RBS 2010 Annual Report Download - page 241

Internal control
The Board of directors is responsible for the Group’s system of internal
control that is designed to facilitate effective and efficient operations and
to ensure the quality of internal and external reporting and compliance
with applicable laws and regulations. In devising internal controls, the
Group has regard to the nature and extent of the risk, the likelihood of it
crystallising and the cost of controls. A system of internal control is
designed to manage, but not eliminate, the risk of failure to achieve
business objectives and can only provide reasonable, and not absolute,
assurance against the risk of material misstatement, fraud or losses.
The Board has established a process for the identification, evaluation and
management of the significant risks faced by the Group, which operated
throughout the year ended 31 December 2010 and to 23 February 2011,
the date the directors approved the Report and Accounts. This is
confirmed by a process which requires senior members of the executive
and management to certify that they have assessed the adequacy and
effectiveness of their internal control framework and the compliance of
their business with Group policies and associated standards (in
accordance with the Group Policy Framework), and they meet the
requirements of Sarbanes-Oxley Section 404 and the UK Corporate
Governance Code Section C2. The policies that govern these processes,
and reports on internal controls arising from them, are regularly reviewed
by the Board and meet the requirements of the guidance ‘Internal Control:
Revised Guidance for Directors on the Combined Code’ issued by the
Financial Reporting Council in October 2005. Enhancements have been
made to the Risk Management framework throughout 2010 and further
improvements will be made in 2011.
The effectiveness of the Group’s internal control system is reviewed
regularly by the Board, the Audit Committee and the Board Risk
Committee. Executive management committees or boards of directors in
each of the Group’s businesses receive regular reports on significant
risks facing their business and how they are being controlled. In addition,
the Board receives monthly risk management reports. Details of the
Group’s approach to risk management are given in the Risk and balance
sheet management section, on pages 119 to 125 of the Business review.
The Audit Committee has received confirmation that management has
taken, or is taking, the necessary action to remedy any failings or
weaknesses identified through the operation of the Group framework of
controls.
The Group’s independent auditors present to the Audit Committee reports
that include details of any significant internal control matters which they
have identified. The system of internal controls of the authorised
institutions and other regulated entities in the Group is also subject to
regulatory oversight in the UK and overseas. Additional details of the
Group’s regulatory oversight are given in the Supervision and Regulatory
developments and reviews sections on pages 397 to 399.
Internal control over financial reporting
The Group is required to comply with Section 404 of the US Sarbanes-
Oxley Act of 2002 and assess the effectiveness of internal control over
financial reporting as of 31 December 2010.
The Group assessed the effectiveness of its internal control over financial
reporting as of 31 December 2010 based on the criteria set forth by the
Committee of Sponsoring Organizations of the Treadway Commission in
‘Internal Control - Integrated Framework’.
Based on its assessment, management has concluded that, as of 31
December 2010, the Group's internal control over financial reporting is
effective.
The Group's auditors have audited the effectiveness of the Group's
internal control over financial reporting and have given an unqualified
opinion.
Management's report on the Group's internal control over financial
reporting will be filed with the Securities and Exchange Commission at
the same time as the Annual Report on Form 20-F.
Disclosure controls and procedures
As required by US regulations, the effectiveness of the company's
disclosure controls and procedures (as defined in the rules under the
Exchange Act) have been evaluated. The evaluation concluded that the
company's disclosure controls and procedures were adequate and
effective and designed to ensure that material information relating to the
company and its consolidated subsidiaries would be made known to them
by others within those entities.
Changes in internal control
There was no change in the company's internal control over financial
reporting that occurred during the period covered by this report that has
materially affected, or is reasonably likely to materially affect, the
company's internal control over financial reporting.
239RBS Group 2010
Governance