Guidelines for the Assessment of the Performance of Audit Committees of Companies Listed on the Exchange

May 31, 2012 SEC MEMORANDUM CIRCULAR NO. 4, S. 2012 GUIDELINES FOR THE ASSESSMENT OF THE PERFORMANCE OF AUDIT COMMITTEES OF COMPANIES LISTED ON THE EXCHANGE Consistent with the objective of the Commission to align its rules with global standards and practices in order to develop the Philippine capital market, it issued the Revised Code of Corporate Governance (the "Code") in 2009 to foster and promote effective, quality, and transparent corporate governance. One of the significant provisions of the Code is the creation of an audit committee ("AudCom"). The role of the AudCom has been given importance due to the reliance by global capital markets on quality financial statements. Recent events in developed countries have shown the need for an effective AudCom to ensure not only accurate and transparent financial disclosures but also the observance of adequate risk controls. These guidelines shall apply to companies listed on the Philippine Stock Exchange ("Exchange"). For companies in the process of registering their securities for public offering and listing, a transition clause is provided for in paragraph (5) of these Guidelines. All other corporations are encouraged to conduct similar assessment activities. 1. Oversight Responsibilities Under the Code Article 3 (K) of the Code provides that the AudCom shall consist of at least three (3) directors, who shall preferably have accounting and finance backgrounds, one of whom shall be an independent director and another with audit experience. The chair of the AudCom should be an independent director. It likewise provides the following functions of the AudCom: a) Assist the Board in the performance of its oversight responsibility for the financial reporting process, system of internal control, audit process, and monitoring of compliance with applicable laws, rules and regulations; cASIED b) Provide oversight over Management's activities in managing credit, market, liquidity, operational, legal and other risks of the corporation. This function shall include regular receipt from Management of information on risk exposures and risk management activities; c) Perform oversight functions over the corporation's internal and external auditors. It should ensure that the internal and external auditors act independently from each other, and that both auditors are given unrestricted access to all records, properties and personnel to enable them to perform their respective audit functions; d) Review the annual internal audit plan to ensure its conformity with the objectives of the corporation. The plan shall include the audit scope, resources and budget necessary to implement it; e) Prior to the commencement of the audit, discuss with the external auditor the nature, scope and expenses of the audit, and ensure proper coordination if more than one audit firm is involved in the activity to secure proper coverage and minimize duplication of efforts; f) Organize an internal audit department, and consider the appointment of an independent internal auditor and the terms and conditions of its engagement and removal; g) Monitor and evaluate the adequacy and effectiveness of the corporation's internal control system, including financial reporting control and information technology security; h) Review the reports submitted by the internal and external auditors; i) Review the quarterly, half-year and annual financial statements before their submission to the Board, with particular focus on the following matters: Any change/s in accounting policies and practices Major judgmental areas Significant adjustments resulting from the audit HIAESC Going concern assumptions Compliance with accounting standards Compliance with tax, legal and regulatory requirements. j) Coordinate, monitor and facilitate compliance with laws, rules and regulations; k) Evaluate and determine the non-audit work, if any, of the external auditor, and review periodically the non audit fees paid to the external auditor in relation to their significance to the total annual income 1 of the external auditor and to the corporation's overall consultancy expenses. The committee shall disallow any non-audit work that will conflict with his duties as an external auditor or may pose a threat to his independence. 