RBS 2009 Annual Report Download - page 220

RBS Group Annual Report and Accounts 2009218
Corporate governance continued
Internal control
The Board of directors is responsible for the Group’s system of internal
control that is designed to facilitate effective and efficient operations
and to ensure the quality of internal and external reporting and
compliance with applicable laws and regulations. In devising internal
controls, the Group has regard to the nature and extent of the risk, the
likelihood of it crystallising and the cost of controls. A system of internal
control is designed to manage, but not eliminate, the risk of failure to
achieve business objectives and can only provide reasonable, and not
absolute, assurance against the risk of material misstatement, fraud or
losses.
The Board has established a process for the identification, evaluation
and management of the significant risks faced by the Group, which
operated throughout the year ended 31 December 2009 and to 24
February 2010, the date the directors approved the Report and
Accounts. This process is regularly reviewed by the Board and meets
the requirements of the guidance ‘Internal Control: Revised Guidance
for Directors on the Combined Code’ issued by the Financial Reporting
Council in October 2005. Enhancements have been made to the Risk
Management Framework during throughout 2009 and further
improvements will be made in 2010.
The effectiveness of the Group’s internal control system is reviewed
regularly by the Board, the Audit Committee and, since January 2010,
the Board Risk Committee. Executive management committees or
boards of directors in each of the Group’s businesses receive regular
reports on significant risks facing their business and how they are being
controlled. In addition, the Board receives monthly risk management
reports. Details of the Group’s approach to risk management are given
in the Risk, capital and liquidity management section of the Business
review. The Audit Committee has received confirmation that
management has taken, or is taking, the necessary action to remedy
any failings or weaknesses identified through the operation of the RBS
group framework of controls.
The Group’s independent auditors present to the Audit Committee
reports that include details of any significant internal control matters
which they have identified. The system of internal controls of the
authorised institutions and other regulated entities in the Group is also
subject to regulatory oversight in the UK and overseas. Additional
details of the Group’s regulatory oversight are given in the Supervision
and Regulatory reviews and developments sections on pages 361 and
362.
Internal control over financial reporting
The Group is required to comply with Section 404 of the US Sarbanes-
Oxley Act of 2002 and assess the effectiveness of internal control over
financial reporting as of 31 December 2009.
The Group assessed the effectiveness of its internal control over
financial reporting as of 31 December 2009 based on the criteria set
forth by the Committee of Sponsoring Organizations of the Treadway
Commission in ‘Internal Control – Integrated Framework’.
Based on its assessment, management has concluded that, as of
31 December 2009, the Group’s internal control over financial reporting
is effective.
The Group’s auditors have audited the effectiveness of the Group’s
internal control over financial reporting and have given an unqualified
opinion.
Management’s report on the Group’s internal control over financial
reporting will be filed with the SEC at the same time as the Annual
Report on Form 20-F.
Disclosure controls and procedures
As required by US regulations, the effectiveness of the company’s
disclosure controls and procedures (as defined in the rules under the
US Securities Exchange Act of 1934) have been evaluated. This
evaluation has been considered and approved by the Board which has
instructed the Group Chief Executive and the Group Finance Director to
certify that, as at 31 December 2009, the company’s disclosure controls
and procedures were adequate and effective and designed to ensure
that material information relating to the company and its consolidated
subsidiaries would be made known to them by others within those
entities.
Changes in internal control
There was no change in the company’s internal control over financial
reporting that occurred during the period covered by this report that has
materially affected, or is reasonably likely to materially affect, the
company’s internal control over financial reporting.