No. 4/2018 Puuuc ENITnEs CoRPORATE GovERNANCE Cap.l0:31 279. Information to be disclosed should be prepared, audited and made available in accordance with the highest standards of accounting, financial and non-financial disclosure. 280. A company shonld not disclose its financial statements unless they have been approved by the chairperson of the board and have been signed by the chief executive officer (CEO) and the chief finance officer (CFO). 281. The Board should be responsible for the governance of the company's information conmmnication technology. 282. The Board should establish a system for identifying and printing company information as an impmtant business asset. 283. The board must ensure that an information security management system (SMS) is developed, implemented and recorded in an appropriate and applicable information security framework. 284. The board should supervise the information security strategy and delegate and empower management to implement it. 285. The ISMS should include the follO\ving high level information security plinciples(a) confidentiality of infommtion; (b) integrity of information; (c) availability of information systems in a timely manner; (d) retention of information. 286. The Board should provide leadership and direction to ensure that the company's Information Communication Technology, ICT, achieves, sustains and enhances the company's strategic objectives. 287. The Board should take necessary steps to ensure that there are processes in place for the complete, timely, relevant, accurate, integrated and accessible ICT repmting by management to the Board and by the Board to the shareholders. 288. The Board must establish a robust process for identifying and exploiting opportunities to improve the perfommnce and sustainability of the company through effective and efficient IC'T use. 289. The Board should ensure that ICT fmmeworks, policies, processes, procedures and standards are implemented with a view to minimising ICT risks, delivering value, ensuring business continuity and assisting the company in managing its ICT resources efficiently and cost effectively. Recommendations 290. The company should have a written poiicy on disclosure. 291. Disclosure should include material information on(a) financial and operating results of the company; (b) the company's objectives; (c) major share ownership and voting rights; (d) members of the Board and key Executives; (c) material foreseeable risk factors; (f) material issues regarding employees and other stakeholders; (g) governance stmctures and policies; (h) capital stmcture and arr-angements, if any, which etmble certain shareholders to obtain a degree of control disproportionate to their equity ownership; 144