2 The non-audit work, if allowed, should be disclosed in the corporation's annual report; l) Establish and identify the reporting line of the internal auditor to enable him to properly fulfill his duties and responsibilities. He shall functionally report directly to the AudCom. The AudCom shall ensure that, in the performance of the work of the Internal Auditor, he shall be free from interference by outside parties. The above functions may be categorized into the following oversight responsibilities: Category Oversight responsibilities under the Code Financial Reporting and Sub-paragraphs (a), (g), (h) & (i) Disclosures Risk Management Sub-paragraph (b) Internal Control Sub-paragraphs (a), (g) & (j) Management Sub-paragraphs (b) & (j) Internal Audit Sub-paragraphs (a), (c), (d), (f) & (h) External Audit Sub-paragraphs (a), (c), (e), (h) & (k) In addition to the above, the AudCom should make its composition and structure in accordance with the requirements of the Code. Although the Code provides the minimum qualification requirements, the company is not precluded from setting higher standards. Its operation should attain a desirable level of independence by making available resources and outside advisors that the AudCom may avail of in the performance of its duties. TEDaAc 2. Charter of an Audit Committee The AudCom should promulgate a charter that contains, among others, its purpose, membership, structure, operations, reporting process, resources and other relevant information. The charter should specify how the committee shall perform its oversight functions as prescribed by the Code. On the basis of the provisions of the charter and the records of activities and operation of the AudCom, an assessment can be made whether or not it has effectively performed its duties. 3. Reference Guides In the preparation of its charter, the AudCom should strictly observe the requirements of the Code and other applicable laws and regulations in the Philippines. For practices and standards that are not found in the said laws and regulations, the AudCom shall refer to global best practices and standards. In case of conflict, the Code and the applicable laws and regulations in the Philippines shall prevail. The following references may be consulted or considered by the AudCom in the preparation of its charter: (a) Guidebook for Audit Committees in Singapore issued by the Audit Committee Guidance Committee; (b) Audit Committee Effectiveness What Works Best (4th Edition) issued by PricewaterhouseCoopers and The Institute of Internal Auditors Research Foundation; (c) The Audit Committee Guide Series issued by Grant Thorton; (d) Shaping the Audit Committee Agenda (a reference guide for effective audit committees) issued by KPMG Audit Committee Institute; (e) Such other materials issued by professional organizations or institutions. DcCHTa There is no assurance that the above references are exhaustive and complete. The AudCom should exercise its judgment on the manner and extent to which the references would be applicable to it, taking into consideration the applicable rules and regulations in the Philippines and its own circumstances. The Commission takes no responsibility for the accuracy or completeness of information in the above references. 4. Assessment of Performance (a) The baseline on the assessment of the effectiveness of the performance of the AudCom is its charter. Thus, it should be prepared in accordance with the requirements of the Code and other applicable laws and regulations in the Philippines, and should be aligned with the best practices and standards as provided for in any or combination of the above reference guides. (b) The AudCom shall assess its performance through a self-assessment worksheet that contains the following information: Assessment Responsibilities Specific Areas/ Is this part of Has this been Follow-up under the Dimensions the Audit implemented Actions Code (Non-exclusive List) Committee's (If yes, cite Needed Charter? reference (Yes or No) document) Setting of 1. Committee size Committee 2. Independence requirement Structure and 3. Qualifications, skills and Operation attributes of members and Chair 4. Financial knowledge of members 5. Succession plan for members and Chair 6. Meetings (frequency, etc.) 7. Reporting to the Board and issuance of certifications on critical compliance issues 8. Evaluations 9. Resources including access to outside advisors 10. Training and education Oversight on 1. Extent of understanding Financial of the company's business Reporting and and industry in which it Disclosures operates 2. Compliance with financial reporting regulations 3. Recognition of management's responsibility over the financial statements 4. Appropriateness of accounting policies adopted by management 5. Reasonableness of estimates, assumptions, and judgments used in the preparation of financial statements 6. Identification of material errors and fraud, and sufficiency of risk controls 7. Actions or measures in case of finding of error or fraud in financial reporting 8. Review of unusual or complex transactions including all related party transactions 9. Determination of impact of new accounting standards and interpretations 10. Assessment of financial annual and interim reports as to completeness, clarity, consistency and accuracy of disclosures of material information including on subsequent events and related party transactions 11. Review and approval of management representation letter before submission to external auditor 12. Communication of the AudCom with legal counsel covering litigation, claims, contingencies or other significant legal issues that impact financial statements 13. Fair and balance review of financial reports 14. Assessment of correspondence between the company and regulators regarding financial statement filings and disclosures Oversight on 