APC 2014 Annual Report Download - page 166

3CORPORATE GOVERNANCE
INTERNAL CONTROL AND RISK MANAGEMENT
Risk identification and management 9.4
General risks at the Group level
and transfer of such risks; it also prepares and deploys measures
to prevent these risks and protect assets.
Risk management by the Security Department
The Internal Audit Department uses interviews to update the list of
general risks at the Group level each year. In2014, 48 of the
Group’s top managers were interviewed. The Group’s Security Department defines corporate governance
The risks identified through these interviews are ranked by impact, with regard to loss prevention in the area of willful acts against
probability of occurrence and level of mitigation. The property and people.
threat/opportunity aspect of each risk is also taken into account. In this respect and in close cooperation with the Risk and
Risk factors related to the company’s business, as well as Insurance Department, it is directly involved in assessing the nature
procedures for managing and reducing those risks, are described of such risk as well as defining adequate prevention and protection
in «Risk Factors. » These procedures are an integral part of the measures.
internal control system. The Security Department publishes internally a table of «Country
The risk matrix and the analysis of changes from one year to the Risks» for use in security procedures that are mandatory for
next contribute to the development of an internal audit plan for the people travelling, expatriates and local employees. On request, it
following year. The major and global risks were audited by the provides support to local teams for any security issues (site audit,
Internal Audit Department over a period of three years to assess expatriates or local employee security, security on
action plans for managing and reducing these risks. In2014, a assignments,etc.).
third of the major and global risks identified at the end of2013 It provides daily coordination with the Group’s worldwide partner in
were audited. the field of medicalandsecurity assistance (International SOS –
Local risks related to the company’s business at
start of contract in January2011).
It brings its methodology to develop emergency plans (evacuation
the unit level
plans, crisis management plans, business continuity plans,etc.)
and coordinates the corporate crisis team (SEECC – Schneider
Local risks related to the company’s business are managed first Electric Emergency Coordination Center) each time that it is
and foremost by the units in liaison with the Operating Divisions, activated.
based on Group guidelines (in particular via the Key Internal The Security Department is integrated in the «Fraud Committee»
Controls). Each subsidiary is responsible for implementing alongside the Internal Audit Department and the Legal Department
procedures that provide an adequate level of internal control. and is directly involved in combatting internal fraud (managing and
The divisions implement cross-functional action plans for risk carrying out internal investigations). The Security Department
factors related to the company’s business identified as being created a new entity responsible for investigations (internal and
recurrent in the units or as having a material impact at the Group external fraud) within the Security Department itself and in charge
level, as appropriate. The internal control system is adjusted to to support internal investigators as well as to define methodology &
account for these risks. procedures to conduct investigations properly (according to the
Law and to be efficient in gathering evidences).
The Group’s insurance programs cover the remaining portion of
transferable risks. The Security Function also participates in crisis management, in
particular in the management of corporate crisis cell and in support
Risks related to Solutions
of local entities (limiting the consequences of the occurrence of
certain risks such as civil war, weather events, pandemics, attacks
on people, terrorism,etc.).
The Solutions Risk Management Department defines and
implements principles and tools designed to manage these risks.
Management of Information Systems risks
The network of Solution Risk Managers assesses the risks of all
major projects in conjunction with the Tender Managers during the A Global IT Security Department inside Information, Process and
preparation of offers. Organization Department (IPO) defines and implements specific
Risk management by the Risk and Insurance
security policies for information systems, ensuring basic computer
hygiene, confidentiality, integrity, availability and accountability of all
our information and technology assets. This department identifies
Department
critical processes and information to capture, secure and prioritize
The Risk and Insurance Department contributes to the internal them. Their members have proved and certified security technical
control system by defining and deploying a Group-wide insurance skills and they perform regularly audits. After each audit, a report is
strategy, as defined in «Risk Factors and Insurance Strategy. » issued setting out findings and recommendations. All corrective
The insurance strategy includes the identification and quantification actions are monitored.
of the main insurable risks, the determination of levels of retention
164 2014 REGISTRATION DOCUMENT SCHNEIDER ELECTRIC