By Heather Cheeseman, Partner, Internal Audit, Risk and Compliance and Bruce Willis, Partner and National Lead, Internal Audit, Risk and Compliance, KPMG in Canada
On the path to a public offering, a solid foundation counts. Every step to a stock market launch must be supported by a unified vision, stakeholder commitments, and an accurate and timely view of the organization's current standing. Herein, having the right internal controls is critical to having that support take seed.
"As a business and management team, if you're heading down the public path, you need to know the information you're using to analyze the organization and make good decisions is accurate, timely, and complete," says the Chief Financial Officer (CFO) of a large Canadian retailer, who quarterbacked the apparel company's own initial public offering (IPO) in 2017, as well as additional IPO processes prior to joining the company.
"Part of our main objective," he continues, "Was to embed the right controls, within the most effective framework, to get us information faster so that we could continually generate updates as to how we were performing in relation to our strategic objectives and – more importantly – allow us to adjust our strategy as needed based on real-time business results."
The retailer's decision to go public was a natural next step in its expansion ambitions. By doing so, the company aimed to bolster its brand, access a wider pool of talent, build its global supplier network, and generate new financial streams for its ambitious growth objectives.
Having led IPO transitions in his past, the CFO recognized the need to invest in a framework for internal controls that would position the company well for its public debut.
"Once you've been involved in an IPO process, you appreciate the value of timely and reliable financial information," he says. "There's a tendency to just assume the information is right and that all you need is the annual financial statements, but the reality is you need controls in place to produce accurate information that will help you make quick business decisions. So as you approach something like an IPO, it becomes clear you need a framework."
With the need for an internal controls framework came the requirement of buy-in from the organization's leadership and board. Fortunately, he recalls, making the case for an investment in an internal control framework came easy, "I took the board through a review of the company's current strengths and the opportunities on our horizon. Once they saw where we could be, and how consistently accurate data would get us there, they trusted the move to begin looking for a suitable framework."
There is no one-size-fits-all approach to internal control frameworks. The challenge is to find the right system, with the right balance for the organization. For the Canadian retailer, that was the Committee of Sponsoring Organizations of the Treadway Commission's (COSO) fit-for-purpose framework, described by the commission as 'a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance'.
"What I liked about this framework model was its risk-based approach," he says. "It's not a textbook, off-the-shelf model that makes us review every single area; it focuses on our priorities and greatest areas of risk."
The flexibility of the fit-for-purpose framework was also a draw. It enabled the organization to grow and evolve beyond its IPO by utilizing elements of the framework to ensure its controls were doing their job and aligned with the organization's objectives.
The top-down nature of the framework instilled additional support, notes the CFO, "I think a lot of companies lose sight of the fact that everyone needs to be involved in this process – right up to the board level."
Selecting the COSO framework was an important step. So too, says the CFO, was finding the right risk management support to embed the fit-for-purpose model into the organization.
"I've always found that the best approach is to partner with someone who can come into the company with an outside perspective, assess our current governance and control environment, and help set up a framework that will allow us to not just do the assessment of the controls, but understand what is needed on a go-forward basis," says the CFO. "This approach went a long way to ensuring we extracted full value out of the exercise," he adds.
That go-forward support continues to fuel the retailer's success. The fit-for-purpose framework has not only bolstered operations, but it has generated a renewed sense of confidence among staff, stakeholders, and industry analysts in regards to the organization's growth.
"Having the assurance that we follow a framework, that we have these controls in place and that we assess them regularly, gives a lot of people confidence that the information we're presenting is accurate," says the CFO. "I'm looking forward to presenting the results of our internal control work to the board because I believe when we show them the controls we have in place, they'll be able to breathe a sigh of relief knowing what we're showing them is up to date and accurate. Over time, their level of confidence will increase as we present and certify on a regular basis."
As for the organization's ability to maintain that degree of confidence, he states, "After a while, the controls become part of your DNA. They become routine, which is the way it should be, so at the end of the day you can focus your time and efforts on building the organization and using the information that's coming out as a result of those controls."
Although the organization's IPO transition may have been his third time going public, the CFO is first to admit that each company's experience is unique. Nevertheless, he has accrued more than a few insights into the process; the first of which being that any major transition is apt to fail without the right team.
"You have to make sure you have the right people on your side. That can mean working with third-parties that have been through the process before, or bringing on more talent in your finance department to oversee your controls, which is what we did," he says.
Another lesson learned is that it pays to assess one's current controls and organizational capabilities to better understand one's needs and avoid spending more time and resources on unnecessary changes. And finally, he concludes, on the road to public offering, it pays to take your time, "You need to get out in front of it, especially when you're introducing controls. Even if going public is on the distant horizon, there's no harm in going through the exercise today. You'll get timely and accurate information that will only benefit your business."