Do financial analysts take into account risk management and internal control information?

Transcriptie

1 UNIVERSITEIT GENT FACULTY OF ECONOMICS AND BUSINESS ADMINISTRATION ACADEMIC YEAR Do financial analysts take into account risk management and internal control information? Master thesis to obtain the degree of: Master of Science in Applied Economic Sciences: Business Engineering Dries De Craemer Lead by Prof. Dr. Gerrit Sarens

2

3 UNIVERSITEIT GENT FACULTY OF ECONOMICS AND BUSINESS ADMINISTRATION ACADEMIC YEAR Do financial analysts take into account risk management and internal control information? Master thesis to obtain the degree of: Master of Science in Applied Economic Sciences: Business Engineering Dries De Craemer Lead by Prof. Dr. Gerrit Sarens

4 I, undersigned, declare that the contents of this thesis can be consulted and/or reproduced, provided citation. Dries De Craemer Ondergetekende verklaart dat de inhoud van deze masterproef mag geraadpleegd en/of gereproduceerd worden, mits bronvermelding. Dries De Craemer

5 Nederlandse Samenvatting In deze masterproef wil ik de nagaan hoe financieel analisten omgaan met de publicatie van risk management en interne controle informatie door bedrijven en hoe zij dit opnemen in hun valuatie. Voorgaand onderzoek heeft uitgewezen dat het publiceren van dergelijke informatie voordelen oplevert voor zowel bedrijven als voor alle stakeholders. Na de literatuurstudie volgt het eigen kwalitatief onderzoek waarin door middel van interviews inzicht verworven wordt in de perceptie van de analisten ten opzichte van dit onderwerp. Deze interviews werd gecodeerd en verwerkt door middel van een within case analyse en een cross case analyse. De resultaten van deze analyses worden vergeleken met de literatuurstudie, hieruit worden conclusies getrokken en aanbevelingen gemaakt. Uit de interviews blijkt dat de financieel analisten geen belang hechten aan de publicatie van informatie over het risk management- of interne controle raamwerk dat gebruikt wordt door de bedrijven. Verder stellen we vast dat de bekendgemaakte informatie met betrekking tot risk management of interne control door bedrijven, vaak niet opgenomen wordt door analisten in hun valuatie. Hun valuatie is voornamelijk gebaseerd op kwantitatieve elementen, informatie over risk management of interne controle is hier moeilijk in te integreren. Een andere verklaring die analisten aangeven is dat ze zowel risk management als interne controle beschouwen als elementen van de interne bedrijfsvoering. De systemen op zich hebben dus zeker hun nut, maar de externe rapportering over deze systemen bevat geen meerwaarde. Om aan de wet te voldoen zijn bedrijven vaak verplicht op regelmatige basis bepaalde zaken over risk management en interne controle te publiceren. Het voorbereidingswerk dat hierbij komt kijken en de kosten die hiervoor gemaakt worden kunnen aanzienlijk oplopen. Indien deze informatie niet gewaardeerd wordt door investeerders en analisten, kan men zich afvragen wat de waarde hiervan is en of een herziening van de wetgeving hierrond aan de orde is. De wetgever en toonaangevende organisaties zoals COSO kunnen hiervoor samenwerken zodat de publicatie van risk management en interne controle informatie een meerwaarde kan betekenen voor zowel de bedrijven als voor de stakeholders.

6 Word of thanks I would like to thank a couple of people who contributed to the creation of this thesis. First of all I would like to thank Prof. Dr. Gerrit Sarens who provided me with guidance and advice throughout the year. His input was indispensable for this thesis. Next I would like to thank the financial analysts who found time in their busy schedule to sit down with me and share their expertise. I would also like to thank my parents for supporting me and letting me follow my own path. Without their unconditional support, I would have never been able to achieve what I have during my studies. Lastly, I want to thank my fellow students and friends for their support throughout my studies. i

