Annual internal control reporting and its applicability to Maltese listed companies : an evaluation

Abstract

The recent corporate scandals spurred the United States to pass a controversial piece of legislation 'The Sarbanes Oxley Act'. One of its main clauses requires the annual report of companies registered with the Securities and Exchange Commission to include a detailed report on internal control over financial reporting (ICOFR). As a response to this legislation, the European Union (EU) is developing its own corporate governance regulations, which will in all probability mirror the Sarbanes-Oxley rules. Although the EU has not yet announced its intentions, countries like the Netherlands have voluntarily introduced regulations similar to Section 404. Within the framework of these developments lay the need to ascertain whether Section 404 would be applicable to the Maltese scenario and whether the Malta Financial Services Authority (MFSA) should demand such extensive levels of internal control reporting, even if the EU refrains from replicating the provisions of Section 404. The dissertation was aimed at determining the applicability of the requirements of Section 404 to companies whose equities are listed on the Malta Stock Exchange. This included an evaluation of the expected impact of such requirements on internal organisational factors, on the annual statutory audit and on financial statement users. While unlisted public companies were given brief consideration, private companies fell outside the scope of the study. The need for strong corporate governance is paramount in public companies where the distinction between ownership and control is more pronounced than in private companies. A rigorous literature review outlined the contents of the ICOFR report (as mandated by Section 404) and the process required for its preparation. It went on to analyse the impact of such a report on organisations, on the annual statutory audit and on users of financial statements. An analysis of the internal control reporting practices of listed Maltese companies revealed that the key disclosures mandated by Section 404 are presently missing. Consequently, interviews with internal auditors of listed companies, external auditors and the MFSA sought to determine whether the ICOFR report would be appropriate for listed Maltese companies. The majority of internal auditors believed that the ICOFR report would be unsuitable to the local scenario. The major reason cited was that the costs would be too burdensome, especially since most of the theoretical benefits of the report would be curtailed by the particular characteristics of local financial statement users. On the other hand, the majority of external auditors and the MFSA respondent maintained that the report would be applicable, as it would infuse enhanced control discipline within companies and would enhance the credibility of financial reports. The MFSA stated that it would only introduce the report if required to do so by the EU. The study concluded that if the EU were to introduce the report in question, listed Maltese companies need not let their relatively small size instill fear of such a requirement - the report would in no way compel the introduction of controls that are inappropriate for their size and structure. The study ended with a number of recommendations to listed Maltese companies, external auditors and the MFSA.