Cap. 10:31 Punuc EN'l1TIEs CoRPORATE GovERNANCE No. 4/2018 216. Recommendations from external auditors should include a discussion of the main accounting policies, material weaknesses and significant flaws of internal controls and procedures, alternative accounting approaches, instances of disagreement with management and risk assessment and analysis of possible fraud. 217. The external auditors should be appointed for a pre-defined period of time. 218. lf necessary, the re-appointment of external auditors should be preceded by a formal and documented assessment of their independence and performance. Their re-appointment should be approved ammally by a simple majority of the shareholders at an annual general meeting. 219. Extemal auditors should not be allowed to provide consultancy work to the company which they audit. 220. The audit committee and the Board must be familiar with all the services provided by external auditors to ensure that the auditors' independence is beyond reproach and to avoid potential conflicts of interest. 221. The external auditors should give an assurance of their independence from the company in writing on an annual basis. 222. The relationship between the external auditors and the chief executive officer and other officers of the company should be based on professionalism and independence. INTERNAL AUDIT FUNCTION, METHODOLOGY Al\11) MANDATE Principles 223. The Board, through the audit committee, should be assisted by a competent internal audit unit to provide assurance on internal controls. risk management and governance processes in accordance with the standards of the Professional Practice of Internal Audit. 224. The audit committee should oversee the internal audit function, evaluate its performance and ensure that the internal audit function is subjected to an independent quality assurance review. 225. The chief audit executive should rep01t functionally to the chairperson of the audit committee and administratively to the chief executive officer. Recommendations 226. The Board must ensure that there is a continuous and effective risk and results-based intemal audit. 227. The Internal audit unit should(a) (b) evaluate the company's governance processes; conduct an objective assessment of the effectiveness of risk management processes and the internal control frame\vork; (c) systeflk'ltically analyse and evaluate business processes and associated controls; assess risk of fraud, corruption, unethical behaviour and other irregularities. (d) 228. Intemal controls should be established not only over financial matters, but also over operational, compliance and sustainability issues. 229. The Board should ensure that the internal audit activity is sufficiently empowered to perform its mandate. 230. The Board should define, approve and put in place an internal audit charter. 231. The internal audit activity should adhere to the International Intemal Auditing Standards (IIAS) and Code of Ethics. 137