Provision 29: Are We Focusing on the Right Assurance?

Back in March, I shared my thoughts on what a practical and proportionate approach to Provision 29 assurance might look like.

At the time, my view was simple: focus on understanding Material Controls, the risks they address, the sources of assurance that already exist, and the confidence management has in their effectiveness. Additional testing should only be performed where there is a clear reason to do so.

Three months later, and with the first declarations now much closer, I’ve been reflecting further on what assurance under Provision 29 should actually look like.

Are we confusing activity with assurance?

In conversations and posts about Provision 29, we often hear the language of SOX: testing plans, dry runs, walkthroughs, OE testing etc etc.

But I do wonder whether some organisations are defaulting to testing because it is something tangible to do, rather than because it is the most effective way to support the Board declaration on Material Control effectiveness.

We should also acknowledge that there’s an industry built around control testing: advisers, consultants, software providers, recruitment specialists and assurance functions. Unsurprisingly, many of the proposed solutions involve more testing!

What are Boards actually trying to determine?

If, like me, you’ve spent time working out what the set of Material Controls should actually consist of you’ll probably agree that it’s not that easy. We are trying to distil how a business actually ensures that it achieves its immediate, critical objectives and how it looks to the horizon to continue to exist in a manageable number of controls that can then be explained to a Board. So, therefore, for me, the starting point is not the control but the executive.

Provision 29 requires Boards to determine whether Material Controls are effective. To do that, we need to understand how executive management oversees the achievement of critical business objectives and the management of principal risks.

I would frame the approach around a series of questions that focus on how the executive ensures that the Material Control is effective:

• What are you accountable for?
• What are your objectives and what are the tasks critical to achieving them?
• What are your most significant risks to meeting those objectives and delivering those tasks?
• How would you know if those risks were materialising?
• How do you gain confidence that objectives and critical tasks are being achieved?
• What information do you rely on?
• Do your direct reports understand all the above?
• What oversight mechanisms tell you whether things are working or not?

Those conversations tell me far more about the effectiveness of a Material Control than a sample selection methodology ever could.

The danger of managing the artefacts

I recently came across a quote from Michael Rasmussen, “The organisation ends up managing the artefacts of governance instead of governing the business.”

That observation rings true and is a potential failing in a testing-heavy approach; we need to get to the essence of effectiveness rather than a set of artifacts.

Provision 29 did not emerge because of failures in operational process controls. It emerged because of failures in governance, oversight, challenge and decision-making.

Whether we look at Maxwell, Polly Peck, Carillion, Greensill, Thomas Cook, BHS, Enron or WorldCom, the underlying issues were never about an individual operational control failing in isolation. The failures were at the level of business model, leadership, oversight, governance and culture.

Judgement matters

As we enter the final months before declarations, I think there is a danger in searching for certainty where none exists. Provision 29 is principles-based and Boards (and their advisors in the business) will need to exercise judgement, just as they do in leading the business.

For those responsible for Provision 29 programmes, that requires meaningful engagement with the executives and the Board. Not a 30-minute meeting to present test results. Not a spreadsheet review. Real discussion about whether objectives are being achieved, whether risks remain within appetite and whether there are emerging issues that need to be addressed. They also need to acknowledge groupthink, hubris, culture etc. No amount of testing can replace that conversation.

COCO, a framework worth revisiting

To close, I want to revisit a framework that I found useful in my early consulting career: COCO. Developed by the Canadian Institute of Chartered Accountants in 1995, before COSO became dominant, COCO places people at the centre of control effectiveness.

Its four components remain highly relevant today when we consider the effectiveness of Material Controls:

• Purpose – Is it clear what the control is trying to achieve?
• Commitment – Is there genuine ownership and accountability at a control level and at a business-wide, cultural level?
• Capability – Does the owner have the authority, information, skills and resources required?
• Monitoring and Learning – Is the performance of the control evaluated and amended in response to the evaluation and wider circumstances?

For governance and oversight Material Controls, these questions will provide a more meaningful assessment of effectiveness than traditional control testing.

If Provision 29 is about helping Boards reach a conclusion on whether Material Controls are effective, then we will need fewer test scripts and more conversations.