Our performance in 2009 - Sappi

80 Corporate governance continued
Disclosure controls
Disclosure controls and procedures include controls and procedures designed to ensure that
information required to be disclosed by the group in the reports that it files or submits is
accumulated and communicated to the group’s management, including the chief executive officer
and chief financial officer, as appropriate to allow timely decisions regarding required disclosure.
The group has implemented disclosure controls and procedures as deemed appropriate by
management. The disclosure committee reviews all Sappi Limited external financial reports prior
to their release. On occasion these meetings are held jointly with the audit committee.
Internal audit
The group’s internal audit department has a current complement of 18 persons, of which 14 are
experienced with relevant qualifications and four are in training. It has a specific mandate from
the audit committee and independently appraises the adequacy and effectiveness of the group’s
systems, financial internal controls and accounting records, reporting its findings to local and
divisional management, the external auditors as well as the respective audit committees. The
head of internal audit reports to the audit committee on a functional basis and meets privately
with the audit committee and individual board members on a regular basis. The head of internal
audit has direct access to the chief executive officer and chief financial officer as well as other
senior management, as required, and has an open invitation to attend executive and management
committee meetings such as the audit committee, disclosure committee, audit review meetings,
chief financial officer meetings, group risk meetings and regional financial committee meetings.
Internal audit is also invited to attend and participate in strategic workshops at group and regional
levels. This is in line with the strategic positioning of internal audit as recommended by the King III
Report whereby internal audit’s role should not be restricted to a compliance activity but should
be risk-based, aligned with the company’s strategy and risk management process. The internal
audit coverage plan is based on a risk assessment performed for each operating unit. This
incorporates risks identified by management during the group risk assessment process as well
as the results of audit work performed. This process ensures that the audit coverage is focused
on identified high risk areas. During 2009, internal audit focused additional resources on IT
security, forensic investigations and the integration and control readiness projects relating to the
four new mills in the Europe region. The report submitted by internal audit to the audit committee
includes amongst other things an overview of Hotline allegations and forensic activities, a
summary of potentially significant control issues identified, audit risk assessments, audit coverage
plans, actual performance against planned activities, the periodic evaluation of the system of
internal controls and details of any scope restrictions as well as audit resource developments.
Our resources are allocated to audit projects based on a top down risk assessment approach
employing the GAIT methodology, which is a guide to assessing the scope of IT general controls
based on risk. The different types of audit assignments conducted in 2009 are represented in
the chart alongside.
Company secretary
All directors have access to the advice and services of the company secretary and are entitled
and authorised to seek independent and professional advice about affairs of the group at the
group’s expense. The company secretary is responsible for the duties set out in Section 268G
of the South African Companies Act of 1973. Specific responsibilities include the provision of
guidance to directors as to how to discharge their duties in the best interests of the company as
well as arranging for the induction of new directors.
Code of ethics
Sappi requires its directors and employees to act with the utmost good faith and integrity in all
transactions and with all stakeholders with whom they interact. This commitment is reflected in
the group’s Code of Ethics that commits the company and employees to sound business
practices and compliance with legislation.