Part 7: Internal controls
7.1
In this Part, we discuss:
- why internal controls are important for effective governance;
- the main findings from our work; and
- how well each entity performed against our expectations.
Why are internal controls important for effective governance?
7.2
Boards have a role in assessing the design and effectiveness of an organisation's internal controls. Those controls are organisational (terms of references, independence, and separation of duties), operational (planning and budgeting), and about personnel (training, development, and recruitment). Internal controls include periodic reviews (including internal and external audit). Internal controls are critical to providing assurance to a board that an organisation's activities are compliant and in line with the expectations of the board.
Safeguarding artistic freedom and integrity in the management of collections
7.3
Internal controls to ensure independence are important (such as procedures and processes for declaring and managing conflicts of interest) because they help to maintain artistic freedom, and to manage the risk of personal interests of board members or staff from interfering in, or unduly influencing, funding decisions, and in the acquisition and management of collections. Controls that set terms of references for board committees and for management roles, and that define segregation of duties, are particularly important.
Audit and risk committees
7.4
We expect boards to oversee the organisation's control systems and to have established audit and risk committees to carry out this role. The audit and risk committee's responsibilities should be well defined and understood. They should include overseeing the main financial and operational reporting systems and processes, and advising the board on the approval of audited financial statements.
7.5
Audit and risk committees need financial literacy and experience to robustly question and challenge the information they are presented with.
The role of external auditors
7.6
External auditors are able to provide boards with a different perspective on the organisation, which can prove valuable when it comes to the monitoring and oversight that boards provide.
7.7
At the least, boards should expect the external auditor to have a view about the financial systems, processes and controls, and staff capability. Boards should ask their auditor for an independent view of their organisation.
7.8
Similarly, we expect an organisation's external auditors to provide the board with formal and informal feedback and insight to help the board maintain an overall view of how the organisation is performing. This is particularly true when organisations are going through significant change. Both internal and external sources of assurance should play an important role in providing information on the effect of this change.
Main findings about internal controls
7.9
Overall, the boards of the entities we looked at have appropriate oversight of control systems. However, there is scope for boards to place more emphasis on assessing the effectiveness of their internal controls and identifying opportunities for improvements.
Independence and declarations of interest
7.10
All the boards have policies for ensuring board members' independence, such as declarations of interest. We saw evidence through board minutes that board member independence is regularly reviewed and that members acted appropriately when conflicts of interest were identified.
7.11
The boards have policies to define the segregation of duties between the board and management, but, as we describe in Part 4, in practice the separation between the boards and management was sometimes blurred. This creates a risk that the personal interests of board members can unduly influence operational decisions about funding, and the acquisition and management of collections, which should be guarded against. We did not see any evidence that board members were unduly influencing decisions in the entities we looked at.
Audit and risk committees
7.12
All but one of the entities had an established audit and risk committee (Creative New Zealand is considering whether to establish an audit and risk committee). Each of these boards were using the audit and risk committee to review the organisation's internal controls framework and provide assurance to the board that both the organisation's financial systems and its internal controls are sound.
7.13
The role of internal and external auditors in providing insight to the board would benefit from some attention. Internal audit work programmes could be strengthened with a clearer link to organisational challenges and risks. We also found that the boards and their audit and risk committees could make more use of their external auditors, particularly in gaining a different perspective on the organisations' controls and wider organisational health and performance.
The entities' performance
7.14
Figure 6 sets out the criteria we have used to assess each entity's performance for the internal controls aspect of governance.