7 TABLE OF CONTENTS Word of thanks... i TABLE OF CONTENTS... ii Tables used... iv 1. Introduction Risk management Internal control Benefits of internal control Internal control deficiencies Link between Internal Control and Risk Management Why companies disclose risk management and internal control information Legal reporting obligations US Sarbanes-Oxley (2002) section Sarbanes-Oxley (2002) section Europe Belgium Voluntary reporting Consequences of disclosure Risk Management disclosure Internal control information disclosure Analysis of a company Empirical study Research set-up and research question Within Case Analysis Case A: Financial analyst at Petercam Case B: Financial analyst at Leleux Associated Brokers Case C: Senior Equity Analyst at Bank Degroof Case D: Equity Analyst at Petercam Case E: Financial analyst at Petercam Case F: Independent financial analyst at Demes Case G: Independent financial analyst Cross Case Analysis Sources of information for financial analysis Knowledge of risk management and internal control frameworks ii

8 8.3.3 Perceived value of disclosure of risk management Perceived value of internal control information Conclusion General Conclusion Bibliography... iv Appendix... vii Interview 1: Herman van Der Loos (Petercam) Analyst A... ix Interview 2: Geert Van Herck (Leleux associated brokers) Analyst B... xi Interview 3: Marc Leemans (Bank Degroof) Analyst C... xiii Interview 4: Junior Cuigniez (Petercam) Analyst D... xv Interview 5: Roderick Verhelst (Petercam) Analyst E... xvi Interview 6: Gert De Mesure (Bvba DEMES) Analyst F... xviii Interview 7: Vincent Koopman (03/03/2014) Analyst G... xix iii

9 Abbreviations used RM IC ERM COSO CG SOX Risk management Internal control Enterprise Risk management Committee Of Sponsoring Organizations of the Treadway Commission Corporate Governance Sarbanes-Oxley Tables used Table 1: Main valuation methods, ranked by type 14 iv

10 v

11 1. Introduction Analysts play a very important role in today s financial world. They are the ones providing millions of people with reliable and relevant information, based on which these people can make investment decisions. The dataset upon which they base their analysis is very large and probably differs from analyst to analyst or from firm to firm. Most of the large asset managers or financial institutions create valuation models for their analysts upon which they can build and enrich with new or other information. Partly due to a series of scandals, the role of risk management and internal control in today s business environment is becoming increasingly important and consequently, businesses are forced to enhance their corporate governance. With the introduction of new legal requirements, such as the Sarbanes-Oxley act (2002) in the US or the Corporate Governance Code (2009) in Belgium, companies are required to disclose more information on how they deal with elements such as internal control and risk management. These disclosures should be a win-win for both investors and companies. Investors gain more insight in the risk structure and internal control systems, which should boost their trust in the companies and their reporting. Consequently, the companies which disclose this information should benefit from this lower perceived risk and be able to obtain cheaper financing and reduce their cost of capital. (Belgian Corporate Governance Code 2009) The direct consequence of these new regulations is that companies will have additional costs of compliance. Not only the direct costs of creation or expansion of these systems, but also the additional costs of preparing the necessary statements and hiring an external auditor will impact the company s bottom line. While the cost side for the corporations is quantitatively determinable, the benefit side is not. To determine this, one has to assume that the additional disclosures made by the companies will reduce the perceived risk and increase the valuation of a company. (Belgian corporate governance code 2009) The valuation of a company is a complex and subjective matter, the exact value of a company doesn t exist since this is always based on assumptions and depends on the models used by analysts. In this thesis I want to assess whether analysts include the 1

