APC 2013 Annual Report Download - page 166

3CORPORATE GOVERNANCE
INTERNAL CONTROL AND RISK MANAGEMENT
Risk identification and management 9.4
General risks at the Group level Risk management by the Risk and Insurance
Department
The Internal Audit Department uses interviews to update the list of
general risks at the Group level each year. In2013, 65 of the The Risk and Insurance Department contributes to the internal
Group’s top managers were interviewed. control system by defining and deploying a Group-wide insurance
strategy, as defined in “Risk Factors and Insurance Strategy.” The
The risks identified through these interviews are ranked by impact insurance strategy includes the identification and quantification of
and probability of occurrence. The threat/opportunity aspect of the main insurable risks, the determination of levels of retention
each risk is also taken into account. and transfer of such risks; it also prepares and deploys measures
Risk factors related to the company’s business, as well as to prevent these risks and protect assets.
procedures for managing and reducing those risks, are described
Risk management by the Security Department
in “Risk Factors.” These procedures are an integral part of the
internal control system.
The Group’s Security Department defines corporate governance
The risk matrix and the analysis of changes from one year to the
with regard to loss prevention in the area of willful acts against
next contribute to the development of an internal audit plan for the
property and people.
following year. The major and global risks were audited by the
Internal Audit Department over a period of three years to assess In this respect and in close cooperation with the Risk and
action plans for managing and reducing these risks. In2013, a Insurance Department, it is directly involved in assessing the nature
third of the major and global risks identified at the end of2012 of such risk as well as defining adequate prevention and protection
were audited. measures.
Global risks at the Operating Division level
The Security Department publishes internally a table of “Country
Risks” for use in security procedures that are mandatory for people
travelling, expatriates and local employees. On request, it provides
Each Operating Division assesses its global risks and ranks them support to local teams for any security issues (site audit,
by impact and probability of occurrence. It defines action plans for expatriates or local employee security, security on
reducing the major risks identified. assignments,etc.).
The Internal Audit Department coordinates these assessments in It provides daily coordination with the Group’s worldwide partner in
the framework of the list of global risks at the Group level each the field of medicalandsecurity assistance (International SOS –
year. start of contract in January2011).
Risk factors related to the company’s business at
It brings its methodology to develop emergency plans (evacuation
plans, crisis management plans, business continuity plans,etc.)
and coordinates the corporate crisis team (SEECC – Schneider
the unit level
Electric Emergency Coordination Center) each time that it is
Risk factors related to the company’s business are managed first activated.
and foremost by the units in liaison with the Operating Divisions, The Security Department is integrated in the “Fraud Committee”
based on Group guidelines (in particular via the Key Internal alongside the Internal Audit Department and the Legal Department
Controls). Each subsidiary is responsible for implementing and is directly involved in combatting internal fraud (managing and
procedures that provide an adequate level of internal control. carrying out internal investigations).
The Divisions implement cross-functional action plans for risk The Security Function also participates in crisis management, in
factors related to the company’s business identified as being particular in the management of corporate crisis cell and in support
recurrent in the units or as having a material impact at the Group of local entities (limiting the consequences of the occurrence of
level, as appropriate. The internal control system is adjusted to certain risks such as civil war, weather events, pandemics, attacks
account for these risks. on people, terrorism,etc.).
The Group’s insurance programs cover the remaining portion of
Management of Information Systems risks
transferable risks.
Risk Solutions
An IT Security unit within the Information, Process and
Organization Department defines and implements specific security
The Risk Solutions Management Department defines and policies for information systems. This department has specific skills
implements principles and tools designed to manage these risks. in auditing the security of information systems. After each site
audit, a report is issued setting out findings and recommendations
The network of Solution Risk Managers assesses the risks of all for the attention of the persons in charge of the units audited. The
major projects in conjunction with the Tender Managers during the corrective actions are monitored.
preparation of offers.
164 2013 REGISTRATION DOCUMENT SCHNEIDER ELECTRIC