Tee Int'l needs to step up corporate governance

ON MARCH 3, 2020, Tee International Limited (TIL) released a 13-page Executive Summary of the External Investigator's Report on the questionable transactions involving its controlling shareholder and former group chief executive (GCE) and managing director (MD), Phua Chian Kin (PCK). The investigation was undertaken by PricewaterhouseCoopers Risk Advisory Services (PwC).

The PwC investigation was commissioned following the company's announcement on Sept 4, 2019 that it had identified unexplained remittances of monies involving PCK, two key subsidiaries of TIL - Trans Equatorial Engineering (Trans) and PBT Engineering (PBT) - and Oscar Investment, a British Virgin Islands-incorporated company which is wholly and beneficially-owned by PCK.

The transactions investigated by PwC occurred between July 19, 2018 and Aug 29, 2019. During that period, the board was chaired by 81-year old independent director (ID) Bertie Cheng Shao Shiong, and comprised three other IDs and three executive directors (EDs) - PCK, his brother Phua Boon Kin (PBK) who was deputy MD, and Ms Saw Chin Choo.

Mr Cheng was appointed to the board as an ID in March 2001, so had served for more than 17 years at the time of the questionable transactions. He retired at the company's November 2019 AGM after deciding not to offer himself for re-election.

One of the other IDs, Aric Loh Siang Kee, who is a member of the audit committee (AC) and remuneration committee (RC), was a former audit partner of Deloitte & Touche. He was appointed in August 2014. Deloitte & Touche is the external auditor for TIL. The company's corporate governance report states that Mr Loh ceased being an audit partner of Deloitte in 2013, and said that this complies with the 2012 Singapore Code of Corporate Governance. The 2012 Code, however, recommended a one-year cooling-off period for a former partner or director of the audit firm to join a client's AC. The 2018 Code recommends a two-year cooling off period.

In early March 2020, it was announced that the Commercial Affairs Department (CAD) is looking into these transactions while SGX Regco is also looking into potential breaches of the listing rules.

This was not the first time TIL was in the news for alleged legal breaches. In April 2012, Mr Cheng and PCK were reported to be under investigation by the CAD for possible market rigging between July 2008 and March 2009, although nothing further has been heard about that investigation.

The 2018 annual report shows that TIL had the usual three committees - AC, RC and nominating committee (NC). It also had an executive committee (Exco) which was chaired by PCK, with two other IDs as members, and the other two EDs attending by invitation.

The Practice Guidance issued with the 2018 Code states: "If the Board chooses to form an Executive Committee (Exco) and delegate certain matters for the Exco to decide, it is responsible for understanding the Exco's discussions and endorsing the Exco's decisions." I would go further and urge companies to carefully consider the governance risks associated with an Exco. An Exco could result in over-delegation of board responsibilities or over-interference in operations, and boards ought to seriously consider whether it is needed.

While anecdotal, companies such as Singapore Post and Swiber which got into trouble had Excos in place. I have questioned some companies at AGMs about their Excos, such as SingPost at its 2015 AGM before it unravelled in a corporate governance scandal. Following the scandal, SingPost dissolved its Exco.

Sometimes, companies create Excos because they have an unwieldy board but TIL has a seven-member board. In fact, a few years ago, I attended an AGM chaired by the same chairman as TIL which also had a seven-member board, and asked why they needed to have an exco. I was not convinced by the answer I received.

There were fundamental flaws in TIL's internal control and risk management. The 2018 annual report states: "The Company has appointed Protiviti Pte Ltd (the IA) to provide internal audit services within the Group for selected audits which are not audited internally by the Group's Business Control and Risk Management (BCR). The IA and BCR have unrestricted access to all the company's documents, including access to the AC. Their primary line of reporting is to the chairman of the AC."

CASTING DOUBT

In TIL's case, the BCR as a second line of defence lacks the functional independence to provide independent assurance, which forms part of the basis for the board's and AC's opinion about the adequacy and effectiveness of the internal control and risk management system.

The PwC report cast doubt on the independence and resourcing of the IA function, and the accuracy of the company's disclosures about it. It said: "We also note that prior to October 2018, the internal audit plan was prepared by the former Business Control & Risk Unit Manager and a Finance Business Manager, who functionally reported to the Head of Infrastructure and the CFO respectively instead of directly reporting to the AC chairperson. Given that the Finance Business Manager performs the role of internal audit and risk management in the company in addition to her responsibilities within the finance function, the internal audit function is not independent and it also appears that the function may not be adequately resourced".

One has to question why the AC and board allowed such a situation to persist, and whether the company's disclosures in its annual reports gave an accurate picture of the IA function.

The PwC report identified a number of possible breaches which may warrant further investigation and enforcement action against not only PCK and key management who were directly involved in the transactions, but also other directors with regards to their oversight responsibilities.

To the board's credit, it has released two updates on March 5 and March 15, following the release of the executive summary on March 3, outlining actions it has taken for those directly involved in the questionable transactions and the measures it has implemented to improve its internal controls and corporate governance.

However, questions remain as to whether they are enough.

Following the cessation of PCK as GCE and MD, his brother PBK was appointed interim GCE. However, aside from being PCK's brother and part of the board and key management during the period of the questionable transactions, PBK was and remains a director of both PBT and Trans, the two key TIL's subsidiaries that were directly involved in those transactions. Ms Saw, the other ED, was and remains a director of PBT. Under such circumstances, their involvement in the affairs of the company ought to be minimised, if it is not feasible to have them step aside while the regulatory investigations are in progress.

At such times, the case for an interim Exco made up of IDs to steer the company could be made - it is one of those times that I would support having an Exco as an interim measure. IDs need to stand up and be counted at this time, not bail out immediately or take a hands-off approach. In this regard, it is disappointing that the former chairman stayed for far longer than he should have as an ID, then left as quickly as he did when the questionable transactions came to light. Of course, directors remain accountable even if they have left.

It is also unclear that the company "gets it" in terms of improving its internal control and risk management. In its update on March 15, the company said that the Board has "engaged another separate team from the Internal Auditors to assist in developing enhancements to the Company's policies and procedures" and that it has outsourced the group's Enterprise Risk Management (ERM) function to the internal auditors. This may once again raise concerns about the independence of the IA.

Protiviti, as the IA, may be intruding into the first line of defence responsibilities because the updating and ongoing enhancement of policies and procedures is actually the responsibility of the first line of defence management. The IA's role is to review the adequacy of the internal controls (including policies and procedures) and test their effectiveness. If IA helps to develop or enhance those policies and procedures, it will end up "self-auditing".

While IA service providers may provide both IA and ERM services, the ERM service should not go much beyond assisting the client in its risk assessment to derive the top risks in the company, from which IA then develops its annual audit plan which is aligned with these key risks. Smaller companies may rely on the IA service provider to do this due to the lack of resources and risk management expertise. However, risk management does not stop at risk identification or risk assessment. A risk management function is also responsible for the ongoing oversight of risks in the organisation which is a second line of defence. IA should not be involved in this role.

If TIL truly wants to regain investor confidence and improve its internal controls and corporate governance, it needs to do more than what it has proposed.