Accurate and timely financial reporting can help Middle East companies seize the many opportunities created by the region’s accelerating, technology-driven transformation. At the same time, investors attracted by the Middle East’s growth and ambitious national transformation agendas need to see reliable financial data before committing to a deal.
Rigorous internal control over financial reporting (ICFR) achieves a variety of objectives. These include financial statements which meet the relevant reporting standards, such as IFRS or locally adapted GAAPs; full authorisation by senior management and corporate boards of the transactions and events reported in the statements; processes to prevent or rapidly detect and amend any unauthorised use of assets and resources; and accurate records of all transactions reported in a financial period.
In addition, implementing ICFR is an opportunity for companies to put in place accounting systems and processes that add value by harnessing the power of data analytics and the latest digital technologies to deliver deeper knowledge and insights about operations, customers and markets.
The benefits of ICFR are highly relevant to Middle East companies, amid the region’s transformation, plus increasing competition from international rivals with the latest data-driven financial reporting systems. Too often, regional businesses lack a specific governance, risk management and compliance system for managing internal controls and have not fully engaged all levels of the organisation with the internal control journey.
Yet encouragingly, an increasing number of Middle East companies have reached a level of maturity where they are now able to capture the many benefits of ICFR, providing examples of best practice for less mature companies. These multiple benefits include clear delineation of ICFR roles and responsibilities; a more collaborative internal control culture, with errors corrected in real-time and seen as opportunities to improve internal practices; and the use of data analytics for continuous monitoring and full oversight over the entire process, enabling greater focus on value-adding areas.
In recent years, the importance of ICFR for Middle East companies has been underlined by a series of high-profile business collapses in private equity, financial services, healthcare and construction sectors. These corporate failures alerted other Middle East companies to look deeper at the quality of their own financial reporting. The global health crisis heightened these concerns, as market lockdowns placed businesses across the region under unprecedented financial pressure.
Coming out of the global health crisis, we see a region-wide transition and drive towards ICFR, due to a series of interrelated factors. Regulators will increasingly insist that companies implement ICFR to meet the highest global reporting standards [see Box 1]. More companies will also consider the quality of their ICFR before committing to an IPO, in order to provide confidence to investors and stock exchanges. For their part, foreign investors will demand ICFR before taking stakes in Middle East companies or participating in fundraising rounds. Lastly, at a strategic level, Middle East countries creating modern, data-based knowledge economies will require rigorous ICFR.
2001: Collapse of Enron
2008-9: Global financial crisis
2016: Oil price slump
2016: Qatar Financial Markets Authority (QFMA) tightens stock market financial reporting rules
2016: UAE’s Securities and Commodities Authority introduces stricter reporting standards
2017: Abu Dhabi Accountability Authority (ADAA) introduces stricter reporting standards
Framework development: Builds an effective governance culture based on financial reporting standards and leading control practices
Operations assessment: Provides a mechanism to add value by identifying all accounting processes and reporting risks
Control design review: Leverages data analytics to assess design adequacy of existing financial reporting controls
Upgrading internal practices: Strengthens control design by re-engineering processes and introducing leading digital practices
Sampling techniques: Deploys data-driven sampling methodologies to add value through broader business insights and deeper knowledge of target customers
Effectiveness testing: Uses data analytics and conventional testing techniques to ensure that all transactions comply with financial reporting requirements
Documentation and representation: Ensures that an effective governance culture remains active throughout the ICFR life cycle
The ICFR agenda allows organisations to work collaboratively to ensure that their operations are accurately translated into figures that are reported in regular, up-to-date financial statements. It sounds simple, but many businesses worldwide still treat ICFR as a tick-box exercise, precisely because they underestimate the challenges of implementing it effectively and thereby do not reap the full benefits.
Regulators must adopt an internationally recognised internal control framework and develop rigorous monitoring regimes to assess implementation of ICFR by organisations.
Investors, shareholders and creditors should demand that a company’s financial statements are accurate and encourage periodic ICFR audits.
Board and audit committees must ensure that financial statements are based on an effective ICFR framework.
Senior management must ensure that finance and risk management teams have sufficient resources, training and governance to design and implement internal controls that meet ICFR standards.
All these initiatives form part of an organisation’s journey from traditional cost-based financial reporting to value-focused ICFR. Before embarking on the journey, it is critical for organisations to assess their level of maturity (see illustration below) in order to extract maximum value from their investment in ICFR. The level of value depends on various factors, including the organisation’s size, operations, accounting framework, internal control systems, governance and overall culture.
From our experience, too many Middle East businesses still regard ICFR as a regulatory burden that they are obliged to implement to avoid being penalised. This can result in a lack of clarity among internal stakeholders about their roles and responsibilities in relation to ICFR; a defensive governance culture; conventional internal controls that do not leverage digital tools or data analytics; and lack of insight into the value-adding potential of ICFR.
Starting late on the ICFR journey is excusable, given the unprecedented global health crisis disruption of the past two years. However, not starting at all is a business risk for Middle East companies that investors, regulators, and other stakeholders will simply not accept.
