Nadir Foods: governance weaknesses and risk response

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• Combined chair and chief executive: power is concentrated in one person and there is little independent challenge.
• Board composition: a majority of family directors and only one non-executive who is not independent, so oversight of management is weak.
• No audit committee: there is no independent review of financial reporting, internal control, risk and the auditor.
• Finance director reports to the chairman, which limits the finance function's independence and the ability to raise concerns.
• Executive pay is set by the chairman with no remuneration committee, so there is a risk of pay not linked to long-term performance and agency problems.
• Effect on the bank and other lenders: they may require a higher rate, security or refuse the loan because information may not be reliable.
• Effect on minority or outside stakeholders and on decisions: poor challenge increases the risk of mistakes and unethical behaviour.
• Recommendations: separate the roles, add independent non-executives, create audit, remuneration and nomination committees, and give the finance director a line to the audit committee.
• Link to the objective of the company, that of obtaining finance, with a balanced conclusion that family control can be retained with safeguards.

Marks counted: 0 of 8

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• Expected loss of each risk is probability x loss: 300,000, 300,000, 200,000 and 150,000, a total of $950,000.
• Supplier response: new expected loss is 8% x 1,500,000 = $120,000, a reduction of $180,000.
• Supplier response cost is $90,000, so the net benefit is $90,000 a year, and it appears worth doing.
• Cyber response: new expected loss is 4% x 3,000,000 = $120,000, a reduction of $180,000.
• Cyber response cost is $150,000, so the net benefit is $30,000 a year, which is positive but small.
• Expected values ignore non-financial effects such as reputation, customer trust and legal consequences of a data breach, which may justify the cyber response.
• The probabilities are estimates, so sensitivity should be considered, and a one-off loss may threaten survival even if the expected loss is small.

Marks counted: 0 of 6

Tick each point that your answer made clearly and only once. Points here are this site's own. A real examiner may accept other valid points.

• A clear recommendation: adopt both responses, with the supplier response first as it has the clearer net benefit.
• Establish a risk committee or give the new audit committee the task of reviewing the risk register at least twice a year.
• Assign an owner to each risk and set out the reporting lines.
• Prepare a short governance statement for the bank that sets out the changes and a timetable.
• Use plain, concise language with a clear structure for a business audience, including a summary at the start.
• Show commercial awareness: the loan terms may be better if the bank sees improvements, and the cost of the changes is small compared with the loan.
• State limits and next steps, such as recruiting independent directors and testing the controls.

Marks counted: 0 of 6