APC 2013 Annual Report Download - page 167

CORPORATE GOVERNANCE
INTERNAL CONTROL AND RISK MANAGEMENT
Control procedures 9.5
In addition to the general missions already described, this section
Global Functions
describes specific measures taken in2013 to improve the Group’s In2013, the Global Functions continued to set guidelines, issue
control system. instructions and provide support.
Operating units
For example:
For internal control to be effective, everyone involved must in 2013, specific actions have been taken with regard to Our
l
understand and continuously implement the Group’s general Principles of Responsibility:
guidelines and the Key Internal Controls.
in the investigation section, the Group has a complementary
–
Training in Key Internal Controls continued in2013 for those
tool identical to the professional alert system in order to
involved for the first time in the annual self-assessment process:
manage, using a single protocol, all alerts received
newly promoted managers and units recently integrated.
regardless of how they are received,
Operational units, trained by their line management, undertook
in the prevention section, Purchasing and Human
–
self-assessment of compliance with the Key Internal Controls
Resources functions has prepared 15 “Educational Kits for
governing their scope of operations.
Managers”. These kits for managers enable them to lead
working sessions with the teams on ethical dilemmas,
The self-assessments conducted during the 2013 campaign
possible types of behavior and the behavior recommended
covered 90% of consolidated sales and made it possible to define
3
by the Group, as well as the reference documents that
improvement plans in the operating units, when necessary. The
justify this choice. The first experiments are underway in
ultimate goal is that these evaluations should cover at least 90% of
India and China;
consolidated sales each year.
in2013, the IT Security Department continued its website tests
l
All covered entities assessed in great detail the Key Internal referred to as “penetration testing”. This area of competence
Controls of the control environment. 40% of covered entities have allows the vulnerability of websites to be identified and for
evaluated all of their processes. remedial measures taken to limit the effects on any future
The self-assessments are conducted in the units by each process attacks. In 2013, 30 sites were analyzed;
manager. Practices corresponding to the Key Internal Controls are in2012, the IT Security Department created a platform to better
l
described and performance is rated on a scale of 1 address cyber threats. This platform can switch from a passive
(non-compliance) to 4 (very good). mode to a more proactive mode for detecting and responding to
For each Internal Control Key assessed at below level 3 cyber-attacks.
(compliance) on the scale, an action plan is defined and In 2013, it was rolled out at all planned sites (more than 200
implemented to achieve compliance. These action plans are listed sites).
in the self-assessment report. in addition, the operation of the platform proved satisfactory in
The unit’s financial manager conducts a critical review of the terms of its detection role.
self-assessments by process, and certifies the quality of the overall A new antivirus solution has been deployed on all Group
results. The self-evaluation is then also certified by the person in computers, with significant improvement in centralized fleet
charge of the unit. management and real-time information on updates. A
Operating Divisions
dashboard of the security function of information systems is
published quarterly;
the Solution Risk Managers (Solution Risk Department) assist
l
To control the reliability of the financial statements and the the Tender Managers in risk assessment and the definition of
alignment of performance with set targets, the Group relies on remediation measures during the preparation of offers. The
Senior Management’s quarterly review process and procedures offer-approval circuit prior to submission of bids depends on the
carried out by the Management Control and Accounting Unit to amount and nature of the residual risks;
control the quality of accounting data provided by consolidated in December2013, the Security Department created a new
l
units (see “Internal Control organization and Management – Senior entity responsible for investigations (internal and external fraud)
Management” and “Internal control procedures governing the within the Security Department itself.
production and processing of accounting and financial the Corporate Treasury Department has continued the rollout of
l
information”). the Group secure payments tool, particularly in Asia, to cover
In2013, the Operating Divisions continued to provide training for about 90 subsidiaries. This tool is now integrated in the process
the operating units on internal control issues and examined and of migrating entities to the priority accounting systems selected
challenged the self-assessments of Internal Control of these units. by the Group;
After analyzing the results, improvement plans were developed the tool for managing bank guarantees was also rolled out, and
l
either for certain units or for certain Key Internal Controls at the now includes over EUR850million in guarantees representing
Division level. approximately 52% of operational guarantees issued.
The regional internal auditors carried out controls on site as to the
reliability of self-assessments of Internal Control and the efficiency
of the remediation plans put in place as a result of the previous
year’s self-assessments.
165
2013 REGISTRATION DOCUMENT SCHNEIDER ELECTRIC