12 disclosure of risk management and internal control systems in their valuation and how they interpret this kind of information. To achieve this, I decided to contact several financial analysts for an interview. After gathering and contacting roughly fifty analysts, I was able to conduct seven interviews with analysts who have different backgrounds, a varying amount of experience and different areas of expertise. During these interviews I wanted to gain insight in which elements they use in their analysis and specifically determine the influence of the disclosure of risk management and internal control information. The data gathered from these interviews was processed and used to analyse the similarities or differences in interpretation and valuation by analysts. This research is obviously subject to certain limitations. First of all, I was only able to interview a small subset of financial analysts who were all located in Belgium. Secondly, some analysts were reluctant to disclose the exact method or model which they used for their analysis since they consider this to be proprietary knowledge of their company or themselves. Furthermore, we re dealing with human behaviour we can t be fully sure they perform their analysis exactly like they described it. This work starts off with a literature review in which we describe the concepts of risk management and internal control. We continue with the legal requirements and possible motives for voluntary disclosure by companies. Next we review the previous research on the impact of risk management and internal control disclosures on the company s performance. The last part of our literature review is a brief description of the most commonly used methods analysts use to determine the valuation of a company. The following part is dedicated to the primary research, which consists of the interviews conducted with financial analysts and the analysis of their responses by using a within case and cross case description. In the conclusion, the most important results will be discussed and compared to previous research, followed by an interpretation and a few recommendations. 2. Risk management To define the concept of Risk management is a hard thing to do, mainly because opinions vary on what it actually means. Many leading organizations have tried to define the concept themselves, leading to several definitions. The most respected risk 2

13 framework to which most firms adapt is the COSO Enterprise Risk Management (ERM) framework (2004). It defines ERM as a process, affected by an entity s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. The matching between risk appetite (the amount of risk a company is willing to take while going about its business) and risk tolerance (the acceptable level of variation in the achievement of the company s objectives) is key here. Risk tolerance is included in the COSO Internal control framework as a precondition to (but not as a part of) internal control, which will be discussed in the next chapter. John J. Hampton (2009) studied enterprise risk management (ERM) in detail and tried to formulate a consensus definition of enterprise risk management: ERM is the process of identifying major risks that confront an organization, forecasting the significance of those risks in business processes, addressing the risks in a systematic and coordinated plan, implementing the plan, and holding key individuals responsible for managing critical risks within the scope of their responsibilities. It s noteworthy that most other definitions have similar elements but stress different aspects of the risk management process. Hampton lists the 4 major advantages of the implementation of ERM; it offers internal as well as external advantages to companies. Internally ERM improves the company s capability to deal with their risk exposure efficiently and provides stability to the enterprise. Externally, it creates stronger relationships with regulators and improves stakeholders confidence in the company. Over the last decades, the enterprise risk management systems have gained a lot of traction. Even though the value of ERM is accepted by most firms to be positive, some firms still haven t adapted to this. Golshan et al. (2012) found that this could be due to several reasons. Some firms misunderstand how ERM can be implemented in an effective way and what benefits it brings them. Pagach & Warr (2010) argue that ERM requires a top-down approach instead of a collaborative one, while Kleffner et al. (2003) claim that troubles in measuring risks across the entire company is a main reason. According to Beasley et al. (2005) larger entities are able to spend more money and other resources to implement ERM, this confirmed the earlier findings by Colquitt, Hoyt & Lee (1999) who claim that bigger companies are more likely to employ a concept of 3

14 integrated risk management than smaller firms. Smaller firms might be willing to implement these systems but simply can t afford it. This could also be a reason why some firms haven t adopted a well-defined ERM system yet. 3. Internal control COSO (Committee Of Sponsoring Organizations of the Treadway Commission) has developed the Internal Control framework in 1992, since then it has gained broad acceptance and is considered to be the most used in the world. Over the years, businesses and operating environments have become more complex, technologically advanced and globalized while stakeholders require more accountability and transparency from them. COSO claims this framework can enable companies to develop and maintain efficient and effective internal control systems which will help them adapt to these changes. Implementing an internal control system enables companies to keep its focus on its operations as well as on its financial performance goals. In summary, COSO defines internal control as follows: Internal control is a process, effected by an entity s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1) Effectiveness and efficiency of operations 2) Reliability of reporting 3) Compliance with applicable laws and regulations This definition stresses that an internal control system is not a one-time thing; it requires a continuous effort a process - from the company. It should be noted that good internal control systems don t directly result in improved firm performance since it cannot prevent external factors which are outside of the company s control. Since we re mostly interested here in the reporting objective of internal control, we ll now focus on this topic specifically. Stakeholders are not only concerned about the reliability of the current financial reports but they re also interested in the future financial statements of the firm. An effective internal control system should relieve the concerns of stakeholders about the reliability of the future financial statements. The reporting objective of internal control systems refers to the reporting of financial and non-financial information on the company, both internally and externally. The external reporting is important because companies often need to comply with 4