1. Obtaining management's Risk assurance on the state of Management internal controls and Internal 2. Review of internal auditor's Controls evaluation of internal controls 3. Evaluation of internal control issues raised by external auditors 4. Assessment of control environment including IT systems and functions 5. Setting a framework for fraud prevention and detection including whistleblower program 6. Deliberation on findings of weaknesses in controls and reporting process 7. Understanding and assessment of identified risks 8. Evaluation of sufficiency and effectiveness of risk management processes and policies 9. Preparation and implementation of a Business Continuity Plan 10. Promotion of risk awareness in the organization Oversight on 1. Evaluation of compliance Management with the Code of Conduct and Internal for management Audit 2. Communication with management and internal auditor 3. Assessment of adequacy of resources and independence of Internal Auditor 4. Qualifications of an Internal Auditor 5. In-house or outsource internal audit function 6. Compliance with International Standards on the Professional Practice of Internal Auditing 7. Review and approval of internal audit annual plan 8. Extent and scope of internal audit work 9. Reporting process Oversight on 1. Assessment of External Audit independence and professional qualifications and competence of external auditor 2. Engagement and rotation process of external auditor or firm 3. Review and approval of scope of work and fees of external auditor 4. Assessment of non-audit services 5. Understanding disagreements between the auditor and management 6. Actions on the findings of external auditor 7. Management's competence regarding financial reporting responsibilities including aggressiveness and reasonableness of decisions 8. Evaluation of performance of external audit- reappointment and resignation 9. Compliance of external auditor with auditing standards 10. Completeness and timeliness of communication with external auditor as to critical policies, alternative treatments, observations on internal controls, audit adjustments, independence, limitations on the audit work set by the management, and other material issues that affect the audit and financial reporting. (c) The AudCom should rate its overall level of compliance based on the above parameters. It should use a quantitative rating of 1 to 10 with corresponding qualitative description for each rating such as poor, satisfactory, very satisfactory, or outstanding, based on a clear set of criteria indicated in its charter. (d) The above assessment should be done by the AudCom on an annual basis or in such shorter intervals as may be set by the Board of Directors. The results of the said assessment shall be validated by the company's compliance officer or its Corporate Governance Committee, as may be applicable. (e) A feedback mechanism should be in place to receive comments from management, internal auditor, general counsel and external auditor. This should facilitate dialogue within the organization about possible ways to improve its performance. (f) The entire assessment process should be documented and should form part of the records of the company that may be examined by the Commission from time to time. HITAEC 5. Transition Companies that are in the process of registering their securities for public offering and listing shall disclose in their prospectus the details of their plans on the creation and operation of its AudCom including its intention to prepare a charter. The assessment on the performance of its AudCom, as prescribed by these Guidelines, shall be conducted by the company within one (1) year from the date of its listing on the Exchange. 6. Reporting Obligation All companies listed on the Exchange shall disclose in a current report (SEC Form 17-C) within five (5) days from 30 September 2012 , or from anniversary listing date for those covered under par. (5) above, the following information: (a) Whether or not it has an Audit Committee Charter and, if so, whether or not it has adopted a plan to comply with these Guidelines. If an assessment has been conducted by the company's AudCom, it shall provide a discussion on the results of the same based on these Guidelines and the rating criteria set in its charter. (b) If the company has no Audit Committee Charter, it shall disclose the reason for its failure to prepare it and discuss its plan to address such deficiency. If despite the lack of a charter, the company adopts and implements certain best practices in its various functions and procedures, such fact shall be disclosed in the report. The report shall be signed by the Chairman of the Audit Committee and the Compliance Officer (or the Chairman of the Corporate Governance Committee, if applicable). This Circular shall take effect on June 30, 2012. aTEACS Issued this May 31, 2012, Mandaluyong City. For the Commission: (SGD.) TERESITA J. HERBOSA Chairperson Footnotes 1. This may also be read as "fees paid by the company to the external auditor". 2. As defined under the Code of Ethics for Professional Accountants.