Skip Links
Baker Tilly
United Kingdom
Follow us on Twitter Follow us on LinkedIn

Internal audit, internal controls and risk management – are you properly assured?

Related links

Following the Code of Practice 09 (CoP) on internal controls issued by the Pensions Regulator at the end of 2006, many Trustees will have progressed through risk assessment for their scheme, will have produced a risk register and will have tasked scheme management or internal audit to implement controls to mitigate the known risks.

But are you sure that:

  • Risks continue to be regularly reviewed and updated?
  • Appropriate internal controls have been put into place?
  • The controls implemented are working efficiently, effectively and reliably?

  • Reviewing your risks regularly

    One of the failings of many risk reviews is that a comprehensive register is produced as a one-off exercise and it is then effectively forgotten as management get on with the ‘day job’ of running the scheme.

    Risk management needs, however, to be firmly embedded into any pension scheme (and indeed it is normally a subconscious part of any business decision).

    Following preparation of the initial risk register (see our briefing dated December 2006), the risks arising should, in the words of the Regulator ‘be reviewed periodically, at least on an annual basis, or sooner if substantial changes take place, such as a deterioration in funding, changes in investment managers or where a control has found to be inadequate’.

    Trustees, management and Internal Audit should be asking themselves:
    • Are all risks listed still relevant?
    • Have the risk scores allocated changed in any way?
    • Are there new risks that now need to be included?
    • Have there been any changes in risk mitigating actions?
    • Are the risk owners allocated still the most appropriate?
    • Are you satisfied that the risk management regime is satisfactory?

  • Appropriateness of internal controls

    As Trustees you will need to satisfy yourselves that an internal control regime has been implemented that deals with both the risks defined by the risk register but also ensures that the ‘engine room’ processes and procedures of the scheme are properly implemented and controlled.

    You should ask for confirmation from management that an internal procedures manual has been established; that it covers all major control areas, is regularly updated and specific legislation (e.g. Accounting, Pensions) has been taken account of where appropriate.

    Many pension schemes outsource parts of their scheme management, e.g. to pension administrators and investment managers and you should also be asking for confirmation from the outsourced provider about the adequacy of their internal control environment.

  • Assurance – what do you need?

    To know that internal controls are effective:

    • The controls are being operated in accordance with the procedures manual(s) in place;
    • The control processes are not open to error or fraud;
    • There is sufficient segregation of duties between preparation and authorisation processes.

    To know that internal controls are efficient:

    • There is no unnecessary duplication of control;
    • Manual controls that would be better dealt with by IT systems have been converted appropriately.

    To know that internal controls are reliable:

    • Effective procedures for ensuring business continuity have been put into place;
    • Controls will operate properly in the event of unforeseen staff absence.

  • Assurance – how to obtain it

    Whilst in an ideal world, Trustees would have the time to review internal control systems for themselves, this is rarely likely to be practicable (or desirable!) and you will need to place reliance on other parties to obtain the assurance that you need.

    There are several levels of assurance that can be obtained:

    1. Self assurance by management

    Annual certificates can be prepared by scheme management outlining the internal control systems that they are responsible for and how they ensure these are working as expected. Although there is a lack of independent verification in this method.

    2. Assurance from third parties

    Trustees should ask for and review AAF 1/06 reports (previously known as FRAG 21 reports) from their investment managers, custodians and administrators.

    These will outline the internal control regimes in place at these third parties. Where such reports are not produced, the Trustees should be questioning that fact.

    All schemes, regardless of size, should be requesting these reports, although it must be noted that these reports are best practice and not scheme specific.

    3. Assurance from your external auditors

    Your external auditors will have a good understanding of your scheme’s internal financial controls for the purposes of their statutory audit.

    Trustees could therefore consider requesting that their external auditor agrees a separate engagement to specifically target certain areas of internal financial control to be tested each year.

    More detailed testing, outside the scope of the statutory audit, will provide further assurance on key areas, however the scheme auditor needs to be careful not to cross ethical boundaries and compromise their independence.

    4. Assurance from an independent firm

    For larger schemes, Trustees should seriously consider appointing an independent firm as internal auditors to provide them with assurance on the entire system of internal controls.

    This service will be totally independent, should review all areas of high risk each year, and other risk areas on a cyclical basis as appropriate.

    The internal audit service will report to Audit Committee meetings and should produce an annual report with an overall opinion on the state of the system of internal control.

    Where the Company has an Internal Audit department, the Trustees can seek their involvement with the agreement of the Company, however, very often, the Company Internal Audit department lack the resources and pensions expertise to carry out a detailed review of the scheme’s internal controls.

  • Summary

    In summary, Trustees who are taking risk management seriously within their scheme will:
    • Review risks to the scheme regularly;
    • Review the processes for embedding risk management within their scheme;
    • Overview the internal control regime in place;
    • Request assurance, both internally or externally, that controls are in place to deal with risks, and that these controls are operating effectively, efficiently and reliably.