David Jacobson's External Insights

Identity fraud: keeping personal information secure

The recent fraudulent theft of personal information about 145,000 people from Choicepoint in the US highlighted the importance of organisations which collect personal information, having safeguards to keep it secure.

Whilst there is much that you can do individually to protect your own information, how can you be sure that someone you voluntarily give it to will protect it?

National Privacy Principle (NPP) 4.1 provides that an organisation must take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.

This Information Sheet gives useful tips for organisations complying with that obligation, including physical security, computer security, communications security and personnel security.

In Australia, Baycorp Advantage is the major credit information database.

Its website offers information about how to get a copy of your credit file, how to protect yourself against credit fraud and what to do if  someone is using your identity to get credit.

APRA announces guidelines for governance of financial institutions and insurers

APRA Chair John Laker has spelt out the principles APRA has followed in drafting new prudential standards on governance of financial institutions and in determining whether a director of those bodies is "fit and proper".

Some key quotes:

Boards need to ensure that there are appropriate reporting systems in place to enable them to perform their review and oversight roles effectively. They must have in front of them the information they need to make well-informed decisions, rather than simply accept what management provides. We find some boards that have not put in the effort to understand the main elements and risks of their business and, hence, what is crucial for them to know...

Even with effort, some boards struggle to master the more complex environment in which ADIs operate today. We see examples where boards have not properly understood critical undertakings by their regulated institutions – for example, the servicing costs of Tier 2 capital or the strategic consequences of securitisation programs. It is unrealistic to expect that all board directors will have a strong technical understanding of sophisticated financial instruments but they should have, as a minimum, a high-level conceptual understanding of the risks facing the institution and the strategic impact of major initiatives. Too often, management will push the positives of significant new undertakings without balancing the case by identifying the risks of getting the strategic direction or the implementation wrong. Boards need to see themselves as a challenge to management and institutional ambitions and their questioning and probing can add great value to the long-term viability of the institution...

We look for balance in boards. Not just a balance of skills and experience but as wide a range of perspectives and thought processes as possible around the board table. Of course, this is not always easy to achieve and less so when directors are selected only from a narrow range of backgrounds. If there is a common message coming from these corporate governance issues, it is the importance of having a mix of board directors with a diversity of skills and experience. It is these and other attributes that APRA is seeking to promote in its corporate governance proposals...

The main requirements, which draw onthe ASX Corporate Governance Council’s Principles, are that:
• boards of locally-incorporated regulated institutions must have a majority of independent non-executive directors at all times, with exceptions for particular subsidiaries;
• the chairperson of the board must be an independent non-executive director and cannot have been the chief executive officer of the institution during the previous three years;
• there must be a Board Audit Committee with a majority of independent directors, including the chairperson. The chairperson of the board will be allowed to sit on the Committee but will not be able to chair it;
• there must be a Board Risk Committee with responsibility for developing, setting and monitoring adherence to risk management strategies. This Committee may be combined with the Board Audit Committee under certain circumstances; and
• there must be a dedicated and well-resourced internal audit function with free and unfettered access to the Board Audit Committee. However, we will not be insisting that there be a sole reporting line to that Committee...

APRA will not be establishing its own objective criteria on independence or a tenure limit. Instead, firstly, we will align our definition of independence with that set out in the ASX Corporate Governance Council’s Principles. APRA-regulated institutions listed on the ASX already have to meet these principles on an “if not, why not” basis. However, these are only a relatively small percentage of our institutions and our approach will impose a level playing field on governance matters across all our institutions. A board wishing to depart from the ASX definition would need to agree this with APRA — that is, the “if not, why not”
arguments will have to be persuasive to us...

APRA will be more flexible on the issue of board renewal, to better allow for the circumstances of individual boards. We will require each board to have a policy on board renewal that ensures that the board remains open to new ideas and independent thinking, while retaining adequate expertise. We will not stipulate any details in these policies but we will review their adequacy as part of our normal supervisory processes...

we will require each board to have procedures for assessing its performance, and that of individual directors and senior managers, against their respective objectives. The detail of these assessment procedures will be for the institutions themselves. As with board renewal, we will not stipulate specific requirements but we will review the adequacy of these arrangements as we go...

Our approach, which is intended to apply across the ADI and insurance industries, has two main elements:
• a requirement that each regulated institution in these industries has a rigorous fit and proper policy, subject to certain basic requirements for acceptable behaviour that would be set out in a prudential standard; and
• a reserve power for APRA to identify and deal with unacceptable behaviour that poses a serious potential risk to beneficiaries and that the institution concerned is unwilling or unable to act on.

