April 2007

Are smaller schemes equipped with the tools to implement internal controls?

Feedback from some of the best run and largest schemes in the UK regarding the recent Code of Practice on Internal Controls is that it is extremely vague.  Alister Esam, CEO of eShare, asks whether we need to provide smaller schemes with better tools if we are to expect them to implement the Code with their more limited resources.

When the Code of Practice on Internal Controls was issued in November 2006, it caused a shift in focus throughout the industry; until this point ‘Trustee Knowledge and Understanding’ had taken centre stage.  Schemes were looking forward to clear guidance on the way in which they were to implement Internal Controls and address risk.

The new Code of Practice was intended to set out “The Regulators expectations of how occupational pension schemes should satisfy the legal requirement to have adequate Internal Controls in place.”  However, in reality, the code has been brief and non descriptive, saying little more than schemes need to implement controls and providing a generic risk management framework which could apply to any organisation. 

“Trustees of an occupational pension scheme must establish and operate adequate Internal Controls.”

Controls are simply described as being ‘systems, arrangements and procedures’; this fails to provide a more detailed explanation or to supply schemes with examples.  The code gives schemes a great degree of flexibility; but is this level of flexibility helpful for the schemes that have yet to implement Internal Controls?

At eShare, a regular Governance Forum is held; an informal discussion between Pension Managers to discuss the real issues currently affecting their schemes.  It is a place to network and share ideas between pension managers with the goal of achieving a higher standard of governance.

At every recent Governance Forum the subject of Internal Controls has always been high on the agenda.  The general consensus from Members has been that the Code is brief, generic and it is not entirely clear how it impacts on their schemes.

eShare Governance Forum Members are not representative of UK pension schemes.  Their very attendance and proactive concern over the topic of governance demonstrates that they want to be at the forefront of good governance.  They pride themselves on being pioneers in improving standards. 

During past forums, each scheme has expressed different ways in which they have sought to ensure and demonstrate compliance with the Code.  Their strategies vary, each with its positive points and potential flaws.  The conclusion seems to be that even amongst the largest schemes there is a lack of clarity over how they should be implementing the code. 

These are some of the most well regarded schemes in the industry and clearly they are finding the code difficult to interpret.  So how are others coping?  The legislation was supposed provide funds with guidance on how The Regulator wanted to see the implementation of adequate controls; how can we expect this to happen when they lack a definition and clear explanation of what is expected?

Several schemes at the forum believed that – regardless of size and status - a systematic, packaged, preferably IT driven solution to establish and manage Internal Controls was required.  The solution needed to be able to take the inexperienced individual through the process to attain a risk framework for their scheme – and then manage that framework.  It needed to have the rigour of a system driven approach to both the identification of risk, the continual review and the mitigation.

For the smaller schemes this is even more important as they do not have the resources to address these issues in a totally manual way.  Using an IT driven solution can relieve the burden of maintaining these controls, eliminate the mundane aspects associated with them and manage the process for them.

Out of the eShare Forum a focus group of leading schemes went back to basics and started to develop a packaged IT driven approach to implementing Internal Controls using eShare.  The system allows schemes flexibility in their management processes whilst ensuring controls are strictly adhered to at all times.  Risks are allocated to individuals or committees and the burden of managing Internal Controls is lessened as the process becomes increasingly automated.  This automation allows all information to be stored in a centralised location so all scheme stakeholders can view appropriate risks and controls which are relevant to them and drill down to the audit trail.

The real benefit is not for the pioneers of this approach but rather for the small schemes and their advisers who need a structure and system to implement the code.  Smaller schemes can now use these tools to simplify the whole process.

So are the smaller schemes equipped with the tools to implement adequate Internal Controls?

Many of the smaller schemes certainly don’t have the resources or experience to implement Internal Controls but thanks to the larger schemes they are starting to receive some process driven IT solutions that will guide them.