warehouse contains 30,000 different components, which are of high value and are readily saleable. Technological change is commonplace and components can become obsolete with little warning. Twice a year, the Purchasing Manager authorises the disposal of obsolete inventory. Inventory control is carried out through a computer system that has been used by the company for the last ten years. Purchasing and receiving Inventory is ordered using manual purchase orders based on tender prices. Goods received into the Central Warehouse are recorded on a manual Goods Received Note which is the source document for computer data entry. Data entry is done by clerical staff employed within the Central Warehouse. Customer orders Orders from customers are entered into the computer by clerical staff in the Sales Department. The computer checks inventory availability and produces a Picking List which is used by Central Warehouse staff to assemble the order. Frequently, there are differences between the computer inventory record and what is physically in the store. The Picking List (showing the actual quantities ready to be delivered) is used by clerical staff to update the computer records in the Central Warehouse. A combined Delivery Note/Invoice is then printed to accompany the goods. Accounting At the end of each financial year, a physical check of inventory is carried out which results in a significant write-off. To allow for these losses, the monthly operating statements to the Board of Directors include a 2% contingency, added to each month’s cost of sales. Internal Audit Department The company’s Internal Audit Department has been asked by the Board to look at the problem of inventory losses. Managers in the Central Warehouse believe that inventory losses are the result of inaccurate data entry, the old and unreliable nature of the computer system and the large number of small inventory items which are easily lost, or which warehouse staff throw away if they are obsolete or damaged.

May 2008 5 P3

Required:

(a) Explain the risks faced by CSX in relation to its inventory control system and recommend specific improvements to the system’s internal controls.

(15 marks)

(b) Recommend (without being specific to the CSX scenario) the tests or techniques, both manual and computerised, that internal auditors can use in assessing the adequacy of inventory controls.

(10 marks)

(Total for Question Two = 25 marks)

Section B continues on the next page

P3 6 May 2008

Question Three LXY is a company, which has a five-year contract to operate buses in and out of the city bus station in Danon, France. The station has 60 bus piers and an average of 90 buses per hour leave Danon for local and national destinations. Services operate between 06.00 and 22.00 daily. All buses are operated solely by the driver, who loads and unloads luggage and checks that all passengers have a valid ticket. LXY only permits travel with a pre-paid ticket. Local buses provide a suburban service to areas within a 20 kilometre radius of Danon. The national services cover distances of up to 500 kilometres and so drivers are frequently required to stay overnight at certain destinations before covering the return service the following day.

Required:

(a) You have recently been appointed Head of Risk and Internal Audit at LXY.

(i) Identify, with a brief justification, three categories which may be used to classify and manage the risks faced by LXY.

(3 marks)

(ii) For ONE of the categories that you have selected in (i) above, identify three possible risks and recommend appropriate tools for their control.

(9 marks)

(Total for Part (a) = 12 marks)

(b) A café owner in Danon has approached LXY with a proposal to provide food and drink facilities on board long-distance bus services.

Identify the additional risks that need to be considered by LXY in the evaluation of the proposal, and how they might be managed.

(4 marks)

(c) Many companies are too small to justify the existence of separate risk management and internal audit functions.

Briefly explain the distinctive roles performed by each of these functions and recommend ways of maintaining their separate effectiveness within a combined department.

(9 marks)

(Total for Question Three = 25 marks)

May 2008 7 P3

Question Four A foreign exchange dealer working in a London-based investment bank wishes to take advantage of arbitrage opportunities in the international money markets. The following data is available relating to interest rates and exchange rates for Australia and the USA:

US$/£ AUS$/£ Spot 2⋅0254 2⋅3180 6 Month Forward 1⋅9971 2⋅3602

The effective six-month Australian dollar interest rate is 3⋅32% and the equivalent US $ rate is 3⋅68%. These rates apply to both borrowing and lending. Assume that in six months’ time the actual exchange rate between sterling and Australian dollars is Aus$ 2⋅32/£. The dealer is authorised to buy or sell up to US$5 million per transaction. The costs for this type of currency trading are charged in sterling at a rate of £3,000 per transaction. Note: Each currency conversion counts as one transaction.

Required:

(a) Calculate the spot and six-month forward cross rates between the Australian and US dollar.

(4 marks)

(b) Explain the meaning of the term “arbitrage profit” and explain why such profits may be available in the scenario outlined above. (No illustrative calculations are required).

(6 marks)

(c) Calculate the profit available to the dealer from exploiting the opportunity shown above, clearly showing all of your calculations.

(10 marks)

(d) Explain the importance of “trading limits” and “value at risk” as tools for managing the risks within a financial trading operation.

(5 marks)

(Total for Question Four = 25 marks)

Section B continues on the next page

P3 8 May 2008

Question Five

(a) With specific reference to risk management:

(i) Define and discuss the role of the Treasury function within an organisation;

and (6 marks)

(ii) Discuss the arguments for and against operating a Treasury function as a

profit centre.

(6 marks)

(Total for Part (a) = 12 marks)

(b) Explain the factors a Board of Directors should consider when deciding what to include in the section entitled ‘’Risk Exposure and Control Systems’’, in their company’s report.

(13 marks)

(Total for Question Five = 25 marks)

End of question paper

Maths Tables and Formulae are on pages 10-13

May 2008 9 P3

P3 10 May 2008

PRESENT VALUE TABLE

Present value of $1, that is ( ) nr −+1 where r = interest rate; n = number of periods until payment or receipt.