15 regulation but it can also be used as a tool to convince stakeholders of the strength of the company. For example, some companies try to obtain the ISO norm for quality management which it can then publish in their annual report. The performance of a company is then judged by investors and analysts by studying the company s annual report and financial statements. (COSO 1992 & 2013) Internal control systems do in no way fully prevent the company from making mistakes, it can only provide reasonable assurance. This term is defined by the FCPA (1977) as such degree of assurance as would satisfy prudent officials in the conduct of their own affairs. When reviewing the adequacy of internal control system, managers must make sure that any mistake that has been made should be able to be considered as a one-time thing, rather than an indication of a failing system which will no longer reasonably assure the reliability of future financial statements. If this is not the case, changes have to be made to the internal control systems and these changes have to be mentioned in the annual report. (Cfr. Infra) 3.1 Benefits of internal control Internal control gives management feedback on how the business is doing and helps to reduce surprises. It increases efficiency and effectiveness within the company and its processes. Moreover, effective internal control is often a necessity to gain access to capital markets which can help a company grow. Internal control leads to increased and more reliable financial reporting to the outside world, which leads to increased investor confidence. Technically, companies are able to determine the costs of internal control systems by adding all the direct costs made to implement the specific systems. However, both the costs and the benefits of internal control systems are rather hard to quantify. 3.2 Internal control deficiencies COSO (2011) defines an internal control deficiency as a situation in which a certain internal control principle is deemed to be non-functional or simply not present. Internal control deficiencies are often classified in one of 3 categories: deficiency, significant deficiency, and material weakness. A material weakness related to financial reporting 5

16 is defined as a condition in which there is a deficiency or a combination thereof in internal control such that there is a reasonable possibility that a material misstatement of the company s financial statements will not be detected, prevented or corrected on a timely basis. The existence of a material weakness in external financial reporting means companies can no longer claim that its internal control system is effective. A significant deficiency is less severe than a material weakness but it s still important enough to the board of directors to look into it. If multiple significant deficiencies are discovered, they are collectively considered as a material weakness. Sarbanes Oxley Section 404 dictates US companies to ensure an internal control system which provides reasonable assurance that material weaknesses will be prevented or detected. This assessment should be made through thorough analysis and testing of the operating effectiveness of the internal controls which prevent or detect material weaknesses in the financial statements. 4 Link between Internal Control and Risk Management Enterprise risk management and internal control are strongly related, yet one is more elaborate than the other. ERM expands in internal control, focusing fully on risk and describing it more broadly, we could therefore state that internal control is a part of risk management itself. They both define 3 different types of objectives which are compliance, operations and reporting. However, enterprise risk management as defined by COSO adds an additional category: Strategic Objectives. These high level goals should be the basis to which the other 3 types should be aligned. (COSO 1992, 2011) It s clear that while internal control is a very useful and necessary exercise, it s not a goal on its own. It s a way for companies to make themselves better, without changing the company drastically, risk management on the other hand has the ability to influence a company at a very high level. 6

