瑞信報告財報內控程序重大缺失，到底是什麼程度？

早幾天瑞信違約掉期創紀錄新高，空穴來風未必無因。今次仔細探討發生咩事！？

內控程序係公司經營嘅命脈

1. 唔理係有上市定無上市嘅公司，都係由人（員工）去經營，而人都係由制度去規管，呢個係必然定律。
2. 流程制度係內控程序，一來係標準化經營程序俾管理層、員工去跟，減少佢地出錯嘅機會。
3. 二來係老細唔洗每時每刻都要喺你隔離睇實你做，由制度幫個老細去管理員工。
4. 三來係公司經營涉及太多金錢利益，有制度流程，洗錢出數，要多重審批，可以減低員工穿櫃桶底機會。

關於上市公司嘅內控

5. 上市公司，除咗要每年做核數外，其實都要每年俾內控顧問審核佢公司嗰套內部運作流程，係唔係有效。
6. 而internal control over financial reporting ，就係專門為編制財務報表嘅內控流程。上市公司每筆交易，邊個負責入數、邊個審批、預算同實際數據差異分析、銀行支票簿邊個keep、支票邊個簽名、密碼公章邊個保管都係內控程序。
7. 再高層次啲，要有一套流程去定期評估公司邊啲財務數據係特別高風險會出錯 ：process of risk assessment ，同埋設立有效措施減低相關風險。即係當外部、內部環境變化，某啲交易就容易瀨嘢，要做多啲防護措施。
8. 好似加息周期呢個外在因素，銀行管理層要有一套流程，識得發現債仔走數機會有冇大咗，點樣加強措施更準確喺財務報表反映個信貸風險。
9. 而尋日瑞信出嘅2022年報，就係披露咗佢地出財務報表嘅時候，無呢種評估風險流程，去避免財務報表出現重大錯誤。即係就算出錯咗，佢哋自己都唔知。

瑞信嘅重大內控缺失

10. 「Management did not design and maintain an effective risk assessment process to identify and analyze the risk of material misstatements in its financial statements 」即係上面講嘅無諗過成份財務報表邊啲位好易出錯，同相應嘅補救措施。

11. 「and did not design and maintain effective monitoring activities relating to (i) providing sufficient management oversight over the internal control evaluation process to support the company’s internal control objectives; (ii) involving appropriate and sufficient management resources to support the risk assessment and monitoring objectives; and (iii) assessing and communicating the severity of deficiencies in a timely manner to those parties responsible for taking corrective action. 」呢個仲離譜，即係內控程序嘅執行，管理層唔多參與、公司又無俾足夠資源去做、當嚴重問題發生，又無機制及時溝通同改正。

12. 「These material weaknesses contributed to an additional material weakness, as management did not design and maintain effective controls over the classification and presentation of the consolidated statement of cash flows.」呢啲缺失導致財務報表嘅現金流量表表述、分類無王管。

13. 「Specifically, certain control activities over the completeness and the classification and presentation of non-cash items in the consolidated statement of cash flows were not performed on a timely basis or at the appropriate level of precision」尤其是一啲非現金交易項目無及時、完整同準確表述。

14. 「This material weakness resulted in the revisions contained in our previously issued consolidated financial statements for the three years ended December 31, 2021 as disclosed in the 2021 Annual Report.」呢啲重大缺失唔係得個講字，而係導致喺2021年報，需要修改番之前已經出咗嘅2019、2020年財務數字。

15. 「Additionally, each of these material weaknesses could result in further misstatements of account balances or disclosures that would result in a material misstatement to the annual consolidated financial statements that would not be prevented or detected.」同埋呢啲缺失，隨時會引起其他財報嘅錯報，未必預防到，亦都未必而家發現到。

16. 「PwC, the independent registered public accounting firm that audited the financial statements for the year ended December 31, 2022, included in this annual report, has issued an adverse opinion on the effectiveness of the Group’s internal control over f inancial reporting as of December 31, 2022.」今年，PWC 已經對我地今時今日嘅破爛不堪嘅內控制度發出最嚴勵嘅否定意見。

17. 「Notwithstanding the existence of these material weaknesses in internal control over financial reporting, the Group confirms that its consolidated financial statements in this Annual Report fairly present, in all material respects, the Group’s consolidated f inancial condition as of December 31, 2022 and 2021, and its consolidated results of operations and cash flows for the years ended December 31, 2022, 2021 and 2020, in conformity with US GAAP, as reflected in PricewaterhouseCoopers AG’s (PwC) report on those financial statements.」雖然我地啲內控係好爛，但管理層保證2020-2022年嘅財務報表都係跟足US GAAP去做㗎。

18. 上面呢個係管理層點都要兜一兜嘅表述；即係本身個管理層都無跟足程序去審核啲數有無跟足程序去做，但佢就可以保證啲數就一定啱。憑乜嘢咁有gut feeling 呢？

瑞信真正嘅核心問題

19. 到呢一刻已經唔需要去分析瑞信嘅財務報表啲數，因為佢套編制財務報表嘅流程都係流流地。而管理層又可以大大聲confirm 啲數無問題。
20. 個核心問題唔係內控有重大缺失，而係佢唔係第一日開門做生意，以前行之有效嘅內控制度，而家竟然變得有重大缺失？
21. 制度唔會自己調整、修改或者唔去執行，由有效變無效，一定涉及人為，而且好明顯係管理層嘅問題。
22. 股神巴菲特成日講投資最緊要除咗睇間公司嘅持續競爭優勢外，就係睇管理層誠信（management integrity）。
23. 如果誠信有問題，就算間公司幾好，財務數據幾亮麗都好都係無用，因為你都唔知係唔係個無誠信嘅管理層刻意誇大出嚟。而套財務報表編制流程有問題，即係啲數有幾堅都係一個大問號，咁就更完全無分析嘅價值啦。

24. 如果內控從來都係咁差，你都無咁驚，因為咁差都可以生存過嚟。但本身係好嘅，一間咁大嘅銀行，突然間到2022年變差令PWC對佢內控有效性俾否定意見（Adverse Opinion），係最差嘅意見，咁就真係好大問題啦。
25. 上個月，瑞信個主席Axel Lehmann因為2022年年尾同市場講佢地客戶資金外流情況已經改善，但事實並非如此而被瑞士監管當局調查。
26. 加息攪到信貸緊縮、生意又做得差、管理層又有意無意講大話、加埋個內控有重大缺失，呢啲都係佢衰落嘅明顯表徵，全部都唔係單一事件。
27. 再講多句，Adverse Opinion 通常只會喺啲妖股、細價股度睇到，因為佢哋冇乜資源冇乜錢，想搵快錢慳成本，所以一定做得差。
28. 但由瑞信身上睇到呢個opinion，真係好震撼，佢哋有大把資源都唔去做好個內控，一定唔係能力問題，可能真係經營面對重大困難，如果內控唔寬鬆啲好多嘢過唔到，就好似有啲建築唔達安全標準，解決方法唔係點樣拆卸重建，而係去降低個安全標準同一道理。

聲明：以上內容純屬個人意見及分享，並不構成投資、買賣建議或推薦
Credit: CFO講年報