2008 Annual report - Sappi

Corporate governance // continued
resources and financial forecasts. The group’s results are
reviewed prior to submission to the board as follows:
• All four quarters and financial year end – by the disclosure
committee and audit committee; and
• Interim and final quarters – by the group’s external auditors.
Internal controls
The board is responsible for the group’s systems of internal
financial and operational control. The group’s internal controls
and systems are designed to provide reasonable assurance as
to the integrity and reliability of external financial reports, that
assets are adequately safeguarded against material loss and
that transactions are properly authorised and recorded. Such
controls are based on established written policies and
procedures which are monitored throughout the group and
are applied by trained, skilled personnel with an appropriate
segregation of duties through clearly defined lines of accountability
and delegation of authority. The control system includes
comprehensive reporting and analysis of actual results against
approved standards and budgets. All employees are required
to maintain the highest ethical standards in ensuring that the
company’s business practices are conducted in a manner
which in all reasonable circumstances is above reproach. As
part of an ongoing process, reviews were undertaken across
the group of the effectiveness of various elements of the group’s
internal controls, procedures and systems. Where potential
improvements are identified, they are being addressed. The
reviews enabled management to further strengthen the group’s
controls and the results of the reviews did not indicate
any material breakdown in the functioning of these controls,
procedures and systems during the year under review. A material
breakdown is defined as a critical weakness in process
or financial systems which could result in a material loss,
contingency or uncertainty requiring disclosure in the published
annual financial statements. Section 404 of the US Sarbanes-
Oxley Act requires companies listed on the NYSE to complete
a comprehensive evaluation and report on the effectiveness
of their internal controls over financial reporting. Sappi has
conducted its third evaluation at the end of fiscal 2008 and will
include its section 404 report in its Form 20-F to be filed with
the United States Securities and Exchange Commission.
Disclosure controls
Disclosure controls and procedures include controls and
procedures designed to ensure that information required to be
disclosed by the group in the reports that it files or submits is
accumulated and communicated to the group’s management,
including the chief executive officer and chief financial officer,
as appropriate to allow timely decisions regarding required
disclosure. The group has implemented disclosure controls
and procedures as deemed appropriate by management. The
disclosure committee meets to review all Sappi Limited external
financial reports prior to their release. On occasion, these
meetings are held jointly with the audit committee.
Internal audit
The group’s internal audit department has a current complement
of 20 persons, of which 15 are experienced and qualified and
five are in training. It has a specific mandate from the audit
committee and independently appraises the adequacy and
effectiveness of the group’s systems, financial internal controls
and accounting records, reporting its findings to local and
divisional management, the external auditors as well as the
respective audit committees. The head of internal audit reports
to the audit committee on a functional basis and to the chief
financial officer on a daily operational basis and has direct
access to the chief executive officer. The internal audit coverage
plan is based on a risk assessment performed for each operating
unit. This incorporates risks identified by management during
the group risk assessment process as well as the results of
audit work performed. This process ensures that the audit
coverage is focused on identified high risk areas. During 2008
internal audit focused on expanding the IT audit scope
to provide additional assurance to management in the IT
security audit area, application control reviews and forensic IT
audit. Internal Audit also started to focus more resources on
operational audits and the inclusion of the top risks per region
in the determination of the audit coverage plan. Internal audit
meets privately with the audit committee and individual board
members on a regular basis. The report submitted by Internal
Audit to the audit committee includes amongst other things
an overview of hotline allegations and forensic activities, a
summary of potentially significant control issues identified, audit
risk assessments, audit coverage plans, actual performance
against planned activities, the periodic evaluation of the system
of internal controls and details of any scope restrictions as well
as audit resource developments.
Company secretary
All directors have access to the advice and services of the
company secretary and are entitled and authorised to seek
independent and professional advice about affairs of the group
at the group’s expense. The company secretary is responsible
for the duties set out in section 268G of the South African
Companies Act of 1973. Specific responsibilities include the
provision of guidance to directors as to how to discharge their
duties in the best interests of the company as well as arranging
for the induction of new directors.
Code of ethics
Sappi requires its directors and employees to act with the
utmost good faith and integrity in all transactions and with all
68