RBS 2008 Annual Report Download - page 157

RBS Group Annual Report and Accounts 2008156
Corporate governance continued
Internal control
The Board of directors is responsible for the Group’s system of internal
control that is designed to facilitate effective and efficient operations
and to ensure the quality of internal and external reporting and
compliance with applicable laws and regulations. In devising internal
controls, the Group has regard to the nature and extent of the risk, the
likelihood of it crystallising and the cost of controls. A system of internal
control is designed to manage, but not eliminate, the risk of failure to
achieve business objectives and can only provide reasonable, and not
absolute, assurance against the risk of material misstatement, fraud or
losses.
The Board has established a process for the identification, evaluation
and management of the significant risks faced by the Group, which
operated throughout the year ended 31 December 2008 and to 25
February 2009, the date the directors approved the Report and
Accounts. This process is regularly reviewed by the Board and meets
the requirements of the guidance ‘Internal Control: Revised Guidance
for Directors on the Combined Code’ issued by the Financial Reporting
Council in October 2005.
The effectiveness of the Group’s internal control system is reviewed
regularly by the Board and the Audit Committee. Executive management
committees or boards of directors in each of the Group’s businesses
receive regular reports on significant risks facing their business and
how they are being controlled. In addition, the Board receives monthly
risk management reports. Additional details of the Group’s approach to
risk management are given in the Risk, capital and liquidity
management section of the Business review on pages 78 to 144. The
Board received a number of reports from Group Internal Audit and
external consultants focussed on certain areas of the business that
have been particularly exposed to loss as a result of the market turmoil.
The Group Audit Committee has received confirmation that
management has taken, or is taking, the necessary action to remedy
failings or weaknesses identified in these reports and through the
operation of the Group’s framework of control.
In addition, the Group’s independent auditors present to the Audit
Committee reports that include details of any significant internal control
matters which they have identified. The system of internal controls of the
authorised institutions and other regulated entities in the Group is also
subject to regulatory oversight in the UK and overseas. Additional details
of the Group’s regulatory oversight are given in the Supervision and
Regulatory reviews and developments sections on pages 279 to 281.
Internal control over financial reporting
The Group is required to comply with Section 404 of the US Sarbanes-
Oxley Act of 2002 and assess the effectiveness of internal control over
financial reporting as of 31 December 2008.
The Group assessed the effectiveness of its internal control over
financial reporting as of 31 December 2008 based on the criteria set
forth by the Committee of Sponsoring Organizations of the Treadway
Commission in ‘Internal Control – Integrated Framework’.
Based on its assessment, management has concluded that, as of 31
December 2008, the Group’s internal control over financial reporting is
effective.
The Group’s auditors have audited the effectiveness of the Group’s
internal control over financial reporting and have given an unqualified
opinion.
Management’s report on the Group’s internal control over financial
reporting will be filed with the SEC at the same time as the Annual
Report on Form 20-F.
Disclosure controls and procedures
As required by US regulations, the effectiveness of the company’s
disclosure controls and procedures (as defined in the rules under the
US Securities Exchange Act of 1934) have been evaluated. This
evaluation has been considered and approved by the Board which has
instructed the Group Chief Executive and the Group Finance Director to
certify that, as at 31 December 2008, the company’s disclosure controls
and procedures were adequate and effective and designed to ensure
that material information relating to the company and its consolidated
subsidiaries would be made known to them by others within those
entities.
Changes in internal controls
There was no change in the company’s internal control over financial
reporting that occurred during the period covered by this report that
has materially affected, or is reasonably likely to materially affect, the
company’s internal control over financial reporting.