BT 2014 Annual Report Download - page 88

85
Governance
Governance
year within the group audit team and his second year as lead partner
which is a role he can continue for a further two years.
The comply-or-explain provision in the UK Corporate Governance Code
has eectively been superseded by the UK Competition Commission’s
nal report and recent developments in Europe. EU legislation requires
mandatory rotation of audit rms every ten years, extendable, if there
is a tender process, up to 20 years. The transitional rules under the EU
legislation will require an initial change of audit rm no later than for the
31 March 2021 year-end audit.
The Competition Commission had previously proposed mandatory audit
tenders at least every ten years with dierent transitional rules, but has
now announced a delay in its implementation programme to consider
fully the implications of the EU rules on its proposals. There is therefore
uncertainty as to whether BT will be required to go to tender prior
to2021.
Until this uncertainty is resolved, the committee will continue to
consider annually the need to go to tender for audit quality or
independence reasons.
There are no contractual obligations in place that restrict our choice of
statutory auditor.
Independence and objectivity
BT has agreed policies in place on what non-audit services can be
provided by the external auditors and the relevant approval process.
The external auditors are not permitted to perform any work which they
may be later required to audit or which might aect their objectivity
and independence or create a conict of interests. There are internal
procedures in place for the approval of work given to the external
auditors, the key points of which are
• No work may be placed with the external auditors without the
concurrence of the Group Finance Director or his delegate.
• Certain non-audit work cannot be given to the external auditors.
Other work may be agreed if there are clear business benets of using
the external auditors rather than an alternative supplier.
• Specic approval is required in advance from the committee or
committee chairman for all audit and non-audit services unless it is
included on the list of pre-approved services or is below £10,000.
• Non-audit fees are reported quarterly to the committee.
During the year, there were no non-audit fees which required the approval
of the committee or the committee chairman. We monitored compliance
with the agreed policies and the level of non-audit fees paid to the
auditors in order to satisfy ourselves that the types of services being
provided and the fees incurred were appropriate. You can see details of
non-audit services carried out by the external auditors in note 7 to the
consolidated nancial statements. In this context audit-related assurance
services are considered to pose a low threat to auditor independence and
therefore the proportion of other non-audit services to total services is
considered the most suitable measure of the non-audit services provided.
These represented 15% of the total fees (2012/13 17%). Further details
of the non-audit services that are prohibited and allowed under the policy
can be found in the corporate governance section of the BT website.
The committee is satised that the overall levels of audit and non-audit
fees are not material relative to the income of the external auditors as
a whole and therefore that the objectivity and independence of the
external auditors was not compromised.
Internal audit
In April 2013, we endorsed the internal audit plan of work.
This integrates the assurance requirements for the internal nancial
controls testing programme, the company’s overseas footprint, and
the group’s risk assurance mapping. It includes coverage of static and
dynamic risks. The audit plan for 2013/14 included 145 audit reviews
in addition to the testing of 113 Sarbanes-Oxley processes. Key areas of
focus across the plan included nancial management and controls,
next generation access, governance and compliance, customer service
and major contracts for networked IT services.
We reviewed promptly all reports from the internal auditors and ensured
that management took appropriate action on issues arising from such
reports. We monitored management’s responsiveness to the ndings and
recommendations of the internal auditors. Examples included physical and
logical security, data segregation and nancial controls in overseas entities.
We have discussed with management the actions required to bring these
matters to resolution and agreed that delivery plans are in place.
We monitor the relationship between the internal and external auditors
and at the end of the year we received a report on the performance of
internal audit.
Internal controls and risk management
BT has in place an internal control environment to protect the business
from material risks which have been identied within the group.
Management is responsible for establishing and maintaining adequate
internal controls over nancial reporting and we have responsibility for
ensuring the eectiveness of these controls. To enable us to do this, each
quarter the lines of business certify compliance with the Turnbull guidance
and Sarbanes-Oxley controls. The outcomes of these reviews are reported
to us and no signicant weaknesses were identied in the annual review.
BT’s risk management processes which have been in place throughout
the period under review identify and monitor the risks facing the group.
The risks which are considered material are reviewed regularly by the
Operating Committee and the Board.
Enterprise-wide risk management
We give risk management special attention and during the year heard
from the Chief Executive on the enterprise-wide risk management
process and the key risks facing the group as a whole. We heard from
each line of business CEO on the key risks in their part of the business
as well as the actions they are taking to address them.
I reported last year that the committee had given particular focus to BT’s
operations in Italy. We have continued to monitor the position there and
signicant progress has been made to improve the control environment.
We also undertook a review of BT’s operations in Latin America, where
improvements were identied. A remediation plan is in place and it is
regularly reviewed by the committee. We have also kept under review
the current trends of security risks facing BT and the progress made to
manage these risks.
We also consider any whistleblowing reports (including the condential,
anonymous submission by employees) regarding accounting, internal
accounting controls or auditing matters, ensuring arrangements are in
place for the proportionate, independent investigation and appropriate
follow-up of such matters. We discussed the ndings from the external
review and benchmark of BT’s condential hotline programme at the
joint meeting with the
Nominating & Governance Committee .
The Board is ultimately responsible for the group’s systems of internal
controls and risk management. You can nd details of the Board’s
and our review of the group’s systems of internal control and risk
management on pages 112 to 113.
Governance
Our performance is reviewed annually by inviting members,
key executives and the external auditors to complete questionnaires.
The results show that the level of discussion and challenge led to a
healthy debate at meetings and that the committee continues to
be eective in terms of behaviours and processes. Enterprise risk
management/risk attitude continues to be an area of focus over the
next 12 months.
Nick Rose
Chairman of the Audit & Risk Committee
7 May 2014