Continuing delays in concluding the terms of the Brexit withdrawal agreement mean that the trading landscape will remain unclear throughout 2019. Businesses are obliged to keep a wide range of potential scenarios under consideration as they attempt to limit the impact of any disruption and manage risk, whilst ensuring that they can take advantage of new trading opportunities outside the European Union.
This poses challenges for Heads of Internal Audit – faced with providing assurance during a period where the risk environment is fluid and uncertain - with management obliged to plan without full information and take action at short notice. The operation of core business controls will also come under threat as management attention is drawn away from “business as usual” operations to deal with immediate issues arising from Brexit.
How are businesses responding?
In early 2019, the Chartered Institute of Internal Auditors published its survey of Chief Audit Executives - Organisations’ preparedness for Brexit- an internal audit perspective. This reported that 75% of businesses surveyed have established a response committee or steering group. This committee typically includes representatives from HR, Legal, Finance, Compliance, Procurement, Supply Chain and Senior Management and has a reporting line to the Board. In many cases, the Head of Internal Audit is also a committee member. For smaller organisations, the Board is taking the lead.
Heads of Internal audit should be reviewing the governance arrangements of the business to ensure that these are sufficient to meet the challenges arising from Brexit. By necessity, they will need to be flexible, enabling decisions to be taken quickly but within an agreed framework of delegation that requires issues to be considered thoroughly before action is taken by those with the appropriate authority.
Key planning activities that should have already been undertaken include scenario planning and impact assessment. In spite of the uncertainty and lack of firm information, business planning should cover a wide range of outcomes to enable those aspects of business operations that are likely to be subject to the most significant impact from Brexit to be identified and viable mitigation strategies developed.
Heads of Internal Audit should be reviewing Brexit scenario planning, to ensure that this is sufficiently detailed and that management plans provide a proportionate response to the emerging risks.
The key elements of Brexit scenario planning are:
- Supply chain mapping
- Workforce planning
- Forecasting analysis
- VAT compliance
- Tax planning
- Data protection.
Businesses should have mapped their supply chain in detail so that they fully understand all the potential challenges and pressure points. This is crucial and should include as a minimum: supply contract obligations and liabilities, logistics, VAT and customs regulation, economic origin documentation required, specific commodity restrictions and notifications, lead times, distribution hubs, inventory building capacity, potential additional costs of delays and obsolescence.
The UK Migration Advisory Committee report on European Economic Area (EEA) migration could have significant consequences for many employers- especially in those sectors employing a high number of EU nationals such as healthcare, hospitality, food production, retail and construction. Workforce issues should have been included in scenario planning to ensure that the business has access to the necessary skills and labour to continue delivering on its objectives.
All businesses rely on forecasts for important management decisions – for example, budgets, valuations, impairment reviews, tax planning, going concern assessments. These forecasts will implicitly or explicitly include assumptions about Brexit. Regardless of what the assumptions are - they should be have been reviewed carefully. Are they realistic? Are they prudent? What are the consequences if the assumptions are significantly incorrect?
Many countries have different VAT arrangements for EU and non-EU businesses. After Brexit, UK businesses will be subject to non-EU arrangements and will therefore need to have double-checked whether their current VAT registrations remain valid. If the current “reverse charge” regime comes to an end without a firm deal, the UK Government has announced that it will introduce transitional cash-flow relief arrangements. These are subject to an approval process and businesses need to have taken steps now to determine whether they can benefit from the relief and if so, to begin the application process.
The UK will cease to benefit from the EU parent subsidiary directive with the consequence that withholding tax may now be due on dividends and interest flows between the UK and Group members in the EU. The suitability of the Group structure needs to be have been reviewed in this context.
Discussions around an agreement on data protection between the UK and EU may continue after Brexit day. UK businesses that receive data from the EEA need to have considered establishing safeguards that will enable data to continue to be transferred until an agreement is reached. Key aspects include binding corporate rules - these require approval by an EEA supervisory authority - and appropriate contractual clauses.
Other options that may also require consideration include:
Authorised Economic Operator (AEO) accreditation - HMRC has suggested that AEO accredited suppliers may be able to have their goods fast–tracked in the event of severe customs delays. It may be of particular benefit to manufacturers and retailers with complex supply chains.
Establishing an EU presence - setting up a subsidiary company or establishing operations in the EU could help mitigate supply chain risk. For financial services, this could enable regulatory authorisations such as passporting rights to be maintained. The Institute of Directors survey of UK businesses in February 2019 noted that 29% were planning or had already shifted part of their operations to a base inside the EU such as Dublin or Paris. Alternatively, the acquisition of a local EU business may be a quicker option.
Ensuring internal audit is fit for purpose
The impact of Brexit during 2019 is likely to be considerable. Heads of Internal Audit therefore need to reconsider their approach and ensure that the internal audit team has the capacity and skills to provide the assurance and ongoing support and challenge required during this difficult period.
As a starting point, the internal audit plan needs review to ensure that it provides the correct balance between core business activity and the management of emerging risks. The key areas of Brexit governance and scenario planning must be considered.
The plan also may require expansion to cover more areas than usual. This could put pressure on team capacity and additional resources may be required to deliver the assurance. Some of the areas are highly technical e.g. VAT, customs regulations. Heads of Internal Audit may need to look outside their teams and appoint external subject matter experts to support the assurance.
Flexibility will also be a key consideration. A more agile approach will need to be adopted with audits likely to be rescheduled at short notice and resource reallocated to respond to an emerging issue. Agile auditing may be a more suitable approach with short sprints of assurance in relation to projects where the end goal is still being defined. Traditional reporting cycles may need to be abandoned and shorter, sharper reporting adopted.
Whatever governance arrangements the business has established to consider its response to Brexit, Heads of Internal Audit should insist on a seat at the table to participate in the discussions. It is crucial that they keep up to date with developments and their expertise in risk and control will be invaluable.
Finally, Audit Committee engagement is essential. They need to understand and be comfortable with the approach to assurance during 2019, agree the reporting arrangements and support any additional funding required.