This approach will never eliminate the risk that a person lacking fitness or integrity might assume a position of responsibility, or that an institution might fail because of inappropriate, incompetent or reckless management. Our objective is to significantly reduce these risks...

We will be releasing a revised fit and proper prudential standard for comment within the next couple of months. It will put the onus on regulated institutions to implement a fit and proper policy that is in keeping with the spirit and intention of the standard, but will leave the contents to the discretion of each institution. It will also, as originally intended, establish what APRA believes is a minimum benchmark for acceptable behaviour, with guidance notes to assist institutions in assessing responsible persons against this benchmark.

Link

Consulting happiness?

When Cam Thompson from Brisbane Lawyer Magazine contacted me and said he'd like to interview me,  my first reaction was "what about?"

He said people would like to know what I'm doing now.

So we had a relaxed interview over coffee and this article (pdf) has now been published.

I hope it communicates what I'm on about, but I don't know where he got the headline from.

By the way, Cam is involved in PLAY The Store which has just opened in Brisbane. Looks interesting.

Why are there so many Codes of Conduct?

Codes are part of a series of regulatory reforms designed to improve compliance as well as reduce costs to Government and business. At the same time regulators are being asked to “do more with less”.

Codes of Conduct were created as a compromise between Governments’ reluctance to impose detailed legislative regulation on industries that were changing and not having any regulation at all. The compromise offered by a range of industries from financial services through to franchising was self-regulation.

Governments now consider industry self-regulation as a prime regulatory option. In fact, by 1997 a staggering total of 30,000 codes of practice were identified in a  review.

Whilst it is possible for consumers and regulators such as the ACCC to take individual action against companies to enforce the law, court actions always take time and are costly. Even when the law is clear, its actual application depends on the facts. Lawmakers are reluctant to prescribe detailed procedures and industry always resists such prescription.

So the view of the Government and regulators was that if an industry could develop a code which met certain criteria, they would be satisfied.

Full article (pdf)

Links:     ACCC Guidelines on voluntary codes
            ASIC policy on approving codes of conduct

Corporate Governance and Tax

The Tax Commissioner, Michael Carmody, recently spoke on "Corporate governance and its role in the taxation area".

As well as remarks on corporate governance, particularly in relation to large corporates, Mr Carmody's address included comments on the operation of the general anti-avoidance provision, Part IVA.

Mr Carmody set out a Part IVA checklist of questions for Boards to ask to assist them in assessing the tax risks associated with particular proposals.

Some quotes:

"It was less than two years ago that I raised managing the tax risk as a governance issue for corporations and their Boards...

Since raising the issue I have sought to reinforce and support more conscious tax risk management by writing directly to the Chairmen of Boards of Australian listed companies; by giving Boards confidence that tax risk analysis papers prepared for them will remain confidential; and more recently by developing cooperative and time sensitive arrangements for private rulings on issues of concern to Boards...

In essence, tax risk management is about the level of comfort a corporation has that they will not face substantial liabilities following a review by the Tax Office, or if they do, about the level of comfort they have they will succeed on appeal to the Courts...

the High Court has confirmed the originally intended and articulated scope of Part IVA as applying to contrived arrangements rather than ordinary family or commercial dealings...

The High Court has further confirmed that Part IVA can apply if the particular means to achieve a commercial end involves contrived steps that are only explicable by their claimed tax benefit. To do otherwise would be to leave a gaping hole in the effectiveness of Part IVA in protecting the integrity in the operative provisions of the law..."

Employee Super Fund Choice

From 1 July 2005 Australian employees will be able to tell employers  which superannuation fund they wish to use for their compulsory superannuation.

Employers will be obliged to provide employees with a standard choice form if they do not already provide a choice.

 The superannuation choice regulations outline the minimum insurance requirements for default funds under choice. A default fund is the fund an employer chooses if the employee does not want to make a choice. Retirement Savings Accounts (RSAs) have been exempted from the minimum insurance requirement.

The regulations also set out what information employees wishing to pick a fund must provide to their employer.

Currently, the choice of fund legislation does not apply to employees covered by a state award. The Government will be introducing an amendment to the choice legislation to allow the Commonwealth to override state awards in respect of superannuation from 1 July 2006.

The Assistant Treasurer's  Press Release

Venture Capital (2)

I went to an AVCAL lunch earlier this week to hear the Sargent Truck Rentals story.

In 15 years the company has expanded from 6 trucks to 900 trucks concentrating on providing fully maintained trucks under operating leases. It operates nationally.

Five years ago the founder brought in a new manager to devise a succession plan and 6 months ago there was a management buy out using private equity from NBC Capital.

A key part of the plan has been the establishment of an employee share plan.

It also rents trucks casually, this pool also backing up as the replacement trucks when its permanent rentals are out of action.

