Guidance on Implementation of Sections 60 – 63 of the Investments and Securities Act 2007

1.0 Introduction

Sections 60 to 63 of the Investments and Securities Act of 2007 require public companies (subject to the reporting requirements of the Act) to include in their annual reports a report of management on the company’s internal control system. A public company is required to file the auditors' attestation report as part of the annual report.

1.1 Certification in annual or periodic reports

In compliance with the provisions of section 60 of the Investments and Securities Act (ISA) 2007:

(1) A public company whose securities are required to be registered under this Act shall file with the Commission on a periodic or annual basis, its audited financial statements, and such other returns as may be prescribed by the Commission from time to time.

(2) The chief executive officer and the chief financial officer or officers or persons performing similar functions in a public company filing periodic or annual reports under subsection (1) of section 60, shall certify (format in appendix 1) in each annual or periodic report filed, that- (a) the signing officer has reviewed the report; (b) based on the knowledge of the officer, the report does not contain: (i) any untrue statement of a material fact, or (ii) omit to state a material fact, which would make the statement, misleading in the light of the circumstances under which such statement was made; (c) based on the knowledge of such officer, the financial statements and other financial information included in the report fairly present in all material respects the financial condition and results of operations of the company as of and for the period presented in the report. (d) the signing officers- (i) are responsible for establishing and maintaining internal controls. (ii) have designed such internal controls to ensure that material information relating to the company and its consolidated subsidiaries is made known to such officers by others within those entities particularly during the period in which the periodic reports are being prepared; (iii) have evaluated the effectiveness of the company's internal controls as of a date within 90 days prior to the report; (iv) have presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date; (e) the signing officers have disclosed to the Auditors of the company and Audit Committee - (i) all significant deficiencies in the design or operation of internal controls which would adversely affect the company's ability to record, process, summarise and report financial data and have identified for the company's Auditors any material weakness in internal controls, and (ii) any fraud, whether or not material, that involves management or other employees who have a significant role in the company's internal controls; (f) the signing officers have identified in the report whether or not there were significant changes in internal controls or other factors that could significantly affect internal controls subsequent to the date of their evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses.

1.2 Duty of directors on internal controls

Internal control means policies, procedures, and practices put in place by management to ensure safety of assets, accuracy of financial records and reports, achievement of corporate objectives and compliance with laws and regulations (Sec. 61(3)). A public company shall establish a system of internal controls over its financial reporting and security of its assets and it shall be the responsibility of the board of directors to ensure the integrity of the company's financial controls and reporting (Sec. 61(1)).

1.3 Management's Annual Assessment of, and Report on, the Company's Internal Control over Financial Reporting

The board of directors of a public company shall report on the effectiveness of the company's internal control system in its annual report (Sec. 61(2)). A company's annual report should include an internal control report of management that contains:

• A statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting (ICFR) for the company;
• A statement identifying the framework used by management to conduct the required evaluation of the effectiveness of the company's internal control over financial reporting;
• Management's assessment of the effectiveness of the company's internal control over financial reporting as of the end of the company's most recent fiscal year, including a statement as to whether or not the company's internal control over financial reporting is effective. The assessment must include disclosure of any "material weaknesses" in the company's internal control over financial reporting identified by management. Management is not permitted to conclude that the company's internal control over financial reporting is effective if there are one or more material weaknesses in the company's internal control over financial reporting; and
• A statement that the registered public accounting firm that audited the financial statements included in the annual report has issued an attestation report on management's assessment of the registrant's internal control over financial reporting.

1.4 Duty of auditor to report on internal controls of public companies

A company is required to file, as part of the company’s annual report, the attestation report of the external auditors that audited the company’s financial statements in addition to the report of the internal control system. The report in the annual report must contain a statement that the external auditors that audited the financial statements, included in the annual report, has issued an attestation report on management's evaluation of the company's internal control system. An auditor of a public company shall, in his audit report to the company, issue a statement as to the existence, adequacy and effectiveness or otherwise of the internal control system of the public company (Sec. 63).

1.5 Auditor Independence Issues

The auditor is required to attest to management's assessment of internal control over financial reporting. Companies and their auditors should be mindful of regulations on auditor independence that prohibit an auditor from providing certain non-audit services to an audit client.

1.6 Material Weaknesses in Internal Control over Financial Reporting

Management of a company is precluded from determining that a company's internal control over financial reporting is effective if it identifies one or more material weaknesses in the company's internal control over financial reporting. Management's report must include disclosure of any material weakness in the company's internal control over financial reporting identified by management in the course of its evaluation.

1.7 Method of Evaluating

The methods of conducting evaluations of internal control over financial reporting will, and should, vary from company to company. In conducting such an evaluation and developing its assessment of the effectiveness of internal control over financial reporting, a company must maintain evidential matter, including documentation, to provide reasonable support for management's assessment of the effectiveness of the company's internal control over financial reporting. Developing and maintaining such evidential matter is an inherent element of effective internal controls. The assessment of a company's internal control over financial reporting must be based on procedures sufficient both to evaluate the design, implementation and to test the operating effectiveness.

1.8 Location of the report in annual financial statements

The report should be close to the corresponding attestation report (opinion page) issued by the company's independent audit firm, or in a portion of the document immediately preceding the companies' financial statement.

1.9 Registration of Auditors of public companies

Public accounting firms that – (a) Prepare or issue any audit report with respect to a public company; or (b) Play a substantial role in the preparation or furnishing of an audit report with respect to a public company, must be registered with the Commission. No person shall carry on the business of auditing a public company unless that person is registered by the Commission on such terms and conditions as may be prescribed from time to time (Sec. 62).