Figure 6
Framework for assessing a board's performance – internal controls
| Assessment rating | Criteria |
|---|---|
| Leading | The board views the internal controls environment as a valuable input into guiding and governing the organisation, not as a compliance exercise. Internal controls are designed to support the strategic outcomes sought by the board and to drive continuous improvement in organisational performance. |
| Comprehensive | There is a well-established and strong internal controls environment. The board has oversight over the control systems that effectively and efficiently guide the organisation towards achieving its objectives and meeting the organisation's external accountabilities. Internal controls are effectively administered, and there is an understanding within the organisation, and by the board, of the importance of internal controls. The board reviews the effectiveness and efficiency of controls and draws on these reviews as a main input into assessing management's performance. As well as having an established audit and risk committee (see Progressing), there is evidence that the audit and risk committee regularly reviews the organisation's internal controls framework. |
| Progressing | There is an established internal controls environment. The board reviews the control systems (implemented and designed by management). There is some understanding within the organisation, and by the board, of the importance of internal controls. There is an audit and risk committee comprising some independent board members. The audit and risk committee's responsibilities are well defined and understood, and include ensuring efficiency of audits, overseeing the financial systems, and advising the board on the approval of audited financial statements. There is evidence that the audit and risk committee actively reviews the organisation's internal controls framework. |
| Developing | The internal control environment is partially established. The board carries out some reviews of the control systems, and these are partially aligned to the organisation's objectives. There is a partially established audit and risk committee. The audit and risk committee's responsibilities are defined but inconsistently understood. The audit and risk committee reviews the organisation's internal controls framework on an ad hoc basis. |
| Ad hoc and limited | There are some basic internal control structures but they are not specifically designed to address the objectives and accountabilities of the organisation. There are some of the following controls: organisational controls (terms of references and segregation of duties), operational controls (planning and budgeting), personnel controls (training, development, and recruitment), and periodic reviews (internal and external audit). There is little understanding of the importance of having a separate audit and risk committee. |
Auckland Art Gallery
7.15
We assessed Auckland Art Gallery's performance as "Progressing".
7.16
Auckland Art Gallery has a range of internal controls, including organisational (terms of references and separation of duties) and operational (planning and budgeting). An established Audit Committee conducts regular reviews – such as of the delegations held by Regional Facilities Auckland and Auckland Art Gallery.
7.17
The segregation of duties between the Regional Facilities Auckland board and Auckland Art Gallery are set out clearly in the board's policies. From our review of board papers and minutes, there was evidence that the board and management were acting according to the policies for segregation of duties. The interests of the board members are regularly declared before board meetings. This creates a good environment for protecting the integrity of the acquisition and management of collections.
7.18
Interviewees had a shared understanding of the Audit Committee's responsibilities. Board papers show that there has been minimal discussion about the effectiveness of internal controls or regular reviews of the internal controls in place. The board has confidence that the Audit Committee will highlight any issues with internal controls.
7.19
There was evidence that the Audit Committee is providing information to and advising the board on financial statements. The audit committee's responsibilities are primarily focused on compliance and reporting activities. However, there is an increasing focus on risk identification, management, and reporting.
Creative New Zealand
7.20
We assessed Creative New Zealand's performance as "Comprehensive".
7.21
Creative New Zealand has a well-established and strong internal controls environment.
7.22
The new Arts Council was given an overview of the major internal controls as part of its induction process. The Arts Council's governance manual, which the Arts Council discussed at its first meeting, clearly sets out the major internal controls and compliance requirements.
7.23
We saw evidence in meeting minutes that the Arts Council has oversight and an understanding of the control systems. We also saw evidence that the Arts Council (in the absence of an audit committee) is actively reviewing policies and processes associated with the internal control framework – such as the process for legislative compliance reporting, and its fraud, separation of duties, and delegations policies.
7.24
The induction of the new board (described in Part 4) has included consideration of the segregation of duties between management and the board (particularly around funding decisions) and the importance of the policies for declaring interests. This included ensuring that the board understands the frameworks through which Creative New Zealand makes funding decisions, as well as the performance reporting and monitoring that underpins funding decisions.
7.25
As part of embedding its new governance arrangements, Creative New Zealand has decided to carry out all governance activities centrally and to not form any subcommittees. This is to ensure that all board members understand their responsibilities and are aware of the range of governance activities the board carries out. At the time of our audit, an audit and risk committee had not yet been put in place.
Govett-Brewster Art Gallery
7.26
We assessed Govett-Brewster Art Gallery's performance as "Progressing".
7.27
New Plymouth District Council is responsible for establishing and maintaining a system of internal controls designed to provide reasonable assurance of the integrity and reliability of financial reporting. Interviewees noted that an advantage of being part of a Council governance structure was the comprehensive internal controls environment.