Venture Capital in Australia

Venture capital (or private equity) has had an exotic but relatively low profile in Australia: governments have encouraged it (by amending legislation such as in Queensland) but individual venture capital organisations write their own selection rules which are highly confidential.

AVCAL (Australian Venture Capital Association Limited) is doing an excellent job publicising common industry views. Its website has some great resources and information about venture capital in its different forms and how to get it if you are a growing business. It has links to institutional investors, business angels and incubators.

One of Australia's most successful firms is Champ Ventures. Its director Bill (WD) Ferris wrote a book in 2000 on his experiences in Australian venture capital called "Nothing Ventured, Nothing Gained: thrills and spills in venture capital". Worth reading. It's available from AIM Books.

The McKinsey Quarterly has an article on Why some private equity firms do better than others.

It concludes that the successful investors "actively own" the businesses they invest in. This is a key issue if your business is seeking funds.

If you're a business wanting to know how to improve your ability to obtain  capital then Achaeus offers extensive training.

And if you want to understand how an American venture capitalist thinks read Feld Thoughts. And BeyondVC and Business Week Online Deal Flow.

Business reconstructions and sales and employment law

Does a change of business owner terminate an employee’s employment or make an employee redundant?

Two High Court decisions handed down this week shine some light on this issue.

Amcor

In CFMEU v Amcor Limited [2005] HCA 10  the High Court overturned the Federal Court's decision, at trial, that 800 Amcor employees were entitled to redundancy pay as the result of a demerger, despite the employees being offered employment with the new employer on terms and conditions identical to those they had with Amcor.

The High Court held that severance payments were not due unless a position in the business was abolished. The change of identity of the employer was irrelevant.  It decided that "a position becoming redundant" did not mean simply that the employer no longer had a need for any employee to perform a particular task.

A redundancy is therefore not likely to arise just because there was a demerger, business restructure or transfer. There was no entitlement for redundancy pay where the employee worked in the same job, under the same terms and conditions, even though the employer changed. Redundancy involved the job itself becoming redundant.

Gribbles

In  Minister for Employment and Workplace Relations v  Gribbles Radiology [2005] HCA 9  the High Court decided that a radiology company was not the successor of another business and therefore was not required to pay severance payments to employees.

It was originally held by the Federal Court that there had been a 'transmission of business' between a company (MDIG) that provided radiology services to the Heritage Clinic in suburban Melbourne until August 1999, and another company (Gribbles), which began providing radiology services to the clinic in August 1999. There was no relationship or transaction between MDIG and Gribbles. Each company had entered arrangements directly with the Heritage Clinic to provide services and staff directly to the clinic.

When Gribbles took over, it engaged the same four radiographers who had been employed by MDIG, to perform substantially the same work, on the same roster. In July 2000, Gribbles terminated the services of the four employees on the basis that it was not a party to, and not bound by, the HSUA (Private Radiology – Victoria) Award 1993 and therefore was not obliged to pay redundancy and severance entitlements. MDIG was a named party to the HSUA Award, which requires the payment of severance pay in the event of redundancies.

The court originally held that the four radiographers were entitled to the severance entitlements because Gribbles was a 'successor, assignee or transmitee' of MDIG's business under section 149 of the Workplace Relations Act.

The High Court decided that in order to be a "successor" to the business the new employer must carry on some part of the former employer's business, not just the same type of business.

It decided that even though Gribbles carried on the same type of business, in the same place with the same employees, not all elements of the business continued through a direct transaction between Gribbles and MDIG.

Employee Due Diligence issues

An investigation of potential employment issues should be carried out when:

* there is a  sale or purchase of a business;

* there is a sale or purchase of part of a business;

* entering into a contract to provide outsourced services (or some of them) to an entity, in place of an existing service provider/contractor; and

* there is a transfer between corporations during a restructure.

The incoming employer should ensure that relevant awards and workplace agreements are closely examined to avoid complex disputes.

Use business email prudently

Yesterday I posted a note about record retention and electronic discovery.

Today I learned (via this WSJ article) that the Boeing CEO Harry Stonecipher's sacking over his affair with a female co-executive was triggered by his emails to her which explicitly described their relationship.

The article chronicles the executives and politicians who have come to grief over indiscreet email communications.

The key quote:

As for e-mail -- well, unlike love, it is forever. You may think you've destroyed every last vestige of it, but it lives on, in some forgotten corner of some far-off server, waiting like Sleeping Beauty to be brought back to life by a zealous prosecutor or an overcompensated trial lawyer.

Put another way, would you be happy to see the email's contents in Google or on the front page of your local paper?

UPDATE: 12 March. This Business Week article gives a wrap-up of the story.