APC 2011 Annual Report Download - page 139

1372011 REGISTRATION DOCUMENT SCHNEIDER ELECTRIC
CORPORATE GOVERNANCE
3
INTERNAL CONTROL AND RISK MANAGEMENT
10.4 Risk identification and management
•operating processes (purchases, sales, inventories,etc.);
•accounting and fi nancial cycles;
•Human Resources, IT, Legal and Tax cycles.
The Key Internal Controls are available to all units on the Group
intranet, along with appendices with more detailed information,
links to full policy descriptions on the Functions’ intranets, an
explanation of the risks covered by each Key Internal Control and a
self-assessment guide.
For each cycle, the Key Internal Controls cover compliance, reliability,
risk prevention and management and process performance. The
operating units fi ll out self-assessment questionnaires concerning
the Key Internal Controls.
General risks at the Group level
The Internal Audit Department interviews the Group’s 55 top
managers to update the list of general risks at the Group level
each year. The risks identifi ed through these interviews are ranked
by impact and probability of occurrence. The threat/opportunity
aspect of each risk is also taken into account.
Risk factors related to the Company’s business, as well as
procedures for managing and reducing those risks, are described in
“Risk Factors.” These procedures are an integral part of the internal
control system.
The risk matrix and the analysis of changes from one year to the
next contribute to the development of an internal audit plan for the
following year.
Half of the major and general risks identifi ed at end-2010 were
addressed in audits carried in 2011 to assess action plans for
managing and reducing risks.
Operating risks at the unit level
Operating risks are managed fi rst and foremost by the units in
liaison with the Operating Divisions, based on Group guidelines
(notably the Key Internal Controls). Each subsidiary is responsible
for implementing procedures providing an adequate level of internal
control.
The Operating Divisions implement cross-functional action plans for
operating risks identifi ed as being recurrent in the units or as having
a material impact at the Group level. The internal control system is
adjusted to account for these risks as needed.
The Group’s insurance programs cover the remaining portion of
transferable risks.
Risk Solutions
The Risk Solutions Management Department , defi nes and
implements principles and tools designed to manage these risks;
In 2011, a network of Solution Risk managers was set up to assess
the risks inherent in all major projects. The rules for entering into
agreements and adopting solutions in projects were updated.
Risk management by the Risk and Insurance
Department
The Risk and Insurance Department contributes to internal audits
by defi ning and deploying a Group-wide insurance strategy, as
defi ned in “Risk Factors and Insurance Strategy.” The insurance
strategy includes the identifi cation and assessment of the main
insurable risks and defi nes and recommends measures to prevent
these risks and protect assets.
Risk management by the Safety Department
The Group’s Security Department defi nes corporate governance
with regard to loss prevention in the area wilful acts against property
and people.
In this respect and in close cooperation with the Risk and Insurance
Department, it is directly involved in assessing the nature of such risk
as well as defi ning adequate prevention and protection measures.
The Security Department publishes internally a table of “Country
Risks” for use in security procedures that are mandatory for people
travelling, expatriates and local employees. On request it provides
support to local teams for any security issues (site audit, expatriates
or local employee security, security whilst on assignments,etc.).
It brings its methodology to develop emergency plans (Evacuation
plans, Crisis management plans, Business continuity plans, etc.)
and ensures coordination of the Corporate Crisis Team (SEECC -
Schneider Electric Emergency Coordination Center) each time that
it is activated.
The Security Department is integrated in the “Fraud Committee”
alongside the Internal Audit Department and the Legal Department
and gets involved in combatting internal fraud (managing and
carrying out internal investigations).
Management of information system risks
An IT Security unit within the Information, Process and Organisation
Department defi nes and implements specifi c security policies for
information systems.
This department has specifi c skills in auditing the security of
IT systems. After each site audit, a report is issued setting out
fi ndings and recommendations for the attention of the persons in
charge of the entity audited.