The Subsidiary That Signed Its Own Contracts
A financial services group operates through a regulated parent and an unregulated services subsidiary that provides IT support to the parent. The subsidiary's managing director reports to the group COO and also sits on the parent board as an executive director. Last quarter the subsidiary signed a three-year software contract worth 4% of group annual revenue without parent board approval, because the subsidiary's own delegated authority limit was set at that level when it was much smaller. The group CFO discovered the contract during a routine cash flow review. The subsidiary MD says the contract was within his authority and that he had discussed it informally with the COO. The COO confirms a conversation but says no approval was given. The parent's audit committee meets in three weeks and the external auditor has flagged the matter as a control deficiency.
1. Identify the governance failures in this situation and distinguish between the authority question and the accountability question.
Read the worked answer
These are two related but distinct failures, and conflating them leads to the wrong remedy.
The authority question: was the contract within delegated authority? Formally, possibly yes - the subsidiary's limit was set at a level that permitted it. But that limit was never recalibrated as the subsidiary grew, so a threshold intended for a small support function now authorises commitments material to the group. A delegated authority framework that is not reviewed as the business changes is a design failure, not an individual one. The parent board has, in effect, delegated a material decision without knowing it.
The accountability question: who was responsible for escalating? The subsidiary MD sits on the parent board. That dual role creates an obvious conflict: he is simultaneously the person seeking approval and one of the people who would grant it. Discussing the matter informally with the COO is not a substitute for a documented approval, and the COO's account confirms no approval was given. Informal consultation that stops short of decision is a common way for accountability to evaporate.
The deeper failure is structural: the group has a director with a foot in both entities, an unreviewed authority limit, and no clear escalation route for subsidiary commitments that are material to the group. The external auditor's control deficiency finding is well founded.
2. Recommend the remedial actions the audit committee should require, and explain how each addresses a specific failure.
Read the worked answer
The remedies should map to the failures identified, not be a general instruction to "improve controls."
- Recalibrate delegated authority across the group. Set subsidiary limits by reference to group materiality, not to the subsidiary's own historic size. This addresses the design failure that allowed a 4%-of-revenue commitment to be signed locally.
- Introduce a group materiality escalation trigger. Any commitment above a defined group threshold requires parent board or delegated committee approval regardless of which entity signs. This closes the gap the current structure leaves open.
- Address the dual role. The subsidiary MD's position on the parent board should be reviewed. At minimum, he should be recused from any discussion of subsidiary authority limits or of this contract. The committee should consider whether executive directors of material subsidiaries should sit on the parent board at all.
- Require documented approvals. Informal discussion with the COO must not be treated as authority. A short written approval record for commitments above threshold gives the auditor something to test.
- Contract remediation. The committee should ask management to assess whether the contract can be renegotiated or exited, and to confirm no similar commitments exist elsewhere in the group.
On reporting, the committee should treat this as a reportable control deficiency with a named owner and a completion date, and should track it to closure rather than accepting a management assurance that processes have been "reminded."