UK SOx: Internal Controls FAQs - KPMG UK (2024)

The White Paper consults on three options for the areas covered by the Directors' Attestation:

1. All aspects of the company’s internal control and risk management procedures; or
2. Limited to the internal control structure and procedures for financial reporting (similar to US SOx); or
3. Limited to a subset of the internal control structure and procedures for financial reporting, focusing the auditors’ work only on priority areas of particular interest to investors. (similar to a SOC1).

The Government's preferred approach is option 2.

The White Paper sets out the governments preferred option which really feels like a "minimum" position that companies will need to achieve. The challenges really come around the scope of controls and the framework your use. Our view is that it would be sensible to assume that:

1. Management will need to given some form of annual statement externally about the strength of internal controls over financial reporting
2. While there may or may not be be a requirement for auditor review and / or opinion in relation to that statement you would be wise to work on the basis that your controls and documentation to support those controls should be of an 'auditable standard'
3. Whilst you may be able to select the framework you use, given that COSO 13 is widely recognised as being a strong benchmark and there is lots of support material already in place, this is likely to be the default option for many
4. If you're not already US SOx compliant there will likely be some work that you need to do to support making an external statement
5. Even if you are US SOx compliant, your larger non-listed entities that may currently be scoped out (perhaps due to materiality) could well come into scope under any new PIE defintion

There are a number of “no regrets” actions we believe you can take now:

• These changes will require a cultural shift, and tone from the top, clear roles and responsibilities, scorecards, accountabilities, and training will be key Where to start: Educate your Board on what this will mean for them - this will likely be well understand by the CFO and perhaps others but the impact of these proposed changes extend well beyond finance.
• Be very clear as to the benefits you expect to drive. Our experience from other countries including the US is that those who see this as an opportunity to transform (and not simply as a compliance exercise) are the most successful. Where to start: set out a clear benefits case and use this to help your organisation to understand 'why' they need to change and not simply 'what' they need to change.
• Take a look at any ongoing transformation programmes that you have runnning now. Are you addressing internal controls requirements already? If not, you should be as retro-fitting these later will cost you up to three times more Where to start: Review your ongoing programmes. Do you have an internal controls workstream? Have you got internal controls SMEs embedded in the team? Review the approach and resourcing to ensure you address internal controls now.
• Get your risks right, Where to start: Agree your principal risks in line with your future strategy and business model, starting with the key risks with a financial statement impact. If you don’t know where your principal risks are you will end up with the wrong control environment.
• Invest in the 1st Line of Defence, Where to start: Establish your control owners and process owners now. These are people who understand the end to end finance processes, risks, associated controls and the supporting technology and tools. They need to operate a “show me don’t tell me” mindset to start embedding good governance over your controls early on. Culture and good governance together are what will stop controls from failing.
• Define your key risk indicators, Where to start: Can you confidently list your top 10 financial & IT controls? Do you know which processes present the highest risk; and therefore, need the most attention? Define your key risk indicators upfront with a balance between lagging and forward-looking indicators. This will help prioritise your efforts so that you are focussed on what matters the most.
• Standardise & Automate, Where to start: There are easy wins to standardise processes, controls and leverage technology to drive resilience and efficiency. You can drive down the cost of controls if you really maximise the power of your systems. Our KPMG Powered solution defines leading practice for you and is a great starting point!