INEDs (like other directors) are responsible for the issuer’s compliance with financial reporting obligations. This includes ensuring that financial statements give a true and fair view of the issuer’s financial position.  

Steps to take:

• Establish procedures to ensure keeping of accurate books and records
• Ensure there is sufficient and clear information to enable a regular and informed review of financial data and other information
• Pay attention to red flags – be wary of unusual patterns of transactions, significant expenses or outflow of money - proactively raise enquiries
• Understand auditors’ concerns, take proactive steps to obtain the issuer's financial statements and ensure that they provide a true and fair view of the state of the issuer's affairs and its operational results and cash flows
• Closely monitor the audit process and regularly meet with management and auditors to ensure any audit issues are timely addressed

Questions to ask:

• What is the process of financial reporting at the issuer, who is involved (internally / externally)?
• Has sufficient information been provided to review financial reports?
• Are there any concerns flagged by management or the external auditors? If yes, has sufficient information and responses been provided by management?
• Has the issuer complied with applicable reporting and disclosure obligations?

With their expertise, experience and independent judgement, INEDs are important facilitators assisting the issuer to respond promptly and proactively to any incidents.  

Steps to take:

• Understand and investigate the issues brought to the attention of the Board
• Upon discovery of non-compliances and/or other issues, promptly review and discuss among the Board and take appropriate action to i) address the issues, rectify or remedy the breach; and ii) reassess any internal controls and take measures to prevent future Rule breaches 
• Reassess any internal controls and take measures to prevent future Rule breaches
• Where red flags have been highlighted, tangible efforts should be made to investigate, and follow up on whether, and how, the red flags have been addressed
• Consider Listing Rule implications and disclosure or reporting requirements
• Apply independent judgement to incident assessment and do not simply rely on management to address possible compliance issues
• When the Exchange makes enquiries of the issuer, take steps to follow up and ensure that responses are substantive, accurate, timely and properly documented
• Consider and encourage training of the Board, management and staff to prevent future incidents

Questions to ask:

• What is the applicable process to investigate and remediate the incident under the internal controls?
• What remedial steps should be adopted? Any need to engage external providers?
• How is the implementation of remedial measures monitored?
• Are there any potential Listing Rule or legal / regulatory implications?
• What is the impact on the issuer’s financial reporting?
• Is there any mandatory reporting requirement (to the Exchange or other authorities) in relation to the incident?
• Is any reporting to authorities required as part of the remedial measures identified?
• How are the incident and remedial measures going to be documented?

Oversight of an issuer’s risk management and internal controls is the responsibility, individually and collectively, of the directors, including INEDs.

Steps to take

• Take an active role in designing, implementing, reviewing and monitoring the effectiveness of the internal controls
• Independently assess and review the internal controls - do not simply rely on representations by management
• Ensure that annual reviews are carried out and that internal control reviews cover all material controls (reviews covering only selected internal control cycles on a rotation basis are a deviation from the Corporate Governance Code)
• In annual reviews, among other areas, ensure the review of the adequacy of resources, qualifications, training and experience among the staff
• Proactively consider the necessity of, and establish and implement controls and procedures (as appropriate) for new businesses and transactions
• Set up mechanisms by which information and documents regarding the operations, development, financial performance and risks of new businesses, subsidiaries and/or joint ventures, will be provided to INEDs for review and assessment
• Establish appropriate policies and guidelines governing the investments, and request regular updates of the status and performance of the investments to the Board 
• Assess and ensure that internal controls do not only exist on paper but are properly implemented in the day-to-day operations of a new business 
• Where internal control deficiencies are identified, take steps to ensure that they are properly addressed and rectified - monitor the progress of remedial measures

Questions to ask

• What is the scope of the existing internal controls, how are they monitored on a regular basis? Any documentation?
• What is the process for the annual review of the internal controls' effectiveness?
• Who are the parties responsible (internal and external) for the internal controls and the monitoring and review?
• Are there sufficient resources for the monitoring and review of internal controls?
• If any improvement areas have been identified in the annual review, what are the remedial steps, and what is the status of implementation

INEDs should apply independent judgement and cast an eye over the issuer’s business decisions and transactions.

Steps to take:

• Ensure there is sufficient information to make informed decisions on the matters at hand
• Participate and ask questions – raise concerns with the Board and exercise independent judgement. Do not merely rely on representations of responsible directors or management
• Even if you are not attending a Board meeting, consider the agenda items and obtain minutes of the meeting, raise enquiries before, or follow up after the meeting, or both
• Independently assess professional advice and the reasonableness of valuations
• Ensure the internal control and risk management systems take into account any changes to the issuer’s business and operations, and that there is a mechanism in place for follow-up on the proper conduct of the new business
• Carefully review corporate communications and any other documents (such as monthly financial reports) of the issuer presented to directors for consideration and ensure accuracy and completeness of information
• Ensure that contributions and concerns are properly recorded

Questions to ask:

• Is the proposed new business in the (best) interest of the issuer?
• Has sufficient (or any) due diligence been conducted? 
• Have the risks arising from the new business / transactions been analysed and addressed? 
• What are the Listing Rule implications?
• Have internal procedures been followed and complied with?
• Any consultation with professional advisers and has their advice been implemented?