APC 2014 Annual Report Download - page 167

CORPORATE GOVERNANCE
INTERNAL CONTROL AND RISK MANAGEMENT
Control procedures 9.5
In addition to the general missions already described, this section detected and prevented hundreds of real time attacks,
–
describes specific measures taken in2014 to improve the Group’s
eradicated and Quarantined thousand of viruses detected;
–
control system. in 2014, the Global IT Security (GIS) Department has significantly
l
improved the end point Ex-Com members with the rollout of a
Operating units
HIDS (Host based Intrusion Detection System). Host based
Intrusion Detection System, is a system to detect intruders that
are, unexpected, unwanted or unauthorized people or programs
For internal control to be effective, everyone involved must on a computer;
understand and continuously implement the Group’s general
guidelines and the Key Internal Controls. during 2014, a new IT Security Strategy has been defined to
l
address the new high priority risks and cyber threats identified.
Training in Key Internal Controls continued in2014 for those This strategy has been presented to Ex-Com members during a
involved for the first time in the annual self-assessment process: Cyber War Game (simulation of multi-stage cyber-attack). This
newly promoted managers and units recently integrated. strategy contains important programs like Data Security, Identity
Operational units, undertook self-assessment of compliance with & Access Management, Security Incident Response and
the Key Internal Controls governing their scope of operations. Simulations, End-Point Security, Awareness and Training;
The self-assessments conducted during the 2014 campaign for solutions risk management, a simplified template for the
l
covered more than 90% of consolidated sales and made it
3
assessment of smaller projects was created and included in the
possible to define improvement plans in the operating units, when approval workflow tool;
necessary. The ultimate goal is that these evaluations should cover the Security Department issued a new directive regarding the
l
at least 90% of consolidated sales each year. «multiple travelers on the same flight» risk and deployed
All covered entities assessed in great detail the Key Internal Schneider Electric travel security procedures within Invensys
Controls on process within their scope of operations. (new acquisition).
The self-assessments are conducted in the units by each process
Internal Control Department
owner. Practices corresponding to the Key Internal Controls are
described and performance is rated on a scale of 1
(non-compliance) to 4 (very good). Internal Control continued to deploy the Key Internal Controls
–training and requests for self-assessments– throughout the
For each Internal Control Key assessed at below level 3 Operating Divisions, with the scope extended to cover new units.
(compliance) on the scale, an action plan is defined and
implemented to achieve compliance. These action plans are listed New deficiencies were identified owing to additional Key Internal
in the self-assessment report. Controls, which gave rise to further action plans.
The unit’s financial manager conducts a critical review of the Internal Control self-assessments were received and analyzed,
self-assessments by process, and certifies the quality of the overall which identified areas needing work in2015 as part of the process
results. The self-evaluation is then also certified by the person in of continuous improvement.
charge of the unit. In addition to the analysis and action plans initiated by the Units
The regional internal controllers carried out controls on site to and Operating Divisions, similar work is being carried out in the
assess the reliability of self-assessments and the efficiency of the Global Functions. On the basis of the results obtained in their field,
remediation plans put in place as a result of the previous the various functions define and implement improvement actions
self-assessment. asneeded.
Global Functions
The list of Key Internal Controls continues to evolve.
The software package for the management of self-assessment
questionnaires and follow-up action plans of Internal Audit and
In2014, the Global Functions continued to set guidelines, issue Internal Control introduced in2011 continues to be improved.
instructions and provide support.
The regional internal control organization introduced in2011
For example: consists of 25 regional internal controllers in five regions, who:
in 2014, with regard to Our Principles of Responsibility, a
l
perform the duties defined under the section «Organization and
l
specific support has been brought to the entities which had a management: key participants of internal control – Internal
low score in the 2013 Key Internal Controls dealing with Our Control Department» for the units in their regional scope,
Principles of Responsibility. These actions have consisted in covering all Operational Departments;
meeting with the entities top managers, providing in-site establish standardized procedures (e.g., for internal control
l
trainings to managers and employees and insisting again on the assignments, such as control cycles, documentation, scope
values and principles of the company; definition, work programs etc.);
in 2014, The Global IT Security (GIS) Department has
l
completed more than 80 on-site inspection missions in2014 to
l
successfully: assess the level of internal control and the adequacy of action
managed the major global vulnerabilities such us heartbleed
–
plans, issuing the necessary recommendations when needed.
and shellshock,
165
2014 REGISTRATION DOCUMENT SCHNEIDER ELECTRIC