Interest rates (r) Periods (n) 1% 2% 3% 4% 5% 6% 7% 8% 9% 10% 1 0.990 0.980 0.971 0.962 0.952 0.943 0.935 0.926 0.917 0.909 2 0.980 0.961 0.943 0.925 0.907 0.890 0.873 0.857 0.842 0.826 3 0.971 0.942 0.915 0.889 0.864 0.840 0.816 0.794 0.772 0.751 4 0.961 0.924 0.888 0.855 0.823 0.792 0.763 0.735 0.708 0.683 5 0.951 0.906 0.863 0.822 0.784 0.747 0.713 0.681 0.650 0.621 6 0.942 0.888 0.837 0.790 0.746 0705 0.666 0.630 0.596 0.564 7 0.933 0.871 0.813 0.760 0.711 0.665 0.623 0.583 0.547 0.513 8 0.923 0.853 0.789 0.731 0.677 0.627 0.582 0.540 0.502 0.467 9 0.914 0.837 0.766 0.703 0.645 0.592 0.544 0.500 0.460 0.424 10 0.905 0.820 0.744 0.676 0.614 0.558 0.508 0.463 0.422 0.386 11 0.896 0.804 0.722 0.650 0.585 0.527 0.475 0.429 0.388 0.350 12 0.887 0.788 0.701 0.625 0.557 0.497 0.444 0.397 0.356 0.319 13 0.879 0.773 0.681 0.601 0.530 0.469 0.415 0.368 0.326 0.290 14 0.870 0.758 0.661 0.577 0.505 0.442 0.388 0.340 0.299 0.263 15 0.861 0.743 0.642 0.555 0.481 0.417 0.362 0.315 0.275 0.239 16 0.853 0.728 0.623 0.534 0.458 0.394 0.339 0.292 0.252 0.218 17 0.844 0.714 0.605 0.513 0.436 0.371 0.317 0.270 0.231 0.198 18 0.836 0.700 0.587 0.494 0.416 0.350 0.296 0.250 0.212 0.180 19 0.828 0.686 0.570 0.475 0.396 0.331 0.277 0.232 0.194 0.164 20 0.820 0.673 0.554 0.456 0.377 0.312 0.258 0.215 0.178 0.149

Interest rates (r) Periods

(n) 11% 12% 13% 14% 15% 16% 17% 18% 19% 20% 1 0.901 0.893 0.885 0.877 0.870 0.862 0.855 0.847 0.840 0.833 2 0.812 0.797 0.783 0.769 0.756 0.743 0.731 0.718 0.706 0.694 3 0.731 0.712 0.693 0.675 0.658 0.641 0.624 0.609 0.593 0.579 4 0.659 0.636 0.613 0.592 0.572 0.552 0.534 0.516 0.499 0.482 5 0.593 0.567 0.543 0.519 0.497 0.476 0.456 0.437 0.419 0.402 6 0.535 0.507 0.480 0.456 0.432 0.410 0.390 0.370 0.352 0.335 7 0.482 0.452 0.425 0.400 0.376 0.354 0.333 0.314 0.296 0.279 8 0.434 0.404 0.376 0.351 0.327 0.305 0.285 0.266 0.249 0.233 9 0.391 0.361 0.333 0.308 0.284 0.263 0.243 0.225 0.209 0.194 10 0.352 0.322 0.295 0.270 0.247 0.227 0.208 0.191 0.176 0.162 11 0.317 0.287 0.261 0.237 0.215 0.195 0.178 0.162 0.148 0.135 12 0.286 0.257 0.231 0.208 0.187 0.168 0.152 0.137 0.124 0.112 13 0.258 0.229 0.204 0.182 0.163 0.145 0.130 0.116 0.104 0.093 14 0.232 0.205 0.181 0.160 0.141 0.125 0.111 0.099 0.088 0.078 15 0.209 0.183 0.160 0.140 0.123 0.108 0.095 0.084 0.079 0.065 16 0.188 0.163 0.141 0.123 0.107 0.093 0.081 0.071 0.062 0.054 17 0.170 0.146 0.125 0.108 0.093 0.080 0.069 0.060 0.052 0.045 18 0.153 0.130 0.111 0.095 0.081 0.069 0.059 0.051 0.044 0.038 19 0.138 0.116 0.098 0.083 0.070 0.060 0.051 0.043 0.037 0.031 20 0.124 0.104 0.087 0.073 0.061 0.051 0.043 0.037 0.031 0.026

May 2008 11 P3

Cumulative present value of $1 per annum, Receivable or Payable at the end of each year for n

years rr n−+− )(11

Interest rates (r) Periods

(n) 1% 2% 3% 4% 5% 6% 7% 8% 9% 10% 1 0.990 0.980 0.971 0.962 0.952 0.943 0.935 0.926 0.917 0.909 2 1.970 1.942 1.913 1.886 1.859 1.833 1.808 1.783 1.759 1.736 3 2.941 2.884 2.829 2.775 2.723 2.673 2.624 2.577 2.531 2.487 4 3.902 3.808 3.717 3.630 3.546 3.465 3.387 3.312 3.240 3.170 5 4.853 4.713 4.580 4.452 4.329 4.212 4.100 3.993 3.890 3.791 6 5.795 5.601 5.417 5.242 5.076 4.917 4.767 4.623 4.486 4.355 7 6.728 6.472 6.230 6.002 5.786 5.582 5.389 5.206 5.033 4.868 8 7.652 7.325 7.020 6.733 6.463 6.210 5.971 5.747 5.535 5.335 9 8.566 8.162 7.786 7.435 7.108 6.802 6.515 6.247 5.995 5.759 10 9.471 8.983 8.530 8.111 7.722 7.360 7.024 6.710 6.418 6.145 11 10.368 9.787 9.253 8.760 8.306 7.887 7.499 7.139 6.805 6.495 12 11.255 10.575 9.954 9.385 8.863 8.384 7.943 7.536 7.161 6.814 13 12.134 11.348 10.635 9.986 9.394 8.853 8.358 7.904 7.487 7.103 14 13.004 12.106 11.296 10.563 9.899 9.295 8.745 8.244 7.786 7.367 15 13.865 12.849 11.938 11.118 10.380 9.712 9.108 8.559 8.061 7.606 16 14.718 13.578 12.561 11.652 10.838 10.106 9.447 8.851 8.313 7.824 17 15.562 14.292 13.166 12.166 11.274 10.477 9.763 9.122 8.544 8.022 18 16.398 14.992 13.754 12.659 11.690 10.828 10.059 9.372 8.756 8.201 19 17.226 15.679 14.324 13.134 12.085 11.158 10.336 9.604 8.950 8.365 20 18.046 16.351 14.878 13.590 12.462 11.470 10.594 9.818 9.129 8.514

