Aviva 2013 Annual Report Download - page 78

Aviva plc
Annual report and accounts 2013
76
Directors’ and Corporate governance report continued
US sale
The sale of the Aviva USA business completed on 2 October
2013 and the transaction proceeds received were based on the
estimated earnings and other improvements in statutory surplus
over the period from 30 June 2012 to 30 September 2013. The
final purchase price is subject to customary completion
adjustments. The process to agree completion adjustments is
on-going and is expected to complete by mid-2014. Until the
outcome of this process is known there remains uncertainty on
the final determination of the completion adjustment. The
committee considers the fair value less costs to sell reflected in
the 2013 Annual report and accounts to be appropriate.
Other matters
The committee also considered the carrying value of goodwill in
the Group’s Spanish business and the classification of a number
of businesses as held for sale, including Eurovita, Taiwan, Korea,
Indonesia and Turkey general insurance as disclosed in note 4.
With regard to the Group’s accounts on the Market Consistent
Embedded Value basis, the committee considered and
challenged the key assumptions presented by management.
Internal control
During the year the committee received quarterly updates on
the effectiveness of the Group’s financial reporting control
framework and discussed rectification of any deficiencies in
controls. The controls improvement programme at Aviva
Investors was monitored closely and made good progress during
the year. In addition, the committee commissioned PwC to
review how the improper trading in fixed income securities at
Aviva Investors was allowed to happen and whether the
controls instigated since then are sufficiently robust. Measures
to improve controls have been implemented.
The committee challenged management to improve the
quality of the overall control environment across the Group.
Significant work has been carried out by management to close
issues raised by Internal Audit and the Group’s risk policies and
business standards have been mapped against the Committee
of Sponsoring Organizations of the Treadway Commission’s
Enterprise Risk Management Framework (COSO framework) to
provide a baseline position to assess where further development
is required.
An Integrated Assurance Framework (IAF) is also being rolled
out across the Group as a mechanism for bringing together all
the information on the operation of the control environment
from management, Internal Audit and the Risk function; to
provide a holistic view of the status and quality of controls and
identify common themes and expedite action to remediate
deficiencies.
The committee reported to the Board regarding the
effectiveness of the Group’s overall risk management and
internal control systems including the risk management system
in relation to the financial reporting process. The committee
worked closely with the Risk Committee in its overall review of
the Company’s systems of risk management and internal
controls.
The system of internal controls extends to the Group’s
business units, each of which has an audit committee that
provides an oversight role for its business. Membership of these
business unit audit committees is largely comprised of non-
executive directors of subsidiary companies.
The committee’s terms of reference require it to establish
and monitor procedures for dealing with complaints from
employees in relation to accounting issues. The committee
reviews the procedures annually and received regular updates
from the CAO on any significant complaints received. A
description of the Company’s systems of internal control and
the Group’s risk management framework is included on pages
70 to 72.
Internal audit
Internal Audit reports to the Board (primarily via the Audit
Committee) and to management on the effectiveness of the
Company’s system of internal controls and the adequacy of this
system to manage business risk and to safeguard the Group’s
assets and resources.
Internal audit charter and business standard
The charter sets out the purpose, functions, scope and
responsibilities of the Internal Audit function and how it
maintains independence from the first and second line
management of the Group. The three main functions of Internal
Audit are to:
 Assess and report on the effectiveness of the design and
operation of the framework of controls which enable risk to
be assessed and managed
 Investigate and report on cases of suspected financial crime
and employee fraud
 Undertake advisory projects for management provided that
they do not threaten the function’s actual or perceived
independence from management
The Internal Audit business standard sets out the requirements
for management across the Group to support Internal Audit in
achieving its objectives. It requires businesses to design and
operate processes and controls to satisfy the mandatory
requirements in the standard based on the size and complexity
of the business and the nature of the risks and challenges it
faces. Any breaches of the standard must be reported to the
CAO and others as appropriate.
Annual plan and focus of reviews in 2013
Internal Audit’s 2013 annual plan was reviewed and approved
by the committee. Planned reviews reflected the priorities in the
Group’s 2013-2015 Operational Plan and were prioritised
following a risk-based assessment of the business and a review
against the Group’s risk policies. The reviews carried out
covered an extensive sample of controls over all risk types,
business units and regulated entities and covered ‘business as
usual’ activities and an assessment of change programmes.
Reviews included the implementation of corporate decisions;
maintenance of adequate financial strength and resilience; the
effectiveness of governance, decision making and risk
management; treating customers fairly; the availability, security
and recoverability of IT systems; and the improper allocation of
trades in fixed income securities at Aviva Investors. The
committee received quarterly reports from the CAO on audit
reviews carried out, management’s response to the findings and
progress in addressing identified issues. The CAO prompted
management to increase focus throughout the year on closing
overdue audit issues and on areas where further improvement
is still required.
Effectiveness of the internal audit function
The committee commissioned an independent review of the
effectiveness of the Internal Audit function against the
standards published by the Institute of Internal Auditors (IIA).
Overall, the independent reviewers found that the Internal Audit
function complies with the IIAs standards, code of ethics and
conduct and is fit for purpose. The function demonstrates
expertise in insurance governance, and risk and control. A
number of recommendations were made as to how the function
could develop further, including enhancing the use of data
analytics and related IT tools, and developments to the audit
reports such as including management’s view of risks and
controls. The Internal Audit function intends to implement all of
the recommendations and the committee will oversee progress.