7.28
Many of the controls for Govett-Brewster Art Gallery are Council-wide control systems, focused on the needs of the New Plymouth District Council. We did not see evidence from the Monitoring Committee minutes or other documents that there are reviews of the internal controls framework, and whether this was meeting the specific needs of Govett-Brewster Art Gallery.
7.29
As we have described in Part 4, there is a lack of clarity in the role that the range of trusts and foundations and other bodies that provide funding have in the governance of Govett-Brewster Art Gallery. This lack of clarity could pose a risk to safeguarding the independence of how Govett-Brewster acquires and manages its collections.
7.30
The New Plymouth District Council's Audit and Risk Committee's responsibilities were heavily focused on compliance and reporting activities.
Te Māngai Pāho
7.31
We assessed Te Māngai Pāho's performance as "Progressing".
7.32
The Audit and Risk Committee manages the external audit process. There is a six-monthly legislative compliance update at Audit and Risk Committee meetings, and the chief executive reports to the board about progress against legislative requirements.
7.33
There is evidence that the board is aware of relevant legislative changes, especially those regarding potential amendments to the Māori Language Act 1987. Strategic planning takes these changes into consideration.
7.34
At times, the board becomes involved in discussing the detail underpinning funding applications and recommendations as part of its approval role. This creates a risk that governance discussions are about operational matters that are usually better left to management and blurring the separation of duties between management and governance.
7.35
In Te Māngai Pāho's view, the board's discussions about funding applications are driven by the in-depth knowledge that board members have about te reo Māori and their passion for revitalising the language. However, there is a risk that the board's ability to hold management to account on funding recommendations is limited if the board is involved in the details of making funding recommendations.
Te Papa
7.36
We assessed Te Papa's performance as "Progressing".
7.37
Board papers and minutes showed evidence that the interests of board members are appropriately declared in board meetings.
7.38
Te Papa's financial challenges in 2013 resulted in a review of its internal controls framework, as well as a targeted review of the factors that had led to the financial issues and why these were not identified earlier.
7.39
The Assurance and Risk Committee was involved in the internal controls framework review. The board also drew on external advice in reviewing Te Papa's internal controls and identifying improvement opportunities.
7.40
We saw evidence that the board was receiving regular updates about progress made towards strengthening the internal controls framework and associated behaviours – such as improving financial literacy across the organisation.
7.41
The board charter and policies include the separation of duties between the board and management, which includes how decisions are made on acquisitions and collections management. During the period between the previous chief executive leaving and the appointment of a new chief executive, the chairperson and the board become more involved in operational matters that would normally be the preserve of management. As we described in Part 4, this shift in the separation of duties was appropriate given that the museum was facing a range of significant financial challenges.
7.42
With the appointment of a new chief executive, the board is now stepping back into a more traditional governance role. It will be important for the board and management to establish and agree separation of duties now there is more stability in the management of the organisation.
7.43
The board has been taking a more active role in understanding and guiding the control systems. The board recognises that these are a main factor in the overall framework that the board uses to assure itself that the organisation will achieve its objectives and meet its external accountabilities. As part of this, Te Papa intends to clarify the role of its Assurance and Risk Committee and the interaction between this committee and the board.
Wellington Museums Trust
7.44
We assessed Wellington Museums Trust's performance as "Comprehensive".
7.45
Board papers and minutes we reviewed show that the interests of board members are appropriately declared at board meetings. The separation of duties between the board and the management of Wellington Museums Trust are set out in the board polices.
7.46
Wellington Museums Trust has an established Audit and Risk Committee. There was a shared understanding of the role and responsibilities of the committee. These included ensuring the efficiency of audits, overseeing the financial systems, and advising the board on the approval of audited financial statements.
7.47
The committee is aware that Wellington Museums Trust's internal controls framework was part of the wider Wellington City Council's internal controls framework. The committee interacts regularly with the Council to understand how the relationship between the internal controls frameworks could be optimised. We saw evidence in the minutes of Audit and Risk Committee meetings that policies about internal controls (such as delegations and legislative compliance) are regularly reviewed and updated.
7.48
The board is aware of the internal controls through board reports, which include the minutes of Audit and Risk Committee meetings.