King II report delivers good, bad news for IT

The second King Commission report released on Tuesday raises a number of conundrums for local companies, especially those in the IT arena. The most pertinent surround risk management, e-business and delinquent directors.

The report highlights the task of assessing risk management as one of the more important duties of a company`s board of directors.

"The board must decide the company`s appetite or tolerance for risk - those risks it will take and those it will not take in the pursuit of its goals and objectives," reads the report.

This encompasses day-to-day risk, including safeguarding information and ensuring a company can continue operations in "adverse conditions".

Philip Armstrong, GM of the corporate governance department at attorneys Edward Nathan Friedland, says this would mean companies have to look carefully at IT security, as well as backup systems such as storage and disaster recovery.

"Companies now function almost entirely on IT systems; directors have to familiarise themselves with IT functionality. Data has become vulnerable with all the viruses out there.

"Risk is a day-to-day operational issue. Directors understanding risk, including IT risk, is an inherent part of their responsibilities," says Armstrong.

The King II report acknowledges that e-business has become a fundamental part of many local businesses. With this in mind, the commission recommends that sound control and governance extend beyond the boundaries of the business itself.

The report says companies should ensure that business partners along the supply chain within an e-business set-up also have adequate governance in place.

While no specific recommendations have been set, it raises serious implications for e-marketplaces that will have to ensure each of the companies in its marketplace adhere to satisfactory governance principles.

However, Armstrong points out that in reality this would take the form of a due diligence kind of assessment before admitting a company to a supply chain. It would focus primarily on the risk aspects of governance, and be performed to protect a company`s day-to-day operations.

The report points out that the responsibility to stakeholders, including staff, is particularly pronounced in IT companies.

"Typically, these organisations have traded at a significant earnings multiple because of their perceived growth potential. Employees are often attracted to these businesses with comparatively low fixed income because of the same growth expectations," reads the report.

"Many stakeholders in the organisations do not have a full understanding of the true opportunities or threats facing the organisation. Consequently, the importance of the basic tenets of good governance is particularly significant.

"Management needs to be completely honest and transparent in reporting organisational results and prospects."

This extends to all IT companies, including unlisted entities. Armstrong says while this is not legislated, transparency forms part of a company`s business practice which will be scrutinised.

The report also calls for more stringent legislation concerning delinquent directors.

Despite the fact that the Companies Act requires the Registrar of Companies to keep a list of directors of dissolved companies who have not paid their debts, the King II report points out that in practice this is seldom enforced.

The report states that it is extremely onerous to check some of the grounds of disqualification, while "it may be impossible to check others".

The report recommends that legislative changes be implemented to "buttress the existing provisions of the Companies Act regarding director`s disqualification".

This means that any company would have to conduct "fit and proper" tests on new directors in the same way as a JSE-listed company or a bank.

Armstrong, who is passionate about this section of the report, says new legislation cannot be passed fast enough, although the wheels of government turn slowly.