17 5 Why companies disclose risk management and internal control information Obviously the increased attention for risk management reporting has several root causes. One could wonder whether companies disclose risk management information to comply with different legal requirements or whether they do this on a voluntary basis to please their stakeholders. Companies in the US have to comply with Sarbanes Oxley (Sections 302 and 404), in Europe all firms have to disclose the principle risks and uncertainties they face (European directive 2006/46/EG) and even in Belgium, companies have to report on their risk management and internal control systems. 5.1 Legal reporting obligations IFRS (International Financial Reporting Standards) and US-GAAP (US Generally Accepted Accounting Principles) already endorse companies to perform risk disclosures, requiring companies to inform their investors in the annual report on going concern uncertainties and key causes of uncertainty influencing estimations US The main regulator in the US is the SEC (Securities and Exchange Commission). Their legal requirements in terms of risk management and internal control disclosure are rather limited. They require publicly traded companies to disclose their risk factors in both the annual and quarterly reports (respectively the 10-K and 10-Q forms). Any changes made compared to the last term should be mentioned in the 10-Q forms as well. The introduction of the Sarbanes-Oxley act completely changed the game for internal control and risk management disclosure. Sarbanes-Oxley is a US act which got approved in 2002 by the American government to set the standard for all US public company s management and boards. Most notably, it forced top management to personally certify the accuracy of its financial reports in order to prevent fraud. Additionally, it required them to hire independent external audit firms to verify the financial statements. The 2 most important sections (302 and 404) relevant to this paper are further explained below. 7

18 Sarbanes-Oxley (2002) section 302 The Sarbanes-Oxley Public Company Accounting Reform and Investor Protection Act (2002): section 302 is dedicated to the company s corporate responsibility when it comes to financial reports. It requires the principal executive officer and principal financial officer of American companies to personally certify each annual or quarterly report. They have to guarantee that they have read the report and that it by their knowledge- does not contain any untrue statement and that it fairly represents the financial situation of the company. These executives are also responsible for setting up an internal control system which will inform them about any important material information. The effectiveness of this system has to be tested on a regular basis. Every annual report should also include a review of the effectiveness of these systems. All significant deficiencies in the internal control system or cases of fraud which could reduce the effectiveness of financial reporting have to be disclosed by the signing officers to the external auditor and internal audit committee. Additionally, every significant change in the internal control system should be documented Sarbanes-Oxley (2002) section 404 The Sarbanes-Oxley Public Company Accounting Reform and Investor Protection Act (2002): section 404 is dedicated to the assessment of internal control of financial reporting. It states that every public US Company which publishes an annual report should also include an internal control report in it. This should state the responsibility of management for establishing and maintaining an internal control structure for financial reporting. It should also contain a report on the effectiveness of the internal control framework and systems of the company. Additionally, it states that every public US Company should have their internal control systems audited by a registered public accounting firm (external auditor) which will have to attest to and report on the internal control by the company s management. Management also has the responsibility to evaluate every change that is made in the internal control over financial reporting during the year. It s worth noting that the US law doesn t specifically ask for a risk management framework like they do for an internal control framework. As we will see next, this is the biggest difference between US and European regulation. 8

19 5.1.2 Europe In 2006, Europe issued a guideline (2006/46/EG) which forced public companies with a branch in Europe to include a separate note on corporate governance with their yearly report. This report should include important information on corporate governance and more information on their applied risk management and internal control systems relevant to the process of financial reporting. If a company is part of a group, it s not necessary to publish separate corporate governance reports for all the separate branches, it is however mandatory to provide information on risk management and internal control systems of the group. Directive 2003/51/EC also requires companies to give an elaborate description of the principal risks to which they re prone and which uncertainties they face in the future. The European risk reporting is more advanced and elaborate than the US equivalent. It focuses on the entire corporate risk exposure, treating risks of all categories instead of just sticking to single risk factors and market risks Belgium In Belgium, the laws regulating corporate governance, specifically the part about risk management and internal control systems is not as elaborate as the American Sarbanes Oxley act. Belgian law dictates Belgian financial companies to describe the most important characteristics of their internal control- and risk management systems related to the process of financial reporting. (Belgian Law of 06/04/10) Belgian companies are required to use the Belgian Corporate Governance Code (2009) as the guideline and standard. This code is based on the same comply or explain principle which was recommended by the OESO and recognized by the European Union in its 2006/46/EG guideline. This code states that the board is responsible for taking the appropriate measures to guarantee the integrity and timely publication of the annual report and other financial and non-financial information which has to be made available to stakeholders or possible stakeholders. They re also responsible for the approval of a framework of risk management and internal control (Cf. COSO framework) which is established by the management. This framework should clearly define the definitions of internal control and risk management and help management implement the appropriate risk 9

