Risk and the board of directors
The directors are ultimately responsible for the group’s risk management system and for reviewing its effectiveness. There is a regular schedule for the board to consider the group’s significant risks and mitigating actions. The risk management system is designed to manage, rather than eliminate, the risk of failure to achieve business objectives and there is a continuous process in place for identifying, assessing, managing, monitoring and reporting on the significant risks faced by individual group companies and by the group as a whole. This process has been in place for the year under review up to the approval of the annual report and accounts. The principal risks and uncertainties facing the group are set out on pages 18 and 19 of our consolidated financial statements.
Excom has specific responsibility as the risk management committee for the group’s system of risk management. Excom reviews our significant risks and subsequently reports to the board on material changes and the associated mitigating actions. Reviews on the effectiveness of the risk management system were carried out by excom, as the risk management committee, in April and October 2013 and in March 2014.
Enterprise-wide risk management
Excom views the careful and appropriate management of risk as a key management role. Managing business risk to deliver opportunities is a key element of all our business activities, and is undertaken using a practical and flexible framework which provides a consistent and sustained approach to risk evaluation. Business risks, which may be strategic, operational, financial or environmental, or concern the group’s reputation, are understood and visible. The business context determines in each situation the level of acceptable risk and controls. We continue to seek improvement in the management of risk and during the year we have refreshed our guidance on risk management and revised our internal protocols, and we continue to seek to share best practice throughout our organisation.
Key features of our system of risk management are:
- group statements on strategic direction, ethics and values;
- clear business objectives and business principles;
- an established risk policy;
- a continuous process for identification and evaluation of significant risks to the achievement of business objectives;
- management processes in place to mitigate significant risks to an acceptable level;
- continuing monitoring of significant risks and internal and external environmental factors that may change our risk profile; and
- a regular review of both the type and amount of external insurance purchased, bearing in mind the availability of cover, its cost and the likelihood and magnitude of the risks involved.
In addition to excom’s bi-annual reports to the board on key risks, there is a process of regular reporting to the board through the audit committee on the status of the risk management process. Strategic planning, internal audit and other risk control specialist processes are integrated into line management’s risk processes and simplified risk reporting. The team, led by internal audit, has rolled out a refreshed guidance and group methodology.
Key reports include those that identify, assess and monitor strategic, financial, reputational and operational risks in each country, division and on a group basis.