Interest rates (r) Periods

(n) 11% 12% 13% 14% 15% 16% 17% 18% 19% 20% 1 0.901 0.893 0.885 0.877 0.870 0.862 0.855 0.847 0.840 0.833 2 1.713 1.690 1.668 1.647 1.626 1.605 1.585 1.566 1.547 1.528 3 2.444 2.402 2.361 2.322 2.283 2.246 2.210 2.174 2.140 2.106 4 3.102 3.037 2.974 2.914 2.855 2.798 2.743 2.690 2.639 2.589 5 3.696 3.605 3.517 3.433 3.352 3.274 3.199 3.127 3.058 2.991 6 4.231 4.111 3.998 3.889 3.784 3.685 3.589 3.498 3.410 3.326 7 4.712 4.564 4.423 4.288 4.160 4.039 3.922 3.812 3.706 3.605 8 5.146 4.968 4.799 4.639 4.487 4.344 4.207 4.078 3.954 3.837 9 5.537 5.328 5.132 4.946 4.772 4.607 4.451 4.303 4.163 4.031 10 5.889 5.650 5.426 5.216 5.019 4.833 4.659 4.494 4.339 4.192 11 6.207 5.938 5.687 5.453 5.234 5.029 4.836 4.656 4.486 4.327 12 6.492 6.194 5.918 5.660 5.421 5.197 4.988 7.793 4.611 4.439 13 6.750 6.424 6.122 5.842 5.583 5.342 5.118 4.910 4.715 4.533 14 6.982 6.628 6.302 6.002 5.724 5.468 5.229 5.008 4.802 4.611 15 7.191 6.811 6.462 6.142 5.847 5.575 5.324 5.092 4.876 4.675 16 7.379 6.974 6.604 6.265 5.954 5.668 5.405 5.162 4.938 4.730 17 7.549 7.120 6.729 6.373 6.047 5.749 5.475 5.222 4.990 4.775 18 7.702 7.250 6.840 6.467 6.128 5.818 5.534 5.273 5.033 4.812 19 7.839 7.366 6.938 6.550 6.198 5.877 5.584 5.316 5.070 4.843 20 7.963 7.469 7.025 6.623 6.259 5.929 5.628 5.353 5.101 4.870

P3 12 May 2008

Formulae Annuity Present value of an annuity of £1 per annum receivable or payable for n years, commencing in one year, discounted at r% per annum:

PV = ⎥⎥⎦

⎤

⎢⎢⎣

⎡

+−

nrr ]1[111

Perpetuity Present value of £1 per annum, payable or receivable in perpetuity, commencing in one year, discounted at r% per annum:

PV = r1

Growing Perpetuity Present value of £1 per annum, receivable or payable, commencing in one year, growing in perpetuity at a constant rate of g% per annum, discounted at r% per annum:

PV = gr −

1

May 2008 13 P3

LIST OF VERBS USED IN THE QUESTION REQUIREMENTS A list of the learning objectives and verbs that appear in the syllabus and in the question requirements for each question in this paper. It is important that you answer the question according to the definition of the verb.

LEARNING OBJECTIVE VERBS USED DEFINITION

1 KNOWLEDGE

What you are expected to know. List Make a list of State Express, fully or clearly, the details of/facts of Define Give the exact meaning of

2 COMPREHENSION What you are expected to understand. Describe Communicate the key features

Distinguish Highlight the differences between Explain Make clear or intelligible/State the meaning of Identify Recognise, establish or select after consideration Illustrate Use an example to describe or explain something

3 APPLICATION How you are expected to apply your knowledge. Apply

Calculate/compute To put to practical use To ascertain or reckon mathematically

Demonstrate To prove with certainty or to exhibit by practical means

Prepare To make or get ready for use Reconcile To make or prove consistent/compatible Solve Find an answer to Tabulate Arrange in a table

4 ANALYSIS How are you expected to analyse the detail of what you have learned.

Analyse Categorise

Examine in detail the structure of Place into a defined class or division

Compare and contrast Show the similarities and/or differences between Construct To build up or compile Discuss To examine in detail by argument Interpret To translate into intelligible or familiar terms Produce To create or bring into existence

5 EVALUATION How are you expected to use your learning to evaluate, make decisions or recommendations.

Advise Evaluate Recommend

To counsel, inform or notify To appraise or assess the value of To advise on a course of action

P3 14 May 2008

The Examiners for Management Accounting – Risk and Control Strategy offer to future candidates and to tutors using this booklet for study purposes, the

following background and guidance on the questions included in this examination paper.

Section A – Compulsory Question One is set in a restaurant chain where auditors have identified various risks and have recommended improvements to overcome internal control weaknesses. The question requires candidates to relate the already identified risks to a likelihood/consequences matrix, and in doing so to make judgements about the severity of risks and the need for the recommended internal controls. Candidates are asked to write a report, for which marks are awarded. There is also an ethical dimension to the scenario as the report candidates are asked to produce is from the perspective of the accountant who designed the existing internal controls. The main syllabus areas covered are B (ii) measuring and assessing risk; B (iv) evaluating risk management strategies; B (vi) the costs and benefits of controls; and the ethical issue is part of syllabus outcome C (vii).