20 management and internal control systems. The monitoring of effectiveness of these systems has to be tested at least once a year. (Belgian Corporate Governance Code 2009) A description of the most important characteristics of these systems should also be made public in the Corporate Governance chapter. This chapter specifically states that the management has to create a system of internal controls which identify, evaluate, control and monitor financial and other risks, within the framework approved by the board. (Belgian Corporate Governance Code 2009, principle 6.5) 5.2 Voluntary reporting Voluntary reporting on risk is something a lot of companies already do on a frequent basis to keep their stakeholders informed. Identifying the exact reason why they do this is of course not possible, but it s very likely they do this to please their stakeholders in an attempt to increase their trust in the company. During the last economic crisis it became clear that trust in a public (quoted) company is essential and a lack thereof could be detrimental to a firm. If we follow this reasoning, we would assume that reporting on risk management and internal control information would be beneficial to a firm. One could ask the question whether risk disclosure should be regulated and become mandatory or if it should stay voluntary to reward the most open companies. Some institutions have suggested frameworks in which companies could report on all business risks and provide forward-looking risk disclosures. The problem with this type of regulation would be that companies would be reluctant to providing stakeholders with information which is sensitive and which they don t want their competitors to see. This would result in incomplete risk disclosures which wouldn t effectively reduce the information asymmetry with stakeholders and therefore wouldn t change the required risk premium. (Dobler 2005) Additionally, empirical evidence from Germany showed that risk disclosures only marginally improved after legally requiring companies to report on risk. (Bungartz, 2003; Kajüter, 2004; Fischer and Vielmeyer, 2004) Jorgensen and Kirschenheiter (2003) concluded that imposing mandatory risk disclosure requirements will result in a lower company valuation. They argue that forcing companies to make disclosures they wouldn t voluntarily make, leads to higher 10

21 disclosure costs and therefore a lower company value. They also found that in a voluntary risk disclosure environment, companies who do disclose have a higher share price. This is in line with the findings of Verrecchia (1983) who argues there is an optimal level of risk disclosure after which point the disclosure becomes more expensive than the benefits is brings to the company. We can therefore assume that companies will never voluntarily fully disclose all of their risk information, since this would take up too much resources. In the next chapter we will analyse the consequences of the disclosure of risk and internal control information in detail. 6. Consequences of disclosure 6.1 Risk Management disclosure Dobler (2005) and Healy and Palepu (2001) have investigated the influence of risk disclosure on a company s performance and have concluded that Reporting on risk may decrease the firm s risk premium demanded by the investors and decrease the firm s cost of capital. Risk reporting reduces information asymmetry between stakeholders and the company, which will lower the firm s risk premium demanded by the market to invest with the company. A lower risk premium will result in a lower cost of capital (when calculating the cost of capital through CAPM). (Solomon et al., 2000; Linsley and Shrives, 2000; Lang and Lundholm, 1996) Furthermore, literature has indicated that reporting on risk encourages firms to more actively manage the risk of their own portfolio which is also beneficial to a company. (Linsley and Shrives, 2000). Kajüter (2001), Woods and Reber (2003) and Beretta and Bozzolan (2004) found that firms tend to disclose information on past and present risks, but are rather reluctant to disclosing information on future risk. Linsley & Shrives (2006) contradict this in their more recent study. They found a statistical significant amount of forward-looking risk disclosures. This could be explained either by the increasing attention for risk disclosures in the last couple of years, or by the more broad definition of risk used by Linsley & Shrives. 11