RBS 2003 Annual Report Download - page 123

121
Annual Report and Accounts 2003
Corporate governance
Internal control
The Board of directors is responsible for the Group’s system of
internal control that is designed to facilitate effective and
efficient operations and to ensure the quality of internal and
external reporting and compliance with applicable laws and
regulations. In devising internal controls, the Group has regard
to the nature and extent of the risk, the likelihood of it
crystallising and the cost of controls. A system of internal
control is designed to manage, but not eliminate, the risk of
failure to achieve business objectives and can only provide
reasonable, and not absolute, assurance against the risk of
material misstatement, fraud or losses.
The Board has established an ongoing process for the
identification, evaluation and management of the significant
risks faced by the Group, which operated throughout the year
ended 31 December 2003 and to 18 February 2004, the date
the directors approved the Report and Accounts. This process
is regularly reviewed by the Board and meets the requirements
of the guidance ‘Internal Control: Guidance for Directors on
the Combined Code’ issued by the Institute of Chartered
Accountants in England and Wales in 1999.
The effectiveness of the Group’s internal control system is
reviewed regularly by the Board and the Audit Committee.
Executive management committees or boards of directors in
each of the Group’s businesses receive quarterly reports on
significant risks facing their business and how they are being
controlled. These reports are combined and submitted to the
Board as quarterly risk and control assessments. Additional
details of the Group’s approach to risk management are given
in the ‘Risk management’ section of the ‘Operating and
financial review’ on pages 92 to 109. The Audit Committee also
receives regular reports from Group Risk Management and
Group Internal Audit. In addition, the Group’s independent
auditors present to the Audit Committee reports that include
details of any significant internal control matters which they
have identified. The system of internal controls of the
authorised institutions and other regulated entities in the Group
are also subject to regulatory oversight in the UK and overseas.
Disclosure controls and procedures
The Group Chief Executive and Group Finance Director, after
evaluating the effectiveness of the company’s disclosure
controls and procedures (as defined in the rules under the US
Securities Exchange Act) have concluded and been authorised
by the Board to certify that as at 31 December 2003, the
company’s disclosure controls and procedures were adequate
and effective and designed to ensure that material information
relating to the company and its consolidated subsidiaries
would be made known to them by others within those entities.
Changes in internal controls
There were no significant changes in the company’s internal
controls over financial reporting or, to the knowledge of the
Group Chief Executive and Group Finance Director, in other
factors that could significantly affect those internal controls as
at 31 December 2003.