APC 2010 Annual Report Download - page 136

CORPORATE GOVERNANCE
3INTERNAL CONTROL ANDRISKMANAGEMENT
The Key Internal Controls are available to all units on the Group
intranet, along with appendices with more detailed information,
links to full policy descriptions on the Functions’ intranets, an
explanation of the risks covered by each Key Internal Control and a
self-assessment guide.
For each cycle, the Key Internal Controls cover compliance, reliability,
risk prevention and management and process performance. The
operating units fi ll out self-assessment questionnaires concerning
the Key Internal Controls.
4. Risk identification and management
4.1. General risks at the Group level
The Internal Audit Department interviews the Group’s 40 top
managers to update the list of general risks at the Group level each
year. The risks identifi ed through these interviews are ranked by
impact and probability of occurrence. The threat/opportunity aspect
of each risk is also taken into account.
Risk factors related to the Company’s business, as well as
procedures for managing and reducing those risks, are described
in “Risk Factors.” These procedures are an integral part of the internal
control system.
When drawing up the Internal Audit plan for the coming year, team
members look closely at the risk matrix and the analysis of changes
from one year to the next.
More than half of the major and general risks identifi ed at end-2009
were addressed in audits carried out between 2008 and 2010 to
assess action plans for managing and reducing risks.
4.2. Operating risks at the unit level
Operating risks are managed fi rst and foremost by the units in
liaison with the Operating Divisions, based on Group guidelines
(notably the Key Internal Controls). Each subsidiary is responsible
for implementing procedures providing an adequate level of internal
control.
The Operating Divisions implement cross-functional action plans for
operating risks identifi ed as being recurrent in the units or as having
a material impact at the Group level. The internal control system is
adjusted to account for these risks as needed.
The Group’s insurance programs cover the remaining portion of
transferable risks.
4.3. Risk management by the Risk – Insurance
Department
The Risk – Insurance Department contributes to internal control by
defi ning and deploying a Group-wide insurance strategy, as defi ned
in “Risk Factors.” The insurance strategy identifi es and quantifi es
the main insurable risks and defi nes and recommends measures to
prevent risks and protect assets.
4.4. Risk management by the Safety
Department
The Safety Department contributes to internal control by defi ning and
deploying safety strategies. Like the Risk – Insurance Department,
with which it works in close cooperation on recovery issues, the
Safety Department helps identify and quantify the main risks within
its scope and defi nes and recommends measures to prevent risks
and protect people and assets. It is also involved in defi ning and
deploying business continuity and crisis management plans.
4.5. Management of information system risks
An IT Security unit within the Information, Process and Organisation
Department defi nes and implements specifi c security measures for
information systems.
This Department was given responsibility for auditing the security of
IT systems in 2010. Its fi rst assignments were carried out in 2010;
its recommendations resulted in remedial action plans.
2010 REGISTRATION DOCUMENT SCHNEIDER ELECTRIC134