Section B – answer two of four questions Question Two is a distribution scenario with particular problems in relation to inventory control which is carried out using an older computer system. Candidates are asked to identify the relevant risks and to recommend appropriate internal controls consistent with those risks. Candidates are also asked to recommend the kinds of tests that internal auditors could adopt in testing for the adequacy of inventory controls, both in terms of manual systems and in the particular context of an IT system. The syllabus areas covered are A (iv) Evaluate the appropriateness of an organisation’s management accounting control systems and make the recommendations for improvements; B (i) Define and identify risks facing an organisation; C (i) Explain the importance of management review of controls; and C (iii) Produce a plan for the audit of various organisational activities including management, accounting and information systems. The IT elements relate to syllabus areas E (iv) Evaluate and recommend improvements to the control of information systems, and E (v) Evaluate specific problems and opportunities associated with the audit and control of systems which use information technology.

Question Three describes a bus operating company which is exposed to a very broad range of risks. Candidates are asked to select a categorisation system for the management of risks, in addition to identifying relevant tools of control. There is also a requirement to comment upon the respective roles played by risk management and internal audit in a generic context.

The syllabus areas covered are B (i) Define and identify risks facing an organisation; B (ii) Explain ways of measuring and assessing risks facing an organisation, including the organisation’s ability to bear such risks; and B (vii) Discuss the principles of good corporate governance for listed companies, particularly as regards the need for internal controls.

Question Four required an understanding of exchange rate theory and hedging techniques in order to apply that knowledge to identify an arbitrage opportunity. In addition to calculating cross rates, candidates are required to explain the concept of arbitrage, identify the relevant opportunity, and calculate the resulting profit. General comment upon specific risk control tools makes up the remainder of the question.

The syllabus areas covered are D (iii) Evaluate the effects of alternative methods of risk management and make recommendations accordingly; D (iv) Calculate the impact of differential inflation rates on forecast exchange rates and D (v) Explain exchange rate theory.

Question Five combines aspects of Treasury management and financial reporting in one question. The first part requires candidates to define the role of Treasury and understand the issues to be considered in operating it as a profit centre. The second part requires understanding of the issues underlying decisions to report risk information in the annual report.

The syllabus areas covered are B (vi) Evaluate the costs and benefits of a particular internal control system and C (vi) Discuss the principles of good corporate governance for listed companies, for conducting reviews of internal controls and reporting on compliance.

May 2008 15 P3

Strategic Level Paper

P3 – Management Accounting – Risk and Control Strategy

Examiner’s Answers

SECTION A Answer to Question One The answer to Part (a) is on page 19. (b) Report of recommendations on audit suggestions To: MFT Audit Committee From: Internal Auditor Date: 22 May 2008 Subject: Review of External Auditors’ Management Letter Introduction You have asked me to comment on the external auditors’ management letter arising from their audit. The report contained seven suggestions to overcome perceived risks. In the report that follows I will address each of these suggestions. Recommendations Based on my assessment of the risks in the risk matrix and the available risk responses, my recommendations in respect of each of the external auditors’ suggestions follow. Each suggestion includes a consideration of costs and benefits of adopting the recommendation. 1. Variation in customer spend and margins. This is a medium risk. To be a high risk would

require a large number of restaurants to be performing poorly. A portfolio approach is currently adopted by which better and worse performing restaurants balance each other out to minimise the overall risk to MFT. Only 10% of restaurants have poor performance. I propose that the auditors’ suggestion be adopted, and that internal audit allocates time to the under-performing restaurants. However, as I am the sole internal auditor, the audit committee will need to identify additional resources to support me in this role. However, the cost of the additional resources may well be compensated by improved performance from the currently under-performing restaurants.

P3 16 May 2008

2. The manual order-taking process does have limitations. However, as 80% of our customers pay by credit card, there is little opportunity for theft of cash on anything more than a low scale. Consequently, the risk is considered to be a medium one as, although the risk may arise frequently, it has a low impact. In managing the risk of errors, mis-pricing and cash takings, I believe we should rely on our restaurant managers, supported by comparisons between restaurants to identify areas for further investigation. A computerised order-taking process for each of 74 restaurants would be ideal but would incur high set-up and running costs that are unlikely to be justified by the savings.

3. Stock losses are also medium risk and as for the previous recommendation, are unlikely to have a material effect unless taking place on a large scale. A computerised inventory system will be expensive and the time taken to update it with receipts of stock and sales will be onerous. We currently rely on locked storerooms for safe storage of alcohol and our restaurant managers have the responsibility to accurately count and record stock each week. Again, comparisons between restaurants can identify areas for further investigation.

4. Employee time recording is also medium risk and unlikely to have a material effect unless taking place on a large scale. Again, an automated system will be expensive and we should rely on our restaurant managers to control this, especially as they have a motivation to do so for profit sharing purposes.

5. Customer dissatisfaction and poor brand awareness in some areas is a high risk as this could severely impact our reputation on a wider scale and affect achievement of our corporate goals. As a matter of priority we need to understand the circumstances underlying this problem and take corrective action. It would also be useful to correlate the reputational data with the financially under-performing restaurants to determine any correlation. Our market researchers may be able to shed some light on this, otherwise we may have to use mystery shoppers or other means. This is largely a management issue for MFT which will incur investigation costs, but the reputation effect is potentially far more costly to MFT.

6. The use of corporate credit cards is considered low risk. Expenses are monitored each month when payment is made. The introduction of petty cash would incur additional risks, for example theft of cash. We should accept the risk of misuse.

