No. 4/2018 PUBLIC EN'lTI1ES CORPORATE GOVERNANCE Cap.10:3l (c) there is adherence to and measurement of ethical standards in all aspects of the business; (d) ethical risks and oppo1tunitics are incorporated in the risk management process; (c) a code of conduct and ethics-related policy is implemented; (f) the company's performance in regard to its ethics is assessed, monitored, reported upon and disclosed. Combined Assurance 245. The Audit Committee should ensure that a combined assurance model is applied to provide a coordinated approach to all assurance activities and that the assurance covers all the significant functions within the organisation. 246. The combined assurance m(xlel aims to optimise the assurance coverage obtained from management, internal assurance and external assurance providers on the risk areas affecting a company. 247. The combined assurance provided by internal and external assurance providers and management should be sufficient to satisfy the audit committee that significant risk areas within the organisation have been adequately addressed and that suitable controls exist to mitigate and reduce these risks. 248. Intenk'll audit should form an integral part of the combined assurance model as internal assurance providers. 249. The combined assurance process should be aligned to the risk management process in the organisation. Recommendations 250. Every listed company must put in place a Combined Assurance process to- (a) coordinate the work of all assurance providers that, either directly or indirectly, provide the board and management with certain assurance; (b) provide a communication forum for the work of internal audit, external audit, third patty assurance providers and management in support of the need to report in an integrated and holistic manner to the audit committee; (c) standardize risk assessment processes and foster the use of a common risk language in order to promote comparability across the company; (d) discuss and create common approaches to risk management and coordinate management control self-assessments; (e) ensure that a combined assurance repmt is presented to the risk committee quruterly. 251. The key stakeholders in the combined assurance process are the internal audit unit, the extemal auditors and management. 252. The intemal audit unit should- (a) annually conduct a formal and documented review of the design, implementation and effectiveness of internal financial controls; (b) provide independent assurance on the integrity and robustness of the risk management processes and a written assessment of the effectiveness of the system of intemal control and risk management to the Board; (c) evaluate governance processes including ethics and setting the tight "tone at the top"; (d) assure the Board that the combined assurance model is coordinated to best optimise costs, avoid duplication and prevent an assurance overload; 140