BMW 2011 Annual Report Download - page 72

72
18 COMBINED GROUP AND COMPANY
MANAGEMENT REPORT
18 A Review of the Financial Year
20 General Economic Environment
24 Review of Operations
43 BMW Stock and Capital Market
46 Disclosures relevant for takeovers
and explanatory comments
49 Financial Analysis
49 Internal Management System
51 Earnings Performance
53 Financial Position
56 Net Assets Position
59 Subsequent Events Report
59 Value Added Statement
61 Key Performance Figures
62 Comments on BMW AG
66 Internal Control System and
explanatory comments
67 Risk Management
73 Outlook
transferred to BMW Trust e. V. and can only be used to
meet corresponding pension obligations. In the UK,
the USA and a number of other countries, funds in-
tended to cover the pension benefits of our employees
are also held in pension funds that are kept separate
from corporate assets. As a consequence, the level of
funds required to finance pension payments out of
operations will be substantially reduced in the future.
In addition, the risk of rising life expectancy facing
the
UK pension fund has been hedged. The pension
assets of the BMW Group comprise interest-bearing se-
curities with a high level of creditworthiness, equities,
property and other investment classes.
Risk indicators (e. g. value at risk) are regularly com-
puted in order to identify risks at an early stage and used
to develop measures to mitigate risk. Pension funds are
monitored continuously and managed from a risk-and-
yield perspective. In order to reduce interest rate risks
relating to pensions, regular asset-liability studies are
performed and used to match the maturities of interest-
generating investments with future pension payments.
A broad spread of investments also helps to reduce risk.
In addition, risk limits for asset management have been
defined for each pension fund and are monitored con-
tinuously.
Information and IT risks
We attach great importance to the protection of data,
business secrets and innovative developments to safe-
guard against unauthorised access, damage and misuse.
The protection of information and data is an integral
component of our business processes and based on
In-
ternational Security Standard ISO/IEC 27001. Staff,
process design and information technology each play a
role in our comprehensive risk and security concept.
The requirement to apply uniform standards across the
Group is embedded in our core principles and docu-
mented in detailed working instructions. These instruc-
tions require employees to handle information appro-
priately, ensure that information systems are properly
used and that risks pertaining to information technology
(IT risks) are dealt with transparently. Regular commu-
nication and training measures create a high degree
of security and risk awareness among the employees in-
volved. Employees also receive training from the Group’s
Compliance Organisation to ensure compliance with
legal and regulatory requirements.
Potential IT risks resulting from the use of information
technology and the processing of information are moni-
tored on a regular basis and managed by the departments
responsible.
The technical data protection procedures used primarily
involve process-specific security measures. Standard
activities such as the use of virus scanners, firewall sys-
tems, access controls at both operating system and appli-
cation level, internal testing procedures and the regular
backing up of data are also employed. A security net-
work is in place group-wide to ensure that stipulated re-
quirements are complied with. Regular analyses and
rigorous security management ensure a quality standard
of protection and also cover the activities of our cen-
tralised
IT Security Operation Centre, which is responsi-
ble for the security of internal network communications.
The IT security strategy adopted in 2011 has further
strengthened security within the BMW Group by helping
to identify potential IT risks and take appropriate action.
We protect our intellectual property in the case of co-
operation arrangements and business partner relation-
ships by stipulating clear instructions with regard to
data protection and the use of information technology.
Information underlying key areas of expertise is subject
to particularly stringent security measures.