7. Short-delivery of supplies and consequent stock losses are also a medium risk. As we rely on suppliers and subcontractors, it is possible that a lack of checking by busy employees could result in losses. The suggestion for the restaurant manager to sign for all deliveries should be implemented. There is no cost associated with this.

In responding to the audit suggestions, there are two recurring themes:

• The lack of information technology in our restaurants. I believe that management should carry out a cost-benefit study of computerisation of our restaurants, linked to Head Office for improved reporting.

• The reliance on, and trust in, our restaurant managers, many of whom are long-serving employees. There is an opportunity for fraud and collusion here, and a fraud response plan needs to be put in place, together with the development of a control environment that provides a solid foundation for that trust.

Conclusion I believe that the external auditors have raised, in the main, some valid concerns that I have attempted to respond to here. I hope the foregoing report has been helpful and I am willing to present and discuss my recommendations at the next audit committee meeting.

May 2008 17 P3

(c) Ethical issue MFT has a sole internal auditor, the only resource allocated by the company to internal audit. The IA was responsible for designing the management control and reporting system currently in use. The emphasis of the IA has been to ensure the accuracy and timeliness of management reports and financial accounts. There are consequent issues as to the IAs objectivity in making recommendations. The IA has supported the current manual systems which are now being questioned by the external auditors and it may be that the IAs lack of objectivity prevents him/her from seeing the value of a computerised system, hence one of the recommendations in the answer to section (b) is for a cost-benefit study. Any external audit recommendations can be considered as a criticism of internal controls, and hence of the IA. In that way, the IAs recommendations may also be considered not to be objective. It is important that the company seek broader advice before responding to the external audit management letter.

P3 18 May 2008

Answer to Question One (a) Likelihood/Consequences matrix for MFT

HIGH IMPACT

LOW IMPACTLOW PROBABILITY HIGH PROBABILITY

High risks:High risks are those that have both a high probability of occurring and have a high impact. These risks can threaten business objectives.Avoidance by exiting from high risk activities.These risks need to be avoided by stopping the activity that causes the risk to arise.Risks: reputation risk caused by customer dissatisfaction (Risk 5).

Low risk:Low impact even when they occur.Low risks can be accepted as they have no impact. No management action is required.Example: Improper use of credit cards by restaurant managers Risk 6).

Medium risks:Medium risks that are relatively frequent but have little impact and so are less significant.Reduction through the adoption of various internal controls such as authorisation, password control, checking procedures, etc.Risks: Errors in order-taking process (Risk 2); inventory control (Risk 3); employee time records (Risk 4); short deliveries (Risk 7).

Medium risks:Medium risks that are significant but unlikely to occur may be shared. Sharing most commonly takes place through a portfolio approach, insurance, hedging, outsourcing, and similar techniques.Risks: Variation in spend per customer and gross profit margins due to poor restaurant management and/or theft (Risk 1).

SECTION B Answer to Question Two (a) The computer system is 10 years old; local managers are unconcerned by the problem but the audit objective set by the Board is to reduce the annual 2% write-off. Given that the company makes an annual profit of 6% ($12m/$200m) the annual stock write-off of 2% is a material item for financial reporting and for management action. (i) Internal controls generally: The following are the specific risks identified in the scenario (in no particular order of significance) and the following internal control improvements (in italics) could be made in the context of these risks: • Opportunity for theft of small, high value and readily saleable components by 100 staff

operating over 2 shifts. Improved physical security over warehouse, ensure no access by unauthorised staff, random checks of employees, use of CCTV, checking of items picked for delivery against Delivery Note/Invoice to identify discrepancies. Widespread communication of a fraud response plan within the company.

• Risk of obsolescence, and obsolete stock being disposed of without proper authorisation and recording. Disposal of obsolete or damaged stock only after proper authorisation by two managers, under supervision, and with proper recording of obsolete stock write-offs.

• Lack of separation of duties in Central Warehouse between those handling goods and those doing data entry (different people but in same department under control of same manager). Separation of data entry staff from Central Warehouse to separate office under different manager.

• Shortages in goods actually received compared with quantity invoiced by suppliers. Improved procedure to record receipts. Automated purchase order system with comparison of quantity and price ordered with quantity and price received into stock.

• Overpayments to suppliers and errors in valuation of goods received due to discrepancies between standard cost based on tender price and price actually invoiced by supplier. Automated purchase order system and valuation of stock as per IFRS based on actual cost into store.

• Errors in picking stock and incorrect recording of stock to be delivered on Picking Slip. Investigation of shortages at time of picking to fill customer order.

• Taken-for-granted nature of 2% contingency (poor control environment). Change in control environment through management focus on need for improvement.

• Absence of physical stocktakes more frequently than annually. Inaccurate cut-offs of purchasing and sales at time of annual physical stocktake. Periodic counts of physical stock on a cyclical basis, for certain groups of components at different times of the year.

(ii) Internal controls in relation to IT systems: The major risk is an out-of-date computer system that may not function effectively. Managers in Central Warehouse believe that stock losses are partially a result of inaccurate data entry. In addition, there likely to be clerical errors in recording receipts on manual Goods Received Notes; and data input errors from Picking Slips.

P3 20 May 2008

The following IT control improvements could be made: • Recruitment, training and supervision of data entry staff and separation of duties are

important.

• Logical access controls over inventory records by passwords, timeouts of inactive users, logging of access and so on.

• Separation of duties: data entry staff should be in a different department to the Central Warehouse.

• Input controls should include authorisation of transactions prior to data entry, especially that supplier invoices have been re-calculated, prices are correct against tenders and quantities received as per the Goods Received Note should agree with the supplier invoice. This would be a largely automatic process if purchase ordering was automated.

• Data entry should require password access, there should be on-line validation of inventory codes, mandatory data entry fields, reasonableness checks of quantities and approval of all adjustments to stock quantities, especially write-offs.

• Processing controls may include control totals and balancing between the inventory subsidiary ledger and general ledger records.

• Output controls include transaction listings for review, exception reports (for example negative stock quantities which may indicate errors in data entry of inventory codes), forms control over Picking Slips and the combined Delivery Note/Invoice, suspense accounts for unprocessed transactions and up-to-date distribution lists for reports.

• Network controls must also exist with firewalls, data encryption and anti-virus software to prevent hacking, viruses, computer system malfunction or accidental or deliberate alteration of data.

(b) Internal audit approach: Tests or techniques - manual Different tests are used to provide evidence about how a system or process is operating to enable the formation of an opinion about the adequacy of internal controls. • Walk-through tests could be used to follow a selection of inventory transactions through

the system from ordering through receipt to storage and despatch, identifying the process and the existing controls.

• Compliance testing would check whether the existing system controls are operating as

intended, for example write-off of obsolete stock. • Substantive tests are relevant when there are weak controls or when fraud is suspected.

Testing is usually based on a sample, for example certain stock items, certain suppliers or customers, certain employees or shifts.

• Analytic review involves gaining a better understanding of the control environment and

potential internal control weaknesses through using ratio analysis to identify trends, non-financial performance analysis and benchmarking. Ratios such as inventory turn on groups of inventory items and (non-financial) analysis of stock losses identified from the stocktake by location, supplier, value or type may yield useful information. Benchmarking between different suppliers, between different groups of components or (if possible) with competitors may also be useful. Internal control questionnaires of a wide range of staff involved in purchasing, the central warehouse, despatch and data entry may also result in useful clues.

May 2008 21 P3

• The main internal audit methods are likely to be regular physical stock counts;

corroboration of stock-in-transit records with suppliers and customers; checking of cut-offs; recalculation of supplier invoices and so on. Narratives and flowcharts of system processes may also be helpful.

Auditing IT systems is particularly important given the reliance on computer systems for inventory control. • Computer assisted audit techniques (CAATs) may be used. Test data can be used to

compare the results of inventory processing through the computer system with manual processing to ensure accurate processing by computer.

• Embedded audit facilities allow for a continuous audit review by, for example, an integrated test facility using a false entity, software code comparison programmes to detect programme changes, and logical path analysis programmes which convert software code into flowcharts.

• Audit interrogation software allows auditors to access the inventory system and check large volumes of data by extracting data from computer files, performing calculations, verifying data and comparing it with management reports, and identifying any items that do not comply with system rules.

• Resident audit software permits real-time auditing by tagging items so they can be selected by the auditor at a later date or copied to a system control and review file (SCARF) for later analysis.

Answer to Question Three (a) (i) There is a wide range of categories that may be selected and so any choices which are

both justified and appropriate to the question context are acceptable. The following list is thus indicative rather than prescriptive. There is also an inevitable potential overlap between some categories.

Regulatory Health and Safety Financial Operational

(ii) The risks and related controls that apply to each of the categories identified in a (i)

include: Regulatory – Risks may arise in relation to driver training and licensing; vehicle maintenance; employer and public liability insurance; health and safety; employment contracts; compliance with maximum loading rules and so on. Possible controls: Formal certificated training programmes and refresher courses for drivers; PCB checks for drivers working on school bus routes where appropriate; maintenance of a database of service records and testing information for all vehicles; employment of a team of inspectors responsible for spot checks on loading and ticketing on bus services Health and Safety - Risks may arise in relation to emission levels in public areas; non-smoking rules; disabled access both on the bus station and on the buses; driver training; staff and public security; toilet facilities; food and drink facilities within the bus station; fire protection; risk of accident

P3 22 May 2008

Possible controls: Installation of environmental monitoring equipment to check emission levels on a regular basis; installation of taco graphs on all long distance buses to ensure drivers keep to the legally limited hours; employment of a disabled services liaison officer to ensure ongoing compliance with relevant legislation; employment of security staff to protect members of the public in the bus station and deter thieves; staff training and certification of all staff working in food and drink service areas; employment and full training of cleaning and maintenance staff; compulsory first aid training for certain categories of staff and installation of first aid packs on all buses. Financial – Risks may arise in relation to ticket sales; salary payments; fuel purchases; vehicle maintenance and other expenses; preparation of financial statements. Possible controls: Separation of responsibility for issuing of customer tickets from the role of maintenance of sales records; purchase of fraud protection software; reconciliation of passenger numbers with tickets issued; employment of suitably qualified accounting staff; use of an approved supplier register for all vehicle servicing and fuel; separation of duties for calculation of salaries due and activation of the payments; purchase of insurance against selected risks, for example fire. Operational – the company faces risks that bus services may not be able to operate as planned due to unforeseen events such as adverse weather conditions, traffic accidents, or staff absences. Additionally, there are risks of events such as passenger illness; driver illness or road accident that may arise while a service is in operation. They may also lose the local contracts for services if services are poorly run and/or regularly late. Possible Controls: Register of reserve staff who are willing to be called in at short notice in an emergency; formal monitoring of weather conditions and maintenance of roads and piers within the bus station; installation of a radio control service to monitor vehicle locations and road conditions; establishment of a passenger complaint and compensation scheme in the event of service failure. (b) The additional risks that need to be taken into account relate to both compliance with health and safety regulations in relation to the sale of food and drink, and also the risk of poor service impacting upon the reputation of the bus company itself. Contract terms need to be carefully defined in order to specify where the responsibility lies in the case of issues such as damage to buses caused by spillages or the illness of passengers as a result of eating food sold by the third party. (c) It is quite common for the risk management function to fall within the internal audit department (or vice versa) of an organisation. The roles are, however, distinct, and good governance practice therefore suggests that internal controls should be established to maintain a degree of separation between audit work and risk management work. Risk management is concerned with the identification, measurement, treatment and establishment of controls to manage risks. In contrast, internal audit is involved in the testing and evaluation of the risk controls. Good governance practice suggests that those who design the controls should not also be involved in testing them. The role of a risk management function is to act as an advisory and consultancy service to the operational management and through training and development the risk staff should facilitate operational managers to be able to identify risks in their area of work, and devise controls by which to manage them. The risk managers’ expertise is invaluable in helping staff to identify risks and opportunities and understand the ways in which different types of risk can be managed, but risk management is a support function, not an operational one.

May 2008 23 P3

Standards for internal audit are laid down by the Financial Reporting CouncilInstitute of Internal Auditors and these are used as the basis for audit work and assessment. It should also be standard practice to annually review the scope of work, authority and resources available to internal audit. One of the easiest ways to ensure there is no conflict of interest between the two functions within a combined department is by, first, ensuring clear demarcation of responsibilities and second, by putting in place separate reporting lines. The staff in risk management will report to a section head who will, in turn, report to the Board of Directors, probably via the Finance Director. In contrast, the Head of Internal Audit will report to the Audit Committee comprising non-executive directors. Training regimes should also differ for the two groups of staff, so that the distinctiveness of their skills is clearly reinforced. If risk management staff sit Institute of Risk Management examinations and internal audit staff sit Institute of Internal Audit examinations, then they will regard each other as performing quite different, but complementary, roles. Answer to Question Four (a)

Spot: US$ = 1⋅144 Australian$

Forward: US$ = 1⋅1818 Australian (b) Arbitrage profit arises when a trader is able to take advantage of price or rating differences between two markets. Arbitrage opportunities will frequently be very short-term in nature because the law of supply and demand ensures that they will disappear automatically as they are taken up. The price of the undervalued item will rise and conversely the price of the overvalued item will fall, until equilibrium is regained. In the scenario in question there is scope for an arbitrage profit to be earned because the difference in the interest rates in Australia and the USA is not fully reflected in the forward exchange rates. This creates the opportunity to earn a profit by mirroring a money market hedge and borrowing in one currency whilst investing in another for a fixed period of time. (c) Step Zero First show that there is an arbitrage opportunity. Interest rate parity suggests that the forward rate F(A$/US$) should be ( )( ) $US/140.1$A144.1

0368.10332.1Spot

r1r1

$US/$A$US

$A =×=×+

+

Hence, interest rate parity does not hold as the implied quoted forward rate is A$1·1818/US$. The dollar is overpriced in the forward market so an arbitrage opportunity exists. Because the dollar is overpriced in the forward market, the dealer will buy dollars today and sell dollars forward.

P3 24 May 2008

Step one Borrow the equivalent of US $5 million in Australian dollars. At the spot rate of Aus$1⋅144/US $ this equals a loan of Australian $5,720,000. The annualised interest rate of 6⋅75% equates to a compound rate of 3⋅32% over six months. At the end of the period the balance owing is thus Aus$ 5,909,904. Step Two Buy $5 million US dollars and invest it for six months. The annualised interest rate of 7⋅5% equates to a compound rate of 3⋅68% over six months. The value at the end of six months is US$ 5,184,000 Step Three The anticipated investment receipts are sold forward in exchange for Australian dollars with the intention of using the funds to pay off the loan. The six month forward rate is Aus$1⋅1818/US$. The sale yields Aus $ 6,126,451. After paying off the loan of Aus$5,909,904 this leaves Aus$216,547 before costs. The sterling value is £93,339 at the six month spot rate of Aus$ 2⋅32/£, which after costs of £9,000 gives a net profit of £84,339. An alternative approach is as follows. This calculation assumes that the trader will take her profits today and not after the six months. Step Zero First show that there is an arbitrage opportunity. Interest rate parity suggests that the forward rate F(A$/US$) should be ( )( ) $A$1.140/US1.144

1.03681.0332Spot

r1r1

A$/US$US$

A$ =×=×++

Hence, interest rate parity does not hold as the implied quoted forward rate is A$1·1818/US$. The dollar is overpriced in the forward market so an arbitrage opportunity exists. Because the dollar is overpriced in the forward market, the dealer will buy dollars today and sell dollars forward. Step one Borrow the equivalent of US $5 million in Australian dollars. At the spot rate of Aus$1·144/US $ this equals a loan of Australian $5,720,000. The annualised interest rate of 6·75% equates to a compound rate of 3·32% over six months. At the end of the period the balance owing is thus Aus$ 5,909,904. Step Two At the forward rate of A$1·1818/US$ we US$ 5,000,765 in six months The present value of this amount is US$ 4,823,269 which at today’s rate equals Aus $ 5,517,820 Thus buy US$ 4,823,269 and invest it for six months. The annualised interest rate of 7·5% equates to a compound rate of 3·68% over six months. The value at the end of six months is US$ 5,000,765

May 2008 25 P3

Step Three The anticipated investment receipts are sold forward in exchange for Australian dollars with the intention of using the funds to pay off the loan and interest. The six month forward rate is Aus$1·1818/US$. The sale of US$ 5,000,765 yields Aus$ 5,909,904 which pays off the loan. The arbitrage gain is the difference between the amount of Aus$ borrowed and the cost of the US dollar which equals Aus$ 202,180 (5,720,000 - 5,517,820). The sterling value of this amount is 202,180 /2·3180 = £87,222, which after costs of £9,000 gives a net profit of £78,222 today. (d) In the scenario the trader is subject to a monetary limit on the size of the trade that may be conducted. If all dealers on a trading floor are restricted in this way, then the institution can set a cap on the level of its nominal exposure from trading operations. Such monetary limits, however, only relate to the initial size of a transaction and the trader may, for example purchase a future on which margin payments are required to be made, and these may add to the overall risk exposure. At the same time, the trading limit simply restricts the monetary size of an individual transaction but the control does not consider the related portfolio risk of that transaction. A single trade may, for example, increase a company’s exposure to the US dollar : sterling exchange rates, but if another trader holds exposure in the opposite direction then the two transactions are naturally hedged. Value at risk complements the role of trading limits by requiring an evaluation of the potential loss that may be incurred on a whole portfolio, over a set time frame and subject to a pre-defined confidence limit. For example, a one day VaR of £200 million with a 99% confidence limit indicates that there is just a one per cent chance of losses on the portfolio exceeding £200 million within a single 24 hour period. The problem with VaR is that it can be subject to gaming, which occurs when traders take on positions which, at the individual level, are extremely risky and have a high potential pay-off, but nonetheless have a very small impact of the VaR of the overall portfolio. In such cases, the VaR is effectively underestimating the risk exposure of the business and hence is limited in its control effectiveness. In conclusion, it is therefore essential to apply a range of different types of control to ensure effective risk management within a trading operation. The controls may be both quantitative and qualitative in nature. Answer to Question Five (a)(i) The Treasury function within an organisation is responsible for management of the funding and investment areas of the business, including hedging of financial risks. The debt : equity mix, the ratio of long-term to short-term borrowing, and the level of exposure to fixed versus variable interest rates all create financial risks which must be managed within the confines of the risk appetite specified by the Board of Directors. It is the responsibility of the Treasury division to identify suitable sources of funding, obtain quotes for loan finance, and appoint bankers to manage equity issues as appropriate. Effective control of borrowing and investment activity requires that Treasury staff are fully aware of operational cash flows and thus able to budget for future cash requirements. Treasury will also commonly take responsibility for the evaluation of projects within the organisation and the production of rankings based upon the financial dimensions of the project.

P3 26 May 2008

In addition to arranging sources of funds, Treasury staff are also involved in identifying investment opportunities to make effective use of surplus short term cash positions. This may involve overnight lending or the purchase of commercial paper or Treasury notes as short term investments. The distribution of dividend payments is also a Treasury responsibility although the decision on the size of the dividend is not part of its remit. In making these short term investments, close attention must be paid to the associated levels of risk. (ii) The management of financial risks arising from exposure to interest rate and currency movements is a core element of the Treasury function. Where Treasury services are centralised, the risks from the separate divisions within a business will be internally netted and decisions taken on the extent to which the residual risk will be hedged via external means. The transaction costs arising from external hedging may vary and so another requirement is that Treasury understands and compares the relative costs of alternative hedging methods. The level of hedging that is undertaken reflects the willingness of the business to tolerate a given level of financial risk, or accept the cost of protection through hedging. In a significant proportion of businesses Treasury is seen as a cost centre, the performance of which is evaluated in terms of the management of costs relative to prescribed targets. It is also possible, however, for Treasury to be run as a profit centre. In such cases, performance is evaluated in terms of the ability of Treasury staff to use surplus funds to generate additional profit for the organisation. The cost centre approach is risk averse, while the profit centre approach is risk taking. One relevant factor in the decision is the extent to which Treasury is viewed as servicing the needs of the rest of the business or as a business in its own right. In the case of companies such as Enron, the trading operations became larger than the underlying business, and it is clear that Treasury was not really acting as a service centre. The financial speculation proved to be one element in the company’s downfall in Enron’s case, but this does not imply that using Treasury to earn profits is bad per se. There is no definitively “correct” approach to Treasury management because the decision to opt for a cost or profit based style is ultimately dependent upon the risk appetite of the organisation, as established by the Board of Directors. Operating as a cost centre offers the advantage that there is no risk of large losses arising from speculative activity that may wipe out profits from ordinary business activities. Conversely, treating it as a cost centre may involve ignoring highly lucrative potential opportunities in the financial markets which could increase overall profits. The decision on which approach to adopt must be left with the Board. (b) Until recently, the extent to which a listed company is required to report to external parties on the nature and extent of its exposures to business risks and the methods used to manage those risks has been the subject of minimal regulatory control. In certain specific areas, such as financial instruments, there have been well defined requirements (see for example IAS 39, IFRS 7 and SFAS 133) on what should be reported, but less explicit advice on how to report for example qualitative versus quantitative reporting. In the UK compliance with the Combined Code requires the publication of a governance report which includes information on the structures in place for risk management and control. Additionally, legislation was introduced in 2005 which required the inclusion of a business review within the Directors’ Report. The legislation does not explicitly require the inclusion of risk and control information within the business review although it more broadly states that from October 2008 it should include information on the main trends likely to affect the future development, performance and position of the company’s business. Intuitively, one might expect this to incorporate information about key risks and their management.

May 2008 27 P3

A report published in January 2007 by the Financial Reporting Council on current trends in narrative reporting practice concluded that there was evidence of weaknesses in the reporting of key risks and uncertainties. This suggests that current risk reporting practice focuses on the governance procedures and control systems rather than on the provision of information about the risks themselves. This approach probably reflects the view that revealing data on risks may be commercially sensitive and may also be misunderstood by the users of the annual report. Furthermore, it can be argued that if a company can provide evidence of a robust system of internal controls, then investors can reasonably assume that any risks that may be encountered will be reasonably well managed. This requires the reader to place faith in the systems, even though there is no requirement in the regulations for directors to report on the effectiveness of the internal control system. They are merely required to report that the systems have been reviewed on an annual basis. In deciding what, and how much to report about risks and the systems for their management, a company must pay attention to the sensitivity and potential complexity of such information. Ultimately, it can be argued that risk reporting is itself a risk that has to be managed, and it is for this reason that remains very wide variations in current practice.

P3 28 May 2008