BMW 2009 Annual Report Download - page 65

63 Group Management Report
The internal control system of the BMW Group is aimed
at ensuring the effectiveness of operations. It makes an
important contribution towards ensuring compliance with
the BMW Group’s applicable laws as well as providing
assurance on the
propriety and reliability of internal and
external financial reporting. It is therefore a significant fac-
tor
in the management of process risks.
The principal features of the internal control system, as
far as they relate to individual entity and Group financial
re-
porting processes, are described below. The risk manage-
ment system is an integral part of the internal control system
and is therefore not referred to in this section.
Information and communication
One of the elements of the internal control system is the
area of “Information and Communication”, which ensures
that all information necessary to achieve the objectives
set for the internal control system is made available in an
appropriate and timely manner to those responsible. The
requirements relating to the provision of information rele-
vant for financial reporting at the level of BMW AG, other
consolidated Group entities and the BMW Group are prima-
rily
set out in organisational manuals, in guidelines cover-
ing internal and external financial reporting issues and in
accounting manuals. These instructions, which can be ac-
cessed at all levels via the BMW Group’s intranet system,
provide the framework for ensuring that the relevant rules
are applied consistently across the Group. The quality and
relevance of these instructions is ensured by regular review
as well as by continuous communication between the
relevant departments.
Organisational measures
All financial reporting processes (including Group financial
reporting processes) are structured in organisational terms
in accordance with the principle of segregation of duties.
These structures as well as rigorous application of the
principle of dual control allow errors to be identified at an
early stage and prevent potential wrongdoing. Regular
comparison of internal forecasts and external financial re-
ports improves the quality of financial reporting. The inter-
nal audit department serves as a process-independent
function, testing and assessing the effectiveness of the in-
ternal control system and proposing improvements when
appropriate.
Controls
Extensive controls are carried out by management in all
finan cial reporting processes at an individual entity and
Group level to ensure that legal requirements and internal
guidelines are complied with and that all business trans-
actions are properly executed. Controls are also carried out
with the aid of IT applications, thus reducing the incidence
of process risks.
IT authorisations
All IT applications used in financial reporting processes
throughout the BMW Group are subject to access restric-
tions. As a result, only authorised persons can gain access
on a controlled basis to systems and data, depending
on the nature of the work being performed. In addition, IT
processes are designed and authorisations allocated
using the dual control principle, as a result of which, for in-
stance, requests cannot be submitted and approved by
the same person.
Internal control training for employees
All employees are appropriately trained to carry out their
duties and kept informed of any changes in regulations or
processes that affect them. Managers and staff also have
access to detailed best-practice descriptions relating to
risks and controls in the various processes, thus increasing
risk awareness at all levels. As a consequence, the internal
control system can be evaluated regularly and further
improved as necessary. Employees can, at any time and
independently, deepen their understanding of control
methods and design using an information platform that is
accessible groupwide.
Evaluation of effectiveness of the internal
control system
Responsibilities for ensuring the effectiveness of the in-
ternal
control system in relation to individual entity and
Group
financial reporting processes are clearly defined
and allocated to the relevant managers and process
owners. The BMW Group assesses the design and effec-
tiveness of the internal control system on the basis of in-
ternal review procedures on the one hand (e. g.
manage-
ment self-audits, internal audit findings) and the findings
of external auditors on the other. Audits performed at
regular intervals show that the internal control system in
place throughout the BMW Group is both appropriate and
effective. Continuous revision and further development
of the internal control system ensures its continued
effec-
tiveness. Group entities are required to confirm regularly
as part of their reporting duties that the internal control
system is functioning properly. Effective measures are
implemented whenever weaknesses are identified and
